Interface access control method and system
By mapping the control operation information of the interface market to the interface gateway and authenticating and routing forwarding interface access requests, the existing interface access control methods are solved, and more flexible and efficient interface access control is achieved.
Patent Information
- Application Number
- CN202411906516.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-23
- Publication Date
- 2025-04-15
AI Technical Summary
The existing interface access control methods have low flexibility and low efficiency, making it difficult to manage interface application access in a unified manner.
By obtaining the control operation information of the interface market, the interface application is mapped as an application service in the interface gateway, the client is mapped as a user in the interface gateway, the control operation information is mapped as a routing configuration in the interface gateway, and authenticating and routing forwarding in response to the client's interface access request.
It realizes more flexible management of interface applications and more efficient access control of interfaces, improving the flexibility and efficiency of interface access control methods.
Smart Images
Figure CN119830259A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer control, and in particular, to an interface access control method and system. Background Art
[0002] Interface application refers to the communication and interaction between modules in software development by defining interfaces. The interface market is a platform that provides interface applications. The interface market is usually implemented based on an interface gateway. Users can browse and subscribe to the required interface applications on the interface market to obtain the corresponding interface permissions.
[0003] In the related art, the interface market and the interface gateway are usually coupled, and users need to perform logically complex control operations on the interface gateway to access the interface. The interface access control method is difficult to operate, the operation process is complicated, and the efficiency of the interface access control method is low. In addition, it is difficult to uniformly manage interface application access by directly controlling the interface gateway, and the flexibility of the interface access control method is poor.
[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention
[0005] The embodiments of the present application provide an interface access control method and system to at least solve the technical problems of low flexibility and low efficiency of the interface access control method in the related art.
[0006] According to one aspect of an embodiment of the present application, an interface access control method is provided, including: obtaining control operation information performed on an interface market, wherein the interface market includes an interface application and a client, and the control operation information is used to record information obtained after controlling the client to subscribe to the interface application; mapping the interface application to an application service in an interface gateway, mapping the client to a user in the interface gateway, and mapping the control operation information to a routing configuration in the interface gateway; in response to an interface access request corresponding to the client, authenticating the interface access request using the application service and the user to obtain an authentication result; and routing and forwarding the interface access request to a backend interface corresponding to the interface application according to the authentication result and the routing configuration, wherein the backend interface is used to return an interface access response corresponding to the interface access request.
[0007] Optionally, mapping the interface application to the application service in the interface gateway includes: mapping the actual call address of the interface application to the service interface address corresponding to the application service; and adding a key authentication plug-in and a request conversion plug-in to the application service based on the interface authentication key of the interface application.
[0008] Optionally, mapping the client to a user in the interface gateway includes: creating a user in the interface gateway based on the client; adding an access group with the same name for the user; and adding an interface key for the user in response to a key addition event corresponding to the client.
[0009] Optionally, the routing configuration includes an access control list in the access control plug-in, and the access control records in the access control list are used to define a routing policy between the client and the application service; and the access rule attributes in the access control list are associated with the access group with the same name.
[0010] Optionally, the interface gateway is a Kong gateway, and the Kong gateway is deployed in a containerized manner; the Kong gateway is associated with an object-relational database and a graphical management interface tool, the object-relational database is used to store the configuration information of the Kong gateway, and the graphical management interface tool is used to graphically display the configuration information; the routing management function of the Kong gateway is used to configure the routes of multiple management interfaces, and the multiple management interfaces include a basic authentication mechanism.
[0011] Optionally, the interface access control method also includes: encapsulating multiple management interfaces of the Kong gateway into a bottom layer, a middle layer and an upper layer, wherein the bottom layer is used to define the request object and response object of the bottom layer management interface, and the bottom layer management interface includes: service management interface, routing management interface, user management interface, plug-in management interface, key authentication management interface and access control management interface; the middle layer is used to define the Kong interface that calls the bottom layer management interface; the upper layer is used to convert the domain object of the interface market into a request object, parse the response result returned by the Kong interface, obtain the parsing result, and save the parsing result to the domain object.
[0012] Optionally, the domain objects of the interface market include aggregate roots and entities corresponding to multiple qualified contexts, and the multiple qualified contexts include: application context, client context, subscription context, application classification context and user context; the domain layer of the interface market includes: domain objects, entity relationships corresponding to entities and entity base classes.
[0013] Optionally, the interface market also includes an application layer, which includes an interface application and multiple entity management classes corresponding to multiple entities in the domain object, each entity management class defines multiple state transfer operations; mapping the control operation information to the routing configuration in the interface gateway includes: determining the target aggregate root and target entity from the domain object according to the control operation information, and determining the target entity management class from multiple entity management classes; calling the target aggregate root and target entity management class to perform state transfer processing on the target entity, and updating the current status of multiple entities; calling the target aggregate root, target entity management class and Kong interface to generate the routing configuration in the interface gateway.
[0014] Optionally, the interface access control method also includes: performing consistency detection on the current state and the routing configuration to obtain a detection result; in response to the detection result being that the current state is inconsistent with the entity state corresponding to the routing configuration, re-calling the target aggregate root, target entity management class and Kong interface according to a pre-defined retry operation, and updating the routing configuration.
[0015] Optionally, the interface market includes a standard authorization protocol authentication mechanism; mapping the control operation information to the routing configuration in the interface gateway includes: using the standard authorization protocol authentication mechanism to authenticate the control operation information and determine the scope of authority control; based on the scope of authority control, partially or fully mapping the access actions corresponding to the control operation information to obtain the routing configuration.
[0016] According to another aspect of an embodiment of the present application, an interface access control system is also provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any one of the above-mentioned interface access control methods.
[0017] In an embodiment of the present application, control operation information executed on the interface market is obtained, wherein the interface market includes an interface application and a client, and the control operation information is used to record the information obtained after the interface application is subscribed by the control client; the interface application is mapped to the application service in the interface gateway, the client is mapped to the user in the interface gateway, and the control operation information is mapped to the routing configuration in the interface gateway; in response to the interface access request corresponding to the client, the interface access request is authenticated by the application service and the user to obtain the authentication result; according to the authentication result and the routing configuration, the interface access request is routed and forwarded to the back-end interface corresponding to the interface application, wherein the back-end interface is used to return the interface access response corresponding to the interface access request. Thus, the present application achieves the purpose of mapping the control operation information executed on the interface market to the interface gateway and authenticating the interface access request, managing the interface application more flexibly, and performing access control on the interface more efficiently, thereby achieving the technical effect of improving the flexibility and efficiency of the interface access control method, and thus solving the technical problems of low flexibility and low efficiency of the interface access control method in the related art. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0019] Figure 1 It is a hardware structure block diagram of a terminal device optionally used for an interface access control method according to an embodiment of the present application;
[0020] Figure 2 is a flow chart of an interface access control method according to an embodiment of the present application;
[0021] Figure 3 is a schematic diagram of an optional mapping relationship between an interface market and an interface gateway according to an embodiment of the present application;
[0022] Figure 4 is a schematic diagram of an optional limited context relationship according to an embodiment of the present application;
[0023] Figure 5 is a schematic diagram of an optional entity state transfer according to an embodiment of the present application;
[0024] Figure 6 This is an architectural diagram of an optional interface access control system according to an embodiment of the present application. DETAILED DESCRIPTION
[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0027] According to an embodiment of the present application, an embodiment of an interface access control method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0028] Figure 1is a hardware structure block diagram of a terminal device for an optional interface access control method according to an embodiment of the present application, such as Figure 1 As shown, the terminal device may include one or more processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor (Microcontroller Unit, referred to as MCU) or a programmable logic device (Field Programmable Gate Array, referred to as FPGA)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display device 110, an input / output device 108 (i.e., an I / O device), a Universal Serial Bus (USB) port (which may be included as one of the ports of a computer bus, not shown in the figure), a network interface (not shown in the figure), a power supply (not shown in the figure) and / or a camera (not shown in the figure). It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.
[0029] It should be noted that the one or more processors 102 and / or other data processing circuits may be embodied in whole or in part as software, hardware, firmware or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be fully or partially integrated into any of the other components in the terminal device (or mobile device).
[0030] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the interface access control method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned interface access control method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0031] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the terminal device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.
[0032] Under the above operating environment, the embodiment of the present application provides the following Figure 2 The interface access control method shown, Figure 2 is a flow chart of an interface access control method according to an embodiment of the present application, such as Figure 2 As shown, the method includes the following implementation steps S201 to S204.
[0033] Step S201, obtaining control operation information executed on the interface market, wherein the interface market includes an interface application and a client, and the control operation information is used to record information obtained by controlling the client to subscribe to the interface application.
[0034] The interface market can be a platform for managing interface resources. The interface market can be used to manage interface applications, provide interface applications, access interface applications, and subscribe to interface applications. Interface providers can use the interface market to manage and provide interface applications; interface users can use the interface market to subscribe to and access interface applications; in the process of interface users subscribing to interface applications, the interface market can generate corresponding interface usage addresses and interface access keys.
[0035] The above-mentioned interface application may be a software application in the form of an application program interface, which may be the basic unit for providing an interface in the interface market, which may be used to provide a specific function or service, and which may include interface service address information, interface service authentication information, and instructions for using the interface application, etc. The interface provider needs to provide an interface in the interface market with the interface application as the basic unit.
[0036] The client can be a device connected to the interface market, and the client can be used to subscribe to one or more interface applications. The interface user needs to subscribe to the interface application in the interface market based on the client as the basic unit.
[0037] The above control operation information may include operation type, operation time, operation result, the client corresponding to the execution of the control operation, etc.
[0038] The specific implementation method of obtaining the control operation information may be: using the monitoring tool in the interface market to monitor the interface application, and recording the information obtained after the control client subscribes to the interface application to obtain the control operation information. The above monitoring tool may be a log analysis tool, such as ELK Stack, Grafana, Prometheus, etc.
[0039] It is easy to understand that in the embodiment of the present application, by obtaining the control operation information executed on the interface market, the subscription status of the client to the interface application can be monitored in real time, the control operation information can be processed in a timely manner, and the efficiency of the interface access control method is improved.
[0040] Step S202, mapping the interface application to the application service in the interface gateway, mapping the client to the user in the interface gateway, and mapping the control operation information to the routing configuration in the interface gateway.
[0041] The above application service may include a service interface address, the application service may also include one or more application plug-ins, and the application service may be associated with one or more routing configurations. By utilizing the above application service, the backend server can be associated with the interface application.
[0042] The above-mentioned user may represent a user who uses the interface application, and the user may be used to manage the interface gateway and authenticate access requests to the interface gateway.
[0043] The above-mentioned routing configuration can be used to define access rules. The above-mentioned access rules can include the access path and access operation mode of the interface application, and the access rules can be used to instruct the back-end server to perform operations. The above-mentioned access path can be generated based on the subscription events of the interface application, and each subscription event generates an access path. The above-mentioned subscription event can be used to associate the client with the interface application. Through the routing configuration, the control operation information can be associated with the back-end server.
[0044] The specific implementation method of mapping the interface market and the control operation information performed on the interface market to the interface gateway respectively can be: mapping the interface application to the application service in the interface gateway according to the first mapping rule, mapping the client to the user in the interface gateway according to the second mapping rule, and mapping the control operation information to the routing configuration in the interface gateway according to the third mapping rule.
[0045] It is easy to understand that in the embodiment of the present application, the interface market and the control operation information performed on the interface market are respectively mapped to the interface gateway. This not only allows the operations of the interface market to be mapped to the interface gateway, reducing the difficulty of user access to the interface, but also allows the flexible configuration of the interface gateway to uniformly manage and control interface application access, thereby improving the security and flexibility of the interface access control method.
[0046] Step S203, in response to the interface access request corresponding to the client, the interface access request is authenticated by using the application service and the user to obtain an authentication result.
[0047] The above interface access request can be used to access the backend server corresponding to the interface application, and the interface access request can be triggered by the client executing the request operation. The interface gateway can receive the interface access request from the client, forward the interface access request to the corresponding backend server, and return the processing result to the client.
[0048] The specific implementation method of authenticating the interface access request based on the application service and the user and obtaining the authentication result may be: after receiving the access request to the interface gateway sent by the client, using the user to authenticate the interface access request, determine whether the client sending the interface access request belongs to the client corresponding to the user, and obtain a first authentication result; using the application service of the interface gateway, authenticate and process the access request to obtain a second authentication result; and obtain an authentication result based on the first authentication result and the second authentication result.
[0049] It is easy to understand that in the embodiment of the present application, the interface access request is authenticated by the application service and the user, which can ensure the security of the interface access request, improve the reliability of the interface access control system, and improve the security of the interface access control method.
[0050] Step S204: according to the authentication result and the routing configuration, the interface access request is routed and forwarded to the backend interface corresponding to the interface application, wherein the backend interface is used to return an interface access response corresponding to the interface access request.
[0051] The backend interface may be an interface connected to a backend server, and the backend interface may be accessed through routing configuration.
[0052] The specific implementation method of routing the interface access request to the back-end interface corresponding to the interface application according to the authentication result and routing configuration can be: based on the authentication result, determine whether the authentication result is safe. If the authentication result is safe, use the routing configuration to forward the interface access request to the back-end interface corresponding to the interface application. The back-end interface processes the back-end server according to the interface access request and returns the processing result to the client.
[0053] It is easy to understand that in the embodiment of the present application, by routing the interface access request to the back-end interface corresponding to the interface application according to the authentication result and routing configuration, the access process of the back-end interface can be simplified, the operational difficulty of users accessing the back-end interface can be reduced, and the efficiency of the interface access control method can be improved.
[0054] Through the above steps S201 to S204, in the embodiment of the present application, by mapping the operations of the interface market to the interface gateway, and using the interface gateway to authenticate and route the interface access requests, it is not only possible to simplify the access process of the back-end interface, reduce the difficulty of users accessing the back-end interface, and improve the efficiency of the interface access control method, but also to achieve unified management and control of interface access requests, thereby enhancing the security of the interface access control method.
[0055] Optionally, in the above step S202, mapping the interface application to the application service in the interface gateway may also include the following execution steps:
[0056] Step S221, mapping the actual calling address of the interface application to the service interface address corresponding to the application service;
[0057] Step S222: Based on the interface authentication key of the interface application, a key authentication plug-in and a request conversion plug-in are added to the application service.
[0058] The above-mentioned actual calling address can be the address used to call the interface application in the client. The above-mentioned service interface address can be the address of the interface application to access the back-end server. The above-mentioned interface authentication key can be an encrypted string for verifying identity, and the interface authentication key can be used to verify the identity of the interface access request. The above-mentioned key authentication plug-in can be a plug-in of an identity authentication mechanism, and the key authentication plug-in can be used to determine whether the interface access request passes the identity authentication. The above-mentioned request conversion plug-in can be used to modify or add header information of the interface access request.
[0059] In an exemplary application scenario, Figure 3 is a schematic diagram of an optional mapping relationship between an interface market and an interface gateway according to an embodiment of the present application, such as Figure 3 As shown, the above-mentioned interface gateway can be an open source application programming interface (Application Programming Interface, referred to as API) gateway, for example, Kong API Gateway, referred to as Kong gateway, the above-mentioned key authentication plug-in can be key-auth, and the above-mentioned request conversion plug-in can be request-transformer.
[0060] Specifically, the interface application in the interface market is mapped to the application service (i.e., Service) in the Kong gateway, and the actual calling address of the interface application is mapped to the service interface address corresponding to the application service. Since the interface application contains an interface authentication key for verifying the identity of the interface access request, in order to map the interface authentication key to the Service in the Kong gateway, it is necessary to add a plug-in to the Service. Therefore, based on the interface authentication key of the interface application, the plug-in key authentication plug-in (i.e., key-auth) and request conversion plug-in (i.e., request-transformer) that need to be added are determined and added to the application service.
[0061] Through the above-mentioned steps S221 to S222, in an embodiment of the present application, the actual calling address of the interface application is mapped to the service interface address corresponding to the application service, which can simplify the interface access control process and improve the flexibility of interface management; by adding a key authentication plug-in and a request conversion plug-in to the application service, the interface application can be more comprehensively mapped to the application service in the interface gateway, thereby improving the efficiency of the interface access control method while ensuring the security and reliability of the interface control method.
[0062] Optionally, in the above step S202, mapping the client to a user in the interface gateway may also include the following execution steps:
[0063] Step S223, based on the client, create a user in the interface gateway;
[0064] Step S224, adding an access group with the same name for the user;
[0065] Step S225, in response to the key adding event corresponding to the client, adding an interface key for the user.
[0066] The above-mentioned same-name access group can be a combination of interface applications subscribed by the client, and the same-name access group can be used to represent multiple backend interfaces that users in the interface gateway are allowed to access. By using the same-name access group, the interface applications subscribed by the client can be flexibly managed.
[0067] The key adding event can be triggered by the operation of adding a key in the client. The interface key can be generated based on the key in the client.
[0068] In an exemplary application scenario, Figure 3As shown, in the above application scenario, the above interface key can be an API Key, and a key-auth plug-in is added to the application service. Based on the client, a user (denoted as Consumer) is created in the interface gateway, and the client is mapped to the user; further, in order to more conveniently manage the interface application subscribed by the client, an access group with the same name is added to the user (denoted as group); when the operation of adding a key is executed in the client, a key addition event is triggered, and in response to the key addition event corresponding to the client, an API Key is added to the user in the interface gateway.
[0069] Through the above steps S223 to S225, in the embodiment of the present application, by utilizing the access group with the same name, the interface application subscribed by the client can be managed more conveniently, and by adding interface keys for users, a secure interface access environment can be provided, thereby enhancing the flexibility and security of the interface access control method.
[0070] Optionally, in the above interface access control method, the routing configuration includes an access control list in the access control plug-in, the access control records in the access control list are used to define the routing policy between the client and the application service; the access rule attributes in the access control list are associated with the access group with the same name.
[0071] The access control plug-in can be used to restrict the client's access to the application service. The access control list can be used to store multiple clients that are allowed to access the application service. The routing policy can be used to associate the client with the application service. The interface access request corresponding to the client can access the application service of the interface gateway by utilizing the routing policy. The access rule attribute can be used to determine whether there is an interface application corresponding to the application service in the access group with the same name.
[0072] In an exemplary application scenario, Figure 3 As shown, in the above application scenario, the above routing configuration includes an access control plug-in (i.e., an acl plug-in), and the access control list in the access control plug-in may include an access rule attribute (e.g., an allow attribute). According to the client's subscription operation to the interface application, the allow attribute in the access control list is added to the access group with the same name and an access control record is generated. The access control record can associate the client with the application service, determine the access path for the client to access the application service, and store the access path in the access control list. When the client issues an interface access request to the application service, the access path corresponding to the client is searched in the access control list by a path matching method to determine whether the access path corresponding to the client exists in the access control list. If the access path corresponding to the client exists in the access control list, it is determined that the client can access the application service.
[0073] Through the above-mentioned interface access control method, the embodiment of the present application utilizes an access control list to ensure that only clients that subscribe to the interface application can access the corresponding application service, thereby achieving accurate routing and secure access control of client requests and improving the security of the interface access control method.
[0074] Optionally, in the above-mentioned interface access control method, the interface gateway is a Kong gateway, and the Kong gateway is deployed in a containerized manner; the Kong gateway is associated with an object-relational database and a graphical management interface tool, the object-relational database is used to store the configuration information of the Kong gateway, and the graphical management interface tool is used to graphically display the configuration information; the routing management function of the Kong gateway is used to configure the routes of multiple management interfaces, and the multiple management interfaces include a basic authentication mechanism.
[0075] The above-mentioned containerized deployment method can be used to package software applications and their dependencies into lightweight, portable container units, and deploy them in a container operating environment. The above-mentioned object-relational database can be a database for storing and managing data structures. The above-mentioned configuration information may include but is not limited to plug-in configuration information, gateway management configuration information, and database configuration information. The above-mentioned plug-in configuration information can be used to determine the plug-ins that need to be added to the Kong gateway. The above-mentioned database configuration information can be used to determine the database type, the connection parameters of the database, and the connection method of the database. The above-mentioned basic authentication mechanism can be a security verification mechanism for the management interface, and the basic authentication mechanism can be used to verify the security of the routing of the Kong gateway configuration management interface. The above-mentioned routing management function can be implemented using the interface access framework.
[0076] In an exemplary application scenario, the Kong gateway is implemented using Spring Boot 3.3.0, the object-relational database is a PostgreSQL database, the basic authentication mechanism is Basic Authentication, and the routing management function is implemented using the interface access framework OpenFeign. A containerized environment for the Kong gateway is constructed, and the containerized deployment method is selected to deploy the Kong gateway in the containerized environment to achieve the effect of rapid deployment; the object-relational database is integrated in the containerized environment, and the configuration information of the Kong gateway is stored using the PostgreSQL database to achieve the effect of flexibly adjusting the configuration information of the Kong gateway according to the actual situation; further, the graphical management interface tool is integrated in the containerized environment, and the configuration information is displayed in a graphical form using the graphical management interface tool to provide a graphical interface for the Kong gateway configuration information, which is convenient for monitoring and managing the configuration status and operation status of Kong; further, in order to improve the security of the routing of the Kong gateway configuration management interface, BasicAuthentication is added to multiple management interfaces to ensure that the routing management function of the Kong gateway can only be used to configure the routing of multiple management interfaces if the basic authentication mechanism is passed.
[0077] Through the above-mentioned interface access control method, in the embodiment of the present application, a containerized deployment method is adopted, which can quickly deploy the Kong gateway, improve the efficiency of the interface access control method, and use the object-relational database to store the configuration information of the Kong gateway, so that the configuration information of the Kong gateway can be adjusted more flexibly and conveniently, thereby more flexibly configuring multiple management interfaces; in addition, in the embodiment of the present application, by adding a basic authentication mechanism in the management interface, the security of the routing of the Kong gateway configuration management interface is ensured, thereby improving the security of the interface access control method.
[0078] Optionally, the above interface access control method may further include the following execution steps:
[0079] Step S205, encapsulates multiple management interfaces of the Kong gateway into a bottom layer, a middle layer and an upper layer, wherein the bottom layer is used to define the request object and response object of the bottom layer management interface, and the bottom layer management interface includes: service management interface, routing management interface, user management interface, plug-in management interface, key authentication management interface and access control management interface; the middle layer is used to define the Kong interface that calls the bottom layer management interface; the upper layer is used to convert the domain object of the interface market into a request object, parse the response result returned by the Kong interface, obtain the parsing result, and save the parsing result to the domain object.
[0080] The above-mentioned service management interface can be used to create, update and delete application services of the gateway interface. The above-mentioned routing management interface can be used to configure routing policies in Kong. The above-mentioned user management interface can be used to create, update and delete users of the gateway interface. The above-mentioned plug-in management interface can be used to manage plug-ins in the Kong gateway, for example, to configure the installation parameters of the plug-in. By utilizing the plug-in management interface, plug-ins can be associated with functional modules in the Kong gateway. The above-mentioned key authentication management interface can be used to manage keys in the Kong gateway, and the key authentication management interface can also be used to associate keys with functional modules in the Kong gateway. The above-mentioned access control management interface can be used to determine the application services that users of the gateway interface are allowed to access. The above-mentioned domain object can be an object directly associated with a business function, and the domain object can be used to encapsulate the concepts, rules and logic of the business domain.
[0081] In an exemplary application scenario, multiple management interfaces of the Kong gateway are encapsulated into the bottom layer, the middle layer and the upper layer to synchronize the control operation information executed in the interface market to the Kong gateway, wherein the service management interface, the routing management interface, the user management interface, the plug-in management interface, the key authentication management interface and the access control management interface are encapsulated as the bottom layer, and based on the interface access framework OpenFeign, the request object and response object of each management interface in the bottom layer are defined; the Kong interface that calls the bottom management interface is encapsulated as the middle layer, and the reentrancy of the Kong interface is defined to ensure that the Kong interface can execute code safely; the conversion and parsing management interface is encapsulated as the upper layer, and the conversion and parsing management interface can be used to convert the domain objects of the interface market into request objects, parse the response results returned by the Kong interface, obtain the parsing results, and save the parsing results to the domain objects.
[0082] Still in the above application scenario, the Kong interface of the middle layer is used to call the service management interface to create service A. If an exception is caught in calling the service management interface, it is determined whether service A exists in the Kong gateway. Further, if service A exists in the Kong gateway, the Kong interface of the middle layer is used to call the service management interface to update service A, ensuring that the Kong interface can successfully execute the code.
[0083] Still in the above application scenario, the conversion and parsing management interface is used to obtain the information in the domain object of the interface market (such as the service name of the domain object, the back-end interface address corresponding to the domain object, etc.), convert the information in the domain object, and assemble it into a request object ServiceRequest, and determine whether there is a service B corresponding to the request object ServiceRequest in the Kong gateway. If service B does not exist in the Kong gateway, then based on ServiceRequest, the service management interface is called using the Kong interface to create service B, and the response result ServieResponse is returned to the conversion and parsing management interface; if service B exists in the Kong gateway, then based on ServiceRequest, the service management interface is called using the Kong interface to update service B, and the response result ServieResponse is returned to the conversion and parsing management interface; the response result ServieResponse is parsed using the conversion and parsing management interface to obtain the parsing result (such as the identity information of service B), and the parsing result is saved to the corresponding attribute of the domain object.
[0084] Through the above-mentioned step S205, in the embodiment of the present application, the Kong gateway can be structured and the control logic of the interface market can be separated from the configuration logic of the Kong gateway, which can not only simplify the Kong gateway, but also flexibly maintain and expand the modules of the Kong gateway, thereby improving the flexibility of the interface access control method.
[0085] Optionally, in the above-mentioned interface access control method, the domain objects of the interface market include aggregate roots and entities corresponding to multiple qualified contexts, and the multiple qualified contexts include: application context, client context, subscription context, application classification context and user context; the domain layer of the interface market includes: domain objects, entity relationships corresponding to entities and entity base classes.
[0086] The above-mentioned limited context can be used to define the scope of application and restrictions of the object, and the limited context may include the attributes of the object and the restrictions corresponding to the object. The above-mentioned aggregate root may be a collection of a group of related entities in the domain-driven design, and the aggregate root may be used to manage and maintain the entities in a collection. The above-mentioned entity may be an object with a unique identifier in the domain-driven design that may change during its life cycle, such as a client, an interface application, etc. The above-mentioned entity relationship may be defined using a development tool, and the entity relationship may be used to determine the association relationship between entities in the domain layer, such as a one-to-one association relationship, a one-to-many association relationship, a many-to-one association relationship, etc. Exemplarily, the above-mentioned entity relationship may be an entity relationship between an interface application and a client, and an interface application may establish an association relationship with multiple clients, and a client may also establish an association relationship with multiple interface applications. The above-mentioned entity base class may be used to determine the common attributes and operation methods of the entity, such as the entity state, the inheritance method of the entity state, and the inheritance method of the entity version. By using the entity base class, entities can share common attributes and methods to avoid repeated use of duplicate code.
[0087] In an exemplary application scenario, a domain layer of an interface market is constructed, which includes domain objects, entity relationships corresponding to entities, and entity base classes. The domain objects include aggregate roots and entities corresponding to five limited contexts. Specifically, the domain objects include application context application aggregate root (denoted as APP), client context aggregate root (denoted as AppClient), client context user entity (denoted as ClientUser), client context key entity (denoted as ClientKey), subscription context aggregate root (denoted as AppSubscribe), application category context aggregate root (denoted as Category), user context entity (denoted as AppUser), and user context aggregate root (denoted as User); by using development tools (such as Spring Data JPA), the entity relationships corresponding to entities in the domain layer and entity base classes (such as StatusEntity entity base class) are defined to implement entities / aggregate roots (such as App, AppClient, ClientKey, AppSubscribe) that need to maintain status, and the status of the entity can be inherited from the entity base class.
[0088] In another exemplary application scenario, Figure 4 is a schematic diagram of an optional limited context relationship according to an embodiment of the present application, such as Figure 4As shown, the multiple limited contexts include: application context, client context, subscription context, application classification context and user context, wherein the branches of the subscription context include application context and client context, the branches of the application context include application classification context and user context, and the branches of the client context include user context.
[0089] Through the above-mentioned interface access control method, in the embodiment of the present application, the architecture based on domain-driven design can manage the interface market more clearly and effectively, making the interface market easier to maintain and expand; by utilizing aggregate roots and entities, the business logic corresponding to the interface application is encapsulated to improve the maintainability of the interface market, and the entity base class is utilized to uniformly manage entities with common attributes and behaviors.
[0090] Optionally, the interface market further includes an application layer, the application layer includes an interface application and multiple entity management classes corresponding to multiple entities in the domain object, each entity management class defines multiple state transfer operations; in the above step S202, mapping the control operation information to the routing configuration in the interface gateway may also include the following execution steps:
[0091] Step S226, determining a target aggregate root and a target entity from the domain object according to the control operation information, and determining a target entity management class from a plurality of entity management classes;
[0092] Step S227, calling the target aggregate root and the target entity management class to perform state transfer processing on the target entity, and updating the current states of multiple entities;
[0093] Step S228, call the target aggregate root, target entity management class and Kong interface to generate the routing configuration in the interface gateway.
[0094] The above entity management class can be used to manage entities in the interface market domain layer.
[0095] The above-mentioned state transfer operation may be used to change the state of an entity, and the state transfer operation may include but is not limited to: a create operation, an update operation, an activate operation, a deactivate operation, a remove operation, and a delete operation.
[0096] Specifically, according to the control operation information of the interface market, the application layer determines the target aggregate root and the target entity from the domain object, and determines the target entity management class from multiple entity management classes according to the target entity; further, the target aggregate root and the target entity management class are called to perform state transfer operations on the target entity, and the current states of multiple entities in the domain object are updated. For example, the control operation information is activation control operation information, and the target aggregate root and the target entity management class are called to perform activation operations on the target entity, and the target entity is updated from the created state to the activated state; further, the Kong interface is called to generate a routing configuration in the interface gateway according to the called target aggregate root and target entity management class.
[0097] Through the above steps S226 to S228, in the embodiment of the present application, by constructing the application layer of the interface market, not only can the control operation information be mapped to the routing configuration in the interface gateway, but also the entity status in the domain object can be automatically updated in time according to the control operation information of the interface market, thereby simplifying the process of the interface access control method and improving the efficiency of the interface access control method.
[0098] Optionally, the above interface access control method may further include the following execution steps:
[0099] Step S206, performing consistency check on the current state and the routing configuration to obtain a test result;
[0100] Step S207, in response to the detection result that the current state is inconsistent with the entity state corresponding to the routing configuration, re-call the target aggregate root, target entity management class and Kong interface according to a pre-defined retry operation to update the routing configuration.
[0101] In an exemplary application scenario, Figure 5 is a schematic diagram of an optional entity state transfer according to an embodiment of the present application, such as Figure 5 As shown, the above-mentioned interface gateway is a Kong gateway, and the current status of the above-mentioned multiple entities may include: created (CREATED), updated (UPDATED), activated (ENABLED), disabled (DISABLED), and removed (REMOVED).
[0102] Specifically, an application layer of the interface market is constructed, which includes multiple entity management classes (such as AppManager, ClientManager, ClientKeyManager, and SubscribeManager) corresponding to multiple entities in the interface application and domain objects, and multiple state transfer operations (such as create operations, update operations, activate operations, deactivate operations, remove operations, and delete operations) are defined in each entity management class. Retry operations are predefined in the application layer.
[0103] Furthermore, based on the control operation information executed on the interface market, the target aggregate root and target entity management class are called to perform state transfer processing on the target entity, and the configuration information of the Kong gateway stored in the object-relational database in the containerized environment is modified to ensure that the current state of the entity in the domain object is consistent with the state of the routing configuration in the Kong gateway.
[0104] Still taking the above application scenario as an example, the above control operation is to activate the application operation. According to the activation application operation information, the target aggregate root, target entity and target entity management class are determined, the target aggregate root and target entity management class are called, the target entity is transferred to a state, the information of the activation target entity process is created and stored in the object-relational database, the Kong interface is called, and the routing configuration in the activated Kong gateway is synchronously created based on the information in the object-relational database. If the activation routing configuration in the Kong gateway is successfully created, the status of the routing configuration in the Kong gateway is transferred to activated; if the activation routing configuration in the Kong gateway is not successfully created, the target aggregate root, target entity management class and Kong interface are re-called according to the pre-defined retry operation, the routing configuration in the activated Kong gateway is created again, and the routing configuration is updated. Similarly, the state transfer process of the creation operation, update operation, deactivation operation and removal operation can be determined.
[0105] Through the above steps S206 to S207, in the embodiment of the present application, by performing consistency detection on the current state of the entity in the domain object and the routing configuration, it is possible to ensure the consistency of the current state of the entity and the state of the routing configuration in the gateway interface, thereby improving the reliability of the interface access control method. By utilizing the retry operation, when the current state is inconsistent with the entity state corresponding to the routing configuration, the routing configuration can be updated in a timely manner, thereby ensuring the consistency of the current state of the entity in the domain object and the state of the routing configuration.
[0106] Optionally, the interface market includes a standard authorization protocol authentication mechanism; in the above step S202, mapping the control operation information to the routing configuration in the interface gateway may also include the following execution steps:
[0107] Step S2291, using the standard authorization protocol authentication mechanism, perform identity authentication on the control operation information to determine the scope of authority control;
[0108] Step S2292, according to the authority control scope, partially or completely map the access actions corresponding to the control operation information to obtain the routing configuration.
[0109] The above permission control scope can be used to determine the corresponding control operations that are allowed to be executed according to the identity type. The above identity types can include application owners, application administrators, application developers, and global administrators. The above application owners can perform control operations of viewing interface applications, modifying interface applications, and deleting interface applications, the above application administrators can perform control operations of viewing interface applications and modifying interface applications, the above application developers can perform control operations of viewing interface applications, and the above global administrators can perform all control operations.
[0110] In an exemplary application scenario, a standard authorization protocol authentication mechanism (such as OAuth2 authentication) for the interface market is built based on Spring Security in Spring, and OAuth2 authentication is used to authenticate the control operation information. The identity corresponding to the control operation information authenticated by OAuth2 is classified to obtain the identity type, and the permission management scope is determined according to the identity type. It is determined whether the control operation information belongs to the permission management scope. If the control operation information belongs to the permission management scope, the access action corresponding to the control operation information is partially or fully mapped to obtain the routing configuration.
[0111] It should be noted that, still taking the above application scenario as an example, based on the PreAuthorize annotation in Spring Security, a custom authorization class CustomAuthorization is designed, and the identity type judgment method for executing control operations on the application (such as hasAppRole) and the identity type judgment method for executing control operations on the client (such as hasClientRole) are encapsulated in the custom authorization class CustomAuthorization. In the process of authenticating the control operation information, the custom authorization class CustomAuthorization is called to determine the scope of authority control.
[0112] Through the above steps S2291 to S2292, in the embodiment of the present application, through standardized authorization protocols, refined permission control and dynamic routing configuration mapping, not only the security of the interface market is enhanced, but also the flexibility of interface access control management and the efficiency of interface access control are improved.
[0113] According to another aspect of an embodiment of the present application, an interface access control system is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any one of the aforementioned interface access control methods.
[0114] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program: obtaining control operation information performed on an interface market, wherein the interface market includes an interface application and a client, and the control operation information is used to record information obtained by controlling the client to subscribe to the interface application; mapping the interface application to an application service in an interface gateway, mapping the client to a user in the interface gateway, and mapping the control operation information to a routing configuration in the interface gateway; in response to an interface access request corresponding to the client, authenticating the interface access request using the application service and the user to obtain an authentication result; and routing and forwarding the interface access request to a backend interface corresponding to the interface application based on the authentication result and the routing configuration, wherein the backend interface is used to return an interface access response corresponding to the interface access request.
[0115] In an exemplary application scenario, Figure 6 is an architecture diagram of an optional interface access control system according to an embodiment of the present application, such as Figure 6 As shown, the interface market is user-oriented and includes clients and interface applications. Users perform control operations on the interface market by using the clients to subscribe to the interface applications in the interface market. Furthermore, the interface application is synchronously mapped to the application service (i.e., Service) in the interface gateway (i.e., Kong gateway), the client is synchronously mapped to the user (i.e., Consumer) in the interface gateway, and the control operation information is synchronously mapped to the routing configuration (i.e., Route) in the interface gateway. Users perform control operations on the interface applications in the interface market, generate interface access requests, call the Route in the Kong gateway, determine the Service corresponding to the interface access request, and route and forward the interface access request to the backend server corresponding to the Service.
[0116] It should be noted that, still in the above application scenarios, the Kong gateway includes multiple plug-ins, such as traffic monitoring plug-in, current limiting plug-in, and user restriction plug-in.
[0117] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiment and its optional implementation manners, which will not be described in detail here.
[0118] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0119] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.
[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.
[0121] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
[0122] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0123] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words contribute to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), mobile hard disk, disk or optical disk and other media that can store program codes.
[0124] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. An interface access control method, characterized in that: include: Acquire control operation information executed on the interface market, wherein the interface market includes an interface application and a client, and the control operation information is used to record information obtained by controlling the client to subscribe to the interface application; Mapping the interface application to an application service in an interface gateway, mapping the client to a user in the interface gateway, and mapping the control operation information to a routing configuration in the interface gateway; In response to the interface access request corresponding to the client, the interface access request is authenticated by using the application service and the user to obtain an authentication result; According to the authentication result and the routing configuration, the interface access request is routed and forwarded to a backend interface corresponding to the interface application, wherein the backend interface is used to return an interface access response corresponding to the interface access request.
2. The interface access control method according to claim 1, characterized in that: Mapping the interface application to the application service in the interface gateway includes: Mapping the actual calling address of the interface application to the service interface address corresponding to the application service; Based on the interface authentication key of the interface application, a key authentication plug-in and a request conversion plug-in are added to the application service.
3. The interface access control method according to claim 1, characterized in that: Mapping the client to the user in the interface gateway includes: Based on the client, creating the user in the interface gateway; Add an access group with the same name for the user; In response to the key adding event corresponding to the client, an interface key is added for the user.
4. The interface access control method according to claim 3, characterized in that: The routing configuration includes an access control list in an access control plug-in, wherein the access control records in the access control list are used to define a routing policy between the client and the application service; and the access rule attributes in the access control list are associated with the access group with the same name.
5. The interface access control method according to claim 1, characterized in that: The interface gateway is a Kong gateway, which is deployed in a containerized manner; the Kong gateway is associated with an object-relational database and a graphical management interface tool, the object-relational database is used to store the configuration information of the Kong gateway, and the graphical management interface tool is used to graphically display the configuration information; the routing management function of the Kong gateway is used to configure the routing of multiple management interfaces, and the multiple management interfaces include a basic authentication mechanism.
6. The interface access control method according to claim 5, characterized in that: The interface access control method further includes: encapsulating the multiple management interfaces of the Kong gateway into a bottom layer, a middle layer and an upper layer, wherein: The bottom layer is used to define the request object and response object of the bottom layer management interface, and the bottom layer management interface includes: service management interface, routing management interface, user management interface, plug-in management interface, key authentication management interface and access control management interface; The middle layer is used to define the Kong interface that calls the underlying management interface; The upper layer is used to convert the domain object of the interface market into the request object, parse the response result returned by the Kong interface, obtain the parsing result, and save the parsing result to the domain object.
7. The interface access control method according to claim 6, characterized in that: The domain objects of the interface market include aggregate roots and entities corresponding to multiple defined contexts, respectively, and the multiple defined contexts include: application context, client context, subscription context, application classification context and user context; The domain layer of the interface market includes: the domain objects, entity relationships corresponding to the entities, and entity base classes.
8. The interface access control method according to claim 6, characterized in that: The interface market also includes an application layer, which includes the interface application and multiple entity management classes corresponding to multiple entities in the domain object, each entity management class defines multiple state transfer operations; Mapping the control operation information to the routing configuration in the interface gateway includes: Determine a target aggregate root and a target entity from the domain object according to the control operation information, and determine a target entity management class from the multiple entity management classes; Call the target aggregate root and the target entity management class to perform state transfer processing on the target entity and update the current states of the multiple entities; Call the target aggregate root, the target entity management class and the Kong interface to generate the routing configuration in the interface gateway.
9. The interface access control method according to claim 8, characterized in that: The interface access control method also includes: Performing consistency detection on the current state and the routing configuration to obtain a detection result; In response to the detection result that the current state is inconsistent with the entity state corresponding to the routing configuration, the target aggregate root, the target entity management class and the Kong interface are re-called according to a predefined retry operation to update the routing configuration.
10. An interface access control system, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the interface access control method according to any one of claims 1 to 9.