Business processing method, system, electronic device, storage medium and program product

Abstract

The present invention provides a business processing method, system, electronic device, storage medium and program product, and relates to the field of microservice technology. In an embodiment of the present invention, a security authentication module is added to the microservice, so that the microservice can complete the identity authentication and authority control according to the identity authentication information in the business request combined with the real-time identity verification configuration information obtained by itself, and the point of action of security protection is sunk to the boundary of the microservice application, avoiding single-point security risks, and meeting the requirements of the zero-trust system; and, in an embodiment of the present invention, through bytecode enhancement technology, the security authentication module can be conveniently applied to all microservices, reducing the intrusiveness to the project code and reducing the possible manpower costs of development and operation personnel; and, in an embodiment of the present invention, the identity verification configuration information of the security authentication module can be configured in real time through the identity authentication service to flexibly control the timeliness and scope of the identity feature.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of microservice technology, and in particular, to a business processing method, system, electronic device, storage medium, and program product. Background Art

[0002] Microservice systems usually contain multiple microservices, which are composed of multiple dynamically coordinated container clusters. There are call links between microservices. Usually, microservice systems will introduce security authentication models to meet the security requirements for access to services and interfaces. The most common security authentication model is to establish protection at the network boundary. The solution of gateway combined with JWT (JSON Web Token) for authentication is one of the most common identity authentication technology solutions in microservice systems. However, in the actual application of this solution, there are still performance impact and security issues. Summary of the invention

[0003] Embodiments of the present invention provide a service processing method, system, electronic device, storage medium and program product to at least partially solve the above problems.

[0004] A first aspect of an embodiment of the present invention provides a business processing method, which is applied to a first microservice in a microservice system, wherein the first microservice is configured with a first security authentication module, and the microservice system further includes: an identity authentication service and an access entry service, and the method includes:

[0005] Receive identity verification configuration information sent by the identity authentication service;

[0006] Receive a service request sent by an access portal service, wherein the service request carries identity authentication information;

[0007] Verifying the identity authentication information based on the identity verification configuration information by the first security authentication module;

[0008] If the verification is successful, the service request is processed.

[0009] Optionally, the method further comprises:

[0010] If the verification is successful, the identity authentication information is saved by the first security authentication module;

[0011] In the case where the second microservice needs to perform business processing on the business request, a business forwarding request is generated, and the second microservice is configured with a second security authentication module;

[0012] Adding identity authentication information in the service forwarding request through the first security authentication module;

[0013] The business forwarding request with the identity authentication information added is forwarded to the second microservice.

[0014] Optionally, the identity verification configuration information includes at least a key; and verifying the identity authentication information based on the identity verification configuration information by the first security authentication module includes:

[0015] Decrypting the identity authentication information based on the key in the identity verification configuration information by the first security authentication module;

[0016] In case the decryption is successful, it is determined that the verification is passed.

[0017] Optionally, the identity verification configuration information further includes a validity period and / or a role microservice; and verifying the identity authentication information based on the identity verification configuration information through the first security authentication module includes:

[0018] Determining whether the identity authentication information is within the validity period based on the validity period in the identity verification configuration information, and / or

[0019] Based on the role microservice in the identity verification configuration information, determining whether the identity authentication information is valid for the first microservice;

[0020] When the identity authentication information is within the validity period and / or is valid for the first microservice, the identity authentication information is decrypted by the first security authentication module based on the key in the identity verification configuration information;

[0021] In case the decryption is successful, it is determined that the verification is passed.

[0022] Optionally, the method further comprises:

[0023] The access behavior of the first microservice is recorded to obtain access information;

[0024] The access information is sent to the identity authentication service through the first security authentication module.

[0025] A second aspect of an embodiment of the present invention provides a business processing method, which is applied to an access entry service in a microservice system, wherein the microservice system further includes: an identity authentication service and at least one microservice, wherein the microservice is configured with a security authentication module, and the method includes:

[0026] Receiving an identity authentication request initiated by a user terminal, wherein the identity authentication request carries user identity information;

[0027] Sending the user identity information to an identity authentication service for identity authentication;

[0028] Receive identity authentication information sent by the identity authentication service;

[0029] Sending the identity authentication information to a user terminal;

[0030] Receiving a service request initiated by a user terminal, wherein the service request carries identity authentication information;

[0031] The business request is forwarded to a microservice corresponding to the business request, so that the microservice verifies and processes the business request.

[0032] A third aspect of an embodiment of the present invention provides a microservice system, the system comprising: an identity authentication service, an access entry service and a microservice, the microservice being configured with a security authentication module;

[0033] The access entry service is used to receive an identity authentication request initiated by a user terminal, the identity authentication request carrying user identity information; and send the user identity information to the identity authentication service for identity authentication;

[0034] The identity authentication service is used to authenticate the user identity information sent by the access portal service, and if the authentication is successful, send the identity authentication information to the access portal service;

[0035] The identity authentication service is used to send identity verification configuration information to the security authentication module of the microservice;

[0036] The access portal service is used to receive identity authentication information sent by the identity authentication service; and send the identity authentication information to the user terminal;

[0037] The access entry service is used to receive a service request initiated by a user terminal, the service request carrying identity authentication information; and forward the service request to the microservice;

[0038] The microservice is used to verify the identity authentication information based on the identity verification configuration information through the security authentication module; if the verification is successful, the business request is processed.

[0039] A fourth aspect of an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executed, implements the business processing method as described in the first aspect or the second aspect of the present invention.

[0040] A fifth aspect of an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the business processing method as described in the first aspect or the second aspect of the present invention.

[0041] A sixth aspect of an embodiment of the present invention provides a computer program product, including a computer program / instruction, which is implemented by a processor to implement the steps in the business processing method described in the first aspect or the second aspect of the present invention.

[0042] In an embodiment of the present invention, a security authentication module is added to the microservice, so that the microservice can complete identity authentication and authority control according to the identity authentication information in the business request combined with the real-time identity verification configuration information obtained by itself, and the point of action of security protection is sunk to the boundary of the microservice application, avoiding single-point security risks, and meeting the requirements of the zero-trust system; and, in an embodiment of the present invention, through bytecode enhancement technology, the security authentication module can be conveniently applied to all microservices, reducing the intrusiveness to the project code and alleviating the possible manpower costs of development and operation personnel; and, in an embodiment of the present invention, the identity verification configuration information of the security authentication module can be configured in real time through the identity authentication service to flexibly control the timeliness and scope of identity features. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0044] Figure 1 This is a flowchart of the solution of using the gateway in conjunction with JWT for authentication;

[0045] Figure 2 It is a flowchart of a service processing method provided by an embodiment of the present invention;

[0046] Figure 3 is a flowchart of the steps of the service processing method provided by an embodiment of the present invention;

[0047] Figure 4 is a flowchart of another service processing method provided by an embodiment of the present invention;

[0048] Figure 5 It is a schematic diagram of the interaction flow of the business processing method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] The flow chart of the solution of gateway combined with JWT for authentication is as follows Figure 1 As shown in the figure, the specific process of the program includes:

[0051] The user terminal initiates an authentication request ( Figure 1 (not shown), provide login information, the gateway as the access service entrance sends it to the identity authentication service request for identity authentication, the identity authentication service generates a JWT as an identity credential after verification, returns the JWT to the gateway, and the gateway then sends the JWT to the user terminal ( Figure 1 not shown);

[0052] The user then initiates a business request carrying JWT to the gateway, which verifies the JWT. After verification, the gateway forwards the verified business request carrying JWT to the corresponding microservice;

[0053] After receiving the request, the microservice obtains the JWT for parsing and verification. If the verification passes, the request is considered legal and processed based on the business logic. In the subsequent processing flow of the business request, the JWT is propagated to other microservices.

[0054] In this solution, security authentication is performed through the gateway, which can meet the requirements of the centralized security authentication model. The use of JWT also allows microservices to process requests in a stateless manner, simplifying the logic of the server. However, this security authentication method has some limitations. First, the inventors found that in this solution, the gateway needs to store and manage JWT. If the security of the gateway is threatened, JWT may be tampered with or forged, thereby endangering the security of the entire system. Secondly, in this solution, the gateway needs to process all requests, which may become a bottleneck of the system. Once the gateway fails, the entire system will not work properly, and the complexity of deployment and maintenance will be increased. Thirdly, in this solution, after the request is verified by the gateway, the authorization cannot be withdrawn, and the security of access to the microservice cannot be protected subsequently.

[0055] In order to solve these problems, the embodiment of the present invention proposes a service processing method, specifically, Figure 2 As shown, it shows a flowchart of the business processing method provided by an embodiment of the present invention; the method adopts bytecode injection technology, adds a security authentication module to each microservice, and after receiving the authentication request sent by the user terminal, the access entry service requests identity authentication from the identity authentication service. After completing the authentication, the identity authentication service returns the identity authentication information (specifically, it can be a token, Figure 2The token is used as an example in the example), and the access portal service returns the token to the user terminal. The user terminal can initiate a business request carrying the token. The access portal service does not need to verify the token, and directly sends the business request carrying the token to the security authentication module of the corresponding microservice. In the embodiment of the present invention, the identity authentication service directly pushes the identity verification configuration information to the security authentication module of each microservice. The security authentication module can monitor the identity verification configuration information pushed by the identity authentication service and obtain the real-time identity verification configuration information. Thus, the security authentication module can complete the identity authentication and authority control according to the identity authentication information in the business request combined with the real-time identity verification configuration information obtained by itself.

[0056] Therefore, in the embodiment of the present invention, the point of action of security protection is sunk to the boundary of the microservice application to avoid single-point security risks and meet the requirements of the zero-trust system; and, in the embodiment of the present invention, through bytecode enhancement technology, the security authentication module can be easily applied to all microservices, reducing the intrusiveness to the project code and alleviating the possible manpower costs of development and operation personnel; and, in the embodiment of the present invention, the identity verification configuration information of the security authentication module can be configured in real time through the identity authentication service to flexibly control the timeliness and scope of identity features.

[0057] Specifically, an embodiment of the present invention provides a business processing method, which is applied to a first microservice in a microservice system, wherein the first microservice is configured with a first security authentication module, and the microservice system further includes: an identity authentication service and an access entry service, such as Figure 3 As shown, it shows a flow chart of the steps of the service processing method provided by an embodiment of the present invention, and the method includes the following steps:

[0058] S101, receiving identity verification configuration information sent by an identity authentication service.

[0059] In the embodiment of the present invention, the identity authentication service can push the new identity verification configuration information to all security authentication modules every time it generates new identity verification configuration information. The security authentication module can monitor the identity verification configuration information from the identity authentication service to timely obtain the real-time identity verification configuration information pushed by the identity authentication service.

[0060] In actual application, each microservice in the existing microservice system can be upgraded in a rolling manner. During the upgrade process, bytecode enhancement technology is used to add a security authentication module to each microservice.

[0061] Specifically, bytecode enhancement technology refers to a type of technology that modifies existing bytecode or dynamically generates new bytecode files. This technology allows developers to operate bytecode at runtime, including adding, modifying, or deleting classes and methods, and changing the behavior of methods. Bytecode enhancement technology has a wide range of applications in the Java field, such as implementing aspect-oriented programming (AOP), hot deployment, performance monitoring, mock testing, etc.

[0062] Several key points of bytecode enhancement technology include: ASM, JavaAssist, Byte Buddy and Java Agent.

[0063] Among them, ASM is a library for directly manipulating bytecodes, which provides a rich API to generate, modify and analyze Java bytecodes. JavaAssist is a library that simplifies bytecode editing, which provides a higher level of abstraction, making it easier for developers to enhance bytecodes. Byte Buddy is a code generation and manipulation library for creating and modifying Java classes while a Java application is running without the help of a compiler. It provides a simple and easy-to-use API, supports any version of Java, and has performance advantages. Java Agent refers to a mechanism that is loaded into the Java Virtual Machine (JVM) in the form of an "agent" when the JVM is started, and can interact with programs running on the JVM. With JavaAgent, developers can dynamically monitor, analyze, and even modify executing Java programs while the application is running.

[0064] In the embodiment of the present invention, Java Agent technology can be used to enhance the service by injecting a security authentication module in an attach manner.

[0065] S102, receiving a service request sent by an access portal service, wherein the service request carries identity authentication information.

[0066] In the embodiment of the present invention, the access portal service serves as the access portal of the microservice system and receives requests from user terminals, including authentication requests and service requests.

[0067] In the embodiment of the present invention, the access entry service can be implemented through a gateway or a front end.

[0068] In an embodiment of the present invention, the access portal service can send an identity authentication request to the identity authentication service based on the authentication request sent by the user terminal to obtain the identity authentication information corresponding to the user terminal and send it to the user terminal. In the subsequent process, the user terminal can initiate a business request carrying the identity authentication information to the access portal service. The access portal service can forward the business request carrying the identity authentication information to the corresponding microservice.

[0069] In the embodiment of the present invention, the identity authentication information may be a token.

[0070] In the embodiment of the present invention, the access portal service can obtain corresponding identity authentication information from the identity authentication service based on OIDC.

[0071] OIDC (OpenID Connect) is an authentication and authorization protocol based on the OAuth 2.0 protocol. It provides a secure way for users to authenticate using existing identity providers (such as Google, Facebook, etc.) and authorize third-party applications to access user information.

[0072] Based on the OIDC identity authentication service, the user information carried in the user's identity authentication request can be authenticated. If the authentication passes, the identity authentication information is generated. Subsequent microservices can verify the user's business request based on the identity authentication information.

[0073] S103: Verify the identity authentication information based on the identity verification configuration information through the first security authentication module.

[0074] S104: If the verification is successful, the service request is processed.

[0075] In the embodiment of the present invention, the first security authentication module of the first microservice can intercept the business request sent to the first microservice to verify the identity authentication information. If the verification is successful, the microservice processes the business request based on the business logic.

[0076] Specifically, based on the above embodiment, the method further includes the following steps:

[0077] S105: When the verification is successful, the identity authentication information is saved by the first security authentication module.

[0078] In the embodiment of the present invention, the security authentication module can cache the identity authentication information (eg, token) if the authentication is successful.

[0079] S106 generates a business forwarding request when the second microservice needs to perform business processing on the business request, and the second microservice is configured with a second security authentication module.

[0080] In actual applications, a business request may need to be processed by multiple microservices together. In this case, the first microservice needs to initiate a call to the second microservice. Specifically, a business forwarding request with the destination being the second microservice can be generated.

[0081] S107: Add identity authentication information to the service forwarding request through the first security authentication module.

[0082] In the embodiment of the present invention, the first security authentication module of the first microservice can intercept the service forwarding request sent from the first microservice and add the pre-cached identity authentication information to the service forwarding request.

[0083] S108: forward the business forwarding request with the identity authentication information added to the second microservice.

[0084] In an embodiment of the present invention, the second microservice is configured with a second security authentication module. Therefore, in the second microservice, its second security authentication module intercepts the business forwarding request carrying identity authentication information and verifies the identity authentication information. If the verification passes, the second microservice processes the business forwarding request based on its business logic.

[0085] Specifically, based on the above embodiment, the identity verification configuration information at least includes a key, and the step S103 includes: decrypting the identity authentication information based on the key in the identity verification configuration information through the first security authentication module, and determining that the verification is successful when the decryption is successful.

[0086] In the embodiment of the present invention, the key in the identity verification configuration information can be obtained based on any feasible encryption algorithm in the relevant technology, for example: RSA, HMAC.

[0087] Among them, RSA is an asymmetric encryption algorithm that can use a private key to sign data and then use a public key to verify it. For JWT scenarios, the private key is only saved on the server side, and the public key can be used anywhere that needs to verify the JWT. RSA provides higher security and is suitable for scenarios where JWT needs to be shared between different applications.

[0088] HMAC (Hash-based Message Authentication Code) is a symmetric encryption algorithm that uses the same key to sign and verify JWT. The key is only stored on the server side and is used to verify the integrity and authenticity of the JWT. HMAC is simpler and more efficient than RSA.

[0089] In an embodiment of the present invention, the key in the identity verification configuration information is saved after the identity authentication service processes the identity authentication information sent by the user terminal, and the key is pushed to the security authentication module of the microservice, so that the security authentication module of the microservice can decrypt the identity authentication information based on the key to determine whether the identity authentication information of the user terminal is verified.

[0090] Specifically, based on the above embodiment, the identity verification configuration information also includes a validity period and / or a role microservice, and the step S103 includes the following sub-steps:

[0091] S1031, judging whether the identity authentication information is within the validity period based on the validity period in the identity verification configuration information, and / or judging whether the identity authentication information is valid for the first microservice based on the role microservice in the identity verification configuration information.

[0092] S1032: When the identity authentication information is within the validity period and / or is valid for the first microservice, the identity authentication information is decrypted by the first security authentication module based on the key in the identity verification configuration information.

[0093] S1033: If the decryption is successful, determine that the verification is successful.

[0094] In the embodiment of the present invention, the identity verification configuration information can also configure the validity period and the role of the microservice. In addition, as mentioned above, the identity authentication service can push new identity verification configuration information to the microservice in real time, so that the validity and role of the identity authentication information can be changed in real time by actively sending the identity verification configuration information, which is convenient for controlling the scope of permissions, meeting the principle of least privilege, and providing dynamic authorization capabilities.

[0095] For example, in the aforementioned embodiment, the first microservice verifies the identity authentication information through the first security authentication module in combination with the identity verification configuration information obtained in real time, and after performing business processing, it is determined that the second microservice needs to be called, and a business forwarding request is generated. The first security authentication module intercepts the business forwarding request and adds the identity authentication information. At the same time, the identity authentication service pushes the latest identity verification configuration information, and the validity period of the identity authentication information is adjusted in the latest identity verification configuration information. The first security authentication module of the first microservice and the second security authentication module of the second microservice both obtain the identity verification configuration information. After the first security authentication module of the first microservice sends the identity verification configuration information with the added identity authentication information to the second security authentication module of the second microservice, the second security authentication module, in combination with the latest identity verification configuration information obtained in real time, determines that the validity period of the identity authentication information has exceeded, and the second microservice refuses to process the business forwarding request and returns a response.

[0096] Specifically, based on the above embodiment, the method further includes the following steps:

[0097] S1, record the access behavior of the first microservice to obtain access information.

[0098] S2: Send the access information to the identity authentication service through the first security authentication module.

[0099] In the embodiment of the present invention, since the security authentication module can be connected to each business request sent to the microservice, the security authentication module can record the access behavior occurring in the microservice, obtain the access information, and send the access information to the identity authentication service, so that the identity authentication service can promptly discover possible abnormal access to the microservice, adjust the identity verification configuration information, and handle the abnormal access behavior in a timely manner.

[0100] In an embodiment of the present invention, a service processing method is also provided. Figure 4 As shown, it shows a flow chart of steps of another business processing method according to an embodiment of the present invention. Specifically, the method is applied to an access entry service in a microservice system. The microservice system also includes: an identity authentication service and at least one microservice. The microservice is configured with a security authentication module. The method includes the following steps:

[0101] S201, receiving an identity authentication request initiated by a user terminal, wherein the identity authentication request carries user identity information.

[0102] S202: Send the user identity information to an identity authentication service for identity authentication.

[0103] S203, receiving identity authentication information sent by the identity authentication service.

[0104] S204: Send the identity authentication information to the user terminal.

[0105] S205: Receive a service request initiated by a user terminal, where the service request carries identity authentication information.

[0106] S206: forward the business request to a microservice corresponding to the business request, so that the microservice verifies and processes the business request.

[0107] In the embodiment of the present invention, the user terminal may be a client corresponding to the microservice system.

[0108] In an embodiment of the present invention, the identity authentication service can perform identity authentication based on OIDC. The identity authentication service can authenticate the user information carried in the user's identity authentication request. If the authentication passes, the identity authentication information is generated. The subsequent microservice can verify the user's business request based on the identity authentication information.

[0109] Specifically, the identity authentication service may also generate identity verification configuration information based on a key corresponding to the identity authentication information of the user terminal and the validity period of the identity authentication information and / or the role of the microservice, and actively push the information to the security authentication module of the microservice.

[0110] Specifically, the identity verification configuration information and the identity authentication information correspond one to one. The identity authentication service can create the identity verification configuration information corresponding to each identity authentication information in the form of a data table, so that the security authentication module of the microservice can verify the identity authentication information in each business request received in combination with the identity verification configuration information received from the identity authentication service.

[0111] In the embodiment of the present invention, the access portal service does not need to verify the identity authentication information in the service request, nor does it need to store the identity authentication information, so as to avoid the access portal service processing all requests.

[0112] For ease of understanding, the business processing method provided by the embodiment of the present invention will be explained below based on the data interaction between various components in the microservice system. Specifically, Figure 5 As shown, Figure 5 It is an interactive flow diagram of the business processing method provided by an embodiment of the present invention. In the embodiment of the present invention, the security authentication module can be used as a proxy module to process business requests from microservices and business requests sent to microservices. The identity authentication service is located on the control plane, so that the authority of the user's identity authentication information (role, validity period, role microservice) can be controlled based on the identity authentication service.

[0113] In the embodiment of the present invention, first, each microservice in the microservice system can be initialized and receive a service request, which is sent by a user terminal through a portal access service and carries identity authentication information.

[0114] In an embodiment of the present invention, before a user terminal sends a service request, it needs to first be authenticated by an identity authentication service. After completing the identity authentication of the user terminal, the identity authentication service generates identity authentication information and returns it to the user terminal, and generates identity verification configuration information corresponding to the identity authentication information and pushes it to the security authentication module of the microservice.

[0115] After receiving the business request, the security authentication module intercepts the business request and verifies the identity authentication information carried in the business request according to the identity verification configuration information. If the verification fails, a failure response is returned to the user terminal. If the verification is successful, the identity authentication information is cached, and the microservice performs business processing on the business request based on the business logic. During the business processing, if other microservices need to be called, the current microservice generates a business forwarding request, the security authentication module intercepts the business forwarding request, and adds the previously cached identity authentication information to the business forwarding request. Based on the business forwarding request with the added identity authentication information, a call to other microservices is initiated, and a response is returned to the user terminal.

[0116] In the embodiment of the present invention, the identity authentication service is responsible for verifying the identity information of the user terminal, confirming whether the user's identity information (such as user name and password) is correct, and whether the user has the authority to access specific resources. Once the user's identity information is verified by the identity authentication service, the identity authentication service can issue an identity authentication information (such as a token) to the user, and the token contains the user's identity information (such as user ID).

[0117] In the embodiment of the present invention, the identity authentication information can be signed to ensure that the token is not tampered with during transmission and its source can be verified. The corresponding identity authentication service can add the corresponding signature key to the identity verification configuration information.

[0118] When a user initiates a business request to try to access protected resources, the access entry service sends the business request with identity authentication information to the downstream microservice.

[0119] The security authentication module in the microservice uses the identity verification configuration information (such as key, issuer, signature algorithm, validity period, and role microservice) provided by the identity authentication service to verify the validity of the identity authentication.

[0120] In the embodiment of the present invention, the identity authentication service is responsible for managing keys and security policies, which are necessary for verifying the identity authentication information. The security of the identity authentication information depends on the keys and algorithms provided by the identity authentication service, ensuring that only the service with the correct keys can verify the identity authentication information.

[0121] The identity authentication service can actively push identity verification configuration information to the security authentication module of the microservice, so that each microservice can independently verify the identity authentication information without directly communicating with the identity authentication service.

[0122] In an embodiment of the present invention, before a service call occurs, identity authentication information is obtained and added to the business forwarding request. All microservices in the microservice system are injected with a security authentication module using bytecode enhancement technology. The security authentication module can perform verification based on the identity identifier in the business forwarding request and the real-time dynamic verification configuration information obtained in the security authentication module. Before the microservice needs to perform business logic operations, its security authentication module caches the identity authentication identifier, and for requests triggered in the relevant context, the security authentication module will carry the identity authentication information to the next service.

[0123] In the embodiment of the present invention, the security authentication module of each service can report access statistics to the identity authentication service to provide behavior statistics to detect abnormal access.

[0124] In the embodiment of the present invention, by mounting a non-intrusive Agent, seamless access and fine-grained security control can be achieved for the microservice system.

[0125] The technical solution provided by the embodiment of the present invention acts on the application layer and can perform more precise access control and dynamic authorization for the application layer context.

[0126] In the embodiment of the present invention, JAVA Agent is used to inject the identity authentication module, and no code parsing service and active transmission are required to reduce the intrusion into the engineering code and reduce the complexity of project development and operation.

[0127] Furthermore, in the embodiment of the present invention, the identity verification configuration information is actively sent based on the identity authentication service, so that the validity of the identity authentication information can be changed in real time, which is convenient for controlling the scope of permissions, meets the principle of least privilege, and dynamically provides dynamic authorization capabilities.

[0128] Therefore, the technical solution provided by the embodiment of the present invention can realize the construction of a zero-trust system for a microservice system; it can be used for real-time access control of cloud computing, cloud platforms, and cloud-native systems in computers.

[0129] Based on the same inventive concept, an embodiment of the present invention further provides a microservice system, the system comprising: an identity authentication service, an access entry service and a microservice, the microservice being configured with a security authentication module;

[0130] The access entry service is used to receive an identity authentication request initiated by a user terminal, the identity authentication request carrying user identity information; and send the user identity information to the identity authentication service for identity authentication;

[0131] The identity authentication service is used to authenticate the user identity information sent by the access portal service, and if the authentication is successful, send the identity authentication information to the access portal service;

[0132] The identity authentication service is used to send identity verification configuration information to the security authentication module of the microservice;

[0133] The access portal service is used to receive identity authentication information sent by the identity authentication service; and send the identity authentication information to the user terminal;

[0134] The access entry service is used to receive a service request initiated by a user terminal, the service request carrying identity authentication information; and forward the service request to the microservice;

[0135] The microservice is used to verify the identity authentication information based on the identity verification configuration information through the security authentication module; if the verification is successful, the business request is processed.

[0136] Optionally, the microservice is also used to:

[0137] If the verification is successful, the identity authentication information is saved through the security authentication module; if the second microservice needs to perform business processing on the business request, a business forwarding request is generated, and the second microservice is configured with a second security authentication module; the identity authentication information is added to the business forwarding request through the security authentication module; and the business forwarding request with the added identity authentication information is forwarded to the second microservice.

[0138] Optionally, the identity verification configuration information includes at least a key; and the microservice is specifically used for:

[0139] The security authentication module decrypts the identity authentication information based on the key in the identity verification configuration information; if the decryption is successful, it is determined that the verification is successful.

[0140] Optionally, the identity verification configuration information further includes a validity period and / or an effect microservice; the microservice is specifically used to:

[0141] Determining whether the identity authentication information is within the validity period based on the validity period in the identity verification configuration information, and / or

[0142] Based on the role microservice in the identity verification configuration information, determine whether the identity authentication information is valid for the microservice;

[0143] When the identity authentication information is within the validity period and / or is valid for the microservice, the identity authentication information is decrypted by the security authentication module based on the key in the identity verification configuration information;

[0144] In case the decryption is successful, it is determined that the verification is passed.

[0145] Optionally, the microservice is further used to: record access behaviors of the microservice to obtain access information;

[0146] The access information is sent to the identity authentication service through the security authentication module.

[0147] In the embodiment of the present invention, bytecode injection technology is used to add a security authentication module to each microservice in the microservice system. After receiving the authentication request sent by the user terminal, the access entry service requests identity authentication from the identity authentication service. After completing the authentication, the identity authentication service returns the identity authentication information. The access entry service then returns the token to the user terminal. The user terminal can initiate a business request carrying the token. The access entry service does not need to verify the token and directly sends the business request carrying the token to the security authentication module of the corresponding microservice. In the embodiment of the present invention, the identity authentication service directly pushes the identity verification configuration information to the security authentication module of each microservice. The security authentication module can monitor the identity verification configuration information pushed by the identity authentication service and obtain the real-time identity verification configuration information. Thus, the security authentication module can complete the identity authentication and authority control according to the identity authentication information in the business request combined with the real-time identity verification configuration information obtained by itself.

[0148] Therefore, in the embodiment of the present invention, the point of action of security protection is sunk to the boundary of the microservice application to avoid single-point security risks and meet the requirements of the zero-trust system; and, in the embodiment of the present invention, through bytecode enhancement technology, the security authentication module can be easily applied to all microservices, reducing the intrusiveness of the project code and alleviating the possible manpower costs of development and operation personnel; and, in the embodiment of the present invention, the identity verification configuration information of the security authentication module can be configured in real time through the identity authentication service to flexibly control the timeliness and scope of identity features.

[0149] Based on the same inventive concept, an embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes, the steps in the business processing method described in any of the above embodiments are implemented.

[0150] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the business processing method described in any of the above embodiments are implemented.

[0151] Based on the same inventive concept, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which implements the steps of the business processing method described in any of the above embodiments when executed by a processor.

[0152] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0153] Those skilled in the art will appreciate that the embodiments of the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the embodiments of the present invention may take the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0154] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (apparatus), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0155] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0156] These computer program instructions can also be loaded onto a computer or other programmable terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0157] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0158] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0159] The above is a detailed introduction to a business processing method provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A business processing method, characterized in that: The method is applied to a first microservice in a microservice system, the first microservice is configured with a first security authentication module, the microservice system further includes: an identity authentication service and an access entry service, the method includes: Receive identity verification configuration information sent by the identity authentication service; Receive a service request sent by an access portal service, wherein the service request carries identity authentication information; Verifying the identity authentication information based on the identity verification configuration information by the first security authentication module; If the verification is successful, the service request is processed.

2. The service processing method according to claim 1, characterized in that: The method further comprises: If the verification is successful, the identity authentication information is saved by the first security authentication module; In the case where the second microservice needs to perform business processing on the business request, a business forwarding request is generated, and the second microservice is configured with a second security authentication module; Adding identity authentication information in the service forwarding request through the first security authentication module; The business forwarding request with the identity authentication information added is forwarded to the second microservice.

3. The service processing method according to claim 1, characterized in that: The identity verification configuration information at least includes a key; and verifying the identity authentication information based on the identity verification configuration information by the first security authentication module includes: Decrypting the identity authentication information based on the key in the identity verification configuration information by the first security authentication module; In case the decryption is successful, it is determined that the verification is passed.

4. The service processing method according to claim 3, characterized in that: The identity verification configuration information also includes a validity period and / or an effect microservice; Verifying the identity authentication information based on the identity verification configuration information by the first security authentication module includes: Determining whether the identity authentication information is within the validity period based on the validity period in the identity verification configuration information, and / or Based on the role microservice in the identity verification configuration information, determining whether the identity authentication information is valid for the first microservice; When the identity authentication information is within the validity period and / or is valid for the first microservice, the identity authentication information is decrypted by the first security authentication module based on the key in the identity verification configuration information; In case the decryption is successful, it is determined that the verification is passed.

5. The service processing method according to any one of claims 1 to 4, characterized in that: The method further comprises: The access behavior of the first microservice is recorded to obtain access information; The access information is sent to the identity authentication service through the first security authentication module.

6. A business processing method, characterized in that: The method is applied to an access entry service in a microservice system, wherein the microservice system further comprises: an identity authentication service and at least one microservice, wherein the microservice is configured with a security authentication module, and the method comprises: Receiving an identity authentication request initiated by a user terminal, wherein the identity authentication request carries user identity information; Sending the user identity information to an identity authentication service for identity authentication; Receive identity authentication information sent by the identity authentication service; Sending the identity authentication information to a user terminal; Receiving a service request initiated by a user terminal, wherein the service request carries identity authentication information; The business request is forwarded to a microservice corresponding to the business request, so that the microservice verifies and processes the business request.

7. A microservice system, characterized in that: The system includes: an identity authentication service, an access entry service and a microservice, wherein the microservice is configured with a security authentication module; The access entry service is used to receive an identity authentication request initiated by a user terminal, the identity authentication request carrying user identity information; and send the user identity information to the identity authentication service for identity authentication; The identity authentication service is used to authenticate the user identity information sent by the access portal service, and if the authentication is successful, send the identity authentication information to the access portal service; The identity authentication service is used to send identity verification configuration information to the security authentication module of the microservice; The access portal service is used to receive identity authentication information sent by the identity authentication service; and send the identity authentication information to the user terminal; The access entry service is used to receive a service request initiated by a user terminal, the service request carrying identity authentication information; and forward the service request to the microservice; The microservice is used to verify the identity authentication information based on the identity verification configuration information through the security authentication module; if the verification is successful, the business request is processed.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the business processing method according to any one of claims 1 to 5 or the business processing method according to claim 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the business processing method described in any one of claims 1 to 5 or the business processing method described in claim 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps in the business processing method described in any one of claims 1 to 5 or the business processing method described in claim 6 are implemented.

Images