Cache fine right control and authentication intelligent management method and system
By introducing multi-dimensional authentication and authorization mechanisms into the cache proxy layer, the application system and cache service are decoupled, solving the problems of high operation and maintenance costs and insufficient security in existing technologies, and improving the system's flexibility and data security.
Patent Information
- Application Number
- CN202511258532.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-04
- Publication Date
- 2025-11-28
AI Technical Summary
Existing Redis-based distributed caching methods and processes suffer from problems such as tight coupling between the application system and the cache database, high operation and maintenance costs, lack of business scenario awareness and fine-grained authentication and permission control, resulting in poor system flexibility and insufficient security.
By introducing a cache proxy layer as an intermediate layer, and through multi-dimensional authentication and authorization mechanisms, the application system and cache service are decoupled, enabling fine-grained permission control and business scenario awareness, and building a unified security protection system.
Reduce operational complexity, improve system flexibility and maintainability, achieve resource isolation and refined management, enhance data security, and prevent data leakage and unauthorized operations.
Smart Images
Figure CN121037076A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer, in particular to a cache fine control right and authentication intelligent method and system. BACKGROUND
[0002] With the rapid development of online business, various new businesses and new systems are being built one after another. Using the memory of a machine as a cache database has the characteristics of high-speed caching, which can greatly improve the response time of the system. A large number of business systems and high response time requirements have led to a large demand for cache databases in the industry. Cache databases are generally deployed in a distributed cluster manner, which has the characteristics of large number of machines, difficult deployment, complex configuration, and difficult monitoring. As more and more systems use cache services, the selection of each system cache middleware is different, and the deployment method is also different.
[0003] In the existing Redis-based distributed cache method and process, by introducing distributed cache technology, the problems of capacity limitation caused by deploying data in a small shared memory machine, elasticity and scalability bottleneck under business growth, and high database load pressure under large-scale concurrency are solved. The scheme mainly focuses on the distributed storage and horizontal expansion capability of data.
[0004] However, the general implementation of such a technical solution is that the application system is directly integrated with the cache middleware, and the developer needs to directly handle the connection, configuration, cluster routing and other details of the cache service.
[0005] The existing Redis-based distributed cache method and process have the following disadvantages:
[0006] 1. The coupling between the application system and the cache database is not removed, and the application
[0007] The system only needs to focus on the implementation of business functions and weaken the concern for the physical architecture of the cache database. In the existing scheme, the application system directly depends on the physical deployment architecture of the cache (such as master-slave, sentinel or cluster mode). When the backend cache cluster needs to be expanded, scaled down, upgraded or switched to disaster recovery, the configuration of all associated application systems often needs to be modified, and even the code needs to be changed and redeployed, which results in high post-maintenance cost and greatly reduces the flexibility and maintainability of the system.
[0008] 2. There is no division and use method of cache based on business scenarios. The existing scheme usually lacks
[0009] The perception ability to the business scene causes multiple different nature businesses (such as high-frequency transaction, background report, user session, etc.) to mix the same or the same group of cache resources. This way not only cannot provide differentiated quality of service guarantee for different scenes, but also easily causes resource contention. Abnormal traffic or slow query of a non-core business may seriously affect the stability of the core business.
[0010] 3. Lack of fine-grained authentication and permission management mechanism. Traditional cache access control is usually limited to IP white list or shared password and other single and coarse-grained authentication methods. Once the authentication information is broken, the attacker can obtain full access permission to the entire cache instance. This mechanism cannot meet the high requirements of security under the modern micro-service architecture, that is, it cannot perform fine-grained permission division and access control according to the calling party (different applications, different user roles) and operation intention (different business scenes), and lays a huge hidden danger for security events such as data leakage and illegal tampering.
[0011] 3. Lack of fine-grained authentication and permission management mechanism. Traditional cache access control is usually limited to IP white list or shared password and other single and coarse-grained authentication methods. Once the authentication information is broken, the attacker can obtain full access permission to the entire cache instance. This mechanism cannot meet the high requirements of security under the modern micro-service architecture, that is, it cannot perform fine-grained permission division and access control according to the calling party (different applications, different user roles) and operation intention (different business scenes), and lays a huge hidden danger for security events such as data leakage and illegal tampering. SUMMARY
[0012] The purpose of the present application is to provide a cache fine-grained control right and authentication intelligent method
[0013] To solve the above technical problems, the present application provides a cache fine-grained control right and authentication intelligent method, comprising the following steps:
[0014] The application system initiates a cache call request;
[0015] The cache proxy receives the cache call request and authenticates and authorizes the cache call request;
[0016] The authentication and authorization information is saved to the context of the cache call request;
[0017] The cache proxy registers with the registration center;
[0018] The cache proxy routes to the backend cache cluster according to the cache call request.
[0019] Preferably, the cache call request includes request data, identity, business scene, data source and device identifier.
[0020] Preferably, the authentication and authorization of the cache call request specifically includes the following steps:
[0021] The cache proxy performs identity authentication on the identity of the cache call request, data source authentication on the data source of the cache call request, and device identifier authentication on the device identifier of the cache call request;
[0022] After authentication, the cache proxy authorizes the cache call request based on the identity of the cache call request and the business scenario according to a fine-grained permission policy.
[0023] Preferably, the cache proxy has a connection pool processing mode.
[0024] The cache proxy maintains a connection pool to the backend cache cluster.
[0025] Preferably, the cache proxy performs aspect processing through an interception filter.
[0026] Preferably, the cache proxy implements a cache service protocol and serves as an intermediate layer between the application system and the cache service, and decouples the application and the cache service through a cluster and a sentinel.
[0027] The application also provides a cache fine control and authentication intelligent system, comprising:
[0028] A request module is configured to initiate a cache call request by an application system.
[0029] An authentication and authorization module is configured to authenticate and authorize the cache call request after the cache proxy receives the cache call request.
[0030] A saving module is configured to save the authentication and authorization information into a context of the cache call request.
[0031] A registration module is configured to register the cache proxy to a registration center.
[0032] A routing module is configured to route the cache proxy to a backend cache cluster according to the cache call request.
[0033] Compared with the prior art, the application has the following beneficial effects:
[0034] 1) The application and the cache are completely decoupled, and the system flexibility and maintainability are improved.
[0035] By introducing a cache proxy layer as an intermediate gateway, the application system no longer directly connects to the backend cache. When the backend cache needs to be expanded, data migrated, upgraded or switched in disaster recovery, only the routing configuration in the proxy layer needs to be modified, and the application system does not need any code or configuration change. This greatly reduces the complexity and risk of operation and maintenance, and improves the flexibility and maintainability of the entire system.
[0036] 2) Fine-grained call control and resource isolation based on business are provided.
[0037] With the identification ability of "tenant" and "business scenario", the agent layer can implement differentiated quality of service guarantee for requests from different businesses. For example, by configuring higher resource priority and looser flow control threshold for "kill scene", and configuring lower priority for "report scene", the performance impact of non-core business on core business is effectively avoided, and logical isolation and fine control of resources are realized.
[0038] 3) Build a unified and front-end security protection system to significantly enhance data security:
[0039] By implementing "multi-dimensional authentication" and "fine-grained permission control" in the cache agent layer, the security line is moved forward. Compared with the traditional scheme where each application manages authentication information by itself, a unified security portal is built. For example, even if a request passes the application identity authentication, if its source IP is not in the whitelist, or it tries to perform a write operation on a read-only scenario, it will be directly rejected by the agent layer at the entrance. This greatly reduces the attack surface, fundamentally prevents data leakage and illegal operations, reduces the risk of exposing the entire cache data due to password leakage and other single points of failure, and can implement differentiated governance strategies for different scenarios (such as independent flow control, circuit breaking, monitoring and alarm). BRIEF DESCRIPTION OF DRAWINGS
[0040] The specific embodiments of the present application will be further described in detail below with reference to the accompanying drawings.
[0041] Figure 1 is a framework schematic diagram of a cache fine control and authentication intelligent system of the present application;
[0042] Figure 2 is a schematic diagram of context. DETAILED DESCRIPTION
[0043] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that the present application can be practiced without the specific details presented in this description. In other instances, well-known methods have not been described in detail in order to avoid unnecessarily obscuring the present application.
[0044] The terminology used in this description of one or more embodiments shall include descriptions of specific embodiments only and shall not be considered limiting. As used in this description of one or more embodiments and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.
[0045] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."
[0046] The present invention will now be described in further detail with reference to the accompanying drawings:
[0047] Definitions of abbreviations and key terms:
[0048] Cache Proxy: The cache proxy runtime module is used by various application systems and provides control functions such as multi-tenancy, multi-scenario, authentication and access control.
[0049] Tenant: An independent unit that uses the caching service, usually corresponding to an application system or a business department.
[0050] Scenario: Standardize the definition of caching services according to business scenarios, and use it as a unified specification of capability output object.
[0051] Shared scenario: Application systems share a cache connection pool and share read and write permissions.
[0052] Exclusive scenario: The application system has exclusive access to read and write permissions.
[0053] Fine-grained access control: Based on multiple dimensions such as user roles and business scenarios, precise access control is implemented for cached keys or commands down to the read, write, and delete operation levels.
[0054] Multi-dimensional authentication: In addition to identity authentication, it is a mechanism that combines multiple dimensions such as request source and device information for comprehensive authentication.
[0055] The cache proxy provides control over scenarios, environments, and data centers from a tenant perspective, and integrates multi-dimensional authentication and fine-grained control capabilities. As shown in the diagram, the cache proxy locates the corresponding scenario environment based on the tenant information of the access endpoint, finds the appropriate connection pool based on the scenario environment, and accesses the cache data service through the connection pool. The processing flow is as follows: Figure 1 As shown:
[0056] To better illustrate the technical effects of the present invention, the present invention provides the following specific embodiments to illustrate the above technical process:
[0057] Example 1: A method and system for fine-grained control and authentication of cached data, providing a flexible tenant management mechanism. By binding tenants to projects and systems, it achieves fine-grained management of tenant-scenario relationships. The multi-business scenario processing and authentication / authorization workflow are as follows:
[0058] 1. Request Reception and Context Construction: The application system, as the caller (tenant), initiates a cache call and sends a request call context containing information such as identity and business scenario.
[0059] 2. Multi-dimensional authentication and authorization: After receiving the request data, the cache proxy performs unified processing on the client connection, request data, authentication data, and control parameters.
[0060] 3. Authentication Processing: The proxy layer executes a multi-dimensional authentication mechanism. In addition to traditional identity authentication, it can also introduce verification of data source (such as IP address), device identifier, etc., to ensure the legitimacy of the request source.
[0061] 4. Authorization Processing: After successful authentication, the proxy layer authorizes data based on a pre-defined fine-grained permission policy. It identifies the unique tenant information and the bound business scenario, and determines whether the current request has the corresponding operation permissions (such as read-only, read-write, delete, etc.) on the target cached data based on the role permissions associated with that scenario.
[0062] 5. Context Injection: Authentication and authorization information (such as tenant, scenario, and permission set) is uniformly placed in the request context, such as... Figure 2 As shown.
[0063] 6. Global Transmission and Unified Management: Tenant information, business scenario information, and authorization credentials are transmitted globally during the call process. Each link (such as routing, flow control, and load balancing) can be uniformly managed through tenant and scenario elements to achieve differentiated services. For example, more resources can be allocated to high-priority scenarios, or traffic control can be applied to specific tenants.
[0064] 7. Dynamic Routing and Service Discovery: The cached proxy itself is stateless. By registering with the registry center, clients (application systems) can find available proxy instances through service discovery.
[0065] 8. The proxy layer dynamically routes to the correct backend cache cluster based on information such as the scenario, environment, and data center in the request context, using an internal selector. This makes changes to the backend cache (such as scaling up or switching) completely transparent to the application system.
[0066] 9. The cache proxy features a connection pooling mechanism. The proxy layer maintains connection pools for each backend cache cluster, reusing connections, reducing the overhead of establishing and destroying connections, and improving performance.
[0067] 10. The cache proxy uses various configured interception filters for aspect-oriented processing. All governance capabilities, such as flow control, circuit breaking, logging, monitoring, authentication, and authorization, are implemented as pluggable filters, facilitating feature expansion and maintenance.
[0068] 11. The cache proxy implements the cache service protocol, acting as an intermediary layer between tenants and the cache service. It can decouple applications from the cache service through clustering, sentinel, or other methods. The application system only needs to interact with the proxy layer and does not need to care about whether the underlying cache is in single-machine, master-slave, sentinel, or cluster mode, thus achieving transparency of the physical architecture.
[0069] The core value of this invention lies in reshaping the interaction model between application systems and caching services by introducing an intelligent caching proxy layer that integrates multi-dimensional authentication and fine-grained control capabilities. Its key technical points are:
[0070] 1) Multi-dimensional intelligent routing and decoupling mechanism: The key lies in the cache proxy's ability to parse multi-dimensional information such as tenant, scenario, and environment in the request context, and dynamically route the request to the correct backend cache instance based on this information. This approach is not a simple load balancing, but a content-aware intelligent routing that completely separates the application layer's business logic from the underlying physical deployment. This is the core technology for achieving architectural decoupling and automated operation and maintenance.
[0071] 2) A pre-processed, multi-dimensional authentication and fine-grained access control method: The key to this invention lies in separating the security authentication and access control processes from individual applications and moving them to a unified processing layer at the cache proxy layer. Its innovation is reflected in:
[0072] 2.1) Multi-dimensional authentication: It not only authenticates "who you are" (user / application identity), but also "where you come from" (data source, device), building a three-dimensional and more difficult-to-break trusted access model.
[0073] 2.2) Context-based fine-grained authorization: Permissions are no longer simply granted as a connection, but are dynamically bound to "business scenarios" and "user roles." This means that an application might only have read-only permissions when performing an "order query" scenario, but only have write permissions for specific keys when performing an "inventory deduction" scenario. This context-based dynamic authorization method is key to achieving fine-grained security management of cached data.
[0074] 3) Standardized Business Scenario Abstraction and Governance Capabilities: Another key aspect of this invention is the abstraction of caching usage patterns into standardized "business scenarios." Through unified standardization, division, and management of scenarios, the proxy layer can implement differentiated governance strategies (such as independent flow control, circuit breaking, and monitoring alerts) for different scenarios. This approach, which combines technical governance with business logic, is a crucial technical means to fundamentally solve resource contention and ensure the stability of core business operations.
[0075] Example 2: In Example 1, the authentication and authorization logic was centrally implemented in the cache proxy layer. In this example, this logic is implemented in the client or sidecar mode. That is, a lightweight proxy module is embedded in each application system. This module is responsible for communicating with the control center, pulling authentication and permission policies, and verifying them before the client initiates a request.
[0076] Advantages: It can reduce one network hop and lower request latency.
[0077] Disadvantages: Updating and distributing the strategy is more complex, requiring synchronization across all clients.
[0078] Furthermore, security logic is scattered across various applications, making management and upgrades more costly.
[0079] Example 3: In this example 1, a service discovery pattern relying on an external registry center was adopted. In this example, the application system retrieves a list of proxy server addresses by querying the registry center.
[0080] Advantages: It can leverage existing distributed microservice architecture infrastructure.
[0081] Disadvantages: Increased component management costs.
[0082] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules, units, or units is merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units, modules, or components may be combined or integrated into another device, or some features may be ignored or not executed.
[0083] The units may or may not be physically separate. The components shown as units can be one or more physical units, meaning they can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0084] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0085] In particular, according to embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the functions defined in the methods of this invention. It should be noted that the computer-readable medium described above in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof.
[0086] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0087] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions within the technical scope disclosed in the present invention should be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for fine-grained control and authentication of caches, characterized in that, Includes the following steps: The application system initiates a cache access request; After receiving a cache access request, the cache proxy authenticates and authorizes the cache access request. Authentication and authorization information is saved to the context of the cached call request; The caching proxy registers with the registry center; The cache proxy routes cached requests to the backend cache cluster.
2. The cache fine-grained control and authentication intelligent management method according to claim 1, characterized in that: The cached call request includes the requested data, identity identifier, business scenario, data source, and device identifier.
3. The cache fine-grained control and authentication intelligent management method according to claim 2, characterized in that, Authenticating and authorizing cached access requests involves the following steps: The cache proxy performs identity authentication on the cache call request, data source authentication on the cache call request, and device authentication on the cache call request. After successful authentication, the cache proxy authorizes requests based on fine-grained permission policies, taking into account the identity of the cache call request and the business scenario.
4. The cache fine-grained control and authentication intelligent management method according to claim 3, characterized in that: The cache proxy has a connection pooling mode; The cache proxy maintains a connection pool to the backend cache cluster.
5. The cache fine-grained control and authentication intelligent management method according to claim 4, characterized in that, The cache proxy performs aspect-oriented processing through an intercept filter.
6. The cache fine-grained control and authentication intelligent management method according to claim 5, characterized in that, The caching service protocol is implemented through a caching proxy, which acts as an intermediary layer between the application system and the caching service, and decouples the application and the caching service through clustering and sentinel methods.
7. A cache fine-grained control and authentication intelligent management system, used to implement the cache fine-grained control and authentication intelligent management method as described in any one of claims 1-6, characterized in that, include: The request module is used by the application system to initiate cache access requests; The authentication and authorization module is used to authenticate and authorize cache call requests after the cache proxy receives them. The storage module is used to save authentication and authorization information to the context of the cached call request; The registration module is used to cache proxies to register with the registry center; The routing module is used by the cache proxy to route cached request to the backend cache cluster.