Interaction method and device based on micro-service architecture, equipment and storage medium

Abstract

The embodiment of the invention provides an interaction method and device based on a micro-service architecture, equipment and a storage medium. The micro-service architecture comprises an application program front-end node, an application service cluster, a sandbox cluster and a service interface outside the sandbox cluster, and the method is applied to the application service cluster. The method comprises the following steps: receiving an interaction request from a front-end node of the application program; determining a target interaction path based on the interaction request; the candidate interaction path comprises a first path for interaction based on the sandbox cluster and a second path for interaction based on the service interface; in response to the fact that the target interaction path is the first path, determining a target processing component instance based on the interaction request; and based on the target processing component instance, obtaining a response result of the interaction request. According to the method, the security and flexibility of the application service cluster are improved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to an interaction method, device, equipment and storage medium based on a microservice architecture. Background Technology

[0002] In modern enterprise application systems, distributed systems based on microservice architecture are widely used due to their high scalability, flexibility, and maintainability.

[0003] However, existing microservice architectures face a dilemma in the process of open interaction: excessive openness may lead to security risks such as malicious attacks and data leaks, while excessive isolation will limit the system's scalability and business innovation efficiency.

[0004] Therefore, there is an urgent need for an interaction mechanism that can both ensure system security and enable flexible and open interaction, in order to meet the ever-changing business needs and strict security compliance requirements. Summary of the Invention

[0005] This application provides an interaction method, apparatus, device, and storage medium based on a microservice architecture to improve the security and flexibility of application service clusters.

[0006] In a first aspect, embodiments of this application provide an interaction method based on a microservice architecture, the microservice architecture including: an application front-end node, an application service cluster, a sandbox cluster, and service interfaces outside the sandbox cluster, wherein the sandbox cluster deploys multiple processing component instances, and the method is applied to the application service cluster, the method including:

[0007] Receive interaction requests from the application's front-end node;

[0008] Based on the interaction request, a target interaction path is determined from multiple candidate interaction paths; the candidate interaction paths include: a first path for interaction based on the sandbox cluster, and a second path for interaction based on the service interface;

[0009] In response to the target interaction path being the first path, a target processing component instance is determined from the plurality of processing component instances based on the interaction request;

[0010] Based on the target processing component instance, obtain the response result of the interaction request;

[0011] The response result is fed back to the application's front-end node.

[0012] In one possible implementation, the application service cluster includes: a request verification layer and a smart gateway layer, wherein determining the target processing component instance from the plurality of processing component instances based on the interaction request includes:

[0013] The request verification layer performs security verification on the interaction request to obtain the security verification result of the interaction request. When the security verification result is used to indicate that the verification is successful, the interaction request is forwarded to the smart gateway layer.

[0014] Based on the interaction request, the target processing component instance is determined from the plurality of processing component instances through the intelligent gateway layer.

[0015] In one possible implementation, the security verification includes: verifying the permissions of the requester of the interaction request, and verifying whether the requester's request frequency is greater than or equal to a preset frequency.

[0016] In one possible implementation, obtaining the response result of the interaction request based on the target processing component instance includes:

[0017] The smart gateway layer routes the interaction request to the target processing component instance; the target processing component instance executes the interaction request and obtains the response result.

[0018] The intelligent gateway layer receives the response result from the target processing component instance and forwards the response result to the request verification layer.

[0019] In one possible implementation, the application service cluster further includes: an application interaction layer, wherein the step of feeding back the response result to the application front-end node includes:

[0020] The response result is forwarded to the application interaction layer through the request verification layer.

[0021] The response result is fed back to the application front-end node through the application interaction layer.

[0022] In one possible implementation, the method further includes:

[0023] When the security verification result is used to indicate that the verification failed, the request verification layer sends a first prompt message to the application interaction layer. The first prompt message is used to indicate that the interaction request is prohibited from interacting based on the first path.

[0024] The application interaction layer sends a second message indicating interaction failure to the application front-end node.

[0025] In one possible implementation, determining the target interaction path from multiple candidate interaction paths based on the interaction request includes:

[0026] The interaction request is parsed to obtain the target fields included in the interaction request;

[0027] Based on the target field and the preset mapping relationship between the field and the interaction path, the target interaction path is determined.

[0028] In one possible implementation, the method further includes:

[0029] In response to the target interaction path being the second path, the service interface invocation instruction is executed;

[0030] The response result of the interaction request is obtained through the service interface;

[0031] The response result is fed back to the application's front-end node.

[0032] Secondly, embodiments of this application provide an interactive device based on a microservice architecture, the microservice architecture including: an application front-end node, an application service cluster, a sandbox cluster, and a service interface outside the sandbox cluster, the sandbox cluster deploying multiple processing component instances, the device being applied to the application service cluster, the device comprising:

[0033] A receiving module is used to receive interaction requests from the application's front-end node;

[0034] The first determining module is used to determine a target interaction path from multiple candidate interaction paths based on the interaction request; the candidate interaction paths include: a first path for interaction based on the sandbox cluster, and a second path for interaction based on the service interface;

[0035] The second determining module is configured to, in response to the target interaction path being the first path, determine a target processing component instance from the plurality of processing component instances based on the interaction request;

[0036] The acquisition module is used to acquire the response result of the interaction request based on the target processing component instance;

[0037] The feedback module is used to send the response result back to the application front-end node.

[0038] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0039] The memory stores computer-executed instructions;

[0040] The processor executes computer execution instructions stored in the memory, causing the processor to perform the method described in any of the first aspects above.

[0041] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in any of the first aspects above.

[0042] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in any of the first aspects above.

[0043] This application provides an interaction method, apparatus, device, and storage medium based on a microservice architecture. By clearly defining each part of the microservice architecture and the interaction path, the application service cluster can flexibly select the appropriate path and processing component instance according to the request. This enables the application service cluster to efficiently allocate resources, quickly obtain response results, and provide feedback based on different interaction requests. Under the premise of ensuring security, this improves the interaction efficiency and resource utilization of the application service cluster and can better cope with diverse interaction needs. Attached Figure Description

[0044] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0045] Figure 1 A flowchart illustrating an interaction method based on a microservice architecture provided in this application embodiment;

[0046] Figure 2 A schematic diagram of the structure of an interactive device based on a microservice architecture provided in this application;

[0047] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application.

[0048] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0049] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0050] In this application, the term "comprising" and its variations can refer to non-limiting inclusion; the term "or" and its variations can refer to "and / or". The terms "first", "second", etc., in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0052] In modern enterprise application systems, distributed systems based on microservice architecture are widely used due to their high scalability, flexibility, and maintainability. For example, a bank's online payment system needs to interact with external systems such as third-party payment platforms, risk control systems, and user authentication services, while ensuring the security of core data (such as user account information and transaction records).

[0053] However, to address the open interaction issues in microservice architectures, the main solutions employed are reserved interfaces and sandbox isolation, as well as Application Programming Interface (API) gateways. The reserved interface and sandbox isolation solution predefines standardized interfaces (slots) within the microservice architecture, allowing external modules to call system functions through a sandbox environment. The sandbox restricts the execution scope of external code through resource isolation, access control, and behavior monitoring, preventing malicious code from disrupting core system functions. However, these solutions have significant drawbacks: the strict isolation mechanism of the sandbox significantly increases communication latency and degrades system performance; simultaneously, the fixed interface design struggles to adapt to dynamically changing business needs, resulting in limited system openness.

[0054] API gateway solutions manage external requests centrally, enabling traffic control, authentication, and request filtering. The gateway ensures system security by hiding internal service details and limiting request frequency. However, the scope of API interface access is difficult to control precisely, and external systems may obtain sensitive data through the interface, posing a database leakage risk. Furthermore, API gateways are costly to deploy and maintain, requiring a management platform for policy updates and log analysis, increasing system complexity.

[0055] Therefore, existing microservice architectures face a dilemma in open interaction: excessive openness may lead to security risks such as malicious attacks and data leaks, while excessive isolation can limit the system's scalability and business innovation efficiency. This application's embodiments, by clearly defining the various parts of the microservice architecture and their interaction paths, enable the application service cluster to flexibly select appropriate paths and processing component instances based on requests. This allows the application service cluster to efficiently allocate resources, quickly obtain response results, and provide feedback based on different interaction requests. While ensuring security, this improves the interaction efficiency and resource utilization of the application service cluster, better addressing diverse interaction needs.

[0056] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0057] In this embodiment, the microservice architecture may include application front-end nodes, application service clusters, sandbox clusters, and service interfaces outside the sandbox clusters. The application front-end node can be the entry point for user interaction with the system, such as a front-end application or user interface. In one implementation, the application front-end node may be simply referred to as an application node.

[0058] An application service cluster can be a collection of multiple application service instances that collectively provide a set of related business functions, such as user management or order processing. Optionally, an application service cluster can include one or more of the following: a request validation layer, a smart gateway layer, and an application interaction layer.

[0059] Sandbox clusters can be used to deploy service instances that require isolated runtime environments or process sensitive data. By providing independent runtime environments, sandbox clusters ensure isolation and security between service instances. A sandbox cluster deploys multiple processing component instances, and service interfaces outside the sandbox cluster can communicate with the service instances within the sandbox cluster.

[0060] It should be noted that the executing entity of this application can be the aforementioned application service cluster, which can be deployed on any electronic device with processing capabilities, such as a user terminal or a server, for example, a computer.

[0061] Figure 1 This is a flowchart illustrating an interaction method based on a microservice architecture, provided as an embodiment of this application. Figure 1 As shown, the method includes:

[0062] S101, Receive an interaction request from the application front-end node.

[0063] Optionally, the interaction request may include user action intent, such as clicking a button, submitting a form, or any one or more of these actions. The interaction request may also include relevant parameters, such as a user identifier, request content, or any one or more of these parameters. Optionally, the application service cluster may receive interaction requests from the application frontend nodes via network protocols.

[0064] S102. Based on the interaction request, determine the target interaction path from multiple candidate interaction paths; the candidate interaction paths include: a first path based on the sandbox cluster for interaction, and a second path based on the service interface for interaction.

[0065] Optionally, the candidate interaction path can be a variety of optional logical routes preset by the application service cluster for processing interaction requests. Each candidate interaction path defines different flow methods of the request from the initiating end to the processing end.

[0066] In the first path of interaction based on a sandbox cluster, requests are processed by the isolated environment within the sandbox cluster, suitable for scenarios requiring secure isolation or resource constraints. In the second path of interaction based on a service interface, requests can directly invoke the service through the service interface, suitable for regular business logic processing.

[0067] Optionally, the application service cluster can determine the target interaction path from candidate interaction paths through a policy engine or rule matching, such as based on request type, user permissions, and system load.

[0068] S103. In response to the target interaction path being the first path, determine the target processing component instance from multiple processing component instances based on the interaction request.

[0069] Optionally, a processing component instance can be a specific service unit running in a sandbox cluster. Each processing component instance processes requests independently, and different processing component instances can be deployed on different servers.

[0070] Optionally, the application service cluster can determine the target processing component instance from multiple processing component instances based on any one or more of the interaction requests, such as the traffic of the interaction requests, the calling permissions of the interaction requests, and the frequency of the interaction requests.

[0071] S104. Based on the target processing component instance, obtain the response result of the interaction request.

[0072] Optionally, the response to the interaction request can be the data returned by the target processing component instance after processing the interaction request. For example, the response to the interaction request can be any one or more of the following: order status, status code, etc.

[0073] Optionally, after processing the interaction request, the target processing component instance can send the response result of the interaction request to the application service cluster via a network protocol. The application service cluster can also actively obtain the response result of the interaction request from the target processing component instance.

[0074] S105. Feedback the response result to the application front-end node.

[0075] Optionally, the application service cluster can encapsulate the response result and transmit it to the application front-end node for feedback through a protocol agreed upon with the front-end. This response result can trigger an update of the application front-end node interface or a user prompt.

[0076] This application embodiment clarifies the various parts of the microservice architecture and the interaction path. The application service cluster can flexibly select the appropriate path and processing component instance according to the request. This enables the application service cluster to efficiently allocate resources, quickly obtain response results and provide feedback according to different interaction requests. Under the premise of ensuring security, it improves the interaction efficiency and resource utilization of the application service cluster and can better cope with diverse interaction needs.

[0077] In one implementation, the application service cluster may include a request validation layer and an intelligent gateway layer. Optionally, the request validation layer may be referred to as a component policy enforcement layer, and the intelligent gateway layer may be referred to as a component intelligent gateway layer.

[0078] The request validation layer can perform one or more basic operations on interactive requests, such as validity verification, access control, and traffic filtering, to ensure that only requests that meet the rules can enter the subsequent processing flow. The intelligent gateway layer can be the traffic scheduling hub in the application service cluster, responsible for uniformly receiving, routing, and forwarding interactive requests and response results, while providing one or more functions such as security control, protocol conversion, and load balancing.

[0079] The following section provides a detailed explanation of how the application service cluster determines the target processing component instance from multiple processing component instances based on interactive requests.

[0080] The application service cluster can first perform security verification on the interaction request through the request verification layer, obtain the security verification result of the interaction request, and forward the interaction request to the smart gateway layer when the security verification result is used to indicate that the verification is successful.

[0081] Optionally, security verification can perform legitimacy and security checks on the interaction request. For example, security verification may include authentication, such as verifying whether the source of the interaction request is legitimate. Security verification may include parameter verification, such as verifying whether the format and range of the interaction request parameters meet expectations.

[0082] In one implementation, security verification may include verifying the permissions of the requester of the interactive request, and verifying whether the requester's request frequency is greater than or equal to a preset frequency.

[0083] Optionally, the requester can be an entity that initiates the interaction request, such as any one or more of the following: an end user, an external service, or an internal component. The requester's permissions can be a set of operations pre-assigned to the requester by the application service cluster, allowing it to perform certain actions. By verifying the security of the requester's permissions, the risk of accidental operations or attacks on the application service cluster can be reduced.

[0084] Optionally, the application service cluster can determine whether the requester has the right to perform the operation in the interaction request by comparing the requester's identity and preset permission rules.

[0085] The request frequency of the requester can be the actual rate at which the requester initiates requests within a specific time window, which can be calculated by statistically analyzing request timestamps. The preset frequency can be the maximum allowed request rate set by the application service cluster. Verifying the requester's request frequency can reduce the risk of business anomalies, such as circular calls.

[0086] Optionally, the application service cluster can count the actual number of requests made by the requester within the sliding time window, compare it with a preset threshold, and determine whether to trigger rate limiting.

[0087] Optionally, the application service cluster can request the verification layer to complete the verification, encapsulate the result into structured data, and thus obtain the security verification result of the interaction request. If the security verification result indicates that the verification has passed, the application service cluster can send the interaction request to the intelligent gateway layer via its internal communication protocol.

[0088] The embodiments of this application can verify the permissions of the requester, ensuring that only the requester with the corresponding permissions can initiate interaction, preventing unauthorized access and operation, and protecting system data and functional security; and can verify the request frequency, avoiding excessively frequent requests by the requester, preventing the exhaustion of system resources due to excessive requests, ensuring normal and stable interactive services of the system, and improving the reliability and availability of the system.

[0089] Secondly, the application service cluster can determine the target processing component instance from multiple processing component instances based on the interaction request through the intelligent gateway layer.

[0090] Optionally, the intelligent gateway layer can determine the target processing component instance based on the interaction request by identifying the service corresponding to the path of the interaction request, extracting any one or more parameters of the interaction request, etc.

[0091] The request verification layer in this embodiment first performs security verification, which can filter out insecure requests and prevent invalid or malicious requests from entering the subsequent processing flow, thereby reducing system resource waste and potential security risks. Only after the verification is passed will the smart gateway layer determine the target processing component instance, ensuring that subsequent processing is carried out in a secure environment and improving the stability and security of system interaction.

[0092] The following section provides a detailed explanation of how the application service cluster obtains the response results of interactive requests based on the target processing component instance.

[0093] The application service cluster can first route interaction requests to the target processing component instance through the intelligent gateway layer. The target processing component instance is then used to execute the interaction request and obtain the response result.

[0094] Optionally, interaction request routing can be a process where the smart gateway layer dynamically selects one or more target processing component instances to handle the request based on the interaction request's attributes, such as path, parameters, or any one or more of them. The smart gateway layer can route the interaction request to the target processing component instance by parsing the interaction request's path, query parameters, or any one or more of them, combined with pre-defined rules.

[0095] Optionally, the target processing component instance can execute an interaction request through one or more of the following: data query, state change, or complex calculation, and then obtain a response result. For example, if the interaction request is "request to query an order", the smart gateway layer can determine the target processing component instance for querying the order based on the interaction request. The target processing component instance can execute the interaction request based on the data query and return the content of the queried order.

[0096] Secondly, the application service cluster can receive the response results from the target processing component instance through the intelligent gateway layer and forward the response results to the request verification layer.

[0097] Optionally, the intelligent gateway layer can send a request to the target processing component instance and wait for the target processing component instance to return a response result through the same network connection. The target processing component instance can also proactively push the response result to the intelligent gateway layer through a message queue or event bus.

[0098] Optionally, the intelligent gateway layer can forward the response result to the request verification layer upon receiving it. Alternatively, the intelligent gateway layer can store the response result in a message queue and forward it to the request verification layer through the message queue.

[0099] In this embodiment, the intelligent gateway layer is responsible for routing requests and receiving and forwarding response results, playing a centralized management and coordination role. It can accurately deliver requests to the target processing component instance, ensuring that requests are processed correctly. At the same time, it can receive and forward response results in a timely manner, making the entire interaction process more orderly and efficient, reducing confusion and errors in intermediate links, and improving the accuracy and efficiency of system interaction.

[0100] In one implementation, the application service cluster may further include an application interaction layer. Optionally, the application interaction layer may also be referred to as the core function of the system. The application interaction layer may be a component in the application service cluster that directly faces the application front-end node. It may be responsible for encapsulating the response result into a format that the application front-end node can accept and returning it to the application front-end node through a preset protocol.

[0101] In this scenario, the application service cluster can first forward the response result to the application interaction layer through the request verification layer, and then send the response result back to the application front-end node through the application interaction layer.

[0102] Optionally, the application service cluster can perform security verification on the response results through a request validation layer to ensure that the response results comply with security, compliance, or business rules. The security verification process of the response results by this request validation layer is similar to the security verification process of the interaction request described above, and will not be repeated here.

[0103] Optionally, the application service cluster can forward the response result to the application interaction layer by calling an interface after the security verification of the response result at the request validation layer has passed, or it can forward the response result to the application interaction layer based on a message queue. The application interaction layer can then feed back the response result to the application front-end nodes via network protocols.

[0104] In this embodiment, the application interaction layer acts as an intermediary layer, undertaking the task of feeding back the response results to the application front-end node. It isolates the request validation layer from the application front-end node, making the feedback process more standardized and consistent. Simultaneously, the application interaction layer can appropriately process and format the response results according to the characteristics and needs of the application front-end node, improving the quality and usability of the feedback information and enhancing the user experience.

[0105] In one implementation, when the security verification result indicates that the verification failed, the application service cluster can send a first prompt message to the application interaction layer. The first prompt message indicates that the interaction request is prohibited from interacting based on the first path. The application interaction layer then sends a second prompt message indicating that the interaction failed to the application front-end node.

[0106] Optionally, the security verification result can be used to indicate that the verification failure may be due to one or more of the following: insufficient permissions, absence of the sandbox cluster, or exceeding the threshold for the number of requests per unit time. The application service cluster can prevent the interactive request from continuing to execute along the first path and encapsulate the verification result, such as error code, error description, or any one or more of these, into a first prompt message.

[0107] Optionally, the application service cluster can convert technical errors into a second prompt message that the application frontend can understand, such as "incorrect password," and send the second prompt message of interaction failure back to the application frontend node via network protocol.

[0108] When a request fails verification, this embodiment can promptly send a prompt message and feedback on the interaction failure, allowing the requester to quickly understand the reason for the failure. Specifically, the first prompt message can transmit the reason for failure internally, facilitating subsequent processing and analysis; the second prompt message is directly fed back to the application's front-end node, enabling the user to be aware of the problem immediately, avoiding prolonged waiting, improving the efficiency of handling system interaction anomalies, and enhancing the system's usability.

[0109] The above describes the interaction method based on a microservice architecture that responds to the target interaction path as the first path. The following section provides a detailed explanation of how the application service cluster determines the target interaction path from multiple candidate interaction paths based on the interaction request.

[0110] The application service cluster can first parse the interaction request to obtain the target fields included in the interaction request, and then determine the target interaction path based on the target fields and the preset mapping relationship between the fields and the interaction path.

[0111] Optionally, the target field can be a specific portion of data in the interaction request, such as a user identifier. The predefined mapping relationship between fields and interaction paths can be a predefined set of rules that can clearly define different interaction paths corresponding to different target fields.

[0112] Optionally, the application service cluster can be decomposed according to certain rules and logic to extract the target fields. After obtaining the target fields, the target interaction path is determined through operations such as searching and matching, based on the preset mapping relationship between the fields and the interaction path.

[0113] This application embodiment obtains the target field by parsing the interaction request and determines the interaction path by combining it with the preset mapping relationship. This enables the system to accurately select the appropriate interaction path according to the specific content of the request, avoiding the inefficiency caused by blindly selecting the path, improving the system's ability and efficiency to process different requests, and making the interaction process more intelligent and efficient.

[0114] Based on the above embodiments, when the application service cluster responds to the target interaction path as the second path, it can execute the service interface call instruction, obtain the response result of the interaction request through the service interface, and feed back the response result to the application front-end node.

[0115] Optionally, a service interface can be a convention for interaction and communication between different software components or systems. A service interface can define one or more of the operation methods, input parameters, and output results that the application service cluster can use. Through service interfaces, different parts can collaborate to achieve data transfer and function invocation.

[0116] Optionally, the application service cluster can send a call request to the relevant service interface according to the operation specified in the second path, and start the functional module associated with the service interface to interact. For example, the application service cluster executes the instruction to call the payment service interface and sends payment request information to the payment service.

[0117] Optionally, after calling a service interface, the application service cluster can wait for the service interface to process the request and return the corresponding data, then receive and save this data for subsequent processing and feedback. For example, the application service cluster may obtain a payment success or failure response returned by a payment service interface.

[0118] Optionally, the application service cluster sends the response results of the obtained interaction requests to the application front-end nodes, enabling the front-end nodes to display these results to the user and let the user understand the processing status of the request. For example, the application service cluster sends the response results of order queries to the mobile client of an e-commerce website, and the client displays the order status to the user.

[0119] In this embodiment of the application, when the target interaction path is the second path, the system obtains and feeds back the response result by calling the service interface, thus expanding the system's interaction methods. By utilizing external service interfaces, the system can obtain more diverse resources and services.

[0120] In summary, the interaction method based on a microservice architecture according to the embodiments of this application can mainly consist of a request verification layer, a smart gateway layer, and a contract compiler. The components need to be deployed to the application service cluster and the sandbox cluster to run.

[0121] For example, the runtime state of an interaction method based on a microservice architecture can be represented by the following process:

[0122] A [Application Frontend Node] --> B [Application Interaction Layer]

[0123] B --> C [Service Interface]

[0124] B --> D [Request validation layer]

[0125] D --> E [Smart Gateway Layer]

[0126] E --> F [Sandbox Cluster]

[0127] The steps of this process are described below:

[0128] (1) The application front-end node sends a request to the application interaction layer.

[0129] (2) The application interaction layer processes requests. If it is necessary to call basic services, it calls the service interface.

[0130] (3) If it is necessary to call the component function in the sandbox cluster, the application interaction layer will forward the request to the request verification layer.

[0131] (4) The request verification layer executes relevant policies (e.g., check caller permissions, request frequency limits, etc.), and forwards them to the smart gateway layer after passing the verification.

[0132] (5) The intelligent gateway layer is responsible for routing requests to specific component instances in the sandbox cluster.

[0133] (6) Components in the sandbox cluster execute requests and return results to the smart gateway layer.

[0134] (7) The result is returned to the application interaction layer after passing through the smart gateway layer and the policy execution layer, and finally returned to the application front-end node.

[0135] The R&D process corresponding to the above process is as follows:

[0136] G [Developer] --> H [Function Implementation within the Sandbox Cluster]

[0137] H --> I [Component Interaction Contract Compiler]

[0138] I --> J [Component Standard Secure Communication Code]

[0139] The steps of this process are described below:

[0140] (1) Developers write code for functional modules in a sandbox development environment.

[0141] (2) Developers define the component interaction contract, including interface definition and security requirements.

[0142] (3) The component interaction contract compiler compiles the contract to generate a configuration file containing standard secure communication code.

[0143] (4) Deploy the generated component configuration file to the running sandbox cluster.

[0144] The embodiments of this application have the following technical effects:

[0145] (1) A dynamic balance mechanism between security and openness is established, and an intelligent risk assessment engine is built. Based on real-time risk assessment, dynamic isolation routing is used to analyze traffic characteristics in real time. According to traffic characteristics and security policies, direct communication, lightweight sandbox or deep isolation path is automatically selected to achieve coordinated optimization of system openness expansion and security assurance. Compared with the traditional fixed sandbox solution, the services and data of core application groups can be opened up for specific needs.

[0146] (2) Construct an embedded data protection system, enclose the function implementation inside the application system, establish a three-level data desensitization chain of protocol layer-runtime-output layer, ensure that external systems only obtain business results rather than raw data, avoid a large number of frequent interactions with external systems, reduce the risk of data leakage, and achieve zero-contact protection of core data.

[0147] (3) Declarative interaction contract paradigm: Developers define service call rules and data strategies through declarative configuration. The compiler automatically generates security control code, which significantly reduces the development complexity of service capability calls between heterogeneous systems and reduces security vulnerabilities caused by manual configuration errors.

[0148] The above are the method embodiments provided in this application. The apparatus provided in this application will be described below.

[0149] Figure 2 A schematic diagram of the structure of an interactive device based on a microservice architecture provided in this application is shown below. Figure 2 As shown, the microservice architecture includes: an application front-end node, an application service cluster, a sandbox cluster, and service interfaces outside the sandbox cluster. The sandbox cluster deploys multiple processing component instances. The device is applied to the application service cluster. The microservice architecture-based device 400 provided in this embodiment includes: a receiving module 401, a first determining module 402, a second determining module 403, an obtaining module 404, and a feedback module 405. Optionally, the microservice architecture-based device 400 may further include a processing module 406.

[0150] The receiving module 401 is used to receive interaction requests from the application front-end node.

[0151] The first determining module 402 is used to determine the target interaction path from multiple candidate interaction paths based on the interaction request. The candidate interaction paths include: a first path based on the sandbox cluster for interaction, and a second path based on the service interface for interaction.

[0152] The second determining module 403 is used to determine the target processing component instance from multiple processing component instances based on the interaction request, in response to the target interaction path being the first path.

[0153] The 404 retrieval module is used to retrieve the response result of the interactive request based on the target processing component instance.

[0154] Feedback module 405 is used to send response results back to the application front-end node.

[0155] Optionally, the application service cluster includes a request verification layer and an intelligent gateway layer. The second determining module 403 is specifically used to: perform security verification on the interaction request through the request verification layer, obtain a security verification result for the interaction request, and forward the interaction request to the intelligent gateway layer when the security verification result indicates that the verification has passed. Through the intelligent gateway layer, based on the interaction request, a target processing component instance is determined from multiple processing component instances.

[0156] For example, security checks include: verifying the permissions of the requester in the interaction request, and verifying whether the requester's request frequency is greater than or equal to a preset frequency.

[0157] For example, module 404 is specifically used to route the interaction request to the target processing component instance through the smart gateway layer. The target processing component instance is used to execute the interaction request and obtain a response result. The smart gateway layer receives the response result from the target processing component instance and forwards the response result to the request verification layer.

[0158] For example, the application service cluster also includes an application interaction layer and a feedback module 405, specifically used to forward the response result to the application interaction layer through the request verification layer. The application interaction layer then feeds back the response result to the application frontend node.

[0159] Optionally, the processing module 406 is configured to, through the request verification layer, send a first prompt message to the application interaction layer when the security verification result indicates that the verification has failed. The first prompt message indicates that the interaction request is prohibited from interacting based on the first path. The application interaction layer then sends a second prompt message indicating that the interaction failed to the application front-end node.

[0160] Optionally, the first determining module 402 is specifically used to parse the interaction request to obtain the target fields included in the interaction request. Based on the target fields and the preset mapping relationship between fields and interaction paths, the target interaction path is determined.

[0161] Optionally, the processing module 406 is further configured to, in response to the target interaction path being the second path, execute a service interface call instruction. Through the service interface, it obtains the response result of the interaction request and sends the response result back to the application frontend node.

[0162] The microservice architecture-based device provided in this embodiment can execute the methods provided in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0163] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 3 As shown, the electronic device 500 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 500 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0164] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0165] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0166] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0167] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0168] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0169] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0170] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0171] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0172] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0173] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0174] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0175] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0176] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0177] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0178] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. An interaction method based on a microservice architecture, characterized in that, The microservice architecture includes: an application front-end node, an application service cluster, a sandbox cluster, and service interfaces outside the sandbox cluster. The sandbox cluster deploys multiple processing component instances. The method is applied to the application service cluster, and the method includes: Receive interaction requests from the application's front-end node; Based on the interaction request, a target interaction path is determined from multiple candidate interaction paths; the candidate interaction paths include: a first path for interaction based on the sandbox cluster, and a second path for interaction based on the service interface; In response to the target interaction path being the first path, a target processing component instance is determined from the plurality of processing component instances based on the interaction request; Based on the target processing component instance, obtain the response result of the interaction request; The response result is fed back to the application's front-end node.

2. The method according to claim 1, characterized in that, The application service cluster includes a request verification layer and a smart gateway layer. The step of determining the target processing component instance from the plurality of processing component instances based on the interaction request includes: The request verification layer performs security verification on the interaction request to obtain the security verification result of the interaction request. When the security verification result is used to indicate that the verification is successful, the interaction request is forwarded to the smart gateway layer. Based on the interaction request, the target processing component instance is determined from the plurality of processing component instances through the intelligent gateway layer.

3. The method according to claim 2, characterized in that, The security verification includes: verifying the permissions of the requester of the interaction request, and verifying whether the requester's request frequency is greater than or equal to a preset frequency.

4. The method according to claim 2 or 3, characterized in that, The step of obtaining the response result of the interaction request based on the target processing component instance includes: The smart gateway layer routes the interaction request to the target processing component instance; the target processing component instance executes the interaction request and obtains the response result. The intelligent gateway layer receives the response result from the target processing component instance and forwards the response result to the request verification layer.

5. The method according to claim 2 or 3, characterized in that, The application service cluster further includes: an application interaction layer, wherein the step of feeding back the response result to the application front-end node includes: The response result is forwarded to the application interaction layer through the request verification layer. The response result is fed back to the application front-end node through the application interaction layer.

6. The method according to claim 5, characterized in that, The method further includes: When the security verification result is used to indicate that the verification failed, the request verification layer sends a first prompt message to the application interaction layer. The first prompt message is used to indicate that the interaction request is prohibited from interacting based on the first path. The application interaction layer sends a second prompt message indicating interaction failure to the application front-end node.

7. The method according to any one of claims 1-3, characterized in that, The step of determining the target interaction path from multiple candidate interaction paths based on the interaction request includes: The interaction request is parsed to obtain the target fields included in the interaction request; Based on the target field and the preset mapping relationship between the field and the interaction path, the target interaction path is determined.

8. The method according to any one of claims 1-3, characterized in that, The method further includes: In response to the target interaction path being the second path, the service interface invocation instruction is executed; The response result of the interaction request is obtained through the service interface; The response result is fed back to the application's front-end node.

9. An interactive device based on a microservice architecture, characterized in that, The microservice architecture includes: an application front-end node, an application service cluster, a sandbox cluster, and service interfaces outside the sandbox cluster. The sandbox cluster deploys multiple processing component instances. The device is applied to the application service cluster, and the device includes: A receiving module is used to receive interaction requests from the application's front-end node; The first determining module is used to determine a target interaction path from multiple candidate interaction paths based on the interaction request; the candidate interaction paths include: a first path for interaction based on the sandbox cluster, and a second path for interaction based on the service interface; The second determining module is configured to, in response to the target interaction path being the first path, determine a target processing component instance from the plurality of processing component instances based on the interaction request; The acquisition module is used to acquire the response result of the interaction request based on the target processing component instance; The feedback module is used to send the response result back to the application front-end node.

10. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.

Images