SDN multi-resource pool authentication method, device, equipment, medium and product

Abstract

The application discloses a kind of SDN multi-resource pool authentication method, device, equipment, medium and product, the method includes when detecting that target user selects target resource pool, with the authority check request of resource pool information of target resource pool is sent to authentication service;When receiving the authority check result that authentication service returns after receiving authority check request, if authority check result passes, then allow switching to target resource pool;With the operation request of resource pool information is sent to target service of target resource pool;When receiving the operation result that target service executes operation request after operation request is authenticated, operation result is presented to target user.The multi-resource pool is introduced, and resource pool information is carried in the request to be sent to the service in corresponding resource pool to complete authentication, can take the microservice in the range of multi-resource pool as the authentication object, realize resource pool extensible, increase the authority division of resource pool granularity, and enrich the level of authority management.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to an SDN multi-resource pool authentication method, apparatus, equipment, medium, and product. Background Technology

[0002] Software-defined networking (SDN) enables centralized control and dynamic configuration of network resources, allowing multiple resource pools to intelligently allocate network resources based on business needs and traffic patterns. Services within each SDN resource pool operate independently, possessing their own databases, application services, etc. This results in SDN resource data being scattered across different pools. To achieve unified management and a unified entry point for this dispersed SDN resource pool data, a unified authentication system is needed for user authentication, access control, and other operations. However, current authentication methods focus on microservices and their scalability, neglecting the SDN domain's approach of authenticating microservices across multiple resource pools as a whole, thus failing to reflect the scalability of multiple resource pools. Summary of the Invention

[0003] This invention provides an SDN multi-resource pool authentication method, apparatus, device, medium, and product. By introducing multiple resource pools, when sending an operation request, the information of multiple resource pools is carried and sent to the corresponding resource pool service to complete the authentication. It can use the entire microservice within the scope of multiple resource pools as the authentication object, realize the scalability of resource pools, increase the granularity of permission division of resource pools, and enrich the hierarchical level of permission management.

[0004] To achieve the above objectives, embodiments of the present invention provide an SDN multi-resource pool authentication method applied to a web page front-end, the method comprising: When it is detected that a target user has selected a target resource pool, a permission verification request carrying the resource pool information of the target resource pool will be sent to the authentication service. When the authentication service returns a permission verification result after verifying the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions, if the permission verification result is successful, the target user is allowed to switch to the target resource pool. An operation request carrying the resource pool information is sent to the target service of the target resource pool; When the target service receives the operation result returned by the operation request after authenticating the operation request, the operation result is presented to the target user.

[0005] As an improvement to the above solution, after detecting that the target user has selected the target resource pool, the method further includes: When the target user triggers login authentication, a login request carrying the resource pool information of the target resource pool is sent to the authentication service, so that the authentication service completes login authentication for the target user according to the login mode configured in the target resource pool, generates a valid authentication token for the target user, returns all valid authentication tokens to the web page front end, and caches the valid authentication tokens in the local cache of the target resource pool. Upon receiving the valid authentication token returned by the authentication service, the valid authentication token is cached in the local cache of the webpage frontend.

[0006] As an improvement to the above solution, after allowing the target user to switch to the target resource pool, the method further includes: When the target user is detected to have switched to the target resource pool, the front-end version is switched according to the front-end version number of the target resource pool.

[0007] To achieve the above objectives, this invention provides another SDN multi-resource pool authentication method, applied to a target service of a target resource pool, the method comprising: When a webpage frontend sends an operation request carrying resource pool information of the target resource pool selected by the target user, the resource pool information and user information of the target user are obtained from the operation request. Scan the local cache of the target resource pool based on the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed, and the operation result is returned to the webpage frontend after the operation request is executed. If no valid authentication token matching the target user exists, the registration information of the authentication service is obtained, and the authentication service is invoked to authenticate the operation request based on the registration information, the resource pool information, and the user information. If authentication is successful, the operation request will be executed and the operation result will be returned to the webpage frontend.

[0008] As an improvement to the above solution, if no valid authentication token matching the target user exists, the registration information of the authentication service is obtained, and the authentication service is invoked to authenticate the operation request based on the registration information, the resource pool information, and the user information, including: If no valid authentication token matching the target user exists, the registration information of the authentication service is obtained from the registry center, and the authentication service is remotely invoked based on the registration information. The resource pool information, the user information, the URL of the operation request, and the request method are used as input parameters for the authentication service, so that the authentication service can authenticate the operation request.

[0009] To achieve the above objectives, embodiments of the present invention provide an SDN multi-resource pool authentication device, comprising: The verification request sending module is used to send a permission verification request carrying the resource pool information of the target resource pool to the authentication service when it is detected that the target user has selected the target resource pool; The verification result receiving module is used to receive the permission verification result returned by the authentication service after verifying the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions. If the permission verification result is successful, the target user is allowed to switch to the target resource pool. An operation request sending module is used to send an operation request carrying the resource pool information to the target service of the target resource pool; The operation result receiving module is used to receive the operation result returned by the target service after the operation request is authenticated and executed, and then present the operation result to the target user.

[0010] To achieve the above objectives, embodiments of the present invention provide another SDN multi-resource pool authentication device, including: The operation request receiving module is used to receive an operation request sent by the web page front-end carrying resource pool information of the target resource pool selected by the target user, and obtain the resource pool information and user information of the target user from the operation request. The authentication token matching module is used to scan the local cache of the target resource pool based on the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed, and the operation result is returned to the web page front end after the operation request is executed. The authentication service invocation module is used to obtain the registration information of the authentication service if no valid authentication token matching the target user exists, and invoke the authentication service to authenticate the operation request based on the registration information, the resource pool information and the user information. The operation result sending module is used to return the operation result to the webpage frontend after executing the operation request if the authentication is successful.

[0011] To achieve the above objectives, this invention provides an SDN multi-resource pool authentication device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the above-mentioned SDN multi-resource pool authentication method.

[0012] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the above-described SDN multi-resource pool authentication method.

[0013] To achieve the above objectives, embodiments of the present invention also provide a computer program product, which is stored in a storage medium and executed by at least one processor to implement the steps of the above-described SDN multi-resource pool authentication method.

[0014] Compared with existing technologies, the SDN multi-resource pool authentication method, apparatus, device, medium, and product disclosed in this invention, when a target user selects a target resource pool, sends a permission verification request carrying the resource pool information of the target resource pool to an authentication service; upon receiving a permission verification result returned by the authentication service after verifying the target user's access permissions based on the resource pool information and the pre-stored association between resource pools and user permissions, if the permission verification result is successful, the target user is allowed to switch to the target resource pool; an operation request carrying the resource pool information is sent to the target service of the target resource pool; upon receiving an operation result returned by the target service after authenticating the operation request, the operation result is presented to the target user. By introducing multiple resource pools into the authentication service, resource pool information is sent to the corresponding resource pool service when sending requests to complete authentication. This allows the entire microservice within the scope of multiple resource pools to be used as the authentication object, enabling the resource pool to be scalable. Furthermore, by completing pre-access permission verification through permission verification requests that carry resource pool information, this technology overcomes the limitations of using microservices as authentication objects in existing technologies. It increases the granularity of permission division at the resource pool level, enriches the hierarchical structure of permission management, and intercepts unauthorized user operations on the resource pool at the access entry point. This avoids SDN resource pool data leakage and operational chaos caused by unauthorized access, significantly improving access security in multi-resource pool scenarios. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating an SDN multi-resource pool authentication method provided in an embodiment of the present invention; Figure 2 This is an architecture topology diagram of an SDN multi-resource pool authentication system provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a heterogeneous login method provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of a front-end multi-version switching model provided in an embodiment of the present invention; Figure 5This is a flowchart illustrating another SDN multi-resource pool authentication method provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an SDN multi-resource pool authentication device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of another SDN multi-resource pool authentication device provided in an embodiment of the present invention; Figure 8 This is a structural block diagram of an SDN multi-resource pool authentication device provided in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] It should be noted that the terms "comprising" and "specific" in this invention, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0018] Please see Figure 1 , Figure 1 This is a flowchart illustrating an SDN multi-resource pool authentication method provided in an embodiment of the present invention. This SDN multi-resource pool authentication method is applied to a webpage front-end, and the method includes: S11, When it is detected that the target user has selected the target resource pool, a permission verification request carrying the resource pool information of the target resource pool is sent to the authentication service. S12, when the authentication service receives the permission verification result returned by performing permission verification on the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions, if the permission verification result is successful, the target user is allowed to switch to the target resource pool. S13, send the operation request carrying the resource pool information to the target service of the target resource pool; S14, when the target service receives the operation result returned by the operation request after the operation request is authenticated, the operation result is presented to the target user.

[0019] For example, such as Figure 2 As shown, Figure 2 This is an architecture topology diagram of an SDN multi-resource pool authentication system provided in an embodiment of the present invention; Figure 2 This includes a web (World Wide Web) frontend (web page frontend), gateway, authentication service, resource pool, and related services (target services). Related services are a collective term, primarily referring to the various microservices / application services within each SDN resource pool that carry specific SDN business functions and require access to a unified authentication system. These services are the core carriers for resource pools to implement SDN network management, data processing, and business execution, and are also the main entities initiating authentication requests and receiving gateway forwarding requests in the authentication process. When a target user selects a target resource pool on the web frontend, the frontend sends a permission verification request to the authentication service, with the request header carrying the IP information of the target resource pool. Essentially, the permission system maintains information about the resource pools. When switching resource pools, the web frontend first sends a request to obtain a list of resource pool IPs (Internet Protocol). After selecting a resource pool, it needs to determine whether the user has the necessary permissions for that resource pool. Permission management implements the granular division of resource pools. The web frontend sends a request to the authentication system (authentication service) for resource pool authentication; if the permission verification fails, the switch cannot proceed. After successful permission pre-verification, the operation request carrying the resource pool information is forwarded through the gateway to the relevant service within the corresponding resource pool based on the target resource pool IP address in the request header. The target service then uses gRPC (gRPC Remote Procedure Call) to invoke the authentication method to perform dual authentication of the token validity and operation permissions, returning the authentication result. For example, the target service first obtains key information such as the method name, IP address, and port of the authentication service from the registry center, and then uses this information to invoke the relevant method of the authentication service via gRPC. If authentication is successful, the operation request is executed, and the valid authentication token of the target user is cached locally with an expiration time. The operation result is then returned to the web frontend through the gateway, and the web frontend simultaneously caches the valid authentication token locally with an expiration time. If authentication fails, the operation request is rejected, and an authentication failure result is returned.

[0020] In this embodiment of the invention, after a user selects a target resource pool, a pre-permission verification request carrying resource pool information is first performed. Only after the verification passes is switching resource pools allowed. This breaks through the limitation of existing technologies that only support server-side menu-level permission management. It adds permission division at the resource pool level, intercepting unauthorized user operations on resource pools at the access entry point. This avoids SDN resource pool data leakage and operational chaos caused by unauthorized access, achieving precise permission control at the resource pool level and improving access security in multi-resource pool scenarios. All front-end requests carry resource pool information. The authentication service completes verification based on the pre-stored resource pool and user permission association relationship. When adding / deleting a resource pool, only the resource pool information and the corresponding permission association relationship need to be updated in the authentication service. There is no need to make significant modifications to the front-end interaction process. This meets the expansion requirements of SDN multi-resource pools to be added and deleting at any time, solves the problem of insufficient overall scalability of multi-resource pools in existing technologies, supports flexible expansion of SDN multi-resource pools, and adapts to the dynamic management requirements of resource pools.

[0021] Furthermore, after detecting that the target user has selected the target resource pool, the method further includes: S1101, when the target user triggers login authentication, a login request carrying the resource pool information of the target resource pool is sent to the authentication service, so that the authentication service completes login authentication for the target user according to the login mode configured by the target resource pool, generates a valid authentication token for the target user, returns all valid authentication tokens to the web page front end, and caches the valid authentication tokens in the local cache of the target resource pool. S1102, when the valid authentication token returned by the authentication service is received, the valid authentication token is cached in the local cache of the webpage front-end.

[0022] For example, such as Figure 3 As shown, Figure 3This is a schematic diagram of a heterogeneous login model provided by an embodiment of the present invention. The authentication service can be implemented in various ways, such as accessing a mobile cloud intelligent maintenance platform, using a verification code login method, or other custom login modes. The authentication service is registered in the Etcd registry center, including key information such as the service's listening address, service method name, interface input parameters, and response. The authentication service mainly consists of two parts: ① User login authentication: After logging in, the user obtains a time-limited token, which is carried with each request. Login authentication mainly includes token issuance and token validity verification. ② Permission verification: This verifies whether the user has permission for a certain request or resource. The verification input parameters include username, request URL (Uniform Resource Locator), and request method. Using Etcd as the registry center, Etcd has advantages such as high efficiency, stability, security, and ecosystem compatibility, making it well-suited for the service registration and discovery needs in modern microservice architectures. Once the main body of the authentication method is determined, different implementations of the same interface are achieved using the concept of interface-oriented programming.

[0023] Specifically, when the target user triggers login authentication, a login request carrying the resource pool information of the target resource pool is sent to the authentication service. If the login mode configured for the target resource pool is access to the mobile cloud intelligent maintenance platform, the issuance and verification of tokens, permission verification, and other operations are delegated to the mobile cloud intelligent maintenance platform. The resource pool information, permission resources, and permission menus are registered as Actions with the mobile cloud intelligent maintenance platform. When a user logs in, a request is sent to the mobile cloud intelligent maintenance platform to obtain a token. To reduce interaction with the platform, the verified token is cached locally to improve request response speed. During user permission verification, a request is sent to the mobile cloud intelligent maintenance platform to obtain the Action permission list, and permission determination is performed based on the Action permission list.

[0024] If the target resource pool is configured with a CAPTCHA login method, the Casbin access control framework and RBAC (Role-Based Access Control) model are used. Casbin is a powerful and efficient access control framework for implementing permission verification. This method persistently stores user data, resource data, menu data, role data, and related mappings in the database. At project startup, permission data is fetched into memory. During permission verification, the current user's permission information is compared with the inclusion relationship in the permission data to determine whether the operation is authorized. User authentication is based on the consistency between the logged-in user information and the database.

[0025] This invention registers the authentication service to the registration center and uses interface-oriented programming to implement multiple authentication methods, allowing other services to only be aware of the interface and not depend on the specific implementation, thus supporting flexible switching between multiple login modes. The specific implementation of the authentication service can be flexibly extended, and different resource pools can choose the corresponding login method according to network requirements (such as the production environment accessing the mobile cloud platform and the development environment using verification code login). Other services only need to call the authentication interface through the registration center without having to pay attention to the underlying implementation, thus achieving heterogeneous compatibility of login methods.

[0026] In one specific embodiment, a user enters their account and password on the login interface of resource pool A. The front end sends a login request to the authentication service, requesting to mark resource pool A as logged in to the mobile cloud platform. After receiving the request, the authentication service forwards the login request to the mobile cloud intelligent maintenance platform, and registers the information of resource pool A (IP, name), authorized resources, and authorized menus as Actions to the platform. The mobile cloud platform verifies the user's account and password. After successful authentication, it issues a unified and valid authentication token and binds it to the registered Action permissions. The authentication service caches the valid authentication token in the local cache of each service of resource pool A, and returns the token to the front end. The front end stores the token and completes the login. Alternatively, the user enters their account on the login page of resource pool B, the front end clicks to get the verification code, the authentication service sends the verification code to the user, and the user enters the verification code; the front end sends a login request, requesting to mark resource pool B - verification code login; the authentication service uses the Casbin access control framework and RBAC access control model to verify the consistency of the user's account and verification code from the local database, and at the same time query its role and bound permissions; the authentication service generates a system local token (valid authentication token), distributes it to the front end and caches it locally in each service of resource pool B, and completes the login.

[0027] Furthermore, after allowing the target user to switch to the target resource pool, the method further includes: S1201, when it is detected that the target user has switched to the target resource pool, the front-end version is switched according to the front-end version number of the target resource pool.

[0028] For example, such as Figure 4 As shown, Figure 4 This is a schematic diagram of a front-end multi-version switching model provided in an embodiment of the present invention; Figure 4In this framework, the resource pool stores front-end version information. When a user switches resource pools, the front-end version number is retrieved. Dynamic routing is then implemented based on the resource pool's front-end version number, along with Nginx variables and conditional checks, to complete the front-end version switch. For example, after the latest front-end version is developed, folders corresponding to the front-end pages of all front-end versions are created. These folders include all historical front-end versions and the latest front-end version. After completing the back-end versions corresponding to the front-end page versions, version numbers are configured for the corresponding back-end versions. When a new resource pool is added, its information needs to be registered in the database. This information includes the front-end version information, and relevant modification interfaces are provided to update the front-end version information of the resource pool. When a user successfully switches resource pools, the front-end version information carried by the resource pool is added to the request header of the request, and the switch is performed based on the front-end version information in the request header. Specifically, Nginx is used for request forwarding, and the Nginx configuration file is configured to extract the frontend version information from the request header. If the version number can be obtained, the corresponding file path is set; otherwise, the default frontend version file path is used. If the user's request is not a request to switch resource pools, the request header does not contain frontend version information, meaning the frontend version remains unchanged. In this embodiment of the invention, frontend version switching only occurs after the user performs a resource pool change operation. This allows for frontend version adaptation based on user needs while preventing frequent frontend version switching. Furthermore, to simplify the process, frontend version number information is maintained together with resource pool information for easy retrieval and management.

[0029] Specifically, step S1201 includes: When the target user is detected to have switched to the target resource pool, the association information of the target resource pool is obtained; wherein, the association information includes the IP information, front-end version number and permission verification result of the target resource pool; A version switching request carrying the front-end version number of the target resource pool is sent to the Nginx proxy, so that the Nginx proxy can extract the front-end version number of the target resource pool through preset variables and condition judgment rules, set the corresponding front-end file path according to the front-end version number, and route the request to the front-end folder that matches the front-end version number, load the front-end version of the target resource pool, and complete the front-end version switching.

[0030] For example, in one specific implementation, when a user switches from resource pool A to resource pool B in a logged-in system, the front end first sends an email to TiKV (Transactionally Intuitive Database). The TiKV database sends a request to retrieve the association information of resource pool B. The TiKV database returns the association information of resource pool B (IP 192.168.1.200, front-end version number v3.0, permission verification identifier), and the front-end temporarily stores the version number v3.0. After allowing the user to switch from resource pool A to resource pool B, the front-end adds the front-end version number v3.0 of resource pool B to the request header of the switch request. This request header is identified as front-version:v3.0, and the request is sent to the Nginx proxy. Nginx extracts the front-version field from the request header through variables and conditional judgment rules in the configuration file and identifies the version number as v3.0. Nginx dynamically sets the front-end file path according to the version number and routes the request to the front-end folder that matches the front-end version number, loading the v3.0 version front-end page corresponding to resource pool B. If the version number is not extracted from the request header, Nginx automatically routes to the default version path. After a user successfully switches to resource pool B, they may initiate other operation requests (e.g., modifying the SDN port configuration of resource pool B). These requests are not resource pool switching requests and do not include a front-version field in the request header. Nginx recognizes the absence of a version number identifier, maintains the current v3.0 version front-end path, and directly forwards the request to the corresponding service in resource pool B. This embodiment of the invention maintains front-end version information based on the resource pool dimension, combines it with Nginx dynamic routing to achieve rapid front-end version switching, simplifies the version management process, triggers version changes only when switching resource pools, and avoids frequent switching. It maintains and synchronously obtains front-end version information and resource pool information in a unified manner, simplifying the original complex path based on location information. By triggering version changes only when switching resource pools, it balances version compatibility and system stability.

[0031] This invention discloses an SDN multi-resource pool authentication method. When a target user selects a target resource pool, an authentication request carrying the resource pool information of the target resource pool is sent to an authentication service. Upon receiving an authentication service's authentication result after verifying the target user's access permissions based on the resource pool information and a pre-stored association between resource pools and user permissions, if the authentication result is successful, the target user is allowed to switch to the target resource pool. An operation request carrying the resource pool information is sent to the target service of the target resource pool. Upon receiving the operation result returned by the target service after authenticating the operation request, the operation result is presented to the target user. By introducing multiple resource pools into the authentication service, resource pool information is sent to the corresponding resource pool service when sending requests to complete authentication. This allows the entire microservice within the scope of multiple resource pools to be used as the authentication object, enabling the resource pool to be scalable. Furthermore, by completing pre-access permission verification through permission verification requests that carry resource pool information, this technology overcomes the limitations of using microservices as authentication objects in existing technologies. It increases the granularity of permission division at the resource pool level, enriches the hierarchical structure of permission management, and intercepts unauthorized user operations on the resource pool at the access entry point. This avoids SDN resource pool data leakage and operational chaos caused by unauthorized access, significantly improving access security in multi-resource pool scenarios.

[0032] Please see Figure 5 , Figure 5 This is a flowchart illustrating an SDN multi-resource pool authentication method provided in an embodiment of the present invention. This SDN multi-resource pool authentication method is applied to a target service within a target resource pool. The method includes: S21, when receiving an operation request from the web page front-end carrying resource pool information of the target resource pool selected by the target user, obtain the resource pool information and user information of the target user from the operation request; S22, Scan the local cache of the target resource pool according to the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed. After executing the operation request, the operation result is returned to the web page front end. S23, if no valid authentication token matching the target user exists, obtain the registration information of the authentication service, and call the authentication service to authenticate the operation request based on the registration information, the resource pool information, and the user information; S24. If authentication is successful, the operation result will be returned to the webpage frontend after the operation request is executed.

[0033] In one specific embodiment, after the user completes the resource pool granularity permission verification and confirms switching to resource pool A (IP: 192.168.1.100), the user initiates a business operation request (e.g., querying the SDN network bandwidth configuration of resource pool A). This request header carries the IP address of resource pool A and the user's valid authentication token and is sent to the gateway. The gateway, with its built-in resource pool IP routing rules, recognizes the IP address 192.168.1.100 in the request header and directly forwards the request to the network configuration query service of resource pool A (the target service, such as service1). Service1 of resource pool A successfully receives the request. Service1 first scans its local cache to check if a valid authentication token exists for the user. If the cache exists and is valid, it skips the gRPC call, completes authentication, queries the SDN network bandwidth configuration of resource pool A, and generates business result data. The business result data is then sent back to the web frontend via the gateway, where the bandwidth configuration information is displayed to the user in a chart / list format. Before calling the authentication service via gRPC, the system first scans the cache to check if a match is found and if the local cache is within a valid time zone. If the authentication service exists and is valid, user authentication is performed directly without calling the authorization method. A caching mechanism is used to reduce interaction with the authorization service and improve request response speed.

[0034] Specifically, step S23 includes: S231, if no valid authentication token matching the target user exists, obtain the registration information of the authentication service from the registration center, and remotely invoke the authentication service according to the registration information; S232, the resource pool information, the user information, the URL of the operation request, and the request method are used as input parameters of the authentication service so that the authentication service can authenticate the operation request.

[0035] In one specific embodiment, if the cache lacks a valid authentication token or the valid authentication token has expired, a request is sent to the registry center to obtain the registration information of the authentication service. The registry center returns the registration information of the authentication service (method name, IP port, username, request URL, request method, etc.). An authentication request is initiated to the selected authentication service instance via gRPC. After receiving the gRPC authentication request, the authentication service instance performs dual authentication, verifying both the validity of the execution token and the operation permission. For example, it verifies whether the target user's valid authentication token is a valid token issued by the system and whether it has expired; it verifies whether the user has the permission to query the network bandwidth configuration of resource pool A. If the authentication passes, the authentication service returns a successful authentication result to the service of resource pool A via gRPC. If the token is invalid or the user lacks operation permission, it returns a failed authentication result and terminates the request. After receiving the successful authentication result, service1 of resource pool A executes the operation request, queries the SDN network bandwidth configuration of resource pool A, and generates business result data. The business result data is sent back to the web frontend via the gateway, and the frontend displays the bandwidth configuration information to the user in the form of a chart / list. The tokens that have passed user authentication are stored in the caches of each service in the resource pool, and the caches are set with corresponding expiration times. Within the cache expiration time, users do not need to initiate gRPC authentication calls again for subsequent operations on resource pool A, thus improving response speed.

[0036] It's worth noting that to alleviate the long authentication request and authentication service links between various resource pools, a caching mechanism can be used to store user authentication and authorization information. Within the cached information's validity period, each resource pool doesn't need to send a gRPC request to the authentication service for every request, reducing the interaction between services within the resource pool and the authentication service. Simultaneously, the authentication service is deployed using a microservice approach, allowing for horizontal scaling. To improve service high availability, multiple authentication services are provided and registered in a registry center. When the service containing the authentication object needs authentication, it selects an authentication service based on information from the registry center. A selection strategy can be set during the selection process, using a selector to choose the appropriate authentication service. The caching mechanism alleviates the long link issue between resource pools and the authentication service, while the microservice approach horizontally scales the authentication service, improving the high availability of the authentication center.

[0037] This invention discloses another SDN multi-resource pool authentication method. Upon receiving an operation request from a webpage frontend carrying resource pool information of a target resource pool selected by a target user, the method obtains the target user's resource pool information and user information from the operation request. It then scans the local cache of the target resource pool based on the resource pool information and user information. If a valid authentication token matching the target user exists, the operation request is authenticated, and the operation result is returned to the webpage frontend after execution. If no valid authentication token matching the target user exists, the method obtains the registration information of the authentication service and calls the authentication service to authenticate the operation request based on the registration information, the resource pool information, and the user information. If authentication is successful, the operation result is returned to the webpage frontend after execution. This method introduces multi-resource pool elements into the authentication system, combining caching mechanisms and microservice deployment to improve authentication efficiency and availability, achieving independent scalability of resource pools.

[0038] See Figure 6 , Figure 6 This is a schematic diagram of the structure of an SDN multi-resource pool authentication device 10 provided in an embodiment of the present invention. The SDN multi-resource pool authentication device 10 includes: The verification request sending module 11 is used to send an authorization verification request carrying the resource pool information of the target resource pool to the authentication service when it is detected that the target user has selected the target resource pool. The verification result receiving module 12 is used to receive the permission verification result returned by the authentication service after verifying the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions. If the permission verification result is successful, the target user is allowed to switch to the target resource pool. Operation request sending module 13 is used to send an operation request carrying the resource pool information to the target service of the target resource pool; The operation result receiving module 14 is used to receive the operation result returned by the target service after the operation request is authenticated and executed, and then present the operation result to the target user.

[0039] The SDN multi-resource pool authentication device 10 provided in this embodiment of the invention can implement all the processes of the SDN multi-resource pool authentication method of the above embodiments. The functions and technical effects of each module in the device are the same as the functions and technical effects of the SDN multi-resource pool authentication method of the above embodiments, and will not be repeated here.

[0040] See Figure 7 , Figure 7This is a schematic diagram of another SDN multi-resource pool authentication device 20 provided in an embodiment of the present invention. The SDN multi-resource pool authentication device 20 includes: The operation request receiving module 21 is used to obtain the resource pool information and user information of the target user from the operation request when it receives an operation request sent by the web page front end carrying the resource pool information of the target user's selected target resource pool; The authentication token matching module 22 is used to scan the local cache of the target resource pool according to the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed, and the operation result is returned to the web page front end after the operation request is executed. The authentication service invocation module 23 is used to obtain the registration information of the authentication service if there is no valid authentication token matching the target user, and invoke the authentication service to authenticate the operation request based on the registration information, the resource pool information and the user information; The operation result sending module 24 is used to return the operation result to the webpage frontend after executing the operation request if the authentication is successful.

[0041] The SDN multi-resource pool authentication device 20 provided in this embodiment of the invention can implement all the processes of the SDN multi-resource pool authentication method of the other embodiment described above. The functions and technical effects of each module in the device are the same as those of the SDN multi-resource pool authentication method of the other embodiment described above, and will not be repeated here.

[0042] See Figure 8 , Figure 8 This is a schematic diagram of the structure of an SDN multi-resource pool authentication device 30 provided in an embodiment of the present invention. The SDN multi-resource pool authentication device 30 of this embodiment includes: a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, it implements the steps in the above-described SDN multi-resource pool authentication method embodiment. Alternatively, when the processor 31 executes the computer program, it implements the functions of each module in the above-described SDN multi-resource pool authentication device embodiment.

[0043] For example, the computer program may be divided into one or more modules, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the SDN multi-resource pool authentication device 30.

[0044] The SDN multi-resource pool authentication device 30 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The SDN multi-resource pool authentication device 30 may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will understand that the schematic diagram is merely an example of the SDN multi-resource pool authentication device 30 and does not constitute a limitation on the SDN multi-resource pool authentication device 30. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the SDN multi-resource pool authentication device 30 may also include input / output devices, network access devices, buses, etc.

[0045] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the SDN multi-resource pool authentication device 30, connecting all parts of the SDN multi-resource pool authentication device 30 via various interfaces and lines.

[0046] The memory 32 can be used to store the computer programs and / or modules. The processor 31 implements various functions of the SDN multi-resource pool authentication device 30 by running or executing the computer programs and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0047] The SDN multi-resource pool authentication device 30, if its integrated modules are implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately added to or subtracted from the content as required by the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium may not include electrical carrier signals and telecommunication signals.

[0048] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0049] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the SDN multi-resource pool authentication method as described in the above embodiments.

[0050] Furthermore, embodiments of the present invention also provide a computer program product, which is stored in a storage medium and executed by at least one processor to implement the steps of the SDN multi-resource pool authentication method described above.

[0051] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An SDN multi-resource pool authentication method, characterized in that, Applied to web page front-ends, the method includes: When it is detected that a target user has selected a target resource pool, a permission verification request carrying the resource pool information of the target resource pool will be sent to the authentication service. When the authentication service returns a permission verification result after verifying the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions, if the permission verification result is successful, the target user is allowed to switch to the target resource pool. An operation request carrying the resource pool information is sent to the target service of the target resource pool; When the target service receives the operation result returned by the operation request after authenticating the operation request, the operation result is presented to the target user.

2. The SDN multi-resource pool authentication method as described in claim 1, characterized in that, After detecting that the target user has selected the target resource pool, the method further includes: When the target user triggers login authentication, a login request carrying the resource pool information of the target resource pool is sent to the authentication service, so that the authentication service completes login authentication for the target user according to the login mode configured in the target resource pool, generates a valid authentication token for the target user, returns all valid authentication tokens to the web page front end, and caches the valid authentication tokens in the local cache of the target resource pool. Upon receiving the valid authentication token returned by the authentication service, the valid authentication token is cached in the local cache of the webpage frontend.

3. The SDN multi-resource pool authentication method as described in claim 1, characterized in that, After allowing the target user to switch to the target resource pool, the method further includes: When the target user is detected to have switched to the target resource pool, the front-end version is switched according to the front-end version number of the target resource pool.

4. An SDN multi-resource pool authentication method, characterized in that, The method, applied to a target service within a target resource pool, includes: When a webpage frontend sends an operation request carrying resource pool information of the target resource pool selected by the target user, the resource pool information and user information of the target user are obtained from the operation request. Scan the local cache of the target resource pool based on the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed, and the operation result is returned to the webpage frontend after the operation request is executed. If no valid authentication token matching the target user exists, the registration information of the authentication service is obtained, and the authentication service is invoked to authenticate the operation request based on the registration information, the resource pool information, and the user information. If authentication is successful, the operation request will be executed and the operation result will be returned to the webpage frontend.

5. The SDN multi-resource pool authentication method as described in claim 4, characterized in that, If no valid authentication token matching the target user exists, the registration information of the authentication service is obtained, and the authentication service is invoked to authenticate the operation request based on the registration information, the resource pool information, and the user information, including: If no valid authentication token matching the target user exists, the registration information of the authentication service is obtained from the registry center, and the authentication service is remotely invoked based on the registration information. The resource pool information, the user information, the URL of the operation request, and the request method are used as input parameters for the authentication service, so that the authentication service can authenticate the operation request.

6. An SDN multi-resource pool authentication device, characterized in that, include: The verification request sending module is used to send a permission verification request carrying the resource pool information of the target resource pool to the authentication service when it is detected that the target user has selected the target resource pool; The verification result receiving module is used to receive the permission verification result returned by the authentication service after verifying the access rights of the target user based on the resource pool information and the pre-stored association between the resource pool and user permissions. If the permission verification result is successful, the target user is allowed to switch to the target resource pool. An operation request sending module is used to send an operation request carrying the resource pool information to the target service of the target resource pool; The operation result receiving module is used to receive the operation result returned by the target service after the operation request is authenticated and executed, and then present the operation result to the target user.

7. An SDN multi-resource pool authentication device, characterized in that, include: The operation request receiving module is used to receive an operation request sent by the web page front-end carrying resource pool information of the target resource pool selected by the target user, and obtain the resource pool information and user information of the target user from the operation request. The authentication token matching module is used to scan the local cache of the target resource pool based on the resource pool information and user information. If a valid authentication token matching the target user exists, the authentication of the operation request is passed, and the operation result is returned to the web page front end after the operation request is executed. The authentication service invocation module is used to obtain the registration information of the authentication service if no valid authentication token matching the target user exists, and invoke the authentication service to authenticate the operation request based on the registration information, the resource pool information and the user information. The operation result sending module is used to return the operation result to the webpage frontend after executing the operation request if the authentication is successful.

8. An SDN multi-resource pool authentication device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the SDN multi-resource pool authentication method as described in any one of claims 1-3 or the SDN multi-resource pool authentication method as described in any one of claims 4-5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the SDN multi-resource pool authentication method as described in any one of claims 1-3 or the SDN multi-resource pool authentication method as described in any one of claims 4-5.

10. A computer program product, characterized in that, The computer program product is stored in a storage medium, and the program product is executed by at least one processor to implement the steps of the SDN multi-resource pool authentication method as described in any one of claims 1-3 or as described in any one of claims 4-5.

Images