Service access method and device, server and server cluster

Abstract

The invention provides a service access method and device, a server and a server cluster, and relates to the field of computing equipment, in particular to the fields of cloud computing, distributed systems and micro-services. According to the specific implementation scheme, a local agent service and at least one function service are deployed in the server; in response to a received service access calling request, obtaining identity information of the calling request based on the function service matched with the calling request; based on the local proxy service, verifying the calling request according to the identity information of the calling request; and if it is determined that the verification is passed, processing the call request based on the local proxy service. According to the invention, the problem of centralized identity verification during service access can be solved.

Description

Technical Field

[0001] The present disclosure relates to cloud computing, distributed systems and microservices in the field of computing devices, and more particularly to a service access method, device, server and server cluster. Background Art

[0002] With the development of technologies such as cloud computing, cloud storage, and distributed architecture, services that provide data processing can be deployed in a distributed manner. In other words, services can be deployed in a distributed manner on multiple servers.

[0003] However, the identity authentication for service access is centrally verified, therefore, the present disclosure proposes a decentralized identity authentication scheme for service access. Summary of the invention

[0004] The present disclosure provides a service access method, device, server and server cluster.

[0005] According to a first aspect of the present disclosure, a service access method is provided, the method being applied to a server in a server cluster, wherein a local proxy service and at least one functional service are deployed in the server; the method comprising:

[0006] In response to the received service access call request, based on the functional service matching the call request, obtain the identity information of the call request;

[0007] Based on the local proxy service, the call request is verified according to the identity information of the call request; if it is determined that the verification passes, the call request is processed based on the local proxy service.

[0008] According to a second aspect of the present disclosure, a service access device is provided, the device being applied to a server in a server cluster, wherein a local proxy service and at least one functional service are deployed in the server; the device comprising:

[0009] an acquisition unit, configured to, in response to a received service access call request, acquire identity information of the call request based on a functional service matching the call request;

[0010] A processing unit is used to verify the call request based on the local proxy service and the identity information of the call request; if it is determined that the verification passes, the call request is processed based on the local proxy service.

[0011] According to a third aspect of the present disclosure, a server is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect.

[0012] According to a fourth aspect of the present disclosure, a server cluster is provided, wherein the server cluster includes a plurality of servers as described in the third aspect.

[0013] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising: a computer program, wherein the computer program is stored in a readable storage medium, at least one processor of a server can read the computer program from the readable storage medium, and the at least one processor executes the computer program so that the server executes the method described in the first aspect.

[0014] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the server to execute the method described in the first aspect.

[0015] The technology disclosed herein solves the problem of centralized identity authentication when accessing services.

[0016] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0018] Figure 1 It is an application scenario diagram of a distributed architecture in the prior art;

[0019] Figure 2 is a scene graph that can implement the embodiments of the present disclosure;

[0020] Figure 3 is another scene graph that can implement the embodiments of the present disclosure;

[0021] Figure 4 It is a flowchart of a service access method provided by the first embodiment of the present disclosure;

[0022] Figure 5 is a flow chart of a service access method provided by the second embodiment of the present disclosure;

[0023] Figure 6 is a flow chart of a service access method provided by the third embodiment of the present disclosure;

[0024] Figure 7 is a structural block diagram of a service access device provided by an embodiment of the present disclosure;

[0025] Figure 8 A schematic block diagram of an example server 800 that may be used to implement embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0026] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0027] First, the terms involved in this disclosure are explained:

[0028] Service: A software component or system that performs a specific function or provides specific resources.

[0029] Figure 1 It is an application scenario diagram of a distributed architecture in the prior art. Figure 1 As shown, the scenario includes a server cluster 100, which includes an authorization device 102 and at least one server 101, each of which has at least one service deployed thereon. The authorization device may be, for example, a computer or a server. Figure 1 The example is merely taken as follows: two servers are included, and one service is deployed on each server.

[0030] In the above scenario, when accessing services, services deployed by different servers 101 need to verify the call request to the authorization device 102 to determine whether the call request can be executed. In other words, in this scenario, the verification of the call request is based on the same authorization device, that is, centralized verification. This method is prone to single point failure problems. For example, the authorization device cannot operate normally, resulting in the entire service cluster not being able to operate normally.

[0031] In view of this, the present disclosure provides a service access method, which sets up a proxy service locally on each server, can authenticate the call request for service access to prevent the problem of single point failure, and local verification does not require remote communication with the authorized device, which can improve transmission efficiency.

[0032] Figure 2 is a scene graph that can implement the embodiments of the present disclosure. Figure 2 As shown, the scenario includes a server cluster 200, and the server cluster 200 includes at least one server 201, each of which is deployed with a local proxy service and at least one functional service. Figure 2 The example of three servers with one functional service deployed on each server is used for illustration only. The present disclosure does not limit the number of servers included in the server cluster and the number of functional services deployed on each server.

[0033] Functional service refers to a service with a specific function, and the functional service may include multiple types. For example, the functional service may be a front-end service, which refers to a service that interfaces with a user, such as a service that receives a user request; the functional service may also be a routing service, which refers to a service that can forward a call request; the functional service may also be a database service, which refers to a service corresponding to a database, such as a service that processes data based on a database.

[0034] It is understandable that in a distributed architecture, a service can be split into multiple functional services for execution, each of which is used to perform a specific function to improve the scalability, maintainability and fault tolerance of the system. For example, a service for a data query request can be split into three functional services, one for receiving user requests to call the data query service, one for routing, and one for executing the final data query service.

[0035] It should be noted that the present disclosure does not limit the types of functional services deployed on a server. For example, a server can deploy multiple types of functional services. Figure 2 The example of deploying one type of functional service on a server is used for illustration only.

[0036] The local proxy service can be an intermediate layer or middleware, which can be used to verify the call request for service access, communicate, and transfer the trust chain credentials.

[0037] In an example, refer to Figure 2 As shown, taking function service 1 as the front-end service, function service 2 as the routing service, and function service 3 as the database service as an example, Figure 2The scenario involved is explained: the functional service 1 of server 1 can receive a call request for service access, and send it to the local proxy service 1 for verification. After the verification is successful, it is sent to the functional service 2 of server 2 based on the local proxy service 1; and sent to the functional service 3 of server 3 through the local proxy service 2 of server 2; and sent to the local proxy service 3 of server 3 for verification. After the verification is successful, it returns to the functional service 3 to process the call request, for example, query data based on the call request, and obtain the processing result.

[0038] In another example, Figure 3 is another scene graph that can implement the embodiments of the present disclosure. Figure 3 As shown, the scenario includes a server cluster 300, which includes at least one server 301, each of which is deployed with a local proxy service and multiple types of functional services. Figure 3 It is only illustrated by taking two servers, each server deploying three functional services as an example, where functional service 1i can represent a front-end service, functional service 2i can represent a routing service, and functional service 3i can represent a database service. Each server can refer to the processing method in the above example and process the call request accordingly in combination with the local proxy service deployed by the server according to the functional service matching the received call request, which will not be repeated here. It should be noted that the present disclosure does not limit the types of functional services deployed by each server, which is specifically related to the settings of the server.

[0039] The present invention discloses a service access method, device, server and server cluster, which are applied to cloud computing, distributed systems and microservices in the field of computing equipment to achieve the effect of decentralized identity authentication.

[0040] It should be noted that in the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0041] The following specific embodiments are used to describe in detail the technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0042] Figure 4 : is a flow chart of a service access method provided by the first embodiment of the present disclosure. The execution subject of this embodiment may be a server. The method may include the following steps:

[0043] S401: In response to a received service access call request, obtain identity information of the call request based on a functional service matching the call request.

[0044] Exemplarily, as mentioned above, the server is deployed with a local proxy service and at least one functional service. The functional service includes at least one of a front-end service, a routing service, and a database service. The call request for the above service access represents a request to call a service, which can be triggered by a client or other services. The present disclosure does not limit the triggering method of the call request.

[0045] The identity information of the above-mentioned call request includes the identification information of the initiator of the call request and the identification information of the service called by the call request; wherein the identification information of the initiator may include, for example, user name, password, IP address, process name, role, host name, timestamp or random number and other information, and the identification information of the service called by the call request may include, for example, user name, password, IP address, process name, role, host name, service ID, timestamp or random number and other information, which is not limited in the present disclosure.

[0046] For example, taking a call request indicating calling a data query service to query file A as an example, the server can determine whether the service called by the call request has the ability to access the file based on the identity information, and whether the service called by the call request has the ability to access file A. That is, using the identity information, the information of the calling service and the user information can be combined to prevent unauthorized access or identity theft, thereby improving security.

[0047] In one example, the server can determine the functional service that matches the call request based on the request information in the call request. The request information can be, for example, a Uniform Resource Locator (URL) path, a request method, a request parameter, etc. For example, the server can preset a mapping relationship between the request information and the functional service, and can determine the functional service that matches the call request based on the mapping relationship. It should be noted that the present disclosure does not limit how to match the functional service.

[0048] In one example, the server can extract the identification information of the initiator of the call request carried in the call request itself, and obtain the identification information of the service called by the call request based on the functional service that matches the call request, and obtain the identity information after encrypting, signing, and splicing the two. Alternatively, the server directly receives the identity information of the call request sent by other services. For example, the identity information of the call request can be transmitted in the server cluster, so when the server receives the call request, it can directly receive the identity information of the call request.

[0049] S402: Based on the local proxy service, verify the call request according to the identity information of the call request; if it is determined that the verification passes, process the call request based on the local proxy service.

[0050] In one example, the server can verify the call request based on the identity information of the call request based on the local proxy service. For example, the server can verify whether the identity information has been tampered with based on the identity information of the call request, that is, verify the reliability of the identity information. Exemplarily, the server can perform decryption processing, hash value verification, etc. based on the identity information of the call request to perform verification.

[0051] In one example, if it is determined that the verification is passed, the server can use the local proxy service to process the call request based on the type of functional service that matches the call request.

[0052] Exemplarily, if the functional service that matches the call request is a front-end service, for example, the call request indicates that calling the functional service is a service that receives user query requests. At this time, after the verification is passed, the server can directly send the call request to the database service based on the local proxy service, or send the call request to the routing service so that the routing service sends the call request to the database service. If the functional service that matches the call request is a database service, for example, the call request indicates that calling the functional service is to execute the instructions carried in the call request. At this time, after the verification is passed, the server can obtain the permission of the call request based on the local proxy service, send it to the database service for authentication processing, and execute the instructions carried by the call request after the authentication is passed.

[0053] The service access method provided in this embodiment deploys a local proxy service and at least one functional service on the server. The server can obtain the identity information of the call request based on the functional service that matches the received call request, and use the local proxy service to verify the call request according to the identity information. After the verification is passed, the call request is processed based on the local proxy service. In this way, when accessing the service, the server can use the local proxy service to verify the call request without verifying it with the same authorized device, effectively preventing the occurrence of single point failure problems and ensuring the normal operation of the server cluster. In addition, the call request is verified locally, shortening the communication link and improving the transmission efficiency.

[0054] Figure 5: is a flow chart of a service access method provided by the second embodiment of the present disclosure. The execution subject of this embodiment may be the aforementioned server. This embodiment, based on the aforementioned embodiment, describes in detail the service access method when the functional service matching the call request is a front-end service. The method may include the following steps:

[0055] S501. In response to a received service access call request, obtain identification information of the call request based on a front-end service.

[0056] Exemplarily, the identification information of the call request represents the identification information of the initiator of the call request and the identification information of the service called by the call request. For example, the call request may carry the identification information of the initiator and the ID of the called service. Then, the server may extract the identification information of the initiator of the call request from the call request based on the front-end service, and obtain other identification information of the called service from the database or after communicating with other devices.

[0057] In one example, after obtaining the identification information of the initiator of the call request and the identification information of the service called by the call request, the server can combine the two in a preset combination manner to obtain the identification information of the call request.

[0058] In another example, the server can obtain the initial identification information of the call request based on the front-end service; and determine the combination method of the identification information according to the business type; based on the front-end service, the server combines the initial identification information according to the combination method of the identification information to obtain the identification information of the call request.

[0059] Specifically, the initial identification information may be the identification information of the initiator of the call request and the identification information of the service called by the call request. The above-mentioned call request may include a business type, which is used to indicate the business field involved in the call request. The combination method of the above-mentioned identification information indicates the category of information to be combined and the splicing method. For example, combination method 1 is user name + role + host name, and combination method 2 is host name + process name + role. In other words, the combination method of identification information indicates which information can be used to combine and generate the identification information of the call request, and how to splice and generate the identification information of the call request. Then, the server can use different combinations of identification information according to the business type to combine and process the initial identification information to obtain the identification information of the call request.

[0060] This method can support identity isolation in a multi-tenant environment, and different business areas or business types can have their own independent identity recognition strategies (combination methods) to ensure the security and flexibility of the business.

[0061] S502. Based on the front-end service, encrypt the identification information of the call request to obtain the encrypted identification information; and sign the identification information to obtain the signed identification information.

[0062] Exemplarily, the server can encrypt the identification information of the call request using an encryption algorithm based on the front-end service to obtain the encrypted identification information. The encryption algorithm can be, for example, a symmetric encryption algorithm or an asymmetric encryption algorithm, or salting can be performed in the above encryption algorithm to improve the complexity and security of the data. It should be noted that the present disclosure does not limit the encryption algorithm.

[0063] The server can also sign the identification information of the call request based on the front-end service to obtain the signed identification information. For example, the server can use a hash-based message authentication code (Hash-based Message Authentication Code, HMAC) to sign the identification information of the call request. It should be noted that the present disclosure does not limit the signature processing method.

[0064] It should be noted that the present disclosure does not limit the execution order of encryption processing and signature processing, which can be executed sequentially or in parallel.

[0065] S503: Based on the front-end service, the encrypted identification information and the signed identification information are concatenated to obtain basic identity information of the call request.

[0066] Exemplarily, the server may preset a splicing algorithm based on the front-end service, and according to the preset splicing algorithm, perform splicing processing on the encrypted identification information and the signed identification information to obtain the basic identity information of the call request.

[0067] It can be understood that when the functional service matching the call request is the above-mentioned front-end service, the front-end service can be regarded as the starting point for the backward transmission of the call request. Therefore, the server can first obtain the basic identity information in the identity information of the call request based on the front-end service, so that it can subsequently generate credentials that can be used for trust chain transmission based on the basic identity information.

[0068] S504: Based on the local proxy service, the call request is verified according to the basic identity information included in the identity information of the call request.

[0069] Exemplarily, after the server obtains the basic identity information of the call request based on the front-end service, it can pass the basic identity information of the call request to the local proxy service, and then based on the local proxy service, according to the basic identity information, the reliability of the call request can be verified, so as to ensure the reliability of the basic identity information and improve the accuracy of the subsequent generation of the trust chain transfer credential. For example, the server can parse the basic identity information based on the local proxy service, and can obtain the encrypted identification information and the signed identification information, and then can decrypt the encrypted identification information, and perform signature verification on the signed identification information, and then compare whether the two are consistent to determine the reliability of the basic identity information.

[0070] Specifically, step S504 may include the following steps:

[0071] S5041. Based on the local proxy service, the basic identity information is parsed to obtain the encrypted identification information and the signed identification information; wherein the encrypted identification information and the signed identification information indicate the identification information of the call request.

[0072] For example, as mentioned above, the server obtains the basic identity information by splicing the encrypted identification information and the signed identification information based on the front-end service. Therefore, the server can parse the basic identity information based on the inverse operation of the splicing algorithm based on the local proxy service to obtain the encrypted identification information and the signed identification information.

[0073] S5042. Based on the local proxy service, the encrypted identification information is decrypted to obtain the decrypted identification information; and the signature verification is performed on the signed identification information to obtain the signature verified identification information.

[0074] For example, the server can use a decryption algorithm to decrypt the encrypted identification information based on the local proxy service to obtain the decrypted identification information. It should be noted that the present disclosure does not limit the decryption algorithm, which is specifically related to the setting of the encryption algorithm. The server can also use a private key to perform signature verification on the signature processed identification information based on the local proxy service to obtain the signature verified identification information.

[0075] S5043. Based on the local proxy service, the call request is verified according to the identification information after decryption and the identification information after signature verification.

[0076] Exemplarily, through the above-mentioned step S5042, the server can obtain the identification information after decryption processing and the identification information after signature verification processing based on the local proxy service. Both of them can indicate the identification information of the call request. Therefore, the server can calculate the hash values ​​of the two respectively based on the local proxy service. If it is determined that the hash values ​​of the two are consistent, it means that the basic identity information of the call request is reliable and has not been tampered with, then it is determined that the verification of the call request has passed, otherwise the verification has failed.

[0077] S505: If it is determined that the verification is passed, based on the local proxy service, the derived identity information of the call request and the authority of the call request are determined and stored according to the basic identity information included in the identity information of the call request.

[0078] Exemplarily, the derived identity information of the above-mentioned call request represents the credential of the trust chain transmission, which is used for the trust chain transmission. The derived identity information can be a random string. The present disclosure does not limit the content and size of the derived identity information, as long as it can uniquely identify a call request. After verifying the basic identity information of the call request, the server can generate the derived identity information of the call request based on the basic identity information, and determine the authority of the call request based on the basic identity information. It should be understood that the identification information of the call request is indicated in the above-mentioned basic identity information. Therefore, the server can determine the authority of the call request based on the local proxy service, and store the corresponding relationship between the derived identity information and the authority. It should be noted that when the identification information of the call includes a role, it can not only determine the authority based on the role, but also determine the authority based on the attribute based on the role combined with other attributes such as process name and time, so as to achieve refined control of the authority.

[0079] Specifically, the server can generate derived identity information of the call request based on the basic identity information based on the local proxy service; determine the permission of the call request based on the basic identity information and the preset permission model; based on the local proxy service, store the corresponding relationship between the derived identity information of the call request and the permission in the cloud. It should be noted that the present disclosure does not limit the permission model.

[0080] In this way, the server can generate derived identity information based on the identity information of the call request based on the local proxy for subsequent trust chain transmission, so that in the subsequent transmission process, the intermediate service node does not need to authenticate the call request again, saving cluster overhead.

[0081] In one example, when storing the correspondence between the derived identity information and the authority, the server can determine the cache area corresponding to the derived identity information of the call request based on the derived identity information of the call request based on the local proxy service; and store the correspondence between the derived identity information of the call request and the authority in the cache area corresponding to the derived identity information of the call request. For example, the server can calculate the hash value of the derived identity information, determine the cache area corresponding to the derived identity information of the call request based on the preset correspondence between the hash value and the cache area, and then store it in the cache area.

[0082] In this way, the server can store the correspondence between derived identity information and permissions in multiple cache areas in a distributed manner, avoiding overload of a single cache area. This helps optimize the load balancing of cloud servers, improves the overall performance of the cluster, and facilitates the subsequent retrieval of the correspondence between derived identity information and permissions, thereby improving retrieval efficiency.

[0083] S506: Based on the local proxy service, send a call request and derived identity information.

[0084] Exemplarily, after determining the derived identity information of the call request based on the local proxy service, the server can send the call request and the derived identity information of the call request to other functional services, which can be, for example, a routing service or a database service, depending on the settings of the service called by the call request. For example, if the service called by the call request does not need to go through the routing service, it can be sent directly to the database service for processing.

[0085] The service access method provided in this embodiment is that when the functional service matching the call request is a front-end service, the server can obtain the basic identity information of the call request based on the front-end service, and after the basic identity information is verified based on the local proxy service, the server determines the authority of the call request based on the basic identity information, and generates the derived identity information of the call request for subsequent trust chain transmission. In this way, in the scenario of service topology access, the server deployed with the front-end service can obtain the basic identity information of the call request, verify the basic identity information, realize decentralized identity verification, and generate derived identity information that can be used for trust chain transmission based on the local proxy service, so that the call request can be transmitted based on the derived identity information without the need to authenticate the identity again at the intermediate service node, that is, the derived identity information is used to transmit from the starting point to the end point of the request transmission, and no identity authentication is required in the middle, which saves the computing overhead of the cluster, improves the transmission efficiency of the request, and thus improves the efficiency of service access.

[0086] Figure 6: is a flow chart of a service access method provided by the third embodiment of the present disclosure. The execution subject of this embodiment may be the aforementioned server. This embodiment, based on the aforementioned embodiment, describes in detail the service access method when the functional service matching the call request is a database service. The method may include the following steps:

[0087] S601: In response to a received service access call request, receive derived identity information of the call request based on a database service.

[0088] For example, based on the database service, the server can receive the call request sent by other functional services and the derived identity information of the call request. In this way, in the process of transmitting the call request, only the call request and the derived identity information of the call request that can be used as the trust chain transmission credential need to be transmitted, and other identification information of the call request does not need to be transmitted, thereby improving the transmission efficiency.

[0089] S602: Based on the local proxy service, the call request is verified according to the derived identity information.

[0090] In one example, the server may transmit the derived identity information of the received call request to the local proxy service based on the database service. Then, the server may determine whether the derived identity information exists in the cloud based on the local proxy service to verify the call request.

[0091] Exemplarily, the server can determine the hash value of the derived identity information of the call request based on the local proxy service, determine the cache area according to the hash value, and then determine whether the derived identity information of the call request exists in the cache area; if so, it is determined that the verification of the call request has passed, otherwise, the verification has failed.

[0092] S603: If it is determined that the verification is passed, based on the local proxy service, according to the derived identity information included in the identity information of the call request, the authority of the call request is obtained from the cloud, and the authority of the call request is transmitted to the database service.

[0093] For example, after determining that the verification has passed, the server can, based on the local proxy service, obtain the permissions corresponding to the derived identity information, that is, the permissions of the call request, from the cache area corresponding to the hash value of the derived identity information in the cloud according to the derived identity information of the call request, and pass it to the database service.

[0094] S604: Based on the database service, according to the authority of the call request, the call request is authenticated; and after the authentication is passed, the call request is executed to obtain an execution result.

[0095] Exemplarily, the above execution result is related to the instruction indicated by the call request. If the instruction is to read data, the execution result may be the data read. If the instruction is to write data, the execution result may be the return information of successful writing of data. After receiving the authority of the call request based on the database service, the server may authenticate the call request according to the authority of the call request to determine whether the call request has the authority, and after the authentication is passed, execute the instruction indicated in the call request based on the database service to obtain the execution result.

[0096] For example, taking a call request representing calling a data query service to query file A as an example, the permission of the call request may be, for example, permission to access file A. The database service may have preset identification information of the data query service, that is, the identification information of the service called by the call request. Furthermore, the server may, based on the database service, perform authentication processing on the above permissions according to the identification information of the request initiator carried by the call request and the identification information of the service called by the call request, as well as preset permission verification rules, to determine whether the permission is correct. If the authentication is successful, the instruction to access file A may be executed based on the database service to obtain an execution result.

[0097] In some possible implementations, the server may provide a management service for the local proxy service. By using the visual configuration interface provided by the management service, the administrator may flexibly configure and manage the permission verification rules to reduce the complexity of operations.

[0098] The service access method provided in this embodiment, when the functional service matching the call request is a database service, the server can obtain the derived identity information of the call request based on the database service, and then can obtain the authority of the call request based on the local proxy service using the derived identity information, and then authenticate the authority of the call request based on the database service, and after the authentication is passed, execute the call request to obtain the execution result. In this way, the server can verify the call request based on the local proxy service, realize decentralized identity authentication, and use the derived identity information to transfer the trust chain. The intermediate service nodes in the transfer process do not need to perform authority verification. The authority verification process is set in the underlying database service, and verification is performed before the database is processed, which saves the step of authority verification of the intermediate service node, thereby saving the computing overhead of the cluster and improving the service access efficiency.

[0099] In some embodiments, when the functional service matching the call request is a routing service, the server may receive the call request based on the routing service; pass the call request to the local proxy service; and send the call request based on the local proxy service.

[0100] Specifically, the server can receive the call request and the derived identity information of the call request sent by other functional services based on the routing service, and pass the call request and the derived identity information of the call request to the local proxy service, and send the call request and the derived identity information of the call request to other functional services based on the local proxy service. The other functional service can be, for example, a routing service or a database service, which is specifically related to the setting of the service called by the call request. For example, if the service called by the call request does not need to go through the routing service, it can be sent directly to the database service to process the call request.

[0101] In the service access method provided in this embodiment, when the functional service matching the call request is a routing service, the server receives the call request and the derived identity information of the call request based on the routing service, and forwards the call request and the derived identity information of the call request using the local proxy service. In this way, when executing the routing service, the server only needs to forward the call request based on the local proxy service, without the need to authenticate the call request or verify the authority, thus saving the computing overhead of the cluster and improving the service access efficiency.

[0102] In some embodiments, the server can provide a monitoring service for the local proxy service. Since the call request is forwarded by the local proxy service, the monitoring service can record and analyze the access behavior and authentication status of each service node in real time. Operation and maintenance personnel can track the status of the trust chain in real time through a visual interface to quickly locate and resolve potential security issues.

[0103] In some embodiments, the server may provide a monitoring service for the local proxy service, and the monitoring service may be used to monitor the access behavior of each service node in real time to implement flow control of each service node.

[0104] To sum up, the service access method provided by the present invention, on the one hand, utilizes the local proxy service deployed locally on the server to verify the identity of the call request without the need to verify it with a separate authorization device, thereby realizing decentralized identity authentication, reducing the coupling between services, improving the disaster recovery capability of the cluster, and ensuring the normal operation of the cluster.

[0105] On the other hand, in the scenario of service topology access, the local proxy service of the server where the front-end service is located is used to generate derived identity information of the call request, and the derived identity information of the call request is transmitted between the intermediate service nodes across multiple levels of service calls, reducing the steps of repeated identity authentication and permission verification in the intermediate service nodes, saving cluster overhead and improving cluster performance; moreover, it can flexibly adapt to various communication protocols used in the transmission process, and use the derived identity information as the credential for trust chain transmission. It is only necessary to carry the derived identity information in the message, and the protocol conversion is convenient; at the same time, the use of derived identity information for trust chain transmission can lightweight processing of the transmitted information, reducing the amount of information transmitted and improving transmission efficiency. Moreover, the derived identity information is transmitted in the form of a random string, which is difficult to tamper with, thereby improving the security of transmission.

[0106] On the other hand, after the intermediate service node does not need to perform identity authentication and permission verification steps, the coupling between the servers in the server cluster is reduced, and devices can be added more flexibly.

[0107] Figure 7 700 is a structural block diagram of a service access device provided by an embodiment of the present disclosure, the device is applied to a server in a server cluster, and a local proxy service and at least one functional service are deployed in the server; the device 700 includes the following units:

[0108] The acquisition unit 701 is used to respond to the received service access call request and acquire the identity information of the call request based on the functional service matching the call request;

[0109] The processing unit 702 is used to verify the call request based on the local proxy service and the identity information of the call request; if it is determined that the verification passes, the call request is processed based on the local proxy service.

[0110] In some possible implementations, the functional service includes at least one of a front-end service, a routing service, and a database service.

[0111] In some possible implementations, if the functional service matching the call request is a front-end service, the processing unit 702 includes:

[0112] A determination module, configured to determine and store, based on the local proxy service and according to basic identity information included in the identity information of the call request, the derived identity information of the call request and the authority of the call request;

[0113] A sending module is used to send the call request and the derived identity information based on the local proxy service.

[0114] In some possible implementations, the determining module includes:

[0115] A first determination submodule is used to generate, based on the local proxy service and according to the basic identity information, the derived identity information of the call request; and determine the authority of the call request according to the basic identity information and a preset authority model;

[0116] The storage submodule is used to store the corresponding relationship between the derived identity information and the authority in the cloud based on the local proxy service.

[0117] In some possible implementations, the cloud includes at least one cache slice; the storage submodule is specifically used to:

[0118] Based on the local proxy service, according to the derived identity information, a cache area corresponding to the derived identity information is determined; and the correspondence between the derived identity information and the authority is stored in the cache area corresponding to the derived identity information.

[0119] In some possible implementations, if the functional service matching the call request is a front-end service, and the identity information of the call request includes basic identity information, the acquiring unit 701 includes:

[0120] A first acquisition module, used to acquire identification information of the call request based on the front-end service;

[0121] A processing module, configured to encrypt the identification information of the call request based on the front-end service to obtain the encrypted identification information; and to sign the identification information to obtain the signed identification information;

[0122] The splicing module is used to splice the encrypted identification information and the signed identification information based on the front-end service to obtain the basic identity information of the call request.

[0123] In some possible implementations, the call request indicates a service type; and the first acquisition module includes:

[0124] The acquisition submodule acquires the initial identification information of the call request based on the front-end service; and determines the combination mode of the identification information according to the business type;

[0125] The combination submodule is used to combine the initial identification information based on the front-end service and according to the combination mode of the identification information to obtain the identification information of the call request.

[0126] In some possible implementations, if the functional service matching the call request is a front-end service, the processing unit 702 includes:

[0127] The first verification module is used to verify the call request based on the local proxy service and according to the basic identity information included in the identity information of the call request.

[0128] In some possible implementations, the first verification module includes:

[0129] A parsing submodule, configured to parse the basic identity information based on the local proxy service to obtain the encrypted identification information and the signed identification information; wherein the encrypted identification information and the signed identification information indicate the identification information of the call request;

[0130] A processing submodule, configured to decrypt the encrypted identification information based on the local proxy service to obtain the decrypted identification information; and perform signature verification on the signed identification information to obtain the signature verified identification information;

[0131] A verification submodule is used to verify the call request based on the local proxy service according to the identification information after the decryption process and the identification information after the signature verification process.

[0132] In some possible implementations, if the functional service matching the call request is a database service, the processing unit 702 includes:

[0133] The second acquisition module is used to obtain the authority of the call request from the cloud based on the local proxy service and according to the derived identity information included in the identity information of the call request, and transmit the authority of the call request to the database service.

[0134] In some possible implementations, after the second acquisition module acquires the authority of the call request from the cloud according to the derived identity information included in the identity information of the call request, the processing unit 702 includes:

[0135] The execution module is used to authenticate the call request based on the database service and according to the authority of the call request; and after the authentication is passed, execute the call request to obtain an execution result.

[0136] In some possible implementations, if the functional service matching the call request is a database service, the processing unit 702 includes:

[0137] The second verification module is used to verify the call request based on the local proxy service and the derived identity information.

[0138] In some possible implementations, the second verification module includes:

[0139] The second determination submodule is used to determine whether the derived identity information exists in the cloud based on the local proxy service; if so, determine that the verification of the call request is passed.

[0140] In some possible implementations, if the functional service matching the call request is a database service, and the identity information of the call request includes derived identity information, the acquiring unit 701 includes:

[0141] A receiving module is used to receive the derived identity information of the call request based on the database service.

[0142] In some possible implementations, if the functional service matching the call request is a routing service, the device further includes:

[0143] The forwarding unit is used to receive the call request based on the routing service; transfer the call request to the local proxy service; and send the call request based on the local proxy service.

[0144] According to an embodiment of the present disclosure, the present disclosure also provides a server, a server cluster, a readable storage medium and a computer program product.

[0145] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of the server can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the server executes the solution provided by any of the above embodiments.

[0146] Figure 8 A schematic block diagram of an example server 800 that can be used to implement embodiments of the present disclosure is shown. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit implementations of the present disclosure described and / or claimed herein.

[0147] like Figure 8As shown, the server 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the server 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0148] A number of components in the server 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the server 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0149] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as the service access method. For example, in some embodiments, the service access method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the server 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the service access method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the service access method in any other appropriate manner (e.g., by means of firmware).

[0150] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0151] According to an embodiment of the present disclosure, the present disclosure further provides a server cluster, including multiple servers mentioned in the aforementioned embodiments.

[0152] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0153] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0154] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0155] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0156] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0157] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0158] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A service access method, the method being applied to a server in a server cluster, wherein a local proxy service and at least one functional service are deployed in the server; the method comprising: In response to the received service access call request, based on the functional service matching the call request, obtain the identity information of the call request; Based on the local proxy service, verifying the call request according to the identity information of the call request; If it is determined that the verification passes, the call request is processed based on the local proxy service.

2. The method according to claim 1, wherein: The functional service includes at least one of a front-end service, a routing service, and a database service.

3. The method according to claim 2, wherein: If the functional service matching the call request is a front-end service, the processing of the call request based on the local proxy service includes: Based on the local proxy service, according to the basic identity information included in the identity information of the call request, determining and storing the derived identity information of the call request and the authority of the call request; Based on the local proxy service, the invocation request and the derived identity information are sent.

4. The method according to claim 3, wherein: The determining and storing the derived identity information of the call request and the authority of the call request according to the basic identity information included in the identity information of the call request includes: Based on the local proxy service, generating derived identity information of the call request according to the basic identity information; and determining the authority of the call request according to the basic identity information and a preset authority model; Based on the local proxy service, the correspondence between the derived identity information and the authority is stored in the cloud.

5. The method according to claim 4, wherein: The cloud comprises at least one cache area; based on the local proxy service, storing the correspondence between the derived identity information and the authority in the cloud comprises: Based on the local proxy service, according to the derived identity information, a cache area corresponding to the derived identity information is determined; and the correspondence between the derived identity information and the authority is stored in the cache area corresponding to the derived identity information.

6. The method according to any one of claims 2 to 5, wherein: If the functional service matching the call request is a front-end service, and the identity information of the call request includes basic identity information, then obtaining the identity information of the call request based on the functional service matching the call request includes: Based on the front-end service, obtaining identification information of the call request; Based on the front-end service, encrypt the identification information of the call request to obtain the encrypted identification information; and sign the identification information to obtain the signed identification information; Based on the front-end service, the encrypted identification information and the signed identification information are concatenated to obtain basic identity information of the call request.

7. The method according to claim 6, wherein: The calling request indicates a service type; and obtaining identification information of the calling request based on the front-end service includes: Based on the front-end service, obtaining initial identification information of the call request; and determining a combination method of the identification information according to the business type; Based on the front-end service, the initial identification information is combined and processed according to the combination method of the identification information to obtain the identification information of the call request.

8. The method according to any one of claims 2 to 7, wherein: If the functional service matching the call request is a front-end service, then the local proxy service is used to verify the call request according to the identity information of the call request, including: Based on the local proxy service, the call request is verified according to the basic identity information included in the identity information of the call request.

9. The method according to claim 8, wherein: The verifying the call request according to the basic identity information included in the identity information of the call request includes: Based on the local proxy service, the basic identity information is parsed to obtain the encrypted identification information and the signed identification information; wherein the encrypted identification information and the signed identification information indicate the identification information of the call request; Based on the local proxy service, decrypt the encrypted identification information to obtain the decrypted identification information; and perform signature verification on the signed identification information to obtain the signature verified identification information; Based on the local proxy service, the call request is verified according to the identification information after the decryption process and the identification information after the signature verification process.

10. The method according to claim 2, wherein: If the functional service matching the call request is a database service, the processing of the call request based on the local proxy service includes: Based on the local proxy service, according to the derived identity information included in the identity information of the call request, the authority of the call request is obtained from the cloud, and the authority of the call request is transmitted to the database service.

11. The method according to claim 10, wherein: After obtaining the authority of the call request from the cloud according to the derived identity information included in the identity information of the call request, the method further includes: Based on the database service, according to the authority of the call request, the call request is authenticated; and after the authentication is passed, the call request is executed to obtain an execution result.

12. The method according to claim 10 or 11, wherein: If the functional service matching the call request is a database service, then the local proxy service verifies the call request according to the identity information of the call request, including: Based on the local proxy service, the call request is verified according to the derived identity information.

13. The method according to claim 12, wherein: The verifying the call request according to the derived identity information includes: determining, based on the local proxy service, whether the derived identity information exists in the cloud; If so, it is determined that the verification of the call request has passed.

14. The method according to any one of claims 10 to 13, wherein: If the functional service matching the call request is a database service, and the identity information of the call request includes derived identity information, then obtaining the identity information of the call request based on the functional service matching the call request includes: Based on the database service, derived identity information of the call request is received.

15. The method according to any one of claims 1 to 14, wherein: If the functional service matching the call request is a routing service, it also includes: Based on the routing service, receiving the call request; and transmitting the call request to the local proxy service; Based on the local proxy service, the call request is sent.

16. A service access device, the device being applied to a server in a server cluster, wherein a local proxy service and at least one functional service are deployed in the server; the device comprising: an acquisition unit, configured to, in response to a received service access call request, acquire identity information of the call request based on a functional service matching the call request; A processing unit, configured to verify the call request based on the local proxy service and according to the identity information of the call request; If it is determined that the verification passes, the call request is processed based on the local proxy service.

17. The device according to claim 16, wherein: The functional service includes at least one of a front-end service, a routing service, and a database service.

18. The device according to claim 17, wherein: If the functional service matching the call request is a front-end service, the processing unit includes: A determination module, configured to determine and store, based on the local proxy service and according to basic identity information included in the identity information of the call request, the derived identity information of the call request and the authority of the call request; A sending module is used to send the call request and the derived identity information based on the local proxy service.

19. The device according to claim 18, wherein: The determining module comprises: A first determination submodule is used to generate, based on the local proxy service and according to the basic identity information, the derived identity information of the call request; and determine the authority of the call request according to the basic identity information and a preset authority model; The storage submodule is used to store the corresponding relationship between the derived identity information and the authority in the cloud based on the local proxy service.

20. The device according to claim 19, wherein The cloud comprises at least one cache area; the storage submodule is specifically used for: Based on the local proxy service, according to the derived identity information, a cache area corresponding to the derived identity information is determined; and the correspondence between the derived identity information and the authority is stored in the cache area corresponding to the derived identity information.

21. The device according to any one of claims 17 to 20, wherein: If the functional service matching the calling request is a front-end service, and the identity information of the calling request includes basic identity information, the acquiring unit includes: A first acquisition module, used to acquire identification information of the call request based on the front-end service; A processing module, configured to encrypt the identification information of the call request based on the front-end service to obtain the encrypted identification information; and to sign the identification information to obtain the signed identification information; The splicing module is used to splice the encrypted identification information and the signed identification information based on the front-end service to obtain the basic identity information of the call request.

22. The device according to claim 21, wherein The call request indicates a service type; the first acquisition module includes: The acquisition submodule acquires the initial identification information of the call request based on the front-end service; and determines the combination mode of the identification information according to the business type; The combination submodule is used to combine the initial identification information based on the front-end service and according to the combination mode of the identification information to obtain the identification information of the call request.

23. The device according to any one of claims 17 to 22, wherein: If the functional service matching the call request is a front-end service, the processing unit includes: The first verification module is used to verify the call request based on the local proxy service and according to the basic identity information included in the identity information of the call request.

24. The device according to claim 23, wherein: The first verification module includes: A parsing submodule, configured to parse the basic identity information based on the local proxy service to obtain the encrypted identification information and the signed identification information; wherein the encrypted identification information and the signed identification information indicate the identification information of the call request; A processing submodule, configured to decrypt the encrypted identification information based on the local proxy service to obtain the decrypted identification information; and perform signature verification on the signed identification information to obtain the signature verified identification information; A verification submodule is used to verify the call request based on the local proxy service according to the identification information after the decryption process and the identification information after the signature verification process.

25. The device according to claim 17, wherein: If the functional service matching the call request is a database service, the processing unit includes: The second acquisition module is used to obtain the authority of the call request from the cloud based on the local proxy service and according to the derived identity information included in the identity information of the call request, and transmit the authority of the call request to the database service.

26. The device according to claim 25, wherein After the second acquisition module acquires the authority of the call request from the cloud according to the derived identity information included in the identity information of the call request, the processing unit includes: The execution module is used to authenticate the call request based on the database service and according to the authority of the call request; and after the authentication is passed, execute the call request to obtain an execution result.

27. The device according to claim 25 or 26, wherein: If the functional service matching the call request is a database service, the processing unit includes: The second verification module is used to verify the call request based on the local proxy service and the derived identity information.

28. The device according to claim 27, wherein The second verification module includes: The second determination submodule is used to determine whether the derived identity information exists in the cloud based on the local proxy service; if so, determine that the verification of the call request is passed.

29. The device according to any one of claims 25 to 28, wherein: If the functional service matching the call request is a database service, and the identity information of the call request includes derived identity information, the acquisition unit includes: A receiving module is used to receive the derived identity information of the call request based on the database service.

30. The device according to any one of claims 16 to 29, wherein: If the functional service matching the call request is a routing service, the device further includes: The forwarding unit is used to receive the call request based on the routing service; transfer the call request to the local proxy service; and send the call request based on the local proxy service.

31. A server, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 15.

32. A server cluster, comprising a plurality of servers as claimed in claim 31.

33. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-15.

34. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 15.

Images