Request processing method, electronic equipment, readable storage medium and program product

Abstract

The invention relates to the technical field of communication security, and discloses a request processing method, electronic equipment, a readable storage medium and a program product. According to the method provided by the invention, under the condition that a first service in a server receives an access request, the first service acquires identification information of a previous hop service corresponding to the access request; based on the identification information set of the second service cached by the first service, performing verification processing on the identification information of the previous-hop service to obtain a verification result; and under the condition that the verification result indicates that the identification information of the last-hop service passes verification, the first service performs service processing according to the access request. Thus, when the first service verifies the identification information of the last-hop service of the access request and determines that the last-hop service is the gateway service, authentication processing does not need to be carried out again, computing resource consumption is reduced, the response time of the system to the external access request is shortened, and the system performance is ensured.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a request processing method, an electronic device, a readable storage medium, and a program product. Background Art

[0002] The business processing system is usually composed of multiple services (such as microservices, etc.), and the services within the system can communicate and interact with each other. In order to ensure the network security of the system, when the service in the system (i.e., the service caller) calls other services (i.e., the service provider), the access request sent will carry signature information. When the service provider receives the access request, it can perform authentication processing based on the signature information carried in the access request. After the authentication is passed, the service provider can respond to the access request and perform subsequent business processing according to the request content in the access request.

[0003] The business processing system includes a special service - gateway service. The gateway service is essentially a proxy for external clients. External clients can access non-gateway services (i.e., ordinary services) within the system through the gateway service. In the prior art, the gateway service is usually treated as an ordinary service, that is, when the gateway service receives an access request from an external client, it will authenticate the access request. After the authentication is passed, the access request will be forwarded to the service provider. After the service provider receives the access request, it will authenticate again. Because in the response process, after the gateway service authenticates the access request from the external client, the service provider will authenticate the request again. This may consume more system computing resources and may cause the system to respond to the access request from the external client for a long time, affecting system performance. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present application provide a request processing method, an electronic device, a readable storage medium and a program product. The present application is introduced from multiple aspects below, and the implementation methods and beneficial effects of the following multiple aspects can be referenced to each other.

[0005] In a first aspect, an embodiment of the present application provides a request processing method, which is applied to a server, and the method includes: when a first service in the server receives an access request, the first service obtains identification information of a previous-hop service corresponding to the access request; the identification information of the previous-hop service is used to identify the previous-hop service, and the previous-hop service is a service that processes the access request before the first service receives the access request; based on the identification information set of the second service cached by the first service, the identification information of the previous-hop service is verified to obtain a verification result; wherein each identification information in the identification information set of the second service is used to identify the second service in the server; when the verification result indicates that the identification information of the previous-hop service has passed the verification, the first service performs business processing according to the access request.

[0006] It can be understood that the second service refers to all gateway services in the server. Clients or services outside the server can send access requests to services inside the server through the gateway service.

[0007] In an embodiment of the present application, when the first service receives an access request, it can verify the identification information of the previous-hop service of the access request. When it is determined that the previous-hop service is a gateway service, there is no need to perform authentication again. In this way, the consumption of computing resources is reduced, the response time of the system to external access requests is shortened, and the system performance is guaranteed.

[0008] In a possible implementation of the first aspect above, when a first service in a server receives an access request, the first service obtains identification information of a previous-hop service corresponding to the access request, including: when the first service receives an access request, obtaining signature data in the access request; when the access request does not contain signature data, the first service obtains identification information of the previous-hop service corresponding to the access request.

[0009] It is understandable that when a general service receives an access request from another service, a request signature is usually added to the access request, and the request signature is used by the service provider to authenticate the service caller. In the case where the access request does not contain signature data, it can be further determined whether the access request comes from a gateway service and it can be determined that the access request does not come from a non-gateway service. In this way, for access requests that are not from non-gateway services, there is no need to perform authentication processing again, thereby shortening the system's response time to access requests.

[0010] In a possible implementation of the first aspect above, when the verification result indicates that the identification information of the previous-hop service has been verified, the first service performs corresponding business processing according to the access request, including: when the verification result indicates that the identification information of the previous-hop service has been verified, the first service obtains first authorization service information from the local cache; the first authorization service information includes the interface of the service for which the previous-hop service has obtained authorization; when the first authorization service information includes the first interface of the first service, the first service performs business processing according to the access request.

[0011] It can be understood that when the verification result indicates that the identification information of the previous hop service has been verified, it means that the access request comes from the gateway service. Then, it is further determined whether the gateway service has obtained the authorization of the first interface of the first service. In this way, the authentication of all nodes in the service call control process is completed, further reducing the security risk of the entire system architecture.

[0012] In a possible implementation of the first aspect above, when the verification result indicates that the identification information of the previous-hop service has passed the verification, before the first service obtains the first authorization service information from the local cache, the method also includes: the first service obtains the first authorization service information through the management and control service interface in the server; the first service adds the obtained first authorization service information to the local cache.

[0013] In a possible implementation of the first aspect above, the method further includes: when it is determined according to the first authorized service list that the first interface of the first service is not included in the first authorized service list, the first service interrupts processing of the access request.

[0014] In a possible implementation of the first aspect above, when the first service in the server receives an access request, before the first service obtains the identification information of the previous-hop service corresponding to the access request, the method also includes: the management and control service interface in the server receives the current identification information reported by the second service within the current reporting cycle; the current identification information is used to identify the second service; the management and control service interface verifies the current identification information to obtain a verification result; when the verification result indicates that the verification is passed, the management and control service interface adds the current identification information to the identification information set of the second service, and pushes the identification information set of the second service to the first service via a broadcast message, so that the first service caches the identification information set of the second service.

[0015] In an embodiment of the present application, when the identification information (such as the IP address) of the gateway service is updated, the updated identification information can be reported to other services in the server via a broadcast message, thereby ensuring data real-time performance and system availability.

[0016] In a possible implementation of the first aspect above, the management and control service interface verifies the current identification information, including: the management and control service interface obtains historical identification information reported by the second service within a historical reporting period; the historical reporting period is a reporting period before the current reporting period; the historical identification information includes information used to identify the second service within the historical reporting period; the management and control service interface compares the historical identification information with the current identification information to obtain a verification result.

[0017] In a second aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory to implement a request processing method in any possible implementation of the above-mentioned first aspect.

[0018] In a third aspect, an embodiment of the present application provides a readable storage medium having instructions stored thereon. When the instructions are executed on an electronic device, the electronic device executes a request processing method in any possible implementation of the first aspect described above.

[0019] In a fourth aspect, an embodiment of the present application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed, the computer executes the request processing method in any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 According to some embodiments of the present application, a flowchart of a request processing method is shown;

[0021] Figure 2 According to some embodiments of the present application, a structural schematic diagram of a management and control service system is shown;

[0022] Figure 3 According to some embodiments of the present application, a schematic diagram of a service authorization configuration is shown;

[0023] Figure 4 According to some embodiments of the present application, a timing diagram of updating relevant data of each service in a management and control service system is shown;

[0024] Figure 5 According to some embodiments of the present application, a flowchart of another request processing method is shown;

[0025] Figure 6 According to some embodiments of the present application, a schematic structural diagram of an electronic device is shown. DETAILED DESCRIPTION

[0026] The illustrative embodiments of the present application include but are not limited to a request processing method, an electronic device, a readable storage medium, and a program product. The request processing method of the present application is introduced below in conjunction with specific embodiments.

[0027] As mentioned above, in order to ensure the network security of the business processing system, when a service in the system accesses other services in the system or when an external client accesses a service within the system, it needs to obtain authorization from the service provider, and the service provider needs to perform authentication when receiving the access request. In addition, when an external client accesses a service within the system, it usually needs to forward the access request to the service to be accessed through a gateway service.

[0028] However, in the existing service call management and control methods, the particularity of the gateway service is not taken into account, and the gateway service is directly treated as an ordinary service. When the gateway service receives an access request from an external client, it will authenticate the request, and after the authentication is passed, the access request will be forwarded to the service provider. After the service provider receives the request sent by the gateway service, it will authenticate the request again. In this way, due to the two authentication processes, more system computing resources may be consumed, and the system may take a long time to respond to access requests from external clients, affecting the system's query rate per second (QPS). Among them, QPS is an important indicator for evaluating system throughput, which reflects the system's ability to process requests. In high-concurrency scenarios, the level of QPS directly affects the stability of the system and user experience.

[0029] Based on this, an embodiment of the present application provides a request processing method, in which, when a business service in a business processing system receives an access request, it can first determine whether the access request comes from a gateway service. In the case where it is determined that the access request comes from a gateway service, the business service does not need to perform authentication processing again, but responds to the access request and performs subsequent business processing according to the request content in the access request.

[0030] In this way, the security of calls between services can be guaranteed, the consumption of system computing resources can be reduced, the response time of the system to access requests from external clients can be shortened, and system performance can be guaranteed.

[0031] Combine the following Figure 1 The flowchart shown introduces a request processing method provided in an embodiment of the present application.

[0032] Reference Figure 1 ,like Figure 1 As shown, the request processing method provided in the embodiment of the present application includes:

[0033] S101: When a first service in a server receives an access request, the first service obtains identification information of a previous hop service corresponding to the access request.

[0034] In some embodiments, when a first service in a server receives an access request, the first service may obtain identification information of a previous hop service corresponding to the access request. The identification information of the previous hop service is used to identify the previous hop service, and may be an Internet protocol (IP) address of the previous hop service, an identifier of the previous hop service, etc. The previous hop service is a service that processes the access request before the first service receives the access request. For example, when the service caller is an external client, the previous hop service may be a gateway service.

[0035] In some embodiments, when the gateway service in the server receives an access request sent by a client outside the server (i.e., an external access request), it performs authentication, current limiting, and other processing on the access request according to the configuration of the gateway. When the access request does not trigger current limiting and the authentication passes, user information is added to the request header of the access request. Then, the access request is directly forwarded to the internal service interface of the corresponding server according to the routing rules.

[0036] It is understandable that when an ordinary service receives an access request from another service, a request signature is usually added to the access request. The request signature is used by the service provider to authenticate the service caller. When the gateway service receives an external access request, it can directly authenticate the service caller without adding the request signature required by ordinary services. When the access request does not trigger the current limit, it means that the number of requests processed by the system at this time is within the system's processing capacity and the access request can be processed. When the access request authentication is passed, it means that the service caller has the right to access the gateway service.

[0037] In some embodiments, when the first service receives the access request, the signature data in the access request is obtained. When the access request does not include the signature data, the first service obtains the identification information of the previous hop service corresponding to the access request.

[0038] It is understood that, when the access request does not include signature data, the first service can obtain the identification information of the previous hop service corresponding to the access request to determine whether the access request comes from the gateway service. When the access request includes signature data, the first service can determine that the access request comes from a non-gateway service.

[0039] In some embodiments, when the access request includes signature data, the first service may determine that the access request comes from a non-gateway service, authenticate the service caller, and determine whether the service caller has permission to access the first service.

[0040] S102: Based on the identification information set of the second service cached by the first service, verify the identification information of the previous hop service to obtain a verification result.

[0041] In some embodiments, after the first service obtains the identification information of the previous hop service of the access request, it can verify the identification information of the previous hop service based on the cached identification information set of the second service (ie, the gateway service) to obtain a verification result.

[0042] It can be understood that the second service refers to all gateway services in the server, and the identification information set of the second service includes the identification information of all gateway services in the server. Based on the identification information of all gateway services, it can be verified whether the previous hop service is a gateway service.

[0043] Exemplarily, the identification information may be an IP address of a previous hop service, the cached set of identification information of the gateway service may be a set of IP addresses of the gateway service, and the verification process of the identification information of the previous hop service may include determining whether the IP address of the previous hop service is in the set of IP addresses of the gateway service. When the IP address of the previous hop service is in the set of IP addresses of the gateway service, the verification result is that the verification of the identification information of the previous hop service is passed, that is, the previous hop service is a gateway service.

[0044] It can be understood that the IP address set of the gateway service can be in the form of an IP list or an array, etc., and this application does not limit this.

[0045] S103: When the verification result indicates that the identification information of the previous-hop service has been verified, the first service performs service processing according to the access request.

[0046] In some embodiments, when the verification result indicates that the identification information of the previous hop service has been verified, the first service may perform service processing according to the access request. For example, when the first service is a search service, search processing may be performed according to the content corresponding to the access request.

[0047] It can be understood that the verification of the identification information of the previous hop service indicates that the access request is forwarded by the gateway service, that is, the request caller has passed the authentication of the gateway service and has the authority to access the first service, and the first service does not need to perform authentication processing again.

[0048] In some embodiments, when the verification result indicates that the identification information of the previous-hop service has been verified, the first service obtains the first authorization service information from the local cache, and the first authorization service information includes the interface of the service for which the previous-hop service has obtained authorization, that is, the interface of the service accessible to the previous-hop service. When the first authorization service information includes the first interface of the first service, the first service performs business processing according to the access request. Specifically, the first service can first determine the service name of the previous-hop service, and then obtain the first authorization service information from the local cache according to the service name.

[0049] It can be understood that when it is determined that the previous hop service of the access request is a gateway service, the first service can determine that the service caller has the authority to access the first service, and it is necessary to further determine whether the gateway service that forwards the access request has the authority to call the first interface of the first service. When the first service determines that the first authorized service information includes the first interface of the first service, the first service can determine that the gateway service that forwards the access request has the authority to access the first interface, so that business processing can be performed according to the access request.

[0050] In some embodiments, when the verification result indicates that the identification information of the previous-hop service fails to be verified, the first service interrupts the access request, generates an exception log, and returns an error code.

[0051] In some embodiments, before the first service obtains the first authorization service information from the local cache, the first service obtains the first authorization service information through the management and control service interface in the server, and then adds the obtained first authorization service information to the local cache.

[0052] It can be understood that the database in the server stores relevant information of each service in the server, including the service name, version, hash value of each service, and information such as the services and interfaces accessible to each service. The management and control service interface can obtain the first authorized service information from the database.

[0053] In some embodiments, when it is determined according to the first authorized service list that the first interface of the first service is not included in the first authorized service list, the first service interrupts processing of the access request.

[0054] It can be understood that when the first interface is not included in the first authorized service list, it means that the gateway service that forwards the access request does not have the authority to access the first interface. The first service can interrupt the processing of the access request, and can generate an exception log and error code, and return the error code to the service caller through the gateway service, that is, the client that sends the access request.

[0055] In some embodiments, when the first service receives an access request, before the first service obtains the identification information of the previous hop service corresponding to the access request, the management and control service interface in the server receives the current identification information reported by each gateway service in the current reporting cycle, and the current identification information is used to identify each gateway service. The management and control service interface verifies the current identification information and obtains a verification result. If the verification result indicates that the verification is passed, the management and control service interface adds the current identification information to the identification information set of the gateway service, and pushes the identification information set of the gateway service to the first service via a broadcast message, so that the first service caches the identification information set of the gateway service.

[0056] It can be understood that the verification result indicates that the verification passed, which means that the identification information of the gateway service has been updated. The management and control service interface can add the current identification information to the identification information set of the gateway service, and push it to the first service via a broadcast message, so that the first service caches the updated identification information set of the gateway service to the local cache, which is used by the first service to determine whether the access request comes from the gateway service.

[0057] In some embodiments, when the management and control service interface verifies the current identification information, the management and control service interface obtains the historical identification information reported by the gateway service in the historical reporting cycle, where the historical reporting cycle is the reporting cycle before the current reporting cycle, and the historical identification information includes information used to identify the gateway service in the historical reporting cycle. The management and control service interface compares the historical identification information with the current identification information to obtain a verification result.

[0058] Exemplarily, the current identification information may include the current IP address of the gateway service. The management and control service interface can obtain from the database all historical identification information reported by the gateway service in the historical reporting cycle (for example, the two reporting cycles before the current reporting cycle), which may include the service names of all gateway services and the corresponding IP address sets. The current IP address is then compared with all IP addresses in the IP address set. If the current IP address is not in the IP address set, it means that the IP address of the gateway service has changed, and the verification result obtained is verification passed.

[0059] In this way, the request processing method provided in the embodiment of the present application can not only ensure the security of calls between services, but also reduce the consumption of system computing resources. For external access requests, the system does not need to perform secondary authentication processing, thereby shortening the system's response time to external access requests and ensuring system performance.

[0060] Combine the following Figure 2 The system structure diagram shown introduces the structure of a management and control service system provided in an embodiment of the present application.

[0061] Reference Figure 2 ,like Figure 2 As shown, a management and control service system provided in an embodiment of the present application includes a continuous integration / continuous delivery (CI / CD) system, a management and control service backend (also referred to as a management and control service center), a management and control service interface (application programming interface or application programming interface (API)) (not shown in the figure) and a management and control software development kit (SDK). Among them, the management and control service backend includes a database (DB) (not shown in the figure).

[0062] The CI / CD system is responsible for compiling, packaging, and deploying source code, as well as calculating and reporting the hash value of the service running package.

[0063] The management and control service background provides the service call relationship view, and has the functions of gateway IP management, private key management, service authorization management, application topology map, configuration change push, etc. In addition, it can also include microservice management, responsible person setting, interface management, interface call application, approval management and other functions not shown in the figure. Specifically, the management and control service background can generate a private key for each service in the server, which is used to authenticate the identity of each service to ensure that each service can only obtain its own authorization information. The management and control SDK can generate a token through the private key. Services that access the management and control SDK need to interact with the management and control service API through the token to obtain the gateway IP information, service authorization information, etc. in the management and control service background.

[0064] It can be understood that in this application, users can view the IP list corresponding to the gateway service in the management and control service background. If there is an abnormality in the list, the IP address of the gateway service can be manually updated and the updated gateway IP can be broadcast to each service. Each service can update the gateway IP in the local cache to achieve synchronization.

[0065] The control SDK is used for service hash value calculation, gateway IP reporting, gateway identity authentication, authorization data memory cache initialization and synchronization, collection service interface, etc. When a service connected to the control SDK initiates an access request, it performs service permission verification and adds a signature (i.e., signing), and performs service permission verification and signature verification (i.e., signing) when receiving an access request. In some embodiments, after the gateway service is connected to the control SDK, the control SDK will calculate the hash value of the gateway service running package after the gateway service is started, and periodically obtain the gateway service's own IP, version and other information (i.e., pull service metadata and gateway IP data) according to the system configuration time interval, and upload the obtained hash value, gateway IP, version and other data through the control service API (i.e., service metadata reporting).

[0066] The control service API provides functions such as synchronization and acquisition of permission data related to gateway IP and service interface, which is used when the control SDK authenticates the service. It can also control whether the service and interface enable service control and control mode. Specifically, after receiving the data uploaded by the gateway service, the control service API needs to verify the token of the gateway service, and compare and verify the version, hash value and other information of the gateway service in the uploaded data with the version, hash value and other information of the gateway service uploaded to the database by the CI / CD system. After the verification is passed, the IP and upload time of the gateway service are stored in the database. In addition, the control service API can compare the service names and corresponding gateway IP sets of all gateway services updated in the historical reporting cycle in the database with the IP of the gateway service reported most recently. If an IP change occurs, the updated gateway IP set is pushed to all services connected to the control SDK through a broadcast message (i.e., configuration change push). When the service connected to the control SDK receives the broadcast message, it stores the updated gateway IP set and the corresponding gateway service name in the local cache.

[0067] The management and control service system also provides a global gateway authentication switch. If the gateway IP synchronization or authentication is abnormal and cannot be restored temporarily, the switch can be temporarily turned off so that the gateway service IP is not authenticated temporarily. In this way, the stable operation of the business can be guaranteed to the greatest extent.

[0068] It can be understood that the management and control service system may include all services in the server. For the convenience of explanation, Figure 2 Only some services are shown, including gateway service, service A and service B. This application extracts the Hash value of the deployable service running package through the CI / CD system and compares it with the Hash calculated by the runtime control SDK, and then combines it with the unique private key of each service to further increase the difficulty of service identity counterfeiting and improve the security of service access.

[0069] In some embodiments, continue to refer to Figure 2When the gateway service connected to the control SDK is started, the control SDK reports the IP address of the gateway service through a communication protocol (such as the hypertext transfer protocol (HTTP)). When the gateway service receives an access request sent by a client outside the server, it can authenticate and limit the access request according to the configuration of the gateway. For requests that do not trigger the limit and pass the authentication, they are forwarded to the corresponding internal service interface according to the routing rules, without the need to attach the request signature required for ordinary services. If service A receives the access request forwarded by the gateway service, service A can send an IP request (Request.getPeer IP()) to the gateway service to obtain the previous hop IP address of the access request after determining that the access request does not include signature data.

[0070] In some embodiments, the service manager can set the permission information of the service and interface he is responsible for in the management service background. Figure 3As shown, the management and control service backend receives the authorization from the person in charge of service A to service B, that is, the service provider is service A (provide: A), the service caller is service B (vistor: B), and the configuration obtains the authorization token (Token: xxxxxxxxAB) for service B to call service A. The code statement representing the calling relationship can be {provide: A, vistor: B, Token: xxxxxxxxAB}. The management and control service backend receives the authorization from the person in charge of service B to service A, that is, the service provider is service B (provide: B), the service caller is service A (vistor: A), and the configuration obtains the authorization token (Token: xxxxxxxxBA) for service B to call service A. The code statement representing the calling relationship can be {provide: B, vistor: A, Token: xxxxxxxxBA}. The management and control service backend receives authorization from the person in charge of service A to service C, that is, the service provider is service A (provide: A), the service caller is service C (vistor: C), and the authorization token (Token: xxxxxxxxAC) for service C to call service A is configured. The code statement representing the calling relationship can be {provide: A, vistor: C, Token: xxxxxxxxAC}. The management and control service backend receives authorization from the person in charge of service C to service B, that is, the service provider is service C (provide: C), the service caller is service B (vistor: B), and the authorization token (Token: xxxxxxxxCB) for service B to call service C is configured. The code statement representing the calling relationship can be {provide: C, vistor: B, Token: xxxxxxxxCB}. After the person in charge of each service configures the calling relationship, the management and control service backend can store the configured calling relationship and token in the database through the above exemplary code statements.

[0071] Combine the following Figure 4 , introduces a timing diagram of updating relevant data of each service in a management and control service system provided by an embodiment of the present application. Figure 4 As shown, including:

[0072] S401, the CI / CD system reports the service name, version, and Hash value to the management and control service API.

[0073] In some embodiments, the CI / CD system can pull source code from the code repository, compile and package it, and generate multiple deployable service operation packages, each of which corresponds to each service in the server. After the CI / CD system generates the service operation package, it calculates the hash value of each service operation package and reports the service name, version, hash value and other data of each service to the management service API.

[0074] S402, the management and control service API persists the service Hash value in the database.

[0075] In some embodiments, after receiving the service name, version, Hash value and other data of each service, the management service API persists the Hash of the service in the database, and stores the service name, version and other data of each service in the database.

[0076] S403, the management and control SDK integrated with the gateway service reports the gateway IP to the management and control service API.

[0077] In some embodiments, after the gateway service is integrated (or connected) with the control SDK, the control SDK will report the gateway IP to the control service API after the gateway service is started. In addition, the control SDK can also report the version, hash value and other data of the connected gateway service to the control service API.

[0078] S404, gateway service starts, resets, and sets a fixed period.

[0079] In some embodiments, after the gateway service is started, reset, or has a fixed period, the management and control SDK integrated with the gateway service will re-execute S403 and report the gateway IP to the management and control service API.

[0080] S405, the management and control service API broadcasts all instance IP data of all gateways (if inconsistent with the last broadcast data) to each business service integrated with the management and control SDK in the server through the message middleware.

[0081] In some embodiments, after the management and control service API receives the data of the gateway service, it verifies the token of the gateway service, and compares and verifies the version, hash value and other information of the gateway service in the data with the version, hash value and other information of the gateway service uploaded to the database by the CI / CD system. After the verification passes, the IP and upload time of the gateway service are stored in the database. After the management and control service API receives the gateway IP data for the first time, it can broadcast the gateway IP data to each business service in the server that integrates the management and control SDK through the message middleware. Afterwards, the management and control service API can compare the received gateway IP with the last broadcast IP. If it is inconsistent with the last broadcast data, the updated IP data of all gateways will be broadcast to each business service.

[0082] S406, the business service synchronizes the gateway IP and caches it in the local cache.

[0083] In some embodiments, after receiving the broadcast message, the business service synchronizes the gateway IP and caches it in a local cache.

[0084] S407, after receiving configuration operations such as service, interface authorization change, service start / disable control, etc., the management and control service background stores the configuration results generated by the configuration operation into the database.

[0085] In some embodiments, after receiving configuration operations such as service, interface authorization change, service start / disable control, etc., the management and control service background stores the configuration results generated by the configuration operation in the database.

[0086] S408, the management and control service backend generates an authorization change broadcast and sends it to the business service integrated with the management and control SDK through the message middleware.

[0087] In some embodiments, after receiving configuration operations such as service and interface authorization changes in the management and control service background and storing the generated configuration results in the database, the database returns the successfully stored information to the management and control service background. Then, the management and control service background generates an authorization change broadcast and sends the broadcast to the business service integrated with the management and control SDK through the message middleware.

[0088] S409, the management and control SDK integrated with the business service obtains the authorization information of the service from the management and control service API through the private key.

[0089] In some embodiments, the management and control SDK integrated with the business service can obtain the authorization information of the service from the management and control service API through the private key. For example, a request for obtaining authorization information is sent to the management and control service API, and the request may include the private key of the business service.

[0090] S410, the management and control service API obtains authentication information from the database.

[0091] In some embodiments, after the management service API receives a request to obtain authorization information, if the private key in the request passes the authentication, the corresponding authentication information is obtained from the database. In addition, if the private key fails to pass the authentication, no subsequent processing is performed. After the management service API obtains the authentication information, it returns the authentication information to the management SDK that requested the authorization information.

[0092] S411, the management and control SDK integrated with the business service synchronizes the authentication information and caches it in the local cache.

[0093] In some embodiments, after receiving the authentication information, the management and control SDK integrated with the business service synchronizes the authentication information and caches it in a local cache.

[0094] Exemplarily, the authentication information may include a service that can access the service and a private key (<appname,appsecretkey> ), services accessible by this service, and private keys (<appname,appsecretkey> ), services and interfaces accessible by this service ( <appname,list <url>>).

[0095] S412, business service restart.

[0096] In some embodiments, when a business service is restarted, authentication information needs to be re-acquired.

[0097] S413, the management and control SDK integrated with the business service obtains all gateway IP information and authorization information of this service from the management and control service API through the private key.

[0098] In some embodiments, after the business service is restarted, the management and control SDK integrated with the service obtains all gateway information and authorization information of the service from the management and control service API through the private key. For example, a request to obtain all gateway IP information and authorization information of the service is sent to the management and control service API, and the request may include the private key of the business service.

[0099] S414, the management and control service API obtains authentication information from the database.

[0100] In some embodiments, after the management service API obtains the above request, it obtains the authentication information and all gateway IP information from the database if the private key is authenticated. In addition, if the private key is not authenticated, no subsequent processing is performed. After the management service API obtains the authentication information and all gateway IP information, it returns the authentication information and gateway IP information to the management SDK that requests the authorization information.

[0101] S415, the management and control SDK integrated with the business service synchronizes the authentication information and caches it in the local cache.

[0102] In some embodiments, after receiving the authentication information and the gateway IP information, the management and control SDK integrated with the business service synchronizes the authentication information and the gateway IP information and caches them in a local cache.

[0103] Exemplarily, the local cache may include authentication information and gateway IP information, wherein the authentication information may include the service that can access the service and the private key (<appname,appsecretkey> ), services accessible by this service, and private keys (<appname,appsecretkey> ), services and interfaces accessible by this service ( <appname,ist <url>>).

[0104] S416, the management and control SDK integrated with the business service requests synchronization interface information from the management and control service API.

[0105] In some embodiments, the management and control SDK of business service integration requests synchronization interface information from the management and control service API, for example, sends a request for synchronization interface information to the management and control service API.

[0106] S417, the management and control service API obtains the updated DB service data from the database.

[0107] In some embodiments, after receiving the request for synchronizing interface information, the management service API obtains updated DB service data (i.e., database service data) from the database, which may include the updated interface information of the service. After obtaining the updated interface information, the management service API sends the interface information to the management SDK.

[0108] It can be understood that after the user modifies the permission information of the service, the service control background sends a broadcast message to the control SDK through the message middleware, and the control SDK then updates the service permission information. When the service is started or restarted, the control SDK can actively obtain data such as service permission information and interface information. In this way, while improving the real-time performance of the data, the system availability is guaranteed.

[0109] Combine the following Figure 5 The flowchart shown introduces another request processing method provided in an embodiment of the present application.

[0110] Reference Figure 5 , Figure 5 Taking a gateway service (App1) and a business service (App2) involved in the service call control process as an example, the service call control process when a client outside the server requests to access a business service inside the server is shown. Figure 5 As shown, including:

[0111] S501, the gateway service receives an external access request.

[0112] In some embodiments, the gateway service may receive an external access request sent by a client or service external to the server.

[0113] S502: The gateway service determines whether the request triggers current limiting.

[0114] In some embodiments, after receiving an external access request, the gateway service first determines whether the request triggers current limiting. If the gateway service determines that the request triggers current limiting, S514 is executed to return a corresponding error code to the client or service that sent the request. If the gateway service determines that the request does not trigger current limiting, S503 is executed to determine whether the service caller is authenticated based on the request.

[0115] It can be understood that if the request does not trigger the current limit, it means that the number of requests processed by the system at this time is within the system's processing capacity and the access request can be processed. If the request triggers the current limit, it means that the number of requests processed by the system at this time is too large and the request cannot be processed.

[0116] S503: The gateway service determines whether the authentication is successful.

[0117] In some embodiments, after determining that the request does not trigger current limiting, the gateway service determines whether the service caller is authenticated based on the request. If the gateway service determines that the service caller is authenticated, S504 is executed to add user information to the request header. If the gateway service determines that the service caller is not authenticated, S514 is executed to return a corresponding error code to the client or service that sent the request.

[0118] S504, the gateway service adds user information to the request header.

[0119] In some embodiments, when the gateway service determines that the service caller is authenticated, the gateway service adds user information to the request header of the request. The user information may be, for example, the service name (App1) of the gateway service.

[0120] It can be understood that an access request usually includes a request header and a request body. The request header may include context information of the request, such as client environment, client information, authentication information, etc. The request body may include the actual data of the request, that is, the data actually to be sent to the business service.

[0121] S505: The gateway service forwards the request to the business service according to the routing rules.

[0122] In some embodiments, after the gateway service adds user information to the request header of the request, it forwards the request to the corresponding service interface, such as the first interface of the business service (App2) through the HTTP protocol according to the routing rules. For example, the gateway service can send the request to the corresponding service interface according to the uniform resource locator (URL) path in the request. If the partial path of the corresponding service interface in the URL path is " / s", it can indicate that the service interface corresponding to the request is a search interface, and the gateway service can send the request to the search interface.

[0123] S506: The business service receives the request.

[0124] In some embodiments, after the gateway service sends the request, the corresponding business service may receive the request.

[0125] S507: The business service determines whether the request header of the request contains a signature.

[0126] In some embodiments, after receiving the request, the business service first determines whether the request header of the request contains a signature. If it is determined that the request header of the request contains a signature, the business service can determine that the request comes from a non-gateway service, execute S509 to S511, and perform authentication processing based on the request. If it is determined that the request header of the request does not contain a signature, the business service can execute S508 to check whether the request comes from a gateway service.

[0127] S508, the business service checks whether the request comes from the gateway.

[0128] In some embodiments, the business service can obtain the identification information of the previous hop service of the request, such as the IP address of the previous hop service, to determine whether the request comes from the gateway service. If it is determined that the request comes from the gateway service, S512 is executed to check whether the interface is authorized. If it is determined that the request does not come from the gateway service, S514 is executed to return a corresponding error code.

[0129] It can be understood that when the business service determines that the request does not include signature data and that the request is not from the gateway service, it can be determined that an error has occurred in the request and authentication processing cannot be performed based on the request. Therefore, the business service can generate an error code and return it.

[0130] In some embodiments, after obtaining the IP address of the previous hop service of the request, the business service can verify the IP address of the previous hop service based on the locally cached gateway IP address set (an example of the identification information set of the second service mentioned in this application). When the IP address of the previous hop service is in the locally cached gateway IP address set, the business service can determine that the request comes from the gateway service.

[0131] It can be understood that the locally cached gateway IP address set is a trusted whitelist of the IP address of the previous hop service. When the IP address of the previous hop service is in the trusted whitelist, the business service can determine that the request comes from the gateway service without the need for authentication again. Exemplarily, the locally cached gateway IP address set may include the IP address set of the gateway service App1, i.e. [ip1, ip2, ...].

[0132] It can be understood that in the request processing method provided by the present application, the trusted whitelist method based on the IP address of the previous hop service of the request avoids the business service from performing secondary signature verification on the request forwarded by the gateway service, reduces the consumption of computing resources, and improves the security of internal service access while maintaining the original performance.

[0133] S509, the business service checks whether Appname (the name of the service caller) is authorized.

[0134] In some embodiments, when it is determined that the request comes from a non-gateway service, the business service performs authentication processing based on the request to determine whether the service caller has the authority to access the service. First, the business service checks whether the Appname in the request is authorized. If it is determined that the Appname is authorized, S510 is executed to generate a signature. If it is determined that the Appname is not authorized, S514 is executed and a corresponding error code is returned.

[0135] It can be understood that if Appname is authorized, the business service can continue to perform subsequent steps of the authentication process. If Appname is not authorized, the business service can determine that the service caller does not have the authority to access the service, generate a corresponding error code and return it.

[0136] For example, a business service can obtain a list of services that can call this service from a local cache, such as Figure 5 As shown, the list may include the service name and the corresponding token that can access this service, for example, App2-App3: token1, indicating that App3 can access this service, and the token of App3 is token1; App2-App4: token2, indicating that App4 can access this service, and the token of App4 is token2; App2-App5: token3, indicating that App5 can access this service, and the token of App5 is token3.

[0137] S510, the business service generates a signature.

[0138] In some embodiments, after the business service determines that Appname is authorized, it generates a signature and then executes S511 to verify the newly generated signature.

[0139] Exemplarily, the business service generates a signature based on Appname, timestamp (timestamp information), targetappname (service name of this service), targeturi (interface name of the target interface), and appsecret (private key corresponding to the gateway service).

[0140] S511, the business service checks whether the signatures are consistent.

[0141] In some embodiments, the business service verifies the newly generated signature including checking whether the signatures are consistent, that is, whether the newly generated signature is consistent with the signature included in the request. When it is determined that the newly generated signature is consistent with the signature included in the request, the business service determines that the service caller has the authority to access the service, and executes S512 to determine whether the service caller has the authority to access the service interface.

[0142] S512, the business service checks whether the interface is authorized.

[0143] In some embodiments, when the business service determines that the authentication of the request is passed or the request comes from the gateway, it checks whether the interface is authorized. If it is determined that the interface is authorized, S513 is executed, and the business service performs business processing according to the access request. If it is determined that the interface is not authorized, the access request is interrupted, S514 is executed, and a corresponding error code is returned.

[0144] It can be understood that when the business service determines that the request comes from the gateway service, it checks whether the gateway service has the authority to access the interface of this service, completing the authentication of all nodes in the entire service call management process, and further reducing the security risk of the entire system architecture.

[0145] In some embodiments, after the business service determines the service name of the previous hop service of the request, it obtains the first authorized service information from the local cache according to the service name. When it is determined that the first authorized service information includes the first interface of the first service, it is determined that the service caller has the authority to access the first interface of the service, and S513 is executed.

[0146] Exemplarily, the local cache may include authorization information of multiple services, for example 1: the interfaces that service APP1 has obtained authorization for include interface api1 and interface api2 (App1: [api1, api2]), 2: the interfaces that service APP3 has obtained authorization for include interface api1 and interface api3 (App3: [api1, api3]), 3: the interfaces that service APP4 has obtained authorization for include interface api4 and interface api5 (App4: [api4, api5]). Assuming that the previous hop service of the request is the gateway service App1, the business service can obtain the first authorization service information corresponding to App1 (App1: [api1, api2]). If the first interface is api1, the business service can determine that the gateway service that forwards the request has the authority to access the first interface of this service.

[0147] S513, the business service performs business processing.

[0148] In some embodiments, after the business service determines the interface authorization, it can perform business processing according to the access request.

[0149] S514: Return a corresponding error code.

[0150] In some embodiments, when the gateway service determines that the request triggers current limiting, authentication fails, or the business service determines that the request does not include signature data and is not from the gateway service, the non-gateway service is not authorized, the signature verification of the non-gateway service fails, or the interface is not authorized, a corresponding error code is generated and returned.

[0151] The request processing method provided in the embodiment of the present application can ensure the call security between services and reduce the consumption of system computing resources. For external access requests, the system does not need to perform secondary authentication processing, thereby shortening the system's response time to external access requests and ensuring system performance.

[0152] An embodiment of the present application also provides a readable storage medium, on which instructions are stored. When the instructions are executed on an electronic device, the electronic device executes the request processing method mentioned in the present application.

[0153] An embodiment of the present application also provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed, the computer executes the request processing method mentioned in the present application.

[0154] An embodiment of the present application also provides an electronic device, including a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory to implement the request processing method mentioned in the present application.

[0155] Combine the following Figure 6 , introduces an electronic device provided in an embodiment of the present application.

[0156] like Figure 6 As shown, the electronic device may include a transceiver 611 , a processor 612 , and a memory 613 .

[0157] The transceiver 611 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.

[0158] The processor 612 executes the computer execution instructions stored in the memory, so that the processor 612 executes the scheme in the above embodiment. The processor 612 can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital data processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0159] The memory 613 is connected to the processor 612 via a system bus and completes communication between them. The memory 613 is used to store computer program instructions.

[0160] By way of example and not limitation, the memory 613 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 613 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 613 may be inside or outside the integrated gateway device. In some embodiments, the memory 613 is a non-volatile solid-state memory. In some embodiments, the memory 613 includes a read-only memory (ROM). Where appropriate, the read-only memory may be a mask-programmed read-only memory, a programmable read-only memory (PROM), an electrically programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory, or a combination of two or more of these.

[0161] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.

[0162] The method provided in the embodiment of the present application can be applied to any server, and can also be applied to any electronic device, including but not limited to mobile station (MS), mobile terminal (MT), etc. The electronic device mentioned in the present application can be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a desktop computer, a laptop computer, a virtual reality (VR) device, an augmented reality (AR) device, a terminal in industrial control, a terminal in self-driving, a terminal in remote medical surgery, a terminal in smart grid, a terminal in transportation safety, a terminal in smart city, a terminal in smart home, etc. The embodiment of the present application does not limit the specific form of the server.

[0163] The various embodiments disclosed in the present application may be implemented in hardware, software, firmware, or a combination of these implementation methods. The embodiments of the present application may be implemented as a computer program or program code executed on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device.

[0164] Program code can be applied to input instructions to perform the functions described in this application and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

[0165] Program code can be implemented with high-level programming language or object-oriented programming language to communicate with the processing system. When necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described in this application is not limited to the scope of any specific programming language. In either case, the language can be a compiled language or an interpreted language.

[0166] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried or stored on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, instructions may be distributed over a network or through other computer-readable media. Therefore, a machine-readable medium may include any mechanism for storing or transmitting information in a machine (e.g., computer) readable form, including, but not limited to, a floppy disk, an optical disk, an optical disk, a magneto-optical disk, a read-only memory, a random access memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a magnetic card or an optical card, a flash memory, or a tangible machine-readable memory for transmitting information (e.g., carrier waves, infrared signal digital signals, etc.) using the Internet in electrical, optical, acoustic, or other forms of propagation signals. Therefore, a machine-readable medium includes any type of machine-readable medium suitable for storing or transmitting electronic instructions or information in a machine (e.g., computer) readable form.

[0167] In the accompanying drawings, some structural or method features may be shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be required. Instead, in some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. In addition, the inclusion of structural or method features in a particular figure does not mean that such features are required in all embodiments, and in some embodiments, these features may not be included or may be combined with other features.

[0168] It should be noted that the units / modules mentioned in the various device embodiments of the present application are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, or a part of a physical unit / module, or can be implemented as a combination of multiple physical units / modules. The physical implementation method of these logical units / modules themselves is not the most important. The combination of functions implemented by these logical units / modules is the key to solving the technical problems proposed by the present application. In addition, in order to highlight the innovative part of the present application, the above-mentioned device embodiments of the present application do not introduce units / modules that are not closely related to solving the technical problems proposed by the present application, which does not mean that there are no other units / modules in the above-mentioned device embodiments.

[0169] It should be noted that, in the examples and description of the present application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of further restrictions, the elements defined by the statement "include one" do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0170] Although the present application has been illustrated and described with reference to certain embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the present application.< / url> < / url>

Claims

1. A request processing method, characterized in that: Applied to a server, the method comprises: When the first service in the server receives the access request, the first service obtains identification information of a previous hop service corresponding to the access request; the identification information of the previous hop service is used to identify the previous hop service, and the previous hop service is a service that processes the access request before the first service receives the access request; Based on the identification information set of the second service cached by the first service, verify the identification information of the previous hop service to obtain a verification result; wherein each identification information in the identification information set of the second service is used to identify the second service in the server; When the verification result indicates that the identification information of the previous-hop service has passed verification, the first service performs service processing according to the access request.

2. The method according to claim 1, characterized in that When the first service in the server receives the access request, the first service obtains identification information of a previous hop service corresponding to the access request, including: When the first service receives the access request, obtaining signature data in the access request; When the access request does not include the signature data, the first service obtains identification information of a previous-hop service corresponding to the access request.

3. The method according to claim 1, characterized in that When the verification result indicates that the identification information of the previous-hop service has passed the verification, the first service performs corresponding service processing according to the access request, including: When the verification result indicates that the identification information of the previous-hop service has been verified, the first service obtains first authorization service information from the local cache; the first authorization service information includes an interface of a service for which the previous-hop service has obtained authorization; In a case where the first authorized service information includes the first interface of the first service, the first service performs business processing according to the access request.

4. The method according to claim 3, characterized in that When the verification result indicates that the identification information of the previous-hop service has been verified, before the first service obtains the first authorization service information from the local cache, the method further includes: The first service obtains the first authorization service information through the management and control service interface in the server; The first service adds the acquired first authorization service information to the local cache.

5. The method according to claim 3, characterized in that: The method further comprises: When it is determined according to the first authorized service list that the first authorized service list does not include the first interface of the first service, the first service interrupts processing of the access request.

6. The method according to claim 1, characterized in that When the first service in the server receives the access request, before the first service obtains the identification information of the previous hop service corresponding to the access request, the method further includes: The management and control service interface in the server receives the current identification information reported by the second service in the current reporting period; the current identification information is used to identify the second service; The management and control service interface verifies the current identification information to obtain a verification result; When the verification result indicates that the verification is passed, the management and control service interface adds the current identification information to the identification information set of the second service, and pushes the identification information set of the second service to the first service via a broadcast message, so that the first service caches the identification information set of the second service.

7. The method according to claim 6, characterized in that The management and control service interface verifies the current identification information, including: The management and control service interface obtains historical identification information reported by the second service in a historical reporting period; the historical reporting period is a reporting period before the current reporting period; the historical identification information includes information used to identify the second service in the historical reporting period; The management and control service interface compares the historical identification information with the current identification information to obtain the verification result.

8. An electronic device comprising: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory to implement the request processing method according to any one of claims 1 to 7.

9. A readable storage medium, characterized in that: The readable storage medium stores instructions, and when the instructions are executed on an electronic device, the electronic device executes the request processing method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The computer program product comprises a computer program or instructions, which, when executed, causes a computer to execute the request processing method according to any one of claims 1 to 7.

Images