General login authentication method and device based on kong gateway and storage medium

Abstract

This application discloses a general login authentication method, apparatus, and storage medium based on the Kong gateway, relating to the field of network security technology. The method includes: after receiving user authentication information, the authentication service generates an identity token and returns it to the front-end microservice, while simultaneously associating and storing the identity token with custom authentication information; when the front-end microservice initiates an access request to the back-end application service, it carries the identity token, and the access request is intercepted and processed by the Kong gateway; based on the intercepted identity token, the Kong gateway retrieves the corresponding custom authentication information from the cache database; the Kong gateway adds the custom authentication information to the request header of the access request and forwards the access request carrying the custom authentication information to the back-end application service; the back-end application service extracts the custom authentication information from the request header, completes the authentication operation of the access request based on the custom authentication information, and performs allow or deny processing based on the authentication result.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a general login authentication method, device and storage medium based on Kong gateway. Background Technology

[0002] With the widespread adoption of microservices and distributed system architectures, the security of interface access for various business systems has become a core focus of technology development. To prevent unauthorized interface calls from causing data leaks or business anomalies, all backend interfaces must be configured with login authentication mechanisms. API gateways, as a core component of microservice architectures, are commonly deployed at the front end of application services, undertaking unified operations such as traffic routing, rate limiting, and blacklist / whitelist management. Kong Gateway, with its high performance and high availability based on Nginx, has become a mainstream API gateway choice in the industry and is widely used in the authentication architectures of various enterprise-level systems. How to achieve secure, efficient, and scalable login authentication based on Kong Gateway has become an important direction for optimizing distributed system architectures.

[0003] The currently common login authentication solution in the industry is as follows: after a user logs in using a username and password, or by scanning a QR code, the authentication service (AUTH microservice) generates a corresponding identity token based on a JSON Web Token (JWT). All subsequent backend interface requests initiated by the frontend microservice carry this token. Upon receiving the request, the backend application service parses the payload in the token and completes the user authentication and permission verification based on the information in the payload. This solution relies on the JWT's signature mechanism to ensure that the token content is not tampered with, adapts to the stateless architecture requirements of distributed systems, and has become the mainstream authentication method in frontend / backend separation and microservice architectures.

[0004] The aforementioned JWT-based login authentication scheme suffers from core security and scalability flaws. JWT is merely an encoding method; its signature mechanism only prevents content tampering and cannot encrypt the payload. The payload, simply encoded with Base64Url, can be easily decoded. Therefore, no sensitive information can be stored in the payload; only basic, non-sensitive information such as user ID and username can be stored. This limitation significantly restricts the authentication dimensions, making it impossible to extend custom authentication attributes according to business needs. It also fails to meet the fine-grained authentication requirements of enterprise-level systems based on roles, management scope, and other dimensions, becoming a key issue restricting the flexibility and applicability of the system's authentication architecture. Summary of the Invention

[0005] In view of this, this application provides a general login authentication method, device and storage medium based on Kong gateway, which can extend the custom authentication attributes according to business needs and meet the fine-grained authentication needs of enterprise-level systems based on roles, management scope and other dimensions.

[0006] According to a first aspect of this application, a general login authentication method based on a Kong gateway is provided. The method is applied to a computer system, which includes an authentication service, a Kong gateway, a cache database, a unified login platform, front-end microservices, and back-end application services. The method includes: After receiving the user authentication pass information returned by the unified login platform, the authentication service generates an identity token and returns the identity token to the front-end microservice. At the same time, the identity token is associated with custom authentication information and stored in the cache database. When a front-end microservice initiates an access request to a back-end application service, it carries an identity token, and the access request is intercepted and processed by the Kong gateway. Based on the intercepted identity token, the Kong gateway retrieves the corresponding custom authentication information from the cache database. The Kong gateway adds the obtained custom authentication information to the request header of the access request and forwards the access request carrying the custom authentication information to the backend application service. The backend application service extracts custom authentication information from the request header, completes the authentication operation on the access request based on the custom authentication information, and performs the allow or deny processing according to the authentication result.

[0007] According to a second aspect of this application, a universal login authentication device based on a Kong gateway is provided. The device is applied to a computer system, which includes an authentication service, a Kong gateway, a cache database, a unified login platform, front-end microservices, and back-end application services. The device includes: The storage module is used to generate an identity token and return it to the front-end microservice after the authentication service receives the user authentication information returned by the unified login platform. At the same time, the identity token is associated with custom authentication information and stored in the cache database. The request initiation module is used by the front-end microservice to carry an identity token when initiating access requests to the back-end application service. The access requests are intercepted and processed by the Kong gateway. The matching module is used by the Kong gateway to retrieve corresponding custom authentication information from the cache database based on the intercepted identity token; The forwarding module is used by the Kong gateway to add the obtained custom authentication information to the request header of the access request and forward the access request carrying the custom authentication information to the backend application service. The authentication module is used by the backend application service to extract custom authentication information from the request header, complete the authentication operation of the access request based on the custom authentication information, and perform the allow or deny processing according to the authentication result.

[0008] According to a third aspect of this application, a storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the aforementioned general login authentication method based on the Kong gateway.

[0009] According to a fourth aspect of this application, an electronic device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the aforementioned general login authentication method based on the Kong gateway.

[0010] By employing the aforementioned technical solutions, the general login authentication method, device, and storage medium based on the Kong gateway provided in this application, through associating identity tokens with custom authentication information and storing them in a cache database, and relying on the Kong gateway to match and obtain the custom authentication information during the request interception stage and add it to the request header for forwarding to the backend application service, the sensitive custom authentication information is stored independently from the JWT payload. This not only avoids the security defects of the JWT payload being unencrypted and easily decoded, and unable to store sensitive information, but also breaks through the dimensional limitations of the original authentication scheme, which can only authenticate based on non-sensitive basic information such as user ID and username. It can realize multi-dimensional fine-grained custom authentication based on user roles, management scope, and other enterprise-level business requirements, greatly improving the flexibility and applicability of the system authentication architecture. At the same time, all backend application services can directly extract custom authentication information from the request header to complete authentication, without each service parsing the token or obtaining authentication information separately. This reduces code redundancy and improves authentication interaction efficiency, effectively solving the problem of insufficient scalability of the original JWT authentication scheme while ensuring the security of system authentication.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This illustration shows a schematic diagram of a traditional login authentication process provided in an embodiment of this application; Figure 2 This illustration shows a modified login authentication process according to an embodiment of this application; Figure 3 The illustration shows a flowchart of a general login authentication method based on the Kong gateway provided in an embodiment of this application; Figure 4 A flowchart illustrating a general login authentication method based on a Kong gateway, according to another embodiment of this application, is shown. Figure 5 This illustration shows an example of how permission information is stored in Redis, as provided in an embodiment of this application. Figure 6 This illustration shows a schematic diagram of a question-answering device based on a large model, as provided in an embodiment of this application. Detailed Implementation

[0013] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0014] Currently, the commonly used login authentication solutions in the industry are, for example, Figure 1 As shown, the user initiates a login request through the front-end microservice (Step 1). This request is forwarded to the authentication service, namely the AUTH service, via the Kong gateway (Step 2). The AUTH service redirects the request to the CAS unified authentication platform to complete identity verification (Step 3). After successful verification by the CAS platform, the user's basic information is returned to the AUTH service (Step 4). The AUTH service generates an identity token based on the JWT encoding rules and returns the identity token to the Kong gateway (Step 5), which then forwards it to the front-end microservice (Step 6). Subsequently, when the front-end microservice initiates an access request to the back-end application service, it carries this identity token in the access request (Step 7). The request is forwarded to the corresponding back-end application service via the Kong gateway (Step 8). The back-end application service directly parses the payload in the JWT token and completes the identity and permission authentication operation based on the user ID, username, and other non-sensitive basic information in the payload (Step 9). The authentication result and business response are then returned to the front-end microservice via the Kong gateway (Step 10).

[0015] The aforementioned JWT-based login authentication scheme suffers from core security and scalability flaws. JWT is merely an encoding method; its signature mechanism only prevents content tampering and cannot encrypt the payload. The payload, simply encoded with Base64Url, can be easily decoded. Therefore, no sensitive information can be stored in the payload; only basic, non-sensitive information such as user ID and username can be stored. This limitation significantly restricts the authentication dimensions, making it impossible to extend custom authentication attributes according to business needs. It also fails to meet the fine-grained authentication requirements of enterprise-level systems based on roles, management scope, and other dimensions, becoming a key issue restricting the flexibility and applicability of the system's authentication architecture.

[0016] In view of this, this application provides a modified login authentication scheme, such as... Figure 2As shown, the user initiates a login request through the front-end microservice (step 1). This request is forwarded to the authentication service, i.e., the AUTH service, via the Kong gateway (step 2). The AUTH service redirects the request to the CAS unified authentication platform to complete identity verification (step 3). After successful verification by the CAS platform, the user's basic information is returned to the AUTH service (step 4). The AUTH service obtains custom authentication information based on the user's basic information, generates an identity token based on JWT encoding rules, and stores the identity token and custom authentication information in a key-value pair format in the internal Redis. The process begins with caching the database (Step 5) and returning the identity token to the Kong gateway (Step 6), which then forwards it to the front-end microservice (Step 7-1). Subsequent requests from the front-end microservice to access the back-end application service include this identity token in the request (Step 7-2). After the request is intercepted by the Kong gateway, it retrieves the corresponding custom authentication information from the Redis cache database based on the identity token (Step 8), adds the custom authentication information to the request header, and forwards it to the corresponding back-end application service (Step 9). The back-end application service extracts the custom authentication information from the request header and performs fine-grained authentication based on user roles, management scope, and other multi-dimensional information (Step 10). The authentication result and business response are then returned to the front-end microservice via the Kong gateway (Step 11). This solution stores sensitive authentication information in a trusted internal cache, separate from the JWT payload. This ensures the security of the authentication information while enabling multi-dimensional fine-grained authentication, thus improving the flexibility and applicability of the authentication architecture.

[0017] Accordingly, embodiments of the present invention provide a general login authentication method based on the Kong gateway. This method is applied to a computer system, which includes an authentication service, the Kong gateway, a cache database, a unified login platform, front-end microservices, and back-end application services such as... Figure 3 As shown, the method includes: Step 310: After the authentication service receives the user authentication pass information returned by the unified login platform, it generates an identity token and returns the identity token to the front-end microservice. At the same time, it associates the identity token with the custom authentication information and stores it in the cache database.

[0018] The authentication service, or AUTH microservice, is the core service module responsible for user identity authentication, identity token generation, and associated storage of authentication information, providing the basic authentication capabilities for the entire authentication process. The unified login platform, or CAS platform, provides a centralized user identity verification service, supporting multiple verification methods such as username / password and QR code scanning, used to confirm the legitimacy of the user's identity and output authentication success information. The identity token is a stateless identity identifier generated based on JWT encoding rules, carrying only non-sensitive basic user information, used to transmit user identity identifiers in the distributed architecture, and does not contain sensitive authentication data. The front-end microservice is the user-facing interaction entry service, responsible for receiving user operation requests, carrying identity tokens to initiate backend business access, and is the request initiator of the authentication process. Custom authentication information is the sensitive authentication data required for enterprise-level business, including user roles, management scope, customer identifier lists, etc., used to support multi-dimensional fine-grained permission verification. The cache database is a distributed caching service deployed in a trusted intranet environment, used to store the association between identity tokens and custom authentication information, ensuring efficient and secure data access. Specifically, the cache database can be a Redis database, which is deployed in the enterprise intranet environment to form an intranet data interaction environment with the authentication service and Kong gateway.

[0019] In this embodiment of the disclosure, after receiving user authentication approval information from the unified login platform, the authentication service generates an identity token to identify the user and returns the token to the front-end microservice. Simultaneously, it associates the identity token with the custom authentication information required by the corresponding business and stores it in a cache database within the trusted intranet environment. This process separates the sensitive authentication information from the identity token, ensuring the stateless nature of the identity token to adapt to the distributed architecture, while also isolating sensitive authentication data within a trusted environment, preventing direct exposure to untrusted internet transmission links. This lays the foundation for subsequent authentication information acquisition and transmission at the gateway layer.

[0020] This technical solution separates and stores custom authentication information and identity tokens in a trusted cache database on the internal network. This avoids the risk of sensitive information leakage caused by the inability to encrypt JWT payloads and their susceptibility to decoding. It also breaks through the limitation of traditional authentication solutions that can only perform authentication based on non-sensitive basic information. This enables multi-dimensional, fine-grained authentication capabilities based on enterprise-level business needs, while ensuring the efficient acquisition and transmission of authentication information. This significantly enhances the flexibility and business adaptability of the authentication architecture while improving the system's authentication security.

[0021] Step 320: When the front-end microservice initiates an access request to the back-end application service, it carries an identity token. The access request is intercepted and processed by the Kong gateway.

[0022] Among them, the backend application service is a service cluster that carries specific business logic, is used to process user business requests and return responses, and is the final business processing end of the authentication process; the access request is a business call request initiated by the frontend microservice to the backend application service, used to convey the user's operation intent and necessary parameters; the identity token is a user identity identifier generated based on stateless coding rules, used to transmit user identity information in the distributed architecture, and does not contain sensitive authentication data; the Kong gateway is an API gateway deployed between the frontend microservice and the backend application service, and undertakes unified management capabilities such as traffic interception, routing forwarding, and authentication enhancement.

[0023] In this embodiment of the disclosure, when a front-end microservice initiates a business access request to a back-end application service, it carries the acquired identity token in the request. This request is uniformly received and intercepted by the Kong gateway deployed at the traffic ingress point. This process unifies the traffic of all back-end business requests to the gateway layer, providing a unified entry point for the subsequent acquisition and injection of authentication information. This ensures that the authentication logic does not intrude into each back-end application service, achieving centralized management and control of authentication capabilities.

[0024] This technical solution decouples authentication logic from business logic by carrying the identity token with the business request and having it uniformly intercepted by the Kong gateway. This ensures the stable transmission of identity information in the request chain and provides a basis for the gateway layer to uniformly inject custom authentication information, avoiding the duplication of authentication logic by various backend application services, improving the maintainability and scalability of the system architecture, and laying a prerequisite for subsequent fine-grained authentication operations.

[0025] Step 330: Based on the intercepted identity token, Kong gateway retrieves the corresponding custom authentication information from the cache database.

[0026] In this embodiment of the disclosure, after intercepting a service access request carrying an identity token, the Kong gateway uses the identity token as the retrieval basis to initiate a matching query in the cache database. From the stored associations between tokens and authentication information, it retrieves the corresponding user's custom authentication information. This process centralizes the authentication information retrieval logic at the gateway layer. By establishing an association between the identity identifier and sensitive authentication data through the identity token, it achieves efficient and secure retrieval of authentication information, providing pre-support for injecting authentication data into subsequent service requests.

[0027] This technical solution retrieves custom authentication information from a cached database using an identity token as an index. This not only achieves physical isolation between sensitive authentication data and the internet transmission link, ensuring the security of authentication information, but also leverages the efficient query characteristics of the cached database to guarantee real-time and low-latency authentication information retrieval. Furthermore, by centralizing the authentication data retrieval logic at the gateway layer, it avoids backend application services repeatedly implementing the authentication information retrieval logic, thereby improving the maintainability and scalability of the system architecture.

[0028] Step 340: Kong Gateway adds the obtained custom authentication information to the request header of the access request and forwards the access request carrying the custom authentication information to the backend application service.

[0029] The request header of the access request is an auxiliary information carrier area in the HTTP protocol, used to store metadata and auxiliary identifiers. It has high readability, high transmission compatibility and does not interfere with the main business parameters.

[0030] In this embodiment of the disclosure, after the Kong gateway completes the matching and retrieval of authentication information, it injects the obtained custom authentication information into the request header of the access request to enhance the request. Subsequently, according to the routing rules configured in the system, the complete access request carrying the authentication information is forwarded to the corresponding backend application service. This process unifies the encapsulation and transmission logic of permission data to the gateway layer, enabling effective integration of request payload and permission information, and providing standardized structured data support for rapid authentication of backend services.

[0031] This solution injects custom authentication information into the request header at the gateway layer, enabling standardized transmission and unified injection of authentication data. This avoids redundant operations in the backend service, such as repeatedly parsing identity tokens to obtain permission data, thus reducing the development and maintenance costs of various business services. Furthermore, the request header, as a universal carrier, ensures the stable transmission and efficient reading of authentication information. Meanwhile, by isolating sensitive permission data at the gateway processing layer, it further guarantees the security of data interaction and the scalability of the architecture.

[0032] Step 350: The backend application service extracts the custom authentication information from the request header, completes the authentication operation on the access request based on the custom authentication information, and performs the pass or deny processing according to the authentication result.

[0033] In this embodiment of the disclosure, after the backend application service receives the access request forwarded by the Kong gateway, it can extract the injected custom authentication information from the request header, combine it with its own preset business permission rules, perform a comprehensive permission verification on the custom authentication information, complete the authentication operation for this access request, and perform corresponding allow or deny processing on the access request based on the final authentication verification result.

[0034] This technical solution enables backend application services to directly extract custom authentication information from the request header to complete authentication. This eliminates the need for backend services to parse identity tokens and query authentication data, significantly reducing the development and maintenance costs of backend services and avoiding redundant code. Furthermore, the multi-dimensional authentication operations based on custom authentication information overcome the dimensional limitations of traditional authentication schemes, meeting the fine-grained permission control needs of enterprise-level systems. While improving authentication efficiency and reducing network overhead, it significantly enhances the flexibility and business adaptability of the system's authentication architecture, ensuring the security and compliance of system business access.

[0035] In summary, the general login authentication method based on the Kong gateway provided in this application stores the identity token and custom authentication information in a cache database. It leverages the Kong gateway's technical means of matching and retrieving this custom authentication information during request interception and adding it to the request header before forwarding it to the backend application service. This method stores sensitive custom authentication information independently from the JWT payload, avoiding the security flaws of the JWT payload (easily decoded due to its lack of encryption and inability to store sensitive information). It also overcomes the limitations of traditional authentication schemes, which can only authenticate based on non-sensitive basic information such as user ID and username. This enables multi-dimensional, fine-grained custom authentication based on user roles, management scope, and other enterprise-level business requirements, significantly improving the flexibility and applicability of the system's authentication architecture. Furthermore, all backend application services can directly extract the custom authentication information from the request header to complete authentication, eliminating the need for each service to separately parse the token or obtain the authentication information. This reduces code redundancy and improves authentication interaction efficiency, effectively solving the scalability problem of the original JWT authentication scheme while ensuring system authentication security.

[0036] Furthermore, as a refinement and extension of the specific implementation of the above embodiments, and to fully illustrate the implementation of this embodiment, this embodiment also provides another general login authentication method based on the Kong gateway, such as... Figure 4 As shown, the method includes: Step 410: After the authentication service intercepts the login request from the front-end microservice, it redirects the user to the unified login platform, where the user completes the username and password verification or QR code verification.

[0037] In this embodiment of the disclosure, after receiving a user login request initiated by the front-end microservice, the authentication service intercepts and processes the request uniformly. Instead of directly verifying the identity of the request, the login request is redirected to the unified login platform specified by the system. On the unified login platform, the user can choose the username and password verification or QR code verification method according to their own needs and independently complete the submission and verification of identity information. The unified login platform will complete the preliminary identity legality determination based on the verification information submitted by the user.

[0038] This technical solution intercepts front-end login requests through a unified authentication service and redirects them to a unified login platform to complete identity verification. This enables centralized and standardized management of the system's identity authentication process, avoiding code redundancy and maintenance costs associated with each front-end service implementing its own identity verification logic. It also supports multiple identity verification methods, enhancing the flexibility and convenience of user login. The unified identity verification entry point also allows for centralized configuration and updates of the system's identity verification rules, strengthening the security and maintainability of the system's identity authentication process and laying a legitimate and unified foundation for subsequent token generation and authentication operations.

[0039] Step 420: After the unified login platform completes user identity authentication, it returns the user's basic information as authentication pass information to the authentication service.

[0040] In this embodiment of the disclosure, after the unified login platform completes the legality verification of the verification information submitted by the user and confirms the validity of the user's identity, it can use the extracted basic user information as authentication pass information and feed it back to the connected authentication service through the data interaction link within the system. This allows the authentication service to obtain the verified legitimate user identity data, providing an effective identity foundation for the authentication service to carry out subsequent operations such as identity token generation and authentication information association.

[0041] This technical solution, through a unified login platform, returns authentication pass information containing basic user information to the authentication service after user identity authentication is completed. This enables standardized and regulated transmission of identity verification results and basic user information, allowing the authentication service to directly obtain verified legitimate identity data without repeated identity verification, reducing redundant operations and resource consumption on the server side. At the same time, the standardized authentication pass information transmission method ensures the accuracy and consistency of identity data interaction between services, laying a reliable identity data foundation for the smooth operation of the entire subsequent authorization process. It also creates a clear division of responsibilities between the system's identity authentication and subsequent authorization operations, improving the rationality and maintainability of the overall system architecture.

[0042] Step 430: The authentication service obtains the corresponding custom authentication information based on the user's basic information, generates an identity token based on the JWT encoding rules, and returns the identity token directly to the front-end microservice.

[0043] The custom authentication information includes one or more combinations of user employee ID, user role information, and customer identifiers from the user management list, and the custom authentication information is sensitive business authentication information within the enterprise intranet.

[0044] In this embodiment of the disclosure, after receiving the user basic information returned by the unified login platform, the authentication service can use this information to retrieve and obtain the corresponding user's custom authentication information. Then, following the JWT encoding rules, the user basic information is encoded to generate an identity token. Subsequently, the generated identity token is directly pushed to the front-end microservice that initiated the login request, so that the front-end microservice obtains a legitimate identity credential that can be used for subsequent business requests. At the same time, the authentication service completes the correspondence and matching between the user basic information and the custom authentication information, preparing for the associated storage of subsequent authentication information.

[0045] This technical solution obtains customized authentication information by matching user basic information through an authentication service, enabling precise association between identity information and fine-grained authentication information. This provides core data support for subsequent multi-dimensional access control. Simultaneously, it generates identity tokens based on JWT encoding rules and directly returns them to the front-end microservice, ensuring the validity of identity identifiers for subsequent business requests from the front-end microservice and adapting to the stateless architecture requirements of distributed systems. Separating sensitive customized authentication information from identity tokens that only serve as identity identifiers prevents sensitive authentication information from being encapsulated in unencrypted JWT payloads, ensuring the security of sensitive business authentication information from the source of data storage and transmission. Furthermore, it overcomes the limitation of traditional JWT authentication relying solely on non-sensitive basic information, significantly improving the flexibility and business adaptability of the system's authentication architecture.

[0046] Step 440: The authentication service concatenates the identity token according to the fixed prefix concatenation rules to obtain the cache key value. The cache key value is used as the key and the custom authentication information is used as the value. The two are then stored in the cache database as key-value pairs.

[0047] Among them, the fixed prefix concatenation rule is a standardized character concatenation specification preset by the system, which is used to add a unique fixed character prefix to the identity token to form a unique cache retrieval identifier; the cache key value is a unique index identifier formed by concatenating the fixed prefix and the identity token according to the preset rule, which serves as the core keyword for data storage and querying in the cache database; the key-value pair is the basic data storage form of the cache database, with a unique keyword corresponding to the associated data, realizing fast data matching, storage and querying.

[0048] In this embodiment of the disclosure, the authentication service can concatenate a fixed prefix with the generated user identity token according to a pre-set fixed prefix concatenation rule to generate a unique cached key-value pair. This cached key-value pair is then used as the keyword for data storage, and the corresponding user's custom authentication information is used as the associated data. The association between the two is stored in the cache database in key-value pair format, completing the precise binding between the identity token and the custom authentication information. This allows the cache database to form a complete data association relationship where the corresponding authentication information can be retrieved using the identity token. Specifically, the system can store the custom authentication information in a Redis database using a key-value format. The key follows the naming rule of "fixed prefix : token," and is generated by concatenating a system-preset fixed prefix with the user identity token to generate a unique retrieval identifier. The value stores sensitive business information used for subsequent authentication, which may include one or more combinations of data such as user ID, user role information, and a list of customer identifiers managed by the user. Figure 5 As shown, the key is concatenated with the identity token "AAAAxkxxoxxxxxk" using "strategy:" as a fixed prefix to form "strategy:AAAAxkxxoxxxxxk", and the value stores the role list information {"roleIds":"role1,role2,role3"} in JSON format. This completes the association and binding between the identity token and the custom authentication information, providing data support for the subsequent gateway layer to obtain authentication information based on the identity token matching.

[0049] This technical solution generates unique cached key-value pairs using fixed prefix concatenation rules. These key-value pairs are then used to associate and store identity tokens with custom authentication information in a cached database, ensuring a precise and unique binding between the two and guaranteeing the accuracy and efficiency of subsequent authentication information matching queries. By separating sensitive custom authentication information from the unencrypted JWT identity token and storing it independently in the intranet's cached database, the security risk of sensitive information leakage is mitigated at the storage level. Simultaneously, the identity token serves only as an identity identifier, overcoming the information storage limitations of traditional JWT authentication schemes. The key-value pair storage format is well-suited to the fast retrieval characteristics of the cached database, significantly improving the speed at which subsequent systems obtain authentication information, reducing system response latency, and standardizing the storage and management of authentication data. This provides a secure and reliable data source for the efficient execution of the entire authentication process.

[0050] Step 450: When the front-end microservice initiates an access request to the back-end application service, it carries an identity token. The access request is intercepted and processed by the Kong gateway.

[0051] In this embodiment of the disclosure, when a front-end microservice initiates an access request to a back-end application service, it can add the acquired identity token to the request parameters or request header to form a complete access request carrying the identity token. Subsequently, the front-end microservice sends the access request to the Kong gateway according to the system's preset routing rules. The Kong gateway performs a unified interception operation on all access requests sent to the back-end application service. After intercepting the access request, it parses it, extracts the carried identity token, and performs a preliminary validity check on the format and integrity of the identity token, thus completing the pre-processing of the access request.

[0052] Accordingly, the implementation steps may include: when the front-end microservice initiates an access request to the back-end application service, it adds an identity token to the request parameters or request header to form an access request carrying an identity token; the front-end microservice sends the access request to the Kong gateway according to a preset routing rule, and the Kong gateway performs a unified interception operation on all access requests sent to the back-end application service; the Kong gateway parses the intercepted access request, extracts the identity token carried in it, and performs a preliminary validity check on the format integrity of the identity token.

[0053] Among them, the preset routing rules are request forwarding rules pre-configured by the system, which are used to define the transmission path of front-end access requests and guide the front-end microservices to send requests to the specified Kong gateway; format integrity refers to whether the character structure and encoding of the identity token itself conform to the preset generation specifications, which is the basic condition for determining whether the token is valid; the preliminary validity verification is the basic legality verification of the identity token performed by the Kong gateway, which only verifies the format of the token and performs pre-screening for subsequent authentication operations.

[0054] This technical solution enables unified traffic convergence for system access requests by having front-end microservices carry identity tokens in their access requests and send them to the Kong gateway according to preset routing rules. This makes the Kong gateway the sole pre-processing node for all back-end access requests, preventing authentication logic from intruding into back-end application services and decoupling authentication logic from business logic. The Kong gateway uniformly intercepts all access requests and performs initial verification of the identity token's format integrity. This ensures stable transmission and basic legality filtering of the identity token in the request chain, pre-filtering invalid requests and reducing the invalid processing pressure on back-end application services. It also lays the foundation for the gateway layer to obtain custom authentication information based on identity token matching. Furthermore, it supports flexible carrying of the identity token in request parameters or headers, improving system adaptability, reducing overall system development and maintenance costs, and enhancing the execution efficiency of the authentication process and the scalability of the system architecture.

[0055] Step 460: Based on the intercepted identity token, Kong gateway retrieves the corresponding custom authentication information from the cache database.

[0056] In this embodiment of the disclosure, after the Kong gateway extracts the identity token from the intercepted access request, it can concatenate the identity token according to the system's unified fixed prefix concatenation rules to generate a cache key value that is consistent with the authentication service storage. Then, it initiates a data query request to the cache database with the cache key value as the core retrieval condition. After receiving the query request, the cache database performs a matching retrieval on the stored key value pairs according to the passed cache key value, and feeds back the custom authentication information corresponding to the successfully matched cache key value to the Kong gateway, thus completing the accurate acquisition of authentication information.

[0057] Accordingly, the implementation steps may include: Kong gateway concatenating the extracted identity token according to a fixed prefix concatenation rule to generate a cache key value consistent with the cache database; Kong gateway initiating a data query request to the cache database using the generated cache key value; and the cache database performing a matching retrieval based on the received cache key value and returning the custom authentication information corresponding to the successfully matched cache key value to Kong gateway.

[0058] This technical solution uses the Kong gateway to generate cached key-value pairs using a unified fixed prefix concatenation rule. This ensures consistency with the rules used in the authentication service cache storage, guaranteeing the accuracy of custom authentication information matching and retrieval, and avoiding retrieval bias. Based on the identity token, it accurately matches and retrieves corresponding custom authentication information from the cache database, ensuring that sensitive authentication data is always stored in the internal cache database. This eliminates the need for internet request transmission links, mitigating the security risk of sensitive information leakage at the data retrieval stage. Simultaneously, leveraging the efficient retrieval characteristics of the cache database enables rapid retrieval of custom authentication information, reducing system response latency. Centralizing the authentication information matching logic at the gateway layer avoids backend application services performing separate authentication information queries, reducing system redundancy, decoupling authentication logic from business logic, improving the maintainability and scalability of the system architecture, and laying a reliable data foundation for the subsequent injection of authentication information into requests by the gateway layer.

[0059] Step 470: Kong Gateway adds the obtained custom authentication information to the request header of the access request and forwards the access request carrying the custom authentication information to the backend application service.

[0060] In this embodiment of the disclosure, after the Kong gateway obtains the custom authentication information of the corresponding user from the cache database, it can first perform format standardization processing on the authentication information to convert it into field information that conforms to the HTTP request header specification. Then, it adds a custom field with a preset name to the HTTP request header of the currently intercepted access request, writes the standardized custom authentication information into the newly added field, and completes the authentication information enhancement processing of the access request. Finally, the Kong gateway accurately forwards the access request with injected custom authentication information to the corresponding backend application service according to the system's preset service routing configuration, providing complete permission data support for the authentication operation of the backend application service.

[0061] Accordingly, the implementation steps may include: Kong gateway performing format standardization processing on the custom authentication information obtained from the cache database to form field information conforming to the HTTP request header specification; Kong gateway adding a custom field with a preset name to the HTTP request header of the access request, and writing the standardized custom authentication information into the custom field; Kong gateway forwarding the access request with added custom authentication information to the corresponding backend application service according to the preset service routing configuration.

[0062] This technical solution standardizes the format of custom authentication information through the Kong gateway and writes it into a custom field in the request header. This enables standardized and regulated transmission of authentication information, ensuring efficient reading and parsing of authentication information by backend application services. The addition of a dedicated custom field in the request header to store authentication information avoids confusion between authentication information and other data in the request, improving the standardization of data transmission. By injecting custom authentication information into access requests at the gateway layer and performing precise forwarding, backend application services can directly obtain authentication information from the request header without needing to separately parse identity tokens or query cache databases. This significantly reduces the development and maintenance costs of backend services, avoids redundant code and network overhead, and achieves complete decoupling of authentication logic from business logic. Furthermore, the gateway layer uniformly handles the injection of authentication information and request forwarding, creating a centralized and standardized authentication management system. This improves the maintainability and scalability of the system architecture and ensures that sensitive authentication information is processed at the gateway layer before being transmitted to the backend, further enhancing the security of authentication data during transmission.

[0063] Step 480: The backend application service extracts the custom authentication information from the request header, completes the authentication operation on the access request based on the custom authentication information, and performs the pass or deny processing according to the authentication result.

[0064] In this embodiment of the disclosure, after receiving an access request forwarded by the Kong gateway, the backend application service can parse the request header and extract the custom authentication information in the custom field of the preset name. Then, in combination with its own preset business permission rules, it can perform multi-dimensional permission verification on the extracted custom authentication information. The verification covers at least one of the user role permissions and resource management scope permissions. According to the verification results, the access request is processed accordingly. If the custom authentication information passes all dimensions of permission verification, the backend application service will allow the access request and respond to the user's business needs normally. If the custom authentication information fails any dimension of permission verification, the backend application service will reject the access request and return an authentication failure message to the frontend microservice that initiated the request.

[0065] Accordingly, the implementation steps may include: after receiving the forwarded access request, the backend application service parses the request header and extracts the custom authentication information from the custom field with a preset name; the backend application service performs multi-dimensional verification on the extracted custom authentication information according to its own business permission rules, and the verification dimensions include at least one of user role permissions and resource management scope permissions; if the custom authentication information passes all dimension verifications, the backend application service allows the access request and responds to the user's business requirements; if the custom authentication information fails any dimension verification, the backend application service denies the access request and returns an authentication failure message to the frontend microservice.

[0066] This technical solution extracts custom authentication information directly from preset fields in the request header through the backend application service. This eliminates the need for the backend service to parse identity tokens and access cached databases to obtain authentication data, significantly reducing backend service development and maintenance costs and network overhead, and avoiding redundant code. Combined with multi-dimensional permission verification based on business permission rules, it overcomes the limitations of traditional authentication solutions that rely solely on single-dimensional verification of non-sensitive basic information. This enables fine-grained and precise permission control required by enterprise-level systems, effectively ensuring the security and compliance of system business access. Furthermore, it performs differentiated allow or deny processing based on the verification results and provides authentication failure information for denied requests, creating a complete closed loop for permission control. This not only standardizes system access permission management but also allows the frontend to obtain request processing results promptly, improving the rationality of system interaction and user experience. In addition, the reasonable division between authentication logic and business logic further enhances the maintainability and scalability of the system architecture.

[0067] In summary, the general login authentication method based on the Kong gateway provided in this application stores the identity token and custom authentication information in a cache database. It leverages the Kong gateway's technical means of matching and retrieving this custom authentication information during request interception and adding it to the request header before forwarding it to the backend application service. This method stores sensitive custom authentication information independently from the JWT payload, avoiding the security flaws of the JWT payload (easily decoded due to its lack of encryption and inability to store sensitive information). It also overcomes the limitations of traditional authentication schemes, which can only authenticate based on non-sensitive basic information such as user ID and username. This enables multi-dimensional, fine-grained custom authentication based on user roles, management scope, and other enterprise-level business requirements, significantly improving the flexibility and applicability of the system's authentication architecture. Furthermore, all backend application services can directly extract the custom authentication information from the request header to complete authentication, eliminating the need for each service to separately parse the token or obtain the authentication information. This reduces code redundancy and improves authentication interaction efficiency, effectively solving the scalability problem of the original JWT authentication scheme while ensuring system authentication security.

[0068] Furthermore, as Figure 3 and Figure 4 The specific implementation of the method shown in this embodiment provides a general login authentication device based on the Kong gateway, such as... Figure 6 As shown, the device includes: a storage module 61, a request initiation module 62, a matching module 63, a forwarding module 64, and an authentication module 65.

[0069] Storage module 61 can be used to generate an identity token and return the identity token to the front-end microservice after the authentication service receives the user authentication pass information returned by the unified login platform. At the same time, the identity token is associated with custom authentication information and stored in the cache database. The request initiation module 62 can be used to carry an identity token when the front-end microservice initiates an access request to the back-end application service. The access request is intercepted and processed by the Kong gateway. Matching module 63 can be used by the Kong gateway to match and obtain corresponding custom authentication information from the cache database based on the intercepted identity token; Forwarding module 64 can be used by Kong gateway to add the obtained custom authentication information to the request header of the access request and forward the access request carrying the custom authentication information to the backend application service. The authentication module 65 can be used by backend application services to extract custom authentication information from the request header, complete the authentication operation of the access request based on the custom authentication information, and perform the allow or deny processing according to the authentication result.

[0070] In some embodiments of this application, the storage module 61 can be specifically used to intercept the login request of the front-end microservice by the authentication service and redirect it to the unified login platform, where the user completes the username and password verification or QR code verification. After the unified login platform completes the user identity authentication, it returns the user's basic information as authentication pass information to the authentication service. The authentication service obtains the corresponding custom authentication information based on the user's basic information, generates an identity token based on the JWT encoding rules, and directly returns the identity token to the front-end microservice. The authentication service concatenates the identity token according to the fixed prefix concatenation rules to obtain a cache key-value pair, and stores the cache key-value pair as the key and the custom authentication information as the value in the cache database.

[0071] In some embodiments of this application, the custom authentication information includes one or more combinations of user employee ID, user role information, and customer identifier list managed by the user, and the custom authentication information is sensitive business authentication information of the enterprise intranet.

[0072] In some embodiments of this application, the request initiation module 62 can be specifically used to add an identity token to the request parameters or request header when the front-end microservice initiates an access request to the back-end application service, forming an access request carrying an identity token; the front-end microservice sends the access request to the Kong gateway according to a preset routing rule, and the Kong gateway performs a unified interception operation on all access requests sent to the back-end application service; the Kong gateway parses the intercepted access request, extracts the identity token carried therein, and performs a preliminary validity check on the format integrity of the identity token.

[0073] In some embodiments of this application, the matching module 63 can be used by the Kong gateway to concatenate the extracted identity token according to a fixed prefix concatenation rule, and generate a cache key value consistent with the cache database; the Kong gateway initiates a data query request to the cache database through the generated cache key value; the cache database performs matching retrieval based on the received cache key value, and returns the custom authentication information corresponding to the successfully matched cache key value to the Kong gateway.

[0074] In some embodiments of this application, the forwarding module 64 can be specifically used by the Kong gateway to perform format standardization processing on the custom authentication information obtained from the cache database, forming field information that conforms to the HTTP request header specification; the Kong gateway adds a custom field with a preset name to the HTTP request header of the access request, and writes the standardized custom authentication information into the custom field; the Kong gateway forwards the access request with added custom authentication information to the corresponding backend application service according to the preset service routing configuration.

[0075] In some embodiments of this application, the authentication module 65 is specifically used to parse the request header and extract custom authentication information from a custom field with a preset name after the backend application service receives the forwarded access request. The backend application service performs multi-dimensional verification on the extracted custom authentication information according to its own business permission rules. The verification dimensions include at least one of user role permissions and resource management scope permissions. If the custom authentication information passes all dimension verifications, the backend application service allows the access request and responds to the user's business requirements. If the custom authentication information fails any dimension verification, the backend application service denies the access request and returns an authentication failure message to the frontend microservice.

[0076] It should be noted that other corresponding descriptions of the functional units involved in the universal login authentication device based on the Kong gateway provided in this embodiment can be found in [reference needed]. Figure 3 and Figure 4 The corresponding description in [the document] will not be repeated here.

[0077] Based on the above, Figure 3 and Figure 4 Accordingly, this embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the above-described method. Figure 3 and Figure 4 The example shown is a general login authentication method based on the Kong gateway.

[0078] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause an electronic device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0079] Based on the above, Figure 3 and Figure 4 The method shown, and Figure 6 To achieve the above objectives, the present application also provides an electronic device, specifically a personal computer, tablet computer, server, or other network device, as shown in the virtual device embodiment. This device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to achieve the above-described objectives. Figure 3 and Figure 4 The example shown is a general login authentication method based on the Kong gateway.

[0080] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0081] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0082] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0083] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platform, or it can be implemented by hardware.

[0084] This invention stores identity tokens and custom authentication information in a cache database. It leverages the Kong gateway to intercept requests, retrieve this custom authentication information, and add it to the request header before forwarding it to backend application services. This independent storage of sensitive custom authentication information, separate from the JWT payload, avoids the security vulnerabilities of JWT payloads (easily decoded due to lack of encryption) and their inability to store sensitive information. It also overcomes the limitations of traditional authentication schemes, which rely solely on non-sensitive basic information like user ID and username. This allows for multi-dimensional, fine-grained custom authentication based on user roles, management scope, and other enterprise-level business requirements, significantly improving the flexibility and applicability of the system's authentication architecture. Furthermore, all backend application services can directly extract the custom authentication information from the request header to complete authentication, eliminating the need for individual token parsing or authentication information retrieval. This reduces code redundancy and improves authentication interaction efficiency, effectively addressing the insufficient scalability of traditional JWT authentication schemes while ensuring system authentication security.

[0085] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application. Those skilled in the art will understand that the modules in the apparatus of the embodiment can be distributed within the apparatus of the embodiment as described, or can be modified to be located in one or more apparatuses different from this embodiment. The modules of the above-described embodiment can be combined into one module, or further divided into multiple sub-modules.

[0086] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of any particular implementation scenario. The above disclosures are merely a few specific implementation scenarios of this application; however, this application is not limited thereto, and any variations conceived by those skilled in the art should fall within the protection scope of this application.

Claims

1. A universal login authentication method based on the Kong gateway, characterized in that, The method is applied to a computer system, which includes an authentication service, a Kong gateway, a cache database, a unified login platform, front-end microservices, and back-end application services. The method includes: After receiving the user authentication pass information returned by the unified login platform, the authentication service generates an identity token and returns the identity token to the front-end microservice. At the same time, the identity token is associated with custom authentication information and stored in the cache database. When the front-end microservice initiates an access request to the back-end application service, it carries the identity token, and the access request is intercepted and processed by the Kong gateway. Based on the intercepted identity token, the Kong gateway retrieves the corresponding custom authentication information from the cache database. The Kong gateway adds the obtained custom authentication information to the request header of the access request and forwards the access request carrying the custom authentication information to the backend application service. The backend application service extracts the custom authentication information from the request header, completes the authentication operation of the access request based on the custom authentication information, and performs allow or deny processing based on the authentication result.

2. The method according to claim 1, characterized in that, After receiving user authentication approval information from the unified login platform, the authentication service generates an identity token and returns it to the front-end microservice. Simultaneously, it associates the identity token with custom authentication information and stores it in a cache database, including: After the authentication service intercepts the login request of the front-end microservice, it redirects the user to the unified login platform, where the user completes the username and password verification or QR code verification. After completing user identity authentication, the unified login platform returns the user's basic information as authentication pass information to the authentication service. The authentication service obtains the corresponding custom authentication information based on the user's basic information, generates an identity token based on JWT encoding rules, and directly returns the identity token to the front-end microservice. The authentication service concatenates the identity token according to a fixed prefix concatenation rule to obtain a cache key value. The cache key value is used as the key and the custom authentication information is used as the value. The two are then stored in the cache database as key-value pairs.

3. The method according to claim 1, characterized in that, The custom authentication information includes one or more combinations of user employee ID, user role information, and customer identifiers in the user management list, and the custom authentication information is sensitive business authentication information on the enterprise intranet.

4. The method according to claim 1, characterized in that, When the front-end microservice initiates an access request to the back-end application service, it carries the identity token. The access request is intercepted and processed by the Kong gateway, including: When the front-end microservice initiates an access request to the back-end application service, it adds the identity token to the request parameters or request header to form an access request carrying the identity token. The front-end microservice sends the access request to the Kong gateway according to the preset routing rules, and the Kong gateway performs a unified interception operation on all access requests sent to the back-end application service. The Kong gateway parses the intercepted access request, extracts the identity token carried in it, and performs a preliminary validity check on the format integrity of the identity token.

5. The method according to claim 2, characterized in that, Based on the intercepted identity token, the Kong gateway retrieves the corresponding custom authentication information from the cache database, including: The Kong gateway concatenates the extracted identity token according to the fixed prefix concatenation rule to generate a cache key-value pair that is consistent with the cache database. The Kong gateway initiates a data query request to the cache database using the generated cache key value; The cache database performs matching and retrieval based on the received cache key values, and returns the custom authentication information corresponding to the successfully matched cache key values ​​to the Kong gateway.

6. The method according to claim 1, characterized in that, The Kong gateway adds the obtained custom authentication information to the request header of the access request, and forwards the access request carrying the custom authentication information to the backend application service, including: The Kong gateway performs format standardization processing on the custom authentication information obtained from the cache database to form field information that conforms to the HTTP request header specification; The Kong gateway adds a custom field with a preset name to the HTTP request header of the access request, and writes the standardized custom authentication information into the custom field; The Kong gateway forwards the access request with the added custom authentication information to the corresponding backend application service according to the preset service routing configuration.

7. The method according to claim 1, characterized in that, The backend application service extracts the custom authentication information from the request header, completes the authentication operation on the access request based on the custom authentication information, and performs allow or deny processing based on the authentication result, including: After receiving the forwarded access request, the backend application service parses the request header and extracts the custom authentication information from the custom field with the preset name. The backend application service performs multi-dimensional verification on the extracted custom authentication information according to its own business permission rules. The verification dimensions include at least one of user role permissions and resource management scope permissions. If the custom authentication information passes all dimensions of verification, the backend application service will allow the access request and respond to the user's business needs. If the custom authentication information fails any of the verification dimensions, the backend application service will reject the access request and return an authentication failure message to the frontend microservice.

8. The method according to any one of claims 1-7, characterized in that, The cache database is a Redis database, which is deployed in the enterprise intranet environment and forms an intranet data interaction environment with the authentication service and the Kong gateway.

9. A universal login authentication device based on the Kong gateway, characterized in that, The device is applied to a computer system, which includes an authentication service, a Kong gateway, a cache database, a unified login platform, front-end microservices, and back-end application services. The device includes: The storage module is used to generate an identity token and return the identity token to the front-end microservice after the authentication service receives the user authentication pass information returned by the unified login platform. At the same time, the identity token is associated with custom authentication information and stored in the cache database. The request initiation module is used to carry the identity token when the front-end microservice initiates an access request to the back-end application service, and the access request is intercepted and processed by the Kong gateway. The matching module is used by the Kong gateway to match and obtain the corresponding custom authentication information from the cache database based on the intercepted identity token; The forwarding module is used by the Kong gateway to add the obtained custom authentication information to the request header of the access request, and forward the access request carrying the custom authentication information to the backend application service. The authentication module is used by the backend application service to extract the custom authentication information from the request header, complete the authentication operation of the access request based on the custom authentication information, and perform allow or deny processing based on the authentication result.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8.

Images