Authorization method of service group interface and enterprise service bus

Abstract

The invention provides a service group interface authorization method and an enterprise service bus, and belongs to the technical field of data processing, and the method comprises the steps: obtaining a service group interface authorization request of a target service application; the service group interface authorization request comprises an identifier of a target service application and an interface group identifier of a to-be-called service group; according to the identifier of the target service application and the interface group identifier of the to-be-called service group, determining whether the target service application has the calling permission of the to-be-called service group by adopting a preset service group authorization table; wherein authorization information of a plurality of service groups is stored in the preset service group authorization table. According to the invention, the authorization efficiency of the service group is improved, the complexity of the system is reduced, and the user experience is improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and more specifically, to an authorization method for a business group interface and an enterprise service bus. Background Technology

[0002] With the deepening of enterprise informatization, the demand for data interaction and service integration between systems is growing. As a core infrastructure for realizing the interconnection of heterogeneous systems, service bus has been widely used in many industries such as government affairs, finance, and energy. Especially in the service-oriented architecture, service bus undertakes key functions such as protocol conversion, message routing, security control, and traffic management, becoming an important platform to support the open sharing of data assets and service-oriented operation.

[0003] Currently, service buses generally adopt a management model based on a single interface. For each service that needs to be proxied, the administrator needs to enter its basic information, including the original access address, protocol type, authentication method, proxied path, and rate limiting and circuit breaking policies, and the system will then generate independent routing rules and authorization configurations.

[0004] However, existing technical solutions involve configuring each interface family individually, which is cumbersome and inefficient. In particular, when the number of interfaces changes dynamically, the maintenance cost increases significantly. Interface users need to submit applications multiple times, the approval process is repetitive, the user experience is poor, and it is difficult to achieve automatic authorization synchronization for new interface groups, resulting in delayed or missed permissions. Summary of the Invention

[0005] The purpose of this application is to address the shortcomings of the prior art by providing a method for authorizing business group interfaces and an enterprise service bus, thereby improving the authorization efficiency of business groups, reducing system complexity, and enhancing user experience.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, one embodiment of this application provides an authorization method for a service group interface, applied to an enterprise service bus, the method comprising: Obtain the business group interface authorization request of the target business application; the business group interface authorization request includes: the identifier of the target business application and the interface group identifier of the business group to be invoked; Based on the identifier of the target business application and the interface group identifier of the business group to be invoked, a preset business group authorization table is used to determine whether the target business application has the calling permission of the business group to be invoked; wherein, the preset business group authorization table stores authorization information of multiple business groups.

[0007] Optionally, the method further includes: If the target business application has the calling permission of the business group to be called, then the authorization notification of the business group to be called is returned; Receive the interface call request from the target business application for any interface in the business group to be called, wherein the interface call request includes: the interface path of any interface; Based on the interface path of any of the interfaces, query the interface identifier of the business group corresponding to any of the interfaces from the preset path rule configuration table; Based on the interface identifier of the corresponding business group, query the actual interface path of the business group to be called from the preset routing table; The preset interface variable field in the real interface path is updated to the parameter of the preset interface variable field in the interface path of any interface, thereby generating the real path of any interface; Based on the actual path of any of the interfaces, call any of the interfaces to execute the corresponding proxied business.

[0008] Optionally, the step of querying the interface identifier of the corresponding service group of any interface from the preset path rule configuration table based on the interface path of any interface includes: Match all fields in the interface path of any interface, except for the preset interface variable fields, with each path planning information in the preset path planning table; If the preset path planning table contains target path rule information that matches the interface path of any of the interfaces, then the interface identifier of the target path planning information is used as the interface identifier of the business group corresponding to any of the interfaces.

[0009] Optionally, querying the actual interface path of the business group to be called from a preset routing table based on the interface identifier of the corresponding business group includes: Based on the interface identifier of the corresponding business group, determine the corresponding route identifier from multiple route information entries in the preset routing table; The corresponding interface path is determined from the routing information of the corresponding route identifier as the actual interface path of the business group to be called.

[0010] Optionally, determining whether the target business application has calling permission for the business group to be called, based on the identifier of the target business application and the interface group identifier of the business group to be called, using a preset business group authorization table, includes: Determine whether the identifier of the target business application is present in the preset business group authorization table; If the target business application has an identifier in the preset business group authorization table, determine whether the authorization type corresponding to the target business application in the preset business group authorization table is a business group authorization type; Determine whether the interface group identifier corresponding to the target business application in the preset business group authorization table is consistent with the interface group identifier of the business group to be invoked; If the authorization type corresponding to the target business application is a business group authorization type, and the corresponding interface group identifier is consistent with the interface group identifier of the business group to be called, then it is determined that the target business application has the calling permission of the business group to be called.

[0011] Optionally, the method further includes: Obtain the basic information of the business group, which includes: the original interface identifier of the business group, the original interface protocol type of the business group, the original interface path of the business group, the original interface authentication type of the business group, the proxy interface protocol of the business group, the proxy interface path of the business group, the proxy authentication type of the business group, the original interface blacklist and whitelist of the business group, the original interface rate limiting configuration of the business group, the original interface circuit breaker configuration of the business group, and the original interface encryption type of the business group. The path rule configuration information for the input business group is generated based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group. The routing information of the input business group is generated based on the original interface identifier, the original interface protocol type, the original interface path, and the proxy authentication type of the business group. The path rule configuration information of the input business group is stored in the preset path rule configuration table, and the routing information of the input business group is stored in the preset routing table.

[0012] Optionally, the path rule configuration information includes: the interface identifier of the business group, the proxy address of the business group, the proxy port of the business group, the proxy path of the business group, and the interface type of the business group; generating the path rule configuration information of the input business group based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group includes: The interface identifier of the business group is determined based on the original interface identifier of the business group; The proxy address, proxy port, proxy path, and interface type of the business group are determined based on the proxy interface path of the business group.

[0013] Optionally, the routing information includes: the interface identifier of the service group, the real address of the service group, the real port of the service group, the real path of the service group, and the authentication information of the service group; generating the routing information of the input service group based on the original interface identifier of the service group, the original interface protocol type of the service group, the original interface path of the service group, and the proxy authentication type of the service group includes: The interface identifier of the business group is determined based on the original interface identifier of the business group; The real address, real port, and real path of the business group are determined based on the original interface path of the business group. The authentication information of the business group is determined based on the proxy authentication type of the business group.

[0014] Optionally, the method further includes: Get the number of calls for each business group; A call count table for each business group is generated based on the number of calls to each business group and the interface group identifier of the business group.

[0015] Secondly, another embodiment of this application provides an authorization device for a service group interface, the device comprising: The acquisition module is used to acquire the business group interface authorization request of the target business application; the business group interface authorization request includes: the identifier of the target business application and the interface group identifier of the business group to be invoked; The authorization module is used to determine whether the target business application has the calling permission of the business group to be called based on the identifier of the target business application and the interface group identifier of the business group to be called, using a preset business group authorization table; wherein, the preset business group authorization table stores authorization information of multiple business groups.

[0016] Thirdly, another embodiment of this application provides an enterprise service bus, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the enterprise service bus is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the authorization method of any of the service group interfaces described in the first aspect above.

[0017] Fourthly, another embodiment of this application provides a storage medium storing a computer program, which, when executed by a processor, performs the steps of the authorization method for any of the service group interfaces described in the first aspect above.

[0018] The beneficial effects of this application are: This application provides a method for authorizing business group interfaces and an enterprise service bus. It obtains the business group interface authorization request of a target business application, and determines whether the target business application has the necessary access permissions for the business group based on the target application's identifier and the interface group identifier of the business group to be invoked, using a pre-defined business group authorization table. By obtaining the business group interface authorization request of the target business application and determining permissions based on its application identifier, the interface group identifier of the business group to be invoked, and the pre-defined business group authorization table, this application achieves structured, fine-grained, and efficient management of interface access control. Compared to traditional per-interface authorization or coarse-grained control based on user roles, using interface groups as the authorization unit reduces the number of permission configurations and lowers operational complexity. Simultaneously, by centrally managing access policies for multiple business groups through a unified authorization table, it supports rapid querying and dynamic updates, improving system scalability and security. Attached Figure Description To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating an authorization method for a business group interface provided in an embodiment of this application; Figure 2 A schematic diagram of the interface call flow of a business group in an authorization method for a business group interface provided in an embodiment of this application; Figure 3 A flowchart illustrating the process of determining the interface identifier in an authorization method for a business group interface provided in an embodiment of this application; Figure 4 A flowchart illustrating the determination of the actual interface path in an authorization method for a business group interface provided in an embodiment of this application; Figure 5 A flowchart illustrating the process of determining calling permissions in an authorization method for a business group interface provided in this application embodiment; Figure 6 A flowchart illustrating the process of generating a preset path rule configuration table and a preset routing table in an authorization method for a business group interface provided in this application embodiment; Figure 7 A flowchart illustrating the process of determining path rule configuration information in an authorization method for a business group interface provided in this application embodiment; Figure 8 A flowchart illustrating the generation of routing information in an authorization method for a service group interface provided in this application embodiment; Figure 9 A flowchart illustrating the generation of a call count table in an authorization method for a business group interface provided in this application embodiment; Figure 10 A schematic diagram of the structure of an authorization device for a service group interface provided in an embodiment of this application; Figure 11 This is a schematic diagram of an enterprise service bus structure provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0021] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0023] To clearly describe the provision method provided in the embodiments of this application, the method will be described below in conjunction with several accompanying drawings. The authorization method of the business group interface in this application is applied to the Enterprise Service Bus. The Enterprise Service Bus (ESB) is an enterprise basic software platform that implements standard interfaces for communication, interconnection, and conversion in a Service-Oriented Architecture (SOA) environment. It provides services to end-user applications or other services through published and discoverable interfaces. Figure 1A flowchart illustrating an authorization method for a business group interface provided in this application embodiment is shown below. Figure 1 As shown, the method includes: Step 101: Obtain the business group interface authorization request of the target business application.

[0024] The business group interface authorization request includes: the identifier of the target business application and the interface group identifier of the business group to be invoked. The target business application can be a front-end application connected to the enterprise service bus; specifically, it can be an application, a webpage, a third-party system, etc., but this embodiment does not impose such limitations. The business group interface contains multiple interfaces, which are a collection of functionally related or business-cohesive interfaces used to implement function calls for a specific business objective or service domain. The identifier of the target business application indicates the identity code of the application entity that needs to call other system interfaces. The interface group identifier of the business group to be invoked represents the identity code of a set of callable function-related interfaces.

[0025] Optionally, the target business application sends a business interface authorization request to the enterprise service bus, and the enterprise service bus accepts the identifier of the target business application and the interface group identifier of the business group to be invoked in the business group interface authorization request.

[0026] Step 102: Based on the identifier of the target business application and the interface group identifier of the business group to be called, determine whether the target business application has the calling permission of the business group to be called using a preset business group authorization table.

[0027] The preset business group authorization table stores authorization information for multiple business groups. This authorization information indicates which business applications can call each business group, or which business groups each business application can call. Call permissions indicate whether the target business application is allowed to execute all interfaces within a specific interface group.

[0028] In this embodiment, the business group interface authorization request of the target business application is obtained. Based on the identifier of the target business application and the interface group identifier of the business group to be invoked, a preset business group authorization table is used to determine whether the target business application has the calling permission for the business group to be invoked. This application achieves structured, fine-grained, and efficient management of interface access control by obtaining the business group interface authorization request of the target business application and determining permissions based on its application identifier and the interface group identifier of the business group to be invoked, combined with the preset business group authorization table. Compared with the traditional interface-by-interface authorization or coarse-grained control method based on user roles, using interface groups as the authorization unit reduces the number of permission configurations and lowers the complexity of operation and maintenance. At the same time, by centrally managing the access policies of multiple business groups through a unified authorization table, it supports fast querying and dynamic updates, improving the scalability and security of the system.

[0029] Based on the above embodiments, this application also provides a business group interface call flow in the authorization method for business group interfaces. Figure 2 This application provides a schematic diagram of the interface call flow for a business group in an authorization method for a business group interface, as illustrated in the embodiments of this application. Figure 2 As shown, based on steps 101-102 above, the method further includes: Step 201: If the target business application has the calling permission of the business group to be called, then return the authorization notification of the business group to be called.

[0030] Optionally, if the target application has the permission to invoke the business group to be invoked, meaning the target application can invoke the business group to be invoked, then an authorization notification for the business group to be invoked is returned to the target application. This authorization notification informs the target application that it can invoke the business group to be invoked.

[0031] Step 202: Receive the interface call request from the target business application for any interface in the business group to be called.

[0032] The interface call request includes: the interface path of any interface. The business group to be called includes the interface paths of multiple interfaces; the number of interfaces in different business groups varies, and this embodiment does not impose a limitation on this. The interface path is the interface path for any interface generated based on the Enterprise Service Bus. The interface path may include: a static path segment and a dynamic placeholder, where the dynamic placeholder is a preset interface variable field. Interfaces within the same business group have identical static path segments but different dynamic placeholders; that is, interfaces with identical static path segments but different dynamic placeholders can all be within the same business group.

[0033] Optionally, it receives interface call requests from the target business application for any interface in the business group to be called. The interface call request is generated based on the interface path of any interface.

[0034] Step 203: Based on the interface path of any interface, query the interface identifier of the business group corresponding to any interface from the preset path rule configuration table.

[0035] The preset path rule configuration table stores the business group interface identifiers corresponding to the interface paths, meaning that multiple interface paths within a unified business group correspond to the same business group interface identifier.

[0036] Optionally, based on the interface path of any interface, the interface identifier of the business group corresponding to any interface can be queried from the preset path rule configuration table. Here, the interface identifier is the interface identifier corresponding to all interfaces in the business group, and there is only one interface identifier for interfaces in the same business group.

[0037] Step 204: Based on the interface identifier of the corresponding business group, query the actual interface path of the business group to be called from the preset routing table.

[0038] The preset routing table stores interface identifiers and their corresponding actual interface paths. The actual interface path is the path taken when calling the business interface; this actual path does not traverse the enterprise service bus. Multiple interfaces within the same business group correspond to the actual interface path of the business group to be called in the preset routing table.

[0039] Optionally, the actual interface path corresponding to the interface identifier of the corresponding business group can be queried from the preset routing table. This actual interface path is the actual interface path of the business group to be called.

[0040] Step 205: Update the preset interface variable fields in the real interface path to the parameters of the preset interface variable fields in the interface path of any interface, and generate the real path of any interface.

[0041] Here, the path placeholders, determined for the target business application, are used to identify variable positions within a group of interfaces that share the same path structure but whose parts change dynamically. For example, when the actual interface path is http: / / 2.2.2.2:80 / esb / iserver / services / {Group} / rest / maps / , {Group} is a preset interface variable field.

[0042] Optionally, the preset interface variable fields in the real interface path are updated to the parameters of the preset interface variable fields in the interface path of any interface. That is, the real path for the business group in the real interface path is changed to the real path for any interface, thereby generating the real path of any interface.

[0043] Step 206: Based on the actual path of any interface, call any interface to execute the corresponding proxied business.

[0044] Optionally, based on the actual path of any interface, call any interface and execute the corresponding proxied business based on any interface to obtain the corresponding call result.

[0045] In this embodiment, if the target business application has the calling permission for the business group to be called, an authorization notification for the business group to be called is returned; an interface call request from the target business application for any interface in the business group to be called is received; based on the interface path of any interface, the interface identifier of the business group corresponding to any interface is queried from the preset path rule configuration table; based on the interface identifier of the corresponding business group, the real interface path of the business group to be called is queried from the preset routing table; the preset interface variable field in the real interface path is updated to the parameter of the preset interface variable field in the interface path of any interface, generating the real path of any interface; based on the real path of any interface, any interface is called to execute the corresponding proxied business. This application uses business groups for unified authorization and dynamic path matching, which significantly improves the management efficiency and system maintainability of interface calls. When calling an interface, the system automatically identifies the business group to which the request belongs according to the preset path rules, and dynamically extracts the variable parameters in the path through a placeholder mechanism to generate the corresponding real interface path in real time, achieving flexible and accurate routing forwarding. There is no need to configure routing and permissions for each interface individually. Even if the number of interfaces in a business group increases or decreases dynamically, there is no need to modify the configuration. This greatly reduces operation and maintenance costs, ensures configuration consistency, reduces system resource overhead, and enhances the service bus's adaptability to large-scale, high-frequency change scenarios.

[0046] Based on the above embodiments, this application also provides a process for determining the interface identifier in the authorization method for a business group interface. Figure 3 This application provides a flowchart illustrating the process of determining the interface identifier in an authorization method for a business group interface, as shown in the embodiments of this application. Figure 3 As shown, in step 203 above, based on the interface path of any interface, the interface identifier of the corresponding business group of any interface is queried from the preset path rule configuration table, including: Step 301: Match all fields in the interface path of any interface, except for the preset interface variable fields, with the path planning information in the preset path planning table.

[0047] Among them, the path planning information is the proxy interface path of the interface group.

[0048] Optionally, the interface path of any interface is divided into multiple fields other than the preset interface variable fields, and each path planning information in the preset path planning table is divided into multiple sets of multiple fields other than the preset interface variable fields. The multiple fields corresponding to the interface path of any interface are matched with the multiple fields corresponding to each path planning information.

[0049] Step 302: If there is target path rule information in the preset path planning table that matches the interface path of any interface, then the interface identifier of the target path planning information shall be used as the interface identifier of the business group corresponding to any interface.

[0050] Optionally, if multiple fields corresponding to the interface path of any interface match multiple fields corresponding to a certain path planning information in each path planning information, a successful match indicates that there is target path rule information in the preset path planning table that matches the interface path of any interface. The target path rule information is the path planning information that successfully matches the interface path of any interface. Based on the target path rule information, the interface identifier corresponding to the target rule information is determined from the preset path planning table as the interface identifier of the business group corresponding to any interface.

[0051] In this embodiment, all fields in the interface path of any interface, except for the preset interface variable fields, are matched with the path planning information in the preset path planning table. If there is target path rule information in the preset path planning table that matches the interface path of any interface, then the interface identifier of the target path planning information is used as the interface identifier of the business group corresponding to any interface. This application does not require configuring routing rules separately for each specific interface. As long as the non-variable part of the request path is consistent with the fixed path structure of a certain business group rule, it can be automatically assigned to the corresponding business group. This not only reduces the number of rules and configuration and maintenance costs, but also supports the dynamic expansion of interface family members. New interfaces can be automatically identified and proxied as long as they conform to the original path pattern, without the need to modify the configuration or redeploy, thus improving the system's flexibility, scalability, and automation capabilities.

[0052] Based on the above embodiments, this application also provides a process for determining the real interface path in the authorization method of a business group interface. Figure 4 This application provides a flowchart illustrating the process of determining the actual interface path in an authorization method for a business group interface, as shown in the embodiments of this application. Figure 4 As shown, in step 204 above, the actual interface path of the business group to be called is queried from the preset routing table based on the interface identifier of the corresponding business group, including: Step 401: Determine the corresponding route identifier from multiple route information entries in the preset routing table based on the interface identifier of the corresponding business group.

[0053] Each routing entry is a set of routing records, with each entry representing an interface identifier and its corresponding routing identifier. The routing identifier indicates the number of an interface identifier.

[0054] Optionally, based on the interface identifier of the corresponding business group, the routing information corresponding to the interface identifier is determined from multiple routing information entries in the preset routing table, and the routing identifier in the routing information is determined as the corresponding routing identifier of the interface identifier of the corresponding business group.

[0055] Step 402: Determine the corresponding interface path from the routing information of the corresponding route identifier as the real interface path of the business group to be called.

[0056] Optionally, the interface path corresponding to the corresponding route identifier is determined in the routing information of the corresponding route identifier, and used as the actual interface path of the business group to be called.

[0057] In this embodiment, based on the interface identifier of the corresponding business group, a corresponding route identifier is determined from multiple routing entries in a preset routing table; the corresponding interface path is then determined from the routing information of the corresponding route identifier as the actual interface path of the business group to be called. This application manages business groups and actual interface paths through a structured data table, enabling a group of interfaces to complete the overall proxy by configuring only one unified routing rule. This reduces routing redundancy in the system, lowers resource overhead and maintenance complexity, improves the execution efficiency of request forwarding, and enhances the scalability and stability of the system.

[0058] Based on the above embodiments, this application also provides a process for determining calling permissions in the authorization method of a business group interface. Figure 5 A flowchart illustrating the process of determining calling permissions in an authorization method for a business group interface provided in this application embodiment is shown below. Figure 5 As shown, in step 102 above, based on the identifier of the target business application and the interface group identifier of the business group to be invoked, a preset business group authorization table is used to determine whether the target business application has the calling permission for the business group to be invoked, including: Step 501: Determine whether the target business application's identifier is present in the preset business group authorization table.

[0059] For example, Table 1 is a schematic table of a preset service group authorization provided in an embodiment of this application, as shown in Table 1: Table 1. An example of a pre-defined service group authorization table.

[0060] The preset business group authorization table includes: authorization identifier, business group interface identifier, authorized application identifier, and authorization type. The authorization identifier indicates each authorization item, and the authorization type is the interface type. When the interface is an interface of a business group, the authorization type is group.

[0061] Optionally, the identifier of the target business application is determined from the authorized application identifier in the preset business group authorization table to determine whether it has the identifier of the target business application.

[0062] Step 502: If the preset business group authorization table contains the identifier of the target business application, determine whether the authorization type corresponding to the target business application in the preset business group authorization table is a business group authorization type.

[0063] Optionally, if the preset business group authorization table contains an identifier for the target business application, and the specification indicates that the target business application has calling permissions for a certain interface or interface group, then it is determined whether the authorization type corresponding to the target business application in the preset business group authorization table is a business group authorization type.

[0064] Step 503: Determine whether the interface group identifier corresponding to the target business application in the preset business group authorization table is consistent with the interface group identifier of the business group to be called.

[0065] Optionally, it can be determined whether the interface group identifier corresponding to the target business application in the preset business group authorization table is consistent with the interface group identifier of the business group to be called, that is, to determine whether the target business application can call the business group to be called.

[0066] Step 504: If the authorization type corresponding to the target business application is the business group authorization type, and the corresponding interface group identifier is consistent with the interface group identifier of the business group to be called, then it is determined that the target business application has the calling permission of the business group to be called.

[0067] Optionally, if the authorization type corresponding to the target business application is a business group authorization type, and the corresponding interface group identifier is consistent with the interface group identifier of the business group to be called, it means that the target business application can call the business group and the authorization type of the called business group is a business group authorization type, then it is determined that the target business application has the calling permission of the business group to be called.

[0068] In this embodiment, interface access permissions can be managed with a one-time authorization that applies to the entire group. This avoids the cumbersome process of repeatedly applying for and configuring authorization for each interface in the group, which is required in traditional solutions. This improves authorization efficiency and user experience. By distinguishing authorization types and strictly verifying the ownership of interface groups, the risk of unauthorized access is effectively prevented, and system security is ensured.

[0069] Based on the above embodiments, this application also provides a process for generating a preset path rule configuration table and a preset routing table in the authorization method of a business group interface. Figure 6 A flowchart illustrating the process of generating a preset path rule configuration table and a preset routing table in an authorization method for a service group interface provided in this application embodiment is shown below. Figure 6 As shown, based on steps 201-206 above, the method further includes: Step 601: Obtain the basic information of the business group.

[0070] The basic information of the business group includes: the original interface identifier of the business group, the original interface protocol type of the business group, the original interface path of the business group, the original interface authentication type of the business group, the proxy interface protocol of the business group, the proxy interface path of the business group, the proxy authentication type of the business group, the original interface blacklist and whitelist of the business group, the original interface rate limiting configuration of the business group, the original interface circuit breaker configuration of the business group, and the original interface encryption type of the business group.

[0071] The original interface identifier of a business group is used to indicate the unique identifier of a group of interfaces or interface families in the source system. The original interface protocol type of a business group refers to the actual communication protocol supported by the proxied interface, such as HTTP, HTTPS, FTP, WebSocket, SOAP, etc. The original interface path of a business group refers to the actual access path template of the proxied interface in the source system, containing preset interface variable fields representing the common path structure of a group of interfaces. The original interface authentication type of a business group is the authentication method required by the source system for interface access. The proxy interface protocol of a business group refers to the communication protocol type exposed by the enterprise service bus to the caller. The proxy interface path of a business group refers to the unified external access path allocated by the service bus to this business group, also containing preset interface variable fields. The proxy authentication type of a business group refers to the method by which the service bus verifies the identity of the caller. The original interface blacklist / whitelist of a business group refers to the access control list, such as IP addresses and client identifiers, that the source system allows or denies access to. The original interface rate limiting configuration of a business group refers to the call frequency limiting strategy for the entire business group or individual member interfaces, such as the maximum number of calls per second. The circuit breaker configuration for the business group's original interfaces refers to the call frequency limit strategy for the entire business group or individual member interfaces, such as the maximum number of calls per second. The encryption type for the business group's original interfaces is a protection mechanism parameter that automatically stops forwarding requests for a period of time when the backend service fails consecutively to a threshold.

[0072] Optionally, the basic information of the business group can be entered into the enterprise service bus by a third-party device or manually to obtain the basic information of the business group.

[0073] Step 602: Generate and input the path rule configuration information of the business group based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group. Optionally, the path rule configuration information for the business group can be generated and entered by extracting the content related to the path rule configuration information from the original interface identifier, the proxy interface path, and the original interface protocol type of the business group.

[0074] Step 603: Generate and input the routing information of the business group based on the original interface identifier, the original interface protocol type, the original interface path, and the proxy authentication type of the business group.

[0075] Optionally, routing information related to the business group can be extracted from the original interface identifier, the original interface protocol type, the original interface path, and the proxy authentication type of the business group to generate and enter the routing information of the business group.

[0076] Step 604: Store the path rule configuration information of the entered business group into the preset path rule configuration table, and store the routing information of the entered business group into the preset routing table.

[0077] In this embodiment, the original decentralized configuration for a single interface is upgraded to unified rule generation at the business group level, which significantly reduces the number of configuration items and repetitive operations, improves input efficiency and system maintainability. By separating the front-end matching rules and the back-end forwarding rules and storing them in the path rule configuration table and the routing table respectively, the decoupling design of access control and service forwarding is realized. This ensures the accuracy and security of request matching, while supporting flexible protocol conversion and authentication adaptation. There is no need to input or modify rules one by one. Even if the number of interfaces changes dynamically, consistent management can be achieved, which greatly reduces operation and maintenance costs and improves the automation capability and scalability of the service bus in large-scale, high-frequency change scenarios.

[0078] Based on the above embodiments, the path rule configuration information includes: the interface identifier of the business group, the proxy address of the business group, the proxy port of the business group, the proxy path of the business group, and the interface type of the business group. This application also provides a process for determining the path rule configuration information in the authorization method for business group interfaces. Figure 7 This is a flowchart illustrating the process of determining path rule configuration information in an authorization method for a business group interface provided in an embodiment of this application, as shown below. Figure 7 As shown, in step 602 above, path rule configuration information for the business group is generated and entered based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group, including: Step 701: Determine the interface identifier of the business group based on the original interface identifier of the business group.

[0079] The original interface identifier refers to the identification information of a group of proxied interfaces. The interface identifier of the business group is an identifier generated by the service bus for the business group, used to represent a group of interfaces with common path characteristics.

[0080] Optionally, the original interface identifier of the business group can be used as the interface identifier of the business group, or the original interface identifier of the business group can be used as the interface identifier of the business group after adding the corresponding enterprise service bus identifier.

[0081] Step 702: Determine the proxy address, proxy port, proxy path, and interface type of the business group based on the proxy interface path of the business group.

[0082] The proxy interface path is the entry path used when calling interfaces through the Enterprise Service Bus. The proxy address of the business group is the Internet Protocol (IP) address of the host providing services externally through the Enterprise Service Bus. The proxy port of the business group is the service port listened to by the Enterprise Service Bus. The proxy path of the business group is the Uniform Resource Locator (URL) path through which the Service Bus receives requests. A group of business interfaces is identified by the placeholder `{Group}`, which is a preset variable field. The URL path format is ` / xxx / ... / {Group} / yyy / ... / `, with no limit on the number of path levels. This indicates that what is being proxied is not a single interface, but a group of business interfaces. The characteristic of all interface URL paths in the interface group is that the part before the placeholder `{Group}` (` / xxx / ... / `) and the part after it (` / yyy / ... / `) are the same. "Same" means that the number of levels and the content divided by " / " must be identical. The interface type of the business group is the interface group type.

[0083] Optionally, the proxy interface path of the business group is parsed to obtain the proxy address, proxy port, proxy path, and interface type of the business group.

[0084] For example, Table 2 is a schematic table of a preset path configuration provided in an embodiment of this application, as shown in Table 2: Table 2. Configuration diagram of a preset path

[0085] It can be seen that the interface identifier of the business group is 411947801821917, the interface type is an interface group of interface group type, the proxy address is 2.2.2.2, the proxy port is 80, and the proxy path is / esb / iserver / services / {Group} / rest / maps / .

[0086] In this embodiment, the interface identifier of the business group is determined based on the original interface identifier of the business group; the proxy address, proxy port, proxy path, and interface type of the business group are determined based on the proxy interface path of the business group. This application reduces the number of configuration items, avoids repeatedly defining resource information for each interface, improves configuration efficiency and consistency, reduces system maintenance costs, and enhances the flexibility and scalability of the service bus in large-scale, dynamic interface scenarios.

[0087] Based on the above embodiments, the routing information includes: the interface identifier of the service group, the real address of the service group, the real port of the service group, the real path of the service group, and the authentication information of the service group. This application embodiment provides a process for generating routing information in a service group interface authorization method. Figure 8 This is a flowchart illustrating the process of generating routing information in an authorization method for a service group interface provided in an embodiment of this application, as shown below. Figure 8 As shown, in step 603 above, routing information for the business group is generated and entered based on the original interface identifier, original interface protocol type, original interface path, and proxy authentication type of the business group, including: Step 801: Determine the interface identifier of the business group based on the original interface identifier of the business group.

[0088] The original interface identifier refers to the identification information of a group of proxied interfaces. The interface identifier of the business group is an identifier generated by the service bus for the business group, used to represent a group of interfaces with common path characteristics.

[0089] Optionally, the original interface identifier of the business group can be used as the interface identifier of the business group, or the original interface identifier of the business group can be used as the interface identifier of the business group after adding the corresponding enterprise service bus identifier.

[0090] Step 802: Determine the real address, real port, and real path of the business group based on the original interface path of the business group.

[0091] The original interface path of the business group is the complete URL path of the real interface being proxied. The real address of the business group is the server IP address or domain name where the real service resides. The real port of the business group is the network port number that the real service listens on. The real path of the business group is the interface path provided by the real service.

[0092] Optionally, the original interface path of the business group can be parsed to obtain the real address, real port, and real path of the business group.

[0093] Step 803: Determine the authentication information of the business group based on the agent authentication type of the business group.

[0094] The proxy authentication type of the business group refers to the client authentication method required when the service bus provides proxy interfaces to the outside world, that is, how the caller needs to prove its identity to access the business group's interface. The authentication information service bus for the business group configures a complete set of authentication processing rules for the business group, which may include: authentication method, authentication check logic, permission approval process binding information, etc. This application embodiment does not limit these.

[0095] For example, Table 3 is a schematic table of preset routes provided in an embodiment of this application, as shown in Table 3: Table 3. A schematic diagram of a preset route.

[0096] The route identifier is generated based on the number of routes, for example, it can be 1, 2, 3... or A, B, C... etc., and this embodiment of the application does not impose such limitations. The interface group with the service group interface identifier 411947801821917 has a corresponding real address of 1.1.1.1, a real port of 80, a real path of / iserver / services / {Group} / rest / maps / , and authentication information of xxx.

[0097] In this embodiment, the interface identifier of the business group is determined based on its original interface identifier; the real address, real port, and real path of the business group are determined based on its original interface path; and the authentication information of the business group is determined based on its proxy authentication type. This application reduces redundant configuration items, avoids the configuration redundancy and inconsistency risks caused by setting each interface independently, improves system configuration efficiency and security, and reduces the operational complexity and resource overhead of the service bus by uniformly binding the interface identifier, routing information, and authentication policy to the business group, thereby enhancing the adaptability to scenarios with dynamic changes in interface scale.

[0098] Based on the above embodiments, this application also provides a process for generating a call count table in the authorization method of a business group interface. Figure 9 A flowchart illustrating the generation of a call count table in an authorization method for a business group interface provided in this application embodiment is shown below. Figure 9 As shown, based on steps 201-206 above, the method further includes: Step 901: Obtain the number of calls for each business group.

[0099] Optionally, a counter can be set for each business group. Each time a business group is called, the corresponding counter is incremented by 1, thereby calculating the number of times each business group is called based on the counter.

[0100] Step 902: Generate a call count table for each business group based on the call count of each business group and the interface group identifier of the business group.

[0101] The call count table for each business group includes: the interface identifier of the business group, the number of calls made by the business group, and the type of the business group. The call count table can include multiple business groups.

[0102] For example, Table 4 is a schematic table of the number of calls to the service group provided in the embodiments of this application, as shown in Table 4: Table 4. Indicator of Call Count for Business Groups

[0103] Optionally, a call count table for each business group can be generated based on the interface identifier of each business group, the number of calls for each business group, and the type of each business group.

[0104] In this embodiment, the number of calls for each business group is obtained; based on the number of calls for each business group and the interface group identifier of the business group, a call count table for the business group is generated. This application achieves unified call statistics at the business group level by obtaining the number of calls for each business group and combining it with the interface group identifier to generate a call count table for the business group. This avoids the high complexity and low real-time performance issues caused by counting individual interfaces separately and then aggregating them in the traditional method, improves monitoring and operational analysis efficiency, reduces system resource waste in counter management, and enhances the automation level and scalability of the statistical mechanism.

[0105] Based on the same inventive concept, this application also provides an authorization device for a business group interface corresponding to the authorization method of the business group interface. Since the principle of the device in this application is similar to the authorization method of the business group interface described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0106] Figure 10 This application provides a schematic diagram of the structure of an authorization device for a service group interface, the device comprising: The acquisition module 1001 is used to acquire the business group interface authorization request of the target business application; the business group interface authorization request includes: the identifier of the target business application and the interface group identifier of the business group to be invoked; The authorization module 1002 is used to determine whether the target business application has the calling permission of the business group to be called based on the identifier of the target business application and the interface group identifier of the business group to be called, using a preset business group authorization table; wherein, the preset business group authorization table stores authorization information of multiple business groups.

[0107] In one possible implementation, the device further includes: a calling module, specifically used for: If the target business application has the calling permission of the business group to be called, then the authorization notification of the business group to be called is returned; Receive the interface call request from the target business application for any interface in the business group to be called, wherein the interface call request includes: the interface path of any interface; Based on the interface path of any of the interfaces, query the interface identifier of the business group corresponding to any of the interfaces from the preset path rule configuration table; Based on the interface identifier of the corresponding business group, query the actual interface path of the business group to be called from the preset routing table; The preset interface variable field in the real interface path is updated to the parameter of the preset interface variable field in the interface path of any interface, thereby generating the real path of any interface; Based on the actual path of any of the interfaces, call any of the interfaces to execute the corresponding proxied business.

[0108] In one possible implementation, the calling module is specifically used to: match all fields in the interface path of any interface, except for the preset interface variable fields, with the path planning information in the preset path planning table; If the preset path planning table contains target path rule information that matches the interface path of any of the interfaces, then the interface identifier of the target path planning information is used as the interface identifier of the business group corresponding to any of the interfaces.

[0109] In one possible implementation, the calling module is specifically used to: determine the corresponding route identifier from multiple routing information entries in the preset routing table based on the interface identifier of the corresponding business group; The corresponding interface path is determined from the routing information of the corresponding route identifier as the actual interface path of the business group to be called.

[0110] In one possible implementation, the authorization module 1002 is specifically used to: determine whether the identifier of the target business application is present in the preset business group authorization table; If the target business application has an identifier in the preset business group authorization table, determine whether the authorization type corresponding to the target business application in the preset business group authorization table is a business group authorization type; Determine whether the interface group identifier corresponding to the target business application in the preset business group authorization table is consistent with the interface group identifier of the business group to be invoked; If the authorization type corresponding to the target business application is a business group authorization type, and the corresponding interface group identifier is consistent with the interface group identifier of the business group to be called, then it is determined that the target business application has the calling permission of the business group to be called.

[0111] In one possible implementation, the calling module is further configured to: obtain the basic information of the input business group, wherein the basic information of the business group includes: the original interface identifier of the business group, the original interface protocol type of the business group, the original interface path of the business group, the original interface authentication type of the business group, the proxy interface protocol of the business group, the proxy interface path of the business group, the proxy authentication type of the business group, the original interface blacklist and whitelist of the business group, the original interface rate limiting configuration of the business group, the original interface circuit breaker configuration of the business group, and the original interface encryption type of the business group. The path rule configuration information for the input business group is generated based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group. The routing information of the input business group is generated based on the original interface identifier, the original interface protocol type, the original interface path, and the proxy authentication type of the business group. The path rule configuration information of the input business group is stored in the preset path rule configuration table, and the routing information of the input business group is stored in the preset routing table.

[0112] In one possible implementation, the path rule configuration information includes: the interface identifier of the business group, the proxy address of the business group, the proxy port of the business group, the proxy path of the business group, and the interface type of the business group; the calling module is specifically used to: determine the interface identifier of the business group based on the original interface identifier of the business group; The proxy address, proxy port, proxy path, and interface type of the business group are determined based on the proxy interface path of the business group.

[0113] In one possible implementation, the routing information includes: the interface identifier of the service group, the real address of the service group, the real port of the service group, the real path of the service group, and the authentication information of the service group; the calling module is specifically used to: determine the interface identifier of the service group based on the original interface identifier of the service group; The real address, real port, and real path of the business group are determined based on the original interface path of the business group. The authentication information of the business group is determined based on the proxy authentication type of the business group.

[0114] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0115] In one possible implementation, the apparatus further includes a generation module, which is specifically used for: Get the number of calls for each business group; A call count table for each business group is generated based on the number of calls to each business group and the interface group identifier of the business group.

[0116] This application also provides an enterprise service bus. Figure 11 This application provides a schematic diagram of an enterprise service bus architecture, as shown in the embodiments below. Figure 11 As shown, the enterprise service bus includes a processor 1101 and a memory 1102, and optionally, a bus 1103. The memory 1102 stores machine-readable instructions executable by the processor 1101. When the enterprise service bus is running, the processor 1101 and the memory 1102 communicate via the bus 1103. When the machine-readable instructions are executed by the processor 1101, the steps of the authorization method of the aforementioned service group interface are performed.

[0117] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the authorization method for the aforementioned business group interface.

[0118] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0119] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0120] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An authorization method for a business group interface, characterized in that, Applied to an enterprise service bus, the method includes: Obtain the business group interface authorization request of the target business application; the business group interface authorization request includes: the identifier of the target business application and the interface group identifier of the business group to be invoked; Based on the identifier of the target business application and the interface group identifier of the business group to be invoked, a preset business group authorization table is used to determine whether the target business application has the calling permission of the business group to be invoked; wherein, the preset business group authorization table stores authorization information of multiple business groups.

2. The method according to claim 1, characterized in that, The method further includes: If the target business application has the calling permission of the business group to be called, then the authorization notification of the business group to be called is returned; Receive the interface call request from the target business application for any interface in the business group to be called, wherein the interface call request includes: the interface path of any interface; Based on the interface path of any of the interfaces, query the interface identifier of the business group corresponding to any of the interfaces from the preset path rule configuration table; Based on the interface identifier of the corresponding business group, query the actual interface path of the business group to be called from the preset routing table; The preset interface variable field in the real interface path is updated to the parameter of the preset interface variable field in the interface path of any interface, thereby generating the real path of any interface; Based on the actual path of any of the interfaces, call any of the interfaces to execute the corresponding proxied business.

3. The method according to claim 2, characterized in that, The step of querying the interface identifier of the corresponding business group of any interface from the preset path rule configuration table based on the interface path of any interface includes: Match all fields in the interface path of any interface, except for the preset interface variable fields, with each path planning information in the preset path planning table; If the preset path planning table contains target path rule information that matches the interface path of any of the interfaces, then the interface identifier of the target path planning information is used as the interface identifier of the business group corresponding to any of the interfaces.

4. The method according to claim 2, characterized in that, The step of querying the actual interface path of the business group to be called from the preset routing table based on the interface identifier of the corresponding business group includes: Based on the interface identifier of the corresponding business group, determine the corresponding route identifier from multiple route information entries in the preset routing table; The corresponding interface path is determined from the routing information of the corresponding route identifier as the actual interface path of the business group to be called.

5. The method according to claim 1, characterized in that, The step of determining whether the target business application has the calling permission of the business group to be called, based on the identifier of the target business application and the interface group identifier of the business group to be called, using a preset business group authorization table, includes: Determine whether the identifier of the target business application is present in the preset business group authorization table; If the target business application has an identifier in the preset business group authorization table, determine whether the authorization type corresponding to the target business application in the preset business group authorization table is a business group authorization type; Determine whether the interface group identifier corresponding to the target business application in the preset business group authorization table is consistent with the interface group identifier of the business group to be invoked; If the authorization type corresponding to the target business application is a business group authorization type, and the corresponding interface group identifier is consistent with the interface group identifier of the business group to be called, then it is determined that the target business application has the calling permission of the business group to be called.

6. The method according to claim 2, characterized in that, The method further includes: Obtain the basic information of the business group, which includes: the original interface identifier of the business group, the original interface protocol type of the business group, the original interface path of the business group, the original interface authentication type of the business group, the proxy interface protocol of the business group, the proxy interface path of the business group, the proxy authentication type of the business group, the original interface blacklist and whitelist of the business group, the original interface rate limiting configuration of the business group, the original interface circuit breaker configuration of the business group, and the original interface encryption type of the business group. The path rule configuration information for the input business group is generated based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group. The routing information of the input business group is generated based on the original interface identifier, the original interface protocol type, the original interface path, and the proxy authentication type of the business group. The path rule configuration information of the input business group is stored in the preset path rule configuration table, and the routing information of the input business group is stored in the preset routing table.

7. The method according to claim 6, characterized in that, The path rule configuration information includes: the interface identifier of the business group, the proxy address of the business group, the proxy port of the business group, the proxy path of the business group, and the interface type of the business group; generating the path rule configuration information of the input business group based on the original interface identifier of the business group, the proxy interface path of the business group, and the original interface protocol type of the business group includes: The interface identifier of the business group is determined based on the original interface identifier of the business group; The proxy address, proxy port, proxy path, and interface type of the business group are determined based on the proxy interface path of the business group.

8. The method according to claim 6, characterized in that, The routing information includes: the interface identifier of the service group, the real address of the service group, the real port of the service group, the real path of the service group, and the authentication information of the service group; generating the routing information of the entered service group based on the original interface identifier of the service group, the original interface protocol type of the service group, the original interface path of the service group, and the proxy authentication type of the service group includes: The interface identifier of the business group is determined based on the original interface identifier of the business group; The real address, real port, and real path of the business group are determined based on the original interface path of the business group. The authentication information of the business group is determined based on the proxy authentication type of the business group.

9. The method according to claim 2, characterized in that, The method further includes: Get the number of calls for each business group; A call count table for each business group is generated based on the number of calls to each business group and the interface group identifier of the business group.

10. An enterprise service bus, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when the Enterprise Service Bus is running, are executed by the processor to perform the steps of the authorization method for the business group interface as described in any one of claims 1 to 9.

Images