Method for realizing redis data permission isolation

Abstract

The invention discloses a method for realizing redis data permission isolation. The method comprises the following steps: creating an intermediate service, and generating a permission authentication model; the redis client establishes connection with the intermediate service; the redis client sends a first red2 protocol containing the login password to the intermediate service; a login password in the first red2 protocol is analyzed, whether the login password is correct or not is verified based on an authority authentication model, and if the login password is correct, the redis client sends a second red2 protocol containing the operation command to the intermediate service; and analyzing a redis key corresponding to the operation command in the second red2 protocol, and verifying whether the redis key meets the requirement based on the authority authentication model: if so, forwarding the operation command to a redis server and executing the operation command. According to the invention, the intermediate service monitors the redis request, login verification and authentication are carried out based on the authority authentication model, and data authority isolation under the same redis service is realized.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a method for implementing data access control isolation in Redis. Background Technology

[0002] Redis is a distributed caching middleware, renowned for its rich data structures and powerful performance. However, Redis lacks control over data permissions, especially before Redis 6.0, which only supported configuring a global password, making it impossible to achieve logical isolation of data permissions within a single cluster. Therefore, this invention provides a method for implementing Redis data permission isolation to at least solve some of the aforementioned technical problems. Summary of the Invention

[0003] To address the shortcomings of existing methods, this invention provides a method for implementing data access control isolation in Redis. To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for implementing data access control isolation in Redis includes the following steps: Step 1: Create an intermediate service that supports the resp2 protocol; Step 2: Start the intermediate service and generate the authorization model in the intermediate service; Step 3: The Redis client establishes a connection with the intermediate service via the TCP protocol; Step 4: After a successful connection, the Redis client sends the first Resp2 protocol containing the login password to the intermediate service; Step 5: The intermediate service parses the login password from the first resp2 protocol and verifies whether the login password is correct based on the authorization model. If it is correct, the login is successful, and the Redis client sends the second resp2 protocol containing the operation commands to the intermediate service. If it is incorrect, the login failure is returned to the Redis client. Step 6: The intermediate service parses the Redis key corresponding to the operation command in the second Resp2 protocol and verifies whether the Redis key meets the requirements based on the permission authentication model: if it meets the requirements, the intermediate service forwards the operation command to the Redis server; if it does not meet the requirements, it returns insufficient permissions to the Redis client. Step 7: The Redis server executes the operation command and returns the operation result to the Redis client through an intermediate service.

[0004] Furthermore, the authentication model is a JSON array containing a password and a regular expression.

[0005] Furthermore, each password corresponds to a regular expression.

[0006] Furthermore, in step 5, the specific operation of verifying the login password based on the permission authentication model is as follows: compare the login password with the password in the permission authentication model, and compare whether there is a password in the permission authentication model that is the same as the login password. If there is, the verification is correct; otherwise, the verification fails.

[0007] Furthermore, step 5 also includes: if the login password is correct, binding the regular expression corresponding to the password in the authorization model to the interface of the intermediate service.

[0008] Furthermore, an object is created on the interface of the intermediate service, and the regular expression corresponding to the password in the authorization model is bound to the object. The object is of type string.

[0009] Furthermore, in step 6, the specific operation of verifying the Redis key based on the permission authentication model is as follows: match the Redis key with the regular expression on the interface object. If the match is successful, the verification meets the requirements; otherwise, the verification does not meet the requirements.

[0010] Compared with the prior art, the present invention has the following beneficial effects: This invention establishes an intermediate service supporting the Resp2 protocol to monitor Redis requests. The intermediate service implements an authentication model where passwords are used for login verification and regular expressions are used for authorizing Redis key operations, thereby achieving data access isolation within the same Redis service. Attached Figure Description

[0011] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0013] In the description of this invention, it should be noted that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0014] like Figure 1 As shown, the present invention provides a method for implementing Redis data permission isolation, comprising the following steps: Step 1: Create an intermediate service that supports the resp2 protocol; Step 2: Start the intermediate service and generate the authorization model in the intermediate service; Step 3: The Redis client establishes a connection with the intermediate service via the TCP protocol; Step 4: After a successful connection, the Redis client sends the first Resp2 protocol containing the login password to the intermediate service; Step 5: The intermediate service parses the login password from the first resp2 protocol and verifies whether the login password is correct based on the authorization model. If it is correct, the login is successful, and the Redis client sends the second resp2 protocol containing the operation commands to the intermediate service. If it is incorrect, the login failure is returned to the Redis client. Step 6: The intermediate service parses the Redis key corresponding to the operation command in the second Resp2 protocol and verifies whether the Redis key meets the requirements based on the permission authentication model: if it meets the requirements, the intermediate service forwards the operation command to the Redis server; if it does not meet the requirements, it returns insufficient permissions to the Redis client. Step 7: The Redis server executes the operation command and returns the operation result to the Redis client through an intermediate service.

[0015] This invention establishes an intermediate service supporting the Resp2 protocol to monitor Redis requests. The intermediate service implements an authentication model where passwords are used for login verification and regular expressions are used for authorizing Redis key operations, thereby achieving data access isolation within the same Redis service.

[0016] The Resp2 protocol supports five data types: simple string, errors, integers, bulk strings, and arrays. Redis clients use these data types to send operation commands to the Redis server. When the data type of the operation command sent by the Redis client to the Redis server is fixed as arrays, each element in the array is of type bulk string.

[0017] When the intermediate service starts, it generates an authentication model. This authentication model is a JSON array, where each element contains two fields: a password and a regular expression. The valid login password is included in the generated password; passwords not included in the generated password will result in failed login. Each password corresponds to one regular expression. Upon startup, the intermediate service generates multiple sets of passwords and regular expressions as needed, supporting authentication and isolation of different data permissions within the same Redis instance. For example, if an application `client_demo1` requests Redis resources, the intermediate service will generate a unique string as its password, with the corresponding regular expression defaulting to [missing information]. The two applications, appOne and appTwo, use an authentication model where different passwords correspond to different regular expressions. Regular expression 1 restricts appOne to only operate on the Redis key corresponding to appOne, while regular expression 2 restricts appTwo to only operate on the Redis key corresponding to appTwo. This achieves sharing a cluster while maintaining data isolation.

[0018] In some embodiments, step 5, which verifies the login password based on the authentication model, specifically involves comparing the login password with the password in the authentication model. The model is checked to see if a password identical to the login password exists. If it does, the verification is successful; otherwise, the verification fails. If the login password is correct, an object (context) is created on the interface (channel) of the intermediate service. The regular expression corresponding to the password in the authentication model is bound to this object, which is of type string. Then, the regular expression corresponding to the password in the authentication model is bound to the interface of the intermediate service.

[0019] In some embodiments, step 6, which verifies the Redis key based on the permission authentication model, specifically involves matching the Redis key against a regular expression on the interface object. If the match is successful, the verification meets the requirements, and the intermediate service forwards the operation command to the Redis server; otherwise, the verification fails, and a "no permission" message is returned to the Redis client. For example, when the Redis client sends a second Resp2 protocol containing the operation command, the intermediate service can... This regular expression validates the Redis operation command to check if it matches, that is, whether the Redis client has the permission to operate on the Redis key.

[0020] Finally, it should be noted that the above embodiments are merely preferred embodiments of the present invention used to illustrate the technical solutions of the present invention, and are not intended to limit the invention, nor are they intended to limit the patent scope of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention. That is to say, any changes or refinements made to the main design concept and spirit of the present invention that are not of substantial significance, but whose technical problems are still consistent with the present invention, should be included within the protection scope of the present invention. In addition, the direct or indirect application of the technical solutions of the present invention to other related technical fields are similarly included within the patent protection scope of the present invention.

Claims

1. A method for implementing redis data permission isolation, characterized in that: The following steps are involved: Step 1. Create an intermediate service that supports the resp2 protocol; Step 2: Start the intermediate service and generate the permission authentication model in the intermediate service; Step 3: The redis client establishes a connection with the intermediate service through the TCP protocol; Step 4: After the connection is successful, the redis client sends the first resp2 protocol containing the login password to the intermediate service; Step 5: The intermediate service parses the login password in the first resp2 protocol and verifies whether the login password is correct based on the permission authentication model: if it is correct, the login is successful, and the redis client sends the second resp2 protocol containing the operation command to the intermediate service; if it is incorrect, the login failure is returned to the redis client; Step 6: The intermediate service parses the redis key corresponding to the operation command in the second resp2 protocol, and verifies whether the redis key meets the requirements based on the permission authentication model: if it meets the requirements, the intermediate service forwards the operation command to the redis server; if it does not meet the requirements, it returns insufficient permissions to the redis client; Step 7: The redis server executes the operation command and returns the operation result to the redis client through the intermediate service.

2. A method for implementing redis data permission isolation according to claim 1, characterized in that: The permission authentication model is a json array, including a password and a regular expression.

3. A method for implementing redis data permission isolation according to claim 2, characterized in that: One password corresponds to one regular expression.

4. A method for implementing redis data permission isolation according to claim 2, characterized in that: In step 5, the specific operation of verifying the login password based on the authority authentication model is: comparing the login password with the password in the authority authentication model, and comparing whether there is a password identical to the login password in the authority authentication model. If so, the verification is correct, otherwise the verification fails.

5. A method for implementing redis data permission isolation according to claim 2, characterized in that: The step 5 also includes: if the login password is correct, binding the regular expression corresponding to the password in the authority authentication model to the interface of the intermediate service.

6. A method for implementing redis data permission isolation according to claim 5, characterized in that: Create an object on the interface of the intermediate service and bind the regular expression corresponding to the password in the authorization authentication model to the object. The object type is string.

7. A method for implementing redis data permission isolation according to claim 5, characterized in that: In step 6, the specific operation of verifying the redis key based on the authority authentication model is: matching the redis key with the regular expression on the interface object, if the match is successful, the verification meets the requirements, if the match is not successful, the verification does not meet the requirements.

Images