Micro-service access control method and device, system, equipment, medium and product

Abstract

The invention discloses a micro-service access control method and device, a system, equipment, a medium and a product, and the method comprises the steps: receiving a micro-service access request sent by a requester, and enabling the micro-service access request to carry an authentication token; after verifying the authentication token, generating an effective authorization token corresponding to the micro-service access request based on the authentication token; sending the micro-service access request and the effective authorization token to a corresponding target micro-service; the first service is an internal service of the application and corresponds to a micro-service in the application. By adopting an access control method of external identity authentication and internal access authority authorization of the application, the security access control of the internal environment of the application is realized, and the authorization information and process are shielded for a requester; the access control granularity is refined into the access request level, when a security problem occurs in authorization of a single micro-service access request, other micro-service access requests are not affected, and the security of micro-service access control is improved.

Description

Technical Field

[0001] The present application relates to cloud native technology, and in particular to a microservice access control method and apparatus, system, equipment, medium and product. Background Art

[0002] With the development of cloud-native technology, microservice technology has emerged. Microservice technology divides the application into multiple independent and co-operating microservices, and achieves the effects of shortening the application development cycle, enhancing elastic scaling capabilities and simplifying maintenance based on a distributed deployment architecture. Although microservice technology has the above-mentioned technical advantages, it also brings new security issues. Applications developed based on microservice technology will increase the security exposure of the application. If a single microservice of an application is compromised, the attacker can move horizontally between microservices, thereby affecting the security of other microservices and increasing the security risk of the application.

[0003] In related technologies, the security of microservices is usually improved by setting a security boundary for authenticating and authorizing microservice access requests. For example, the current mainstream solutions for microservice access control include role-based access control (RBAC) and open authorization (OAuth2). RBAC performs access control management in a centralized manner, and implements access control to microservice resources by setting a "role" for the requester and granting it specific access rights; OAuth2 returns the access rights to the requester in the form of a token, and the requester accesses the corresponding microservice resources by using the token. Specifically, the security boundary is usually set at the application and external boundary or at the boundary of each microservice within the application.

[0004] However, if access control is performed by setting a security boundary between the application and the external boundary, there is a lack of security access control over the internal environment of the application; if access control is performed by setting a security boundary at the microservice boundary, each microservice needs to set up a corresponding authentication and authorization mechanism, which increases the difficulty of microservice deployment; in related technologies, due to the centralized processing of authentication and authorization, some scheme permissions will be exposed to the requester during the authentication and authorization process, there is a risk of unauthorized access, and the access control granularity is at the user level or role level. If unauthorized access occurs to a single microservice, the security risk will immediately affect other microservices. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a microservice access control method and apparatus, system, equipment, medium and product, aiming to improve the security of microservice access control.

[0006] The technical solution of the embodiment of the present application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a microservice access control method, which is applied to a first service, and the method includes:

[0008] Receive a microservice access request sent by a requester, wherein the microservice access request carries an authentication token;

[0009] After verifying the authentication token, a valid authorization token corresponding to the microservice access request is generated based on the authentication token;

[0010] Send the microservice access request and the valid authorization token to the corresponding target microservice;

[0011] The first service is an internal service of the application and corresponds to a microservice within the application.

[0012] In the above solution, generating a valid authorization token corresponding to the microservice access request based on the authentication token includes:

[0013] Based on the identity information of the requester carried by the authentication token, obtain the cached authorization token corresponding to the microservice access request;

[0014] Based on the validity period information carried by the cached authorization token, determining whether the cached authorization token is valid;

[0015] If it is determined that the cached authorization token is valid, the cached authorization token is used as a valid authorization token corresponding to the microservice access request;

[0016] If it is determined that the cached authorization token is expired, the cached authorization token is updated based on the current operating environment parameters of the target microservice, and the updated authorization token is used as a valid authorization token corresponding to the microservice access request.

[0017] In the above scheme, the method further includes:

[0018] Obtain the current operating environment parameters of the target microservice, where the operating environment parameters include one or more of the following: CPU occupancy, memory occupancy, I / O frequency, and request access frequency;

[0019] The updating of the cached authorization token based on the current operating environment parameters of the target microservice includes:

[0020] Calculate the permission increment information of the requester based on the current operating environment parameters of the target microservice and the weights corresponding to the operating environment parameters;

[0021] Based on the calculated incremental information of each permission and the permission information carried by the cached hand token, updating the cached authorization token;

[0022] The authority information at least includes validity period information.

[0023] In the above scheme, the step of obtaining the cached authorization token corresponding to the microservice access request based on the identity information of the requester carried by the authentication token includes:

[0024] Based on the identity information of the requester, determine whether to cache the authorization token corresponding to the microservice access request;

[0025] If it is determined that the corresponding authorization token is not cached, an authorization token request is sent to the second service, where the authorization token request carries at least the identity information of the requester and the target microservice information;

[0026] receiving and caching a corresponding authorization token sent by the second service;

[0027] The second service is an external service of the application.

[0028] In a second aspect, an embodiment of the present application provides a microservice access control method, which is applied to a second service, and the method includes:

[0029] Receiving an authentication request sent by a requesting party;

[0030] Based on the authentication request, after determining that the identity authentication of the requesting party is passed, generating an authentication token;

[0031] sending the authentication token to the requester;

[0032] The authentication token is used to request access to any microservice within the application; the second service is an external service of the application.

[0033] In the above solution, after determining that the identity authentication of the requesting party is passed, generating an authentication token includes:

[0034] After determining that the identity authentication of the requesting party is passed, querying a preset identity information mapping table based on the user ID of the requesting party carried in the authentication request;

[0035] Based on the queried identity information of the requesting party, an authentication token carrying the identity information is generated.

[0036] In the above solution, the method further includes:

[0037] Receive an authorization token request sent by the first service, where the authorization token request carries at least identity information of the requester and target microservice information;

[0038] Based on the identity information of the requester and the target microservice information, query the preset access permission table, determine the corresponding permission information, and generate an authorization token;

[0039] sending the authorization token to the first service;

[0040] Among them, the first service is an internal service of the application and corresponds to a microservice within the application; the authorization token carries at least the permission information.

[0041] In a third aspect, an embodiment of the present application provides a microservice access control device, which is applied to a first service, and the microservice access control device includes:

[0042] A first receiving module is used to receive a microservice access request sent by a requester, wherein the microservice access request carries an authentication token;

[0043] A first generating module is used to obtain a valid authorization token corresponding to the microservice access request based on the authentication token after verifying the authentication token;

[0044] A first sending module, used to send the microservice access request and the valid authorization token to the corresponding target microservice;

[0045] The first service is an internal service of the application and corresponds to a microservice within the application.

[0046] In a fourth aspect, an embodiment of the present application provides a microservice access control device, which is applied to a second service, and the microservice access control device includes:

[0047] A second receiving module, used to receive an authentication request sent by a requester;

[0048] A second generating module is used to generate an authentication token after determining that the identity authentication of the requesting party is passed based on the authentication request;

[0049] A second sending module, used for sending the authentication token to the requesting party;

[0050] The authentication token is used to request access to any microservice within the application; the second service is an external service of the application.

[0051] In a fifth aspect, an embodiment of the present application provides a microservice access control system, including a second service and at least one first service;

[0052] The first service is an internal service of the application and corresponds to a microservice within the application, and is used to execute the steps of the method described in the first aspect;

[0053] The second service is an external service of the application, used to execute the steps of the method described in the second aspect.

[0054] In a sixth aspect, an embodiment of the present application provides a network device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor, when running the computer program, executes the steps of the method described in the first aspect and the second aspect.

[0055] In a seventh aspect, an embodiment of the present application provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method described in the first aspect and the second aspect are implemented.

[0056] In an eighth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in the first and second aspects.

[0057] The microservice access control method provided in the embodiment of the present application is applied to the first service, and the method includes: receiving a microservice access request sent by the requester, the microservice access request carrying an authentication token; after verifying the authentication token, generating a valid authorization token corresponding to the microservice access request based on the authentication token; sending the microservice access request and the valid authorization token to the corresponding target microservice; wherein the first service is an internal service of the application and corresponds to a microservice inside the application. In this way, the embodiment of the present application splits the identity authentication and access right authorization functions, adopts the access control method of applying external identity authentication + internal access right authorization, realizes the secure access control of the internal environment of the application, and shields the authorization information and process from the requester, effectively preventing unauthorized access attacks; the access control granularity is refined to the access request level, and an authorization token is issued for a single microservice access request. When a security problem occurs in the authorization of a single microservice access request, it will not affect other microservice access requests, thereby improving the security of microservice access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a schematic diagram of the structure of the microservice access control system according to an embodiment of the present application;

[0059] Figure 2 A schematic diagram of a flow chart of a microservice access control method according to an embodiment of the present application;

[0060] Figure 3 This is a flowchart of a microservice access control method according to another embodiment of the present application;

[0061] Figure 4 This is a structural diagram of a microservice access control system in an application example of this application;

[0062] Figure 5 This is a flowchart of a microservice access method in an application example of this application;

[0063] Figure 6 This is a schematic diagram of the structure of a microservice access control device according to an embodiment of the present application;

[0064] Figure 7 This is a structural diagram of a microservice access control device according to another embodiment of the present application;

[0065] Figure 8 This is a schematic diagram of the structure of the network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0066] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0067] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0068] Before describing the microservice access control method provided in the embodiment of the present application, a microservice control system for executing the microservice control method is first described in detail.

[0069] The present application embodiment provides a microservice access control system, such as Figure 1 As shown, the system includes a second service 200 and at least one first service 100, the first service 100 is an internal service of the application and corresponds to a microservice inside the application, and the second service 200 is an external service of the application.

[0070] Here, the application is developed and deployed based on the microservice architecture, and one or more microservices are deployed inside the application; the first service 100 is deployed inside the application and corresponds one-to-one with the microservices inside the application, that is, the number of first services 100 deployed inside the application is the same as the number of microservices; the second service 200 is deployed outside the application.

[0071] It should be noted that both the first service 100 and the second service 200 are used for microservice access control, and microservice access control specifically includes requester identity authentication and access permission authorization. After the microservice access control system determines that the requester identity authentication is passed and the access permission is authorized, the requester can access the corresponding microservice. Among them, in the embodiment of the present application, the first service 100 is used to perform access control on the requester and / or microservice access request for accessing the corresponding microservice, and the second service 200 performs access control on the requester and / or microservice access request for accessing any microservice within the application.

[0072] Here, in the embodiment of the present application, the first service 100 specifically refers to all access control services deployed inside the application and related to the corresponding microservices. In some embodiments, the first service 100 includes a request management service and a local authorization service; the second service 200 specifically refers to all access control services deployed outside the application and related to the application. In some embodiments, the second service 200 includes an authentication service and a central authorization service; in the embodiment of the present application, the internal functional division of the first service 100 and the second service 200 is not specifically limited.

[0073] It should be noted that in the related technologies, the microservice access control system is usually set at the boundary between the application and the outside, and access control management is performed in a centralized manner. For example, after RBAC authenticates the identity of the requester, it sets a "role" for the requester and authorizes specific access rights to the "role" to achieve microservice access control. However, the centralized access control method in the related technologies sets the security boundary at the external boundary of the application, lacking security access control to the internal environment of the application; due to the centralized processing of authentication and authorization, some scheme permissions will be exposed to the requester during the authentication and authorization process, and there is a risk of unauthorized access. Attackers can easily access the inside of the application after bypassing the authentication and authorization process, and the access control granularity is at the user level or role level. If unauthorized access occurs to a single microservice, the security risk will immediately affect other microservices.

[0074] Based on this, in order to solve the above technical problems, the microservice access control system of the embodiment of the present application splits the identity authentication and access permission authorization functions, and adopts the access control method of external identity authentication + internal access permission authorization to improve the security of microservice access control. Specifically, the second service deployed outside the application is used to authenticate the requester, and the first service deployed inside the application is used to authorize access permissions for microservice access requests.

[0075] The present application embodiment provides a microservice access control method, which is applied to a first service, such as Figure 2 As shown, the method includes:

[0076] Step 201: Receive a microservice access request sent by a requester, where the microservice access request carries an authentication token.

[0077] Step 202: After verifying the authentication token, a valid authorization token corresponding to the microservice access request is generated based on the authentication token.

[0078] Step 203: Send the microservice access request and the valid authorization token to the corresponding target microservice.

[0079] The first service is an internal service of the application and corresponds to a microservice within the application.

[0080] Here, the authentication token and authorization token can be JWT (JSON Web Token). JWT is self-contained and lightweight and flexible, and is usually used for authentication and authorization. Here, the authentication token represents that the identity authentication of the requester has passed, and at least carries the identity information of the requester. Specifically, the authentication token is issued by the second service, that is, after the requester passes the identity authentication of the second service, it sends a microservice access request to the first service corresponding to the target microservice.

[0081] It can be understood that after receiving the microservice access request, the first service verifies the validity and information integrity of the authentication token carried in the microservice access request. After the verification is passed, the corresponding valid authorization token is generated. The valid authorization token carries at least the permission information corresponding to the microservice access request, and the microservice access request and the valid authorization token are assembled and sent to the target microservice; after receiving the microservice access request, the target microservice verifies the validity of the valid authorization token, and responds to the microservice access request after the verification is passed.

[0082] It can be understood that in the embodiment of the present application, the microservice access control related service (first service) deployed inside the application is only used to authorize microservice access requests, not to authenticate the identity of the requester. The first service is simple to deploy and shields the authorization information and process from the requester, effectively preventing unauthorized access attacks. The access control granularity is refined to the access request level, and an authorization token is issued for a single microservice access request. When a security problem occurs in the authorization of a single microservice access request, it will not affect other microservice access requests, thereby improving the security of microservice access control.

[0083] Exemplarily, based on the authentication token, generating a valid authorization token corresponding to a microservice access request includes: based on the identity information of the requester carried by the authentication token, obtaining the authorization token corresponding to the cached microservice access request; based on the validity period information carried by the cached authorization token, judging whether the cached authorization token is valid; if it is determined that the cached authorization token is valid, then using the cached authorization token as the valid authorization token corresponding to the microservice access request; if it is determined that the cached authorization token is expired, then updating the cached authorization token based on the current operating environment parameters of the target microservice, and using the updated authorization token as the valid authorization token corresponding to the microservice access request. Exemplarily, based on the identity information of the requester carried by the authentication token, obtaining the authorization token corresponding to the cached microservice access request includes: based on the identity information of the requester, judging whether to cache the authorization token corresponding to the microservice access request; if it is determined that the corresponding authorization token is not cached, sending an authorization token request to a second service, the authorization token request carrying at least the identity information of the requester and the target microservice information; receiving and caching the corresponding authorization token sent by the second service. Wherein, the second service is an external service of the application.

[0084] Here, the identity information of the requester includes at least a user ID and a role ID. The user ID is the unique identifier of the requester, and the role ID is the identity identifier assigned by the microservice access control system when setting different access permissions for the same requester. That is, the user ID can correspond to one or more role IDs. Based on the identity information of the requester, the permission information corresponding to accessing the target microservice can be queried.

[0085] Here, the target microservice information may be a unique identifier of the target microservice, such as a target microservice name.

[0086] It is understandable that since the amount of identity information of the requester is too large, if the permission information is stored in the first service, it will greatly increase the difficulty of deploying the first service inside the application; in this embodiment of the application, the microservice access control system stores the permission information in a second service outside the application, and the first service sends an authorization token request to the second service to obtain an authorization token carrying the corresponding permission information, and in order to simplify the authorization process, the first service caches the corresponding authorization token obtained and generated based on the identity information of the requester. When the first service receives the microservice access request, based on the identity information of the requester, if it is determined that the corresponding authorization token has been cached, the cached authorization token is directly called to generate the corresponding valid authorization token, so as to avoid repeatedly requesting the corresponding authorization token from the second service.

[0087] It should be noted that, in the related art, the access rights of the requester to access the microservice are usually statically set, that is, when a microservice access request is received, the microservice access control system calls the preset access right table, determines the access rights corresponding to the requester and authorizes it; due to the frequent resource occupation and short-term concurrency in the operation of microservices, if a static setting scheme for access rights is adopted, when the microservice environment changes, the access rights are difficult to make corresponding adjustments, and cannot adapt to the rapidly changing life cycle of the microservice environment; the embodiment of the present application takes into account the requirements of microservice operation scenarios and dynamically manages access rights. Specifically, by setting validity period information for the authorization token to limit the validity of the access rights, and determining that the authorization token expires, the authorization token is updated based on the current operating environment parameters of the target microservice to achieve dynamic management of access rights, thereby improving the elasticity and scalability of the microservice access control system, ensuring the availability of microservice resources, and reducing the difficulty of access right management.

[0088] Here, the permission information at least includes validity period information, which may include effective time and expiration time. A valid authorization token is an authorization token within the validity period. If the first service determines that the cached authorization token is within the validity period, it determines that the permission information carried by the cached authorization token is applicable to the current operating environment of the target microservice, and then assembles the cached authorization token with the microservice access request and sends them to the target microservice.

[0089] In some embodiments, the permission information includes, in addition to validity period information, one or more of the following: request operation, request object resource, and valid quota.

[0090] Exemplarily, the method further includes: obtaining current operating environment parameters of the target microservice, where the operating environment parameters include one or more of the following: CPU occupancy, memory occupancy, I / O frequency, and request access frequency.

[0091] Exemplarily, based on the current operating environment parameters of the target microservice, the cached authorization token is updated, including: calculating the requester's incremental permission information based on the current operating environment parameters of the target microservice and the weights corresponding to each operating environment parameter; updating the cached authorization token based on the calculated incremental permission information and the permission information carried by the cached authorization token.

[0092] Here, the first service generates and stores weights corresponding to various operating environment parameters based on the business type of the corresponding microservice; in order to reduce resource usage, the first service periodically obtains and stores the current operating environment parameters of the corresponding microservice.

[0093] It can be understood that if the first service determines that the cached authorization token has expired, it calculates the incremental information of each permission information based on the current operating environment parameters of the corresponding microservice, and dynamically adjusts the corresponding permission information based on the incremental information, so that the permission information carried by the updated authorization token adapts to the current operating environment of the target microservice, and is assembled with the microservice access request as a valid authorization token and sent to the target microservice.

[0094] Based on the aforementioned microservice access control method applied to the first service, the embodiment of the present application also provides a microservice access control method applied to the second service, such as Figure 3 As shown, the method includes:

[0095] Step 301: Receive an authentication request sent by a requester.

[0096] Step 302: Based on the authentication request, after determining that the identity authentication of the requesting party is successful, an authentication token is generated.

[0097] Step 303: Send the authentication token to the requester.

[0098] Among them, the authentication token is used to request access to any microservice inside the application; the second service is an external service of the application.

[0099] Here, in an embodiment of the present application, the microservice access control related service (second service) deployed outside the application is used to authenticate the identity of the requester, and is not used to authorize the microservice access request. The authorization security boundary is set inside the application in a decentralized manner, and the scope of security access control is expanded from the application boundary to the entire application. The authorization information and process are shielded from the requester, effectively preventing unauthorized access attacks.

[0100] Here, the authentication token is used to request access to any microservice within the application. Specifically, the requester sends a microservice access request carrying the authentication token to the target microservice, and the target microservice verifies the authentication token and authorizes the microservice access request.

[0101] Exemplarily, after determining that the requesting party's identity authentication has passed, an authentication token is generated, including: after determining that the requesting party's identity authentication has passed, based on the requesting party's user ID carried in the authentication request, querying a preset identity information mapping table; based on the queried identity information of the requesting party, generating an authentication token carrying the identity information.

[0102] Here, the identity information includes at least the user ID and the role ID, and the identity information mapping table records all the role IDs corresponding to the user ID of each requester; the authentication request carries at least the user ID of the requester, and also carries other information used to authenticate the identity of the requester, such as a login password, etc. The second service authenticates the identity of the requester based on the user ID and login password and other information carried in the authentication request, and issues an authentication token after determining that the identity authentication of the requester is passed.

[0103] It is understandable that the requester who fails to pass the identity authentication does not obtain the authentication token. When sending a microservice access request to the first service, the microservice access request does not carry the authentication token. Therefore, the first service will not generate a corresponding valid authorization token after verifying the microservice access request, and the requester cannot access the target microservice.

[0104] Here, in the embodiment of the present application, although the second service set outside the application is not used for microservice access requests, it is used to store the basic permission information corresponding to each requesting party and each access target microservice.

[0105] Exemplarily, the method also includes: receiving an authorization token request sent by the first service, the authorization token request carries at least the identity information of the requester and the target microservice information; based on the identity information of the requester and the target microservice information, querying a preset access permission table, determining the corresponding permission information, and generating an authorization token; sending the authorization token to the first service; wherein the first service is an internal service of the application and corresponds to a microservice within the application; the authorization token carries at least the permission information.

[0106] Here, the identity information of the requester recorded in the access permission table includes at least: the role ID of the requester; the target microservice information recorded includes at least: the target microservice name; the permission information recorded includes at least: the validity period information; the validity period information may include: the effective time and the expiration time; the basic permission information recorded may also include at least one of the following: the requested operation, the requested object resource and the valid quota.

[0107] It can be understood that after the second service receives the authorization token request sent by the first service, it generates the basic authorization token required for the requester to access the target microservice, and sends the generated authorization token request sent by the first service to the second service to authorize the microservice access request; since the basic authorization token has a validity period, if the basic authorization token generated by the second service expires, the first service will continuously and dynamically update and iterate on the basis of the basic authorization token based on the current operating environment parameters of the corresponding microservice.

[0108] In an application example of the present application, a microservice access control system such as Figure 4As shown, the first service 100 includes a request management service 101 and a local authorization service 102. The request management service 101 is used to receive a microservice access request, and send a valid authorization token request to the local authorization service 102 based on the authentication information carried in the microservice access request, and after receiving the valid authorization token, send the microservice access request and the valid authorization token to the target microservice; the local authorization service 102 is used to generate and cache a valid authorization token after receiving a valid authorization token request; the second service 200 includes an authentication service 201 and a central authorization service 202. The authentication service 201 is used to authenticate the requester; the central authorization service 202 is used to store the permission information corresponding to each requester corresponding to each access target microservice.

[0109] Based on the above microservice access control system, this application example also provides a microservice access method, such as Figure 5 As shown, the method includes:

[0110] Step 501: The requester sends an authentication request to an authentication service.

[0111] Here, the authentication request at least includes the user ID of the requester; the authentication request may also carry a login password to authenticate the identity of the requester.

[0112] Step 502: The authentication service authenticates the identity of the requester and after determining that the identity of the requester has been authenticated, queries the user information mapping table to obtain the identity information of the requester.

[0113] Here, the identity information of the requester includes the user ID and all role IDs of the requester.

[0114] Here, an example of a user information mapping table is shown in Table 1:

[0115] Table 1

[0116]

[0117] Step 503: The authentication service generates an authentication token based on the identity information of the requester.

[0118] Here, the authentication token is in the form of JWT, and the structure of the authentication token is shown in Table 2:

[0119] Table 2

[0120]

[0121] Here, based on the structure of the authentication token shown in Table 2, a specific application example of the authentication token is as follows:

[0122]

[0123]

[0124] Step 504: The authentication service sends an authentication token to the requester.

[0125] Step 505: The requester sends a microservice access request to the request management service.

[0126] Here, the microservice access request carries at least the authentication token sent by the authentication service.

[0127] Here, the requester sends a microservice access request to the request management service corresponding to the target microservice.

[0128] Step 506, after requesting the management service to verify the authentication token, send a valid authorization token request to the local authorization service.

[0129] Here, the request management service and the local authorization service in step 506 correspond to the same microservice.

[0130] Here, the valid authorization token request carries at least the identity information of the requester.

[0131] Step 507: The local authorization service generates a corresponding valid authorization token and sends it to the request management service.

[0132] Here, step 507 specifically includes:

[0133] Step 5071, the local authorization service queries whether the corresponding authorization token is cached based on the identity information of the requester. If so, execute step 5075; if not, execute step 5072.

[0134] Step 5072: The local authorization service sends an authorization token request to the central authorization service.

[0135] Here, the authorization token request carries at least the identity information of the requester and the target microservice information.

[0136] Step 5073, the central authorization service queries the basic permission information corresponding to the requester's access to the target microservice, generates and sends a basic authorization token to the local authorization service.

[0137] Here, the basic authorization token carries at least basic permission information.

[0138] Here, the central authorization service queries the corresponding basic permission information based on the permission information table. An example of the permission information table is shown in Table 3:

[0139] Table 3

[0140]

[0141] Here, the authorization token is in the form of JWT, and the structure of the authentication token is shown in Table 4:

[0142] Table 4

[0143]

[0144] Here, based on the structure of the authorization token shown in Table 4, a specific application example of the authorization token is as follows:

[0145]

[0146]

[0147] Step 5074, the local authorization service sends the basic authorization token to the request management service.

[0148] Step 5075, the local authorization service queries the cached authorization token validity period information to determine whether the authorization token is valid. If so, execute step 5076; if not, execute step 5077.

[0149] Here, the validity period information specifically includes the token effective time and the token expiration time.

[0150] In step 5076, the local authorization service sends the cached authorization token to the request management service.

[0151] Here, the request management service regards the received request management service as a valid authorization token.

[0152] Step 5077, the local authorization service calculates the incremental information of each permission information, updates the cached authorization token, and sends the updated authorization token to the request management service.

[0153] Here, the dynamic permission calculation factors used to calculate the incremental information of each permission information are shown in Table 5:

[0154] Table 5

[0155] Dynamic Permission Calculation Factor illustrate Value range <![CDATA[r cpu ]]> CPU usage 0～1 <![CDATA[r mem ]]> Memory usage 0～1 <![CDATA[r IO ]]> I / O Frequency 0～1 <![CDATA[r rate ]]> Request access frequency (unit: s) 0～∞ w Request complexity weight 0～10

[0156] This example also provides a method for calculating incremental information of permission information, as follows:

[0157] Δ Auth,i,j =W i,j F i,j

[0158]

[0159] Among them, Δ Auth,i,j Request action ACT i , request microservice resources RSCj The incremental information set includes at least: the incremental information of the effective time exp, the expiration time exp and the effective quota Q.

[0160] Here, F i,j Request action ACT i , request microservice resources RSC j The permission impact factor, that is, the current operating environment parameters of the target microservice, is obtained and cached regularly by the local authorization service. i,j The details are as follows:

[0161]

[0162] Here, W i,j For ACT i 、RSC j The weights are as follows:

[0163]

[0164] Among them, w i,j Request action ACT i , request microservice resources RSC j Request complexity weight and corresponding microservice business type definition.

[0165] Step 508 , request the management service to send the microservice access request and the valid authorization token to the target microservice.

[0166] Step 509: After verifying the valid authorization token, the target microservice responds to the microservice access request.

[0167] Here, after receiving the valid authorization token, the target microservice determines whether the same valid authorization token is cached. If it is determined that the same valid authorization token has been cached, it directly responds to the microservice access request; if it is determined that the same valid authorization token is not cached, the validity of the valid authorization token is verified. After the verification is passed, the valid authorization token is cached and the microservice access request is responded.

[0168] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a microservice access control device, which corresponds to the above-mentioned microservice access control method, and each step in the above-mentioned microservice access control method embodiment is also fully applicable to the embodiment of the present device.

[0169] Here, if Figure 6As shown, the embodiment of the present application provides a microservice access control device, which is applied to a first service, and the microservice access control device includes: a first receiving module 601, a first generating module 602, and a first sending module 603. The first receiving module 601 is used to receive a microservice access request sent by a requester, and the microservice access request carries an authentication token; the first generating module 602 is used to verify the authentication token, and then obtain a valid authorization token corresponding to the microservice access request based on the authentication token; the first sending module 603 is used to send the microservice access request and the valid authorization token to the corresponding target microservice; wherein the first service is an internal service of the application and corresponds to a microservice inside the application.

[0170] In some embodiments, the first generation module 602 is specifically used to: obtain the authorization token corresponding to the cached microservice access request based on the identity information of the requester carried by the authentication token; determine whether the cached authorization token is valid based on the validity period information carried by the cached authorization token; if it is determined that the cached authorization token is valid, use the cached authorization token as the valid authorization token corresponding to the microservice access request; if it is determined that the cached authorization token is expired, update the cached authorization token based on the current operating environment parameters of the target microservice, and use the updated authorization token as the valid authorization token corresponding to the microservice access request.

[0171] In some embodiments, the microservice access control device also includes an acquisition module 604, which is used to obtain the current operating environment parameters of the target microservice, and the operating environment parameters include one or more of the following: CPU occupancy, memory occupancy, I / O frequency, and request access frequency.

[0172] In some embodiments, the first generation module 602 is specifically used to: calculate the incremental permission information of the requester based on the current operating environment parameters of the target microservice and the weights corresponding to each operating environment parameter; update the cached authorization token based on the calculated incremental permission information and the permission information carried by the cached authorization token; wherein the permission information includes at least validity period information.

[0173] The first generation module 602 is specifically used to: obtain the authorization token corresponding to the cached microservice access request based on the identity information of the requester carried by the authentication token, including: judging whether to cache the authorization token corresponding to the microservice access request based on the identity information of the requester; if it is determined that the corresponding authorization token is not cached, sending an authorization token request to the second service, the authorization token request carries at least the identity information of the requester and the target microservice information; receiving and caching the corresponding authorization token sent by the second service; wherein the second service is an external service of the application.

[0174] Here, if Figure 7As shown, the embodiment of the present application also provides a microservice access control device, which is applied to the second service, and the microservice access control device includes: a second receiving module 701, a second generating module 702 and a second sending module 703. The second receiving module 701 is used to receive the authentication request sent by the requester; the second generating module 702 is used to generate an authentication token after determining that the identity authentication of the requester is passed based on the authentication request; the second sending module 703 is used to send the authentication token to the requester; wherein the authentication token is used to request access to any microservice inside the application; the second service is an external service of the application.

[0175] In some embodiments, the second generation module 702 is specifically used to: after determining that the requester's identity authentication is passed, query the preset identity information mapping table based on the requester's user ID carried in the authentication request; and generate an authentication token carrying the identity information based on the queried identity information of the requester.

[0176] In some embodiments, the microservice access control device also includes a third receiving module 704, a third generating module 705 and a third sending module 706, wherein the third receiving module 704 is used to receive an authorization token request sent by the first service, and the authorization token request carries at least the identity information of the requester and the target microservice information; the third generating module 705 is used to query the preset access permission table based on the identity information of the requester and the target microservice information, determine the corresponding permission information, and generate an authorization token; the third sending module 706 is used to send the authorization token to the first service; wherein the first service is an internal service of the application and corresponds to the microservice within the application; the authorization token carries at least the permission information.

[0177] It should be noted that the microservice access control device provided in the above embodiment only uses the division of the above program modules as an example when performing microservice access control. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the microservice access control device provided in the above embodiment and the microservice access control method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0178] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a network device. Figure 8 Only an exemplary structure of the network device is shown, not all structures, and can be implemented as needed. Figure 8 Partial or complete structure shown.

[0179] like Figure 8As shown, the network device 800 provided in the embodiment of the present application includes: at least one processor 801, a memory 802, a user interface 803 and at least one network interface 804. The various components in the network device 800 are coupled together through a bus system 805. It can be understood that the bus system 805 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 805 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Figure 8 Various buses are labeled as bus system 805 .

[0180] The user interface 803 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0181] The memory 802 in the embodiment of the present application is used to store various types of data to support the operation of the network device 800. Examples of such data include: any computer program used to operate on the network device 800.

[0182] The microservice access control method disclosed in the embodiment of the present application can be applied to the processor 801, or implemented by the processor 801. The processor 801 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the microservice access control method can be completed by the hardware integrated logic circuit or software instructions in the processor 801. The above-mentioned processor 801 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 801 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 802. The processor 801 reads the information in the memory 802 and completes the steps of the microservice access control method provided in the embodiment of the present application in combination with its hardware.

[0183] In an exemplary embodiment, the network device 800 may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned microservice access control method.

[0184] It can be understood that the memory 802 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an EEPROM, a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0185] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, which may be a computer-readable storage medium, for example, a memory 802 storing a computer program, and the computer program may be executed by a processor 801 of a network device 800 to complete the steps described in the microservice access control method of the present application embodiment. The computer-readable storage medium may be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0186] In an exemplary embodiment, the present application also provides a computer program product, including a computer program, which can be executed by the processor 801 of the network device 800 to complete the steps described in the method of the present application embodiment. It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0187] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0188] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A microservice access control method, characterized in that: Applied to the first service, the method comprises: Receive a microservice access request sent by a requester, wherein the microservice access request carries an authentication token; After verifying the authentication token, generating a valid authorization token corresponding to the microservice access request based on the authentication token; Send the microservice access request and the valid authorization token to the corresponding target microservice; The first service is an internal service of the application and corresponds to a microservice within the application.

2. The method according to claim 1, characterized in that The generating, based on the authentication token, a valid authorization token corresponding to the microservice access request comprises: Based on the identity information of the requester carried by the authentication token, obtain the cached authorization token corresponding to the microservice access request; Based on the validity period information carried by the cached authorization token, determining whether the cached authorization token is valid; If it is determined that the cached authorization token is valid, the cached authorization token is used as a valid authorization token corresponding to the microservice access request; If it is determined that the cached authorization token is expired, the cached authorization token is updated based on the current operating environment parameters of the target microservice, and the updated authorization token is used as a valid authorization token corresponding to the microservice access request.

3. The method according to claim 2, characterized in that The method further comprises: Obtain the current operating environment parameters of the target microservice, where the operating environment parameters include one or more of the following: CPU occupancy, memory occupancy, I / O frequency, and request access frequency; The updating of the cached authorization token based on the current operating environment parameters of the target microservice includes: Calculate the permission increment information of the requester based on the current operating environment parameters of the target microservice and the weights corresponding to the operating environment parameters; Based on the calculated incremental information of each permission and the permission information carried by the cached authorization token, updating the cached authorization token; The authority information at least includes validity period information.

4. The method according to claim 2 or 3, characterized in that: The obtaining, based on the identity information of the requester carried by the authentication token, the authorization token corresponding to the cached microservice access request comprises: Based on the identity information of the requester, determine whether to cache the authorization token corresponding to the microservice access request; If it is determined that the corresponding authorization token is not cached, an authorization token request is sent to the second service, where the authorization token request carries at least the identity information of the requester and the target microservice information; receiving and caching a corresponding authorization token sent by the second service; The second service is an external service of the application.

5. A microservice access control method, characterized in that: Applied to the second service, the method comprises: Receiving an authentication request sent by a requesting party; Based on the authentication request, after determining that the identity authentication of the requesting party is passed, generating an authentication token; sending the authentication token to the requester; The authentication token is used to request access to any microservice within the application; the second service is an external service of the application.

6. The method according to claim 5, characterized in that After determining that the requesting party identity authentication is passed, generating an authentication token includes: After determining that the identity authentication of the requesting party is passed, querying a preset identity information mapping table based on the user ID of the requesting party carried in the authentication request; Based on the queried identity information of the requesting party, an authentication token carrying the identity information is generated.

7. The method according to claim 6, characterized in that The method further comprises: Receive an authorization token request sent by the first service, where the authorization token request carries at least identity information of the requester and target microservice information; Based on the identity information of the requester and the target microservice information, query the preset access permission table, determine the corresponding permission information, and generate an authorization token; sending the authorization token to the first service; Among them, the first service is an internal service of the application and corresponds to a microservice within the application; the authorization token carries at least the permission information.

8. A microservice access control device, characterized in that: Applied to the first service, the microservice access control device includes: A first receiving module is used to receive a microservice access request sent by a requester, wherein the microservice access request carries an authentication token; A first generating module is used to obtain a valid authorization token corresponding to the microservice access request based on the authentication token after verifying the authentication token; A first sending module, used to send the microservice access request and the valid authorization token to the corresponding target microservice; The first service is an internal service of the application and corresponds to a microservice within the application.

9. A microservice access control device, characterized in that: Applied to the second service, the microservice access control device includes: A second receiving module, used to receive an authentication request sent by a requester; A second generating module is used to generate an authentication token after determining that the identity authentication of the requesting party is passed based on the authentication request; A second sending module, used for sending the authentication token to the requesting party; The authentication token is used to request access to any microservice within the application; the second service is an external service of the application.

10. A microservice access control system, characterized in that: comprising a second service and at least one first service; Wherein, the first service is an internal service of the application and corresponds to a microservice within the application, and is used to execute the steps of the method according to any one of claims 1 to 4; The second service is an external service of the application, and is used to execute the steps of the method according to any one of claims 5 to 7.

11. A network device, characterized in that: include: A processor and a memory for storing a computer program that can be run on the processor, wherein the processor, when running the computer program, executes the steps of the method according to any one of claims 1 to 7.

12. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images