Access method, computing device, and computer storage medium

Abstract

Embodiments of the present application provide an access method, a computing device, and a computer storage medium. The access method is applied to a center gateway, and the center gateway is deployed at a center node. The method comprises: receiving an access request for requesting to access a target access interface, wherein the target access interface is deployed at the center node, and the access request is sent by an edge gateway deployed at an edge node; determining whether the edge node has permission to access the target access interface; and when the edge node has the permission to access the target access interface, forwarding the access request to the target access interface. The technical solution provided by the embodiments of the present application achieves the technical effects of improving the access security of the center node and avoiding the center node from network attacks of the edge node.

Description

Access method, computing device and computer storage medium

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on June 14, 2023, with application number 202310707920.6 and invention name “Access Method, Computing Device and Computer Storage Medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of the present application relate to the field of communication technology, and in particular to an access method, a computing device, and a computer storage medium. Background Art

[0003] With the continuous development of the Internet and the Internet of Things, emerging technologies such as distributed computing, cloud computing, and edge computing have gradually become a trend. These emerging technologies generally offer advantages such as flexibility, scalability, and high availability. As a result, many application systems and services are being migrated to the cloud, where they are managed and operated by central nodes.

[0004] Due to the demand for data processing capabilities of central nodes, they are usually deployed in a centralized manner, far away from users. This results in high network latency when users access the central nodes. To address this, edge nodes can be deployed on the user side. Users can then access the edge nodes and then use them to access the cloud service access interface deployed in the central node, reducing network latency.

[0005] Therefore, how to improve the security of access to central nodes and protect central nodes from network attacks from edge nodes has become a technical problem that needs to be solved urgently.

[0006] Summary of the Invention

[0007] Embodiments of the present application provide an access method, apparatus, computing device, and computer storage medium.

[0008] In a first aspect, an embodiment of the present application provides an access method, which is applied to a central gateway, and the central gateway is deployed at a central node. The method includes: receiving an access request for requesting access to a target access interface, the target access interface is deployed at the central node, and the access request is sent by an edge gateway deployed at an edge node; determining whether the edge node has access rights to the target access interface; and forwarding the access request to the target access interface if the edge node has access rights to the target access interface.

[0009] In the second aspect, an embodiment of the present application provides an access method, which is applied to an edge gateway, and the edge gateway is deployed at an edge node. The method includes: sending an access request for a target access interface to a central gateway deployed at a central node, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, forwarding the access request to the target access interface.

[0010] In the third aspect, an access method is provided in an embodiment of the present application, which is applied to an edge application, wherein the edge application is deployed on an edge node, and an edge gateway is also deployed on the edge node. The method includes: sending an access request for a target access interface deployed on a central node to the edge gateway, so that the edge gateway forwards the access request to the central gateway, so that the central gateway determines whether the edge node has access rights to the target access interface; and if the edge node has access rights to the target access interface, forwarding the access request to the target access interface.

[0011] In the fourth aspect, an access method is provided in an embodiment of the present application, which is applied to a target access interface, wherein the target access interface is deployed on a central node, and a central gateway is also deployed on the central node. The method includes: receiving an access request sent by the central gateway, after the central gateway receives the access request sent by the edge gateway deployed on the edge node, determining whether the edge node has access rights to the target access interface; and sending it to the target access node if the edge node has access rights to the target access interface.

[0012] In the fifth aspect, an embodiment of the present application provides an access device, which is applied to a central gateway, and the central gateway is deployed at a central node. The method includes: a first request receiving module, used to receive an access request for requesting access to a target access interface, and the target access interface is deployed at the central node. The access request is sent by an edge gateway deployed at an edge node; an authority determination module, used to determine whether the edge node has access rights to the target access interface; and a request forwarding module, used to forward the access request to the target access interface if the edge node has access rights to the target access interface.

[0013] In the sixth aspect, an embodiment of the present application provides an access device, which is applied to an edge gateway, and the edge gateway is deployed at an edge node. The method includes: a first request sending module, which is used to send an access request for a target access interface to a central gateway deployed at a central node, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

[0014] In the seventh aspect, an embodiment of the present application provides an access device, which is applied to an edge application, and the edge application is deployed on an edge node. An edge gateway is also deployed on the edge node. The method includes: a second request sending module, which is used to send an access request for a target access interface deployed on a central node to the edge gateway, so that the edge gateway forwards the access request to the central gateway, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

[0015] In the eighth aspect, an embodiment of the present application provides an access device, which is applied to a target access interface, and the target access interface is deployed on a central node. A central gateway is also deployed on the central node. The method includes: a second request receiving module, which is used to receive an access request sent by the central gateway. After the central gateway receives the access request sent by the edge gateway deployed on the edge node, it determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, it is sent to the target access node.

[0016] In the ninth aspect, an embodiment of the present application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the access method provided in the embodiment of the present application.

[0017] In a tenth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, the access method provided by the embodiment of the present application is implemented.

[0018] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar components or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in this application and should not be construed as limiting the scope of this application.

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] FIG1 schematically shows a flow chart of an access method provided by an embodiment of the present application.

[0022] FIG2 schematically shows a schematic diagram of an access method provided in an embodiment of the present application.

[0023] FIG3 schematically shows a schematic diagram of a central gateway configuring identity information for an edge gateway in an embodiment of the present application.

[0024] FIG4 schematically shows a schematic diagram of an access method provided in an embodiment of the present application.

[0025] FIG5 schematically shows a block diagram of an access device provided by an embodiment of the present application.

[0026] FIG6 schematically shows a block diagram of a computing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0028] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0029] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] With the continuous development of the Internet and the Internet of Things, emerging technologies such as distributed computing, cloud computing, and edge computing have gradually become a trend. These emerging technologies generally offer advantages such as flexibility, scalability, and high availability. As a result, many application systems and services are being migrated to the cloud, where they are managed and operated by central nodes.

[0031] Due to the demand for data processing capabilities of central nodes, they are usually deployed in a centralized manner, far away from users. This results in high network latency when users access the central nodes. To address this, edge nodes can be deployed on the user side. Users can then access the edge nodes and then use them to access the cloud service access interface deployed in the central node, reducing network latency.

[0032] Therefore, how to improve the security of access to central nodes and protect central nodes from network attacks from edge nodes has become a technical problem that needs to be solved urgently.

[0033] In order to solve the technical problems existing in the related technology, an embodiment of the present application provides an access method, which is applied to a central gateway deployed on a central node, by adopting a technical solution of receiving an access request for requesting access to a target access interface, the target access interface is deployed on the central node, and the access request is sent by an edge gateway deployed on an edge node; determining whether the edge node has access rights to the target access interface; and forwarding the access request to the target access interface when the edge node has access rights to the target access interface. This method enables the access request for requesting access to the central node to be first received by the central gateway, and only forwarding the access request to the central node when the central gateway determines that the edge node sending the access request has access rights, thereby achieving the technical effect of improving the security of access to the central node and preventing the central node from suffering network attacks from edge nodes.

[0034] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0035] Figure 1 schematically shows a flowchart of an access method provided by an embodiment of the present application. The access method is applied to a central gateway, which is deployed at a central node. As shown in Figure 1, the access method may include the following steps: 101, receiving an access request for requesting access to a target access interface, the target access interface is deployed at a central node, and the access request is sent by an edge gateway deployed at an edge node; 102, determining whether the edge node has access rights to the target access interface; 103, forwarding the access request to the target access interface if the edge node has access rights to the target access interface.

[0036] According to an embodiment of the present application, a target access interface can be an interface provided by a central node to other nodes in a distributed system, such as edge nodes, to access and call services or resources provided by the central node. The target access interface can be implemented through technologies such as Web API (Web Application Programming Interface) and RPC (Remote Procedure Call).

[0037] According to an embodiment of the present application, when an edge node initiates an access request, it may carry identification information or access address of the target access interface in the access request, and send the access request to the edge gateway, which then forwards the access request to the central gateway.

[0038] According to an embodiment of the present application, the central gateway can perform unified security control on access requests requesting access to the central node. For example, the central gateway can determine whether the initiator of the access request has access rights to the central node and at least one access interface in the central node, and forward the access request to the central node if the initiator of the access request has access rights to the central node. If the initiator of the access request does not have access rights to the central node, the central gateway can have this access, thereby preventing the central node from being accessed by edge nodes that do not have access rights.

[0039] According to one embodiment of the present application, a pre-maintained access control list (ACL) can be used to determine whether an edge node has access rights to a target access interface. For example, an administrator can pre-register the edge node with the ACL, and then specify the edge node's access rights to the target access interface in the ACL. Thus, after receiving an access request from an edge node, the ACL can be queried to determine whether the edge node has access rights to the target access interface.

[0040] According to the embodiments of the present application, by pre-deploying a central gateway and an edge gateway on the central node and the edge node respectively, a secure and reliable communication channel can be established between the central node and the edge node, and the edge gateway's access rights to the central node can be transmitted through the pre-established communication channel, thereby achieving the technical effect of improving the security of access to the central node and preventing the central node from suffering network attacks from the edge nodes.

[0041] According to one embodiment of the present application, a virtual private network (VPN) can also be used to implement permission confirmation for access requests. For example, a VPN can be used to establish a secure channel between an edge node with access rights to the central node and the central node in advance, thereby connecting the trusted edge node and the central node to form a virtual private network, thereby providing security protection for communication between the edge node and the central node.

[0042] While implementing the concepts of this application, the inventors discovered that a central node can typically deploy multiple cloud services. Therefore, the central node may provide an access interface for each cloud service, and each access interface may require different access permissions from the user. If a VPN is used to establish a secure channel between the edge node and the central node, the trusted edge node may directly obtain access to all access interfaces provided by the central node, making it impossible to implement access interface-level permission control.

[0043] According to an embodiment of the present application, determining whether an edge node has access rights to a target access interface can be specifically implemented as follows: determining whether the edge node has access rights to a central node based on the encrypted identity information carried in the access request; and in the case of determining whether the edge node has access rights to the central node, determining whether the edge node has access rights to the target access interface based on the access request.

[0044] According to an embodiment of the present application, when confirming access rights, the central node may first determine whether the edge node has access rights to the central node. If it is determined that the edge node has access rights to the central node, it may further determine whether the edge node has access rights to at least one access interface provided by the central node. If it is determined that the edge node does not have access rights to the central node, there is no need to further determine whether the edge node has access rights to at least one access interface provided by the central node, and the access may be directly denied.

[0045] According to an embodiment of the present application, by performing two permission confirmations on access requests from edge nodes, it is possible to perform interface-granular access control on solution requests while ensuring that the central node is not subject to network attacks from edge nodes, thereby further improving the access security of the access interface.

[0046] According to an embodiment of the present application, the encrypted identity information is generated by encrypting the identity information of the edge gateway based on a preset encryption method.

[0047] According to an embodiment of the present application, the central gateway can pre-configure identity information for the edge gateway. For example, a trusted edge node can be pre-registered with the central node. After successful registration, identity information uniquely corresponding to the edge gateway is generated and then sent to the edge gateway. After receiving the identity information, the edge gateway can save the identity information locally.

[0048] According to an embodiment of the present application, when the edge gateway sends an access request to the central gateway, the pre-saved identity information can be encrypted according to a preset encryption method to obtain encrypted identity information, and then the encrypted identity information is added to the access request to send the access request carrying the encrypted identity information to the central gateway, so that the central gateway can identify the identity of the edge gateway based on the encrypted identity information and determine whether it has access rights to the central node.

[0049] According to the embodiments of the present application, the preset encryption algorithm may include, for example, a symmetric encryption algorithm, an asymmetric encryption algorithm, etc. The implementation of the specific encryption algorithm can be flexibly set by those skilled in the art according to actual application requirements, and this application does not specifically limit the implementation of the encryption algorithm.

[0050] According to an embodiment of the present application, determining whether an edge node has access rights to a central node based on the identity authentication information carried in an access request can be specifically implemented as follows: decrypting the encrypted identity information according to a preset decryption method corresponding to the preset encryption method to obtain identity information; obtaining pre-stored verification identity information; verifying the identity information using the verification identity information; and if the verification passes, determining that the edge node has access rights to the central node.

[0051] According to an embodiment of the present application, when determining the encryption method for encrypting identity information, a decryption method corresponding to the encryption method can be determined at the same time. For example, decryption of encrypted identity information can be achieved through a key. When encrypting identity information, if a symmetric encryption algorithm is used, a corresponding key can be generated. The symmetric encryption algorithm uses the same key for encryption and decryption operations, so the central gateway can use the key used for encryption to decrypt. When encrypting identity information, if an asymmetric encryption algorithm is used, then when encrypting the identity information, a pair of keys, namely a public key and a private key, needs to be generated. The public key is used to encrypt data, and the private key is used to decrypt data.

[0052] According to an embodiment of the present application, after the encrypted identity information is decrypted, the original identity information can be obtained.

[0053] According to an embodiment of the present application, after the edge gateway successfully registers with the central gateway, the central gateway can synchronously save a copy of the edge gateway's identity information as verification identity information.

[0054] According to an embodiment of the present application, when verifying identity information using verification information, the verification identity information can be compared with the identity information. If the verification identity information is consistent with the identity information, the verification is successful; otherwise, the verification fails.

[0055] According to an embodiment of the present application, after the edge gateway receives the access request sent by the edge application deployed in the edge node, the edge gateway forwards the access request to the central gateway, and the access request also carries the application information of the edge application.

[0056] FIG2 schematically shows a schematic diagram of an access method provided in an embodiment of the present application.

[0057] As shown in FIG2 , 201 may represent a central node, 2011 may represent a central gateway deployed on the central node, 202 may represent an edge node, and 2021 may represent an edge gateway deployed on the edge node.

[0058] According to an embodiment of the present application, an edge application may also run in the edge node 202. The edge application may be an application program running on the edge node 202 to bring computing resources and services closer to end users and devices to reduce latency.

[0059] According to an embodiment of the present application, a cloud service may be running on the central node 201. This cloud service can provide storage, data, and other resources for the operation of edge applications. For example, an edge application can collect data and then transmit the data to the cloud service running on the central node for calculation or storage. For another example, an edge application can obtain data from the cloud service running on the central node 201 and provide services to users based on this data.

[0060] According to an embodiment of the present application, the target access interface provided by the central node 201 may be an interface for edge nodes to access cloud services.

[0061] According to an embodiment of the present application, an access request may be generated when an edge application requests access to a target access interface.

[0062] According to an embodiment of the present application, when an edge application needs to access a target access interface, it can first send an access request to an edge gateway, which then sends the access request to a central gateway, and the central gateway performs permission verification.

[0063] According to an embodiment of the present application, determining whether an edge node has access rights to a target access interface based on an access request can be specifically implemented as follows: obtaining an access whitelist, in which target application information of at least one target application that is allowed to access the target access node is stored; determining whether the application information matches at least one target application information; and if the application information matches at least one target application information, determining that the edge node has access rights to the target access interface.

[0064] FIG3 schematically shows a schematic diagram of a central gateway configuring identity information for an edge gateway in an embodiment of the present application.

[0065] As shown in FIG3 , during the initialization phase, the edge gateway may send a registration request to the central gateway.

[0066] After receiving the registration request, the central gateway can perform security verification on the edge gateway, and after the verification is passed, register the edge gateway to the central gateway and generate identity information uniquely corresponding to the edge gateway.

[0067] After the identity information of the edge gateway is generated, the identity information can be sent to the edge gateway.

[0068] In one embodiment, the edge gateway can also apply for permissions for edge applications running on edge nodes, so that the edge applications can have access rights to the target access interface provided by the central node. For example, the edge gateway can send a permission request to the central gateway with the application information of the edge application. After receiving the permission request, the central gateway can add the application information of the edge application to the whitelist. After the application information of the edge application is added to the whitelist, it means that the edge application has access rights to the target access interface.

[0069] According to the embodiments of the present application, based on this, after the central gateway receives an access request, the application information carried in the access request can be matched with the target application information stored in the whitelist. If the whitelist records target application information that is the same as the application information, it means that the edge application is a trusted application and has access rights to the target access interface.

[0070] According to the embodiments of the present application, usually, when an edge application wants to access a target access interface, it is usually necessary to obtain information such as the address, port, and protocol of the target access interface, and then use the address, port, and protocol information to construct a request message, and send the request message to the target access interface to achieve access to the target access interface.

[0071] In the process of implementing the concept of this application, the inventor discovered that in the above-mentioned access method, it is necessary to expose information such as the address, port and protocol of the target access interface to the edge node or edge application in order to enable the edge application and edge node to access the target access interface. However, the exposure of the address, port and protocol will increase the risk of the target access interface being attacked by the network.

[0072] According to an embodiment of the present application, forwarding the access request to the target access interface can be specifically implemented as follows: obtaining the interface identifier of the target access interface carried in the access request; based on the interface identifier, searching for the access address of the target access interface; and forwarding the access request to the target access interface based on the access address.

[0073] According to an embodiment of the present application, when an edge application wishes to access a target access interface, it may write the interface identifier of the target access interface it requests to access into an access request, and then send the access request to the edge gateway.

[0074] According to an embodiment of the present application, after receiving the access request, the edge gateway may forward the access request to the central gateway.

[0075] According to an embodiment of the present application, the central gateway can maintain the correspondence between the interface identifier and access information of the access interface, such as the access address, port, and protocol. Therefore, after the central gateway receives an access request, it can find the access information of the target access interface based on the interface identifier, and then forward the access request to the target access interface based on the found address, port, protocol and other information.

[0076] In an embodiment of the present application, by deploying a central gateway and an edge gateway at the central node and the edge node respectively, the exposure of access information such as the address, port, and protocol of the central node can be avoided, the port details of the edge node and the central node can be shielded, and the attack surface can be reduced.

[0077] According to an embodiment of the present application, after receiving an access request, the edge gateway may first perform a preliminary verification of the access request before forwarding the access request to the central gateway, such as whether the access request carries the interface identifier of the target access interface and the application information of the edge application, and forward the access interface only if the access request carries the interface identifier of the target access interface and the application information of the edge application.

[0078] According to an embodiment of the present application, the access method further includes: in response to a permission configuration instruction, revoking the access rights of the edge gateway carrying identity information to the central node, so that the central gateway denies the edge gateway access to the central node.

[0079] According to an embodiment of the present application, when it is detected that an edge node is under a hacker attack, that is, the edge node is at risk, the edge gateway can be given permissions to revoke the access rights of the edge gateway to the central node, thereby preventing the central node from being accessed by the edge node at risk and improving the security of the central node.

[0080] According to an embodiment of the present application, by deploying an edge gateway at an edge node, the edge gateway can trace and audit the inbound and outbound traffic of the edge node through online and offline logs.

[0081] FIG4 schematically shows a schematic diagram of an access method provided in an embodiment of the present application.

[0082] As shown in Figure 4, edge applications and edge gateways can be deployed on edge nodes, and central gateways and target access interfaces can be deployed on central nodes.

[0083] When an edge application wants to access the target access interface, the edge application can first access the edge gateway with the identification information of the target access interface. The edge gateway verifies the edge application's access request for the target access interface, and after the verification passes, encrypts the access request. Then, the encrypted access request is sent to the central gateway.

[0084] After receiving the access request, the central gateway can verify the access request to verify whether the edge application has access rights to the target access interface. If it is determined whether the edge application has access rights to the target access interface, the access request is decrypted to obtain the identification information of the target access interface. The central gateway then searches for the access address of the target access interface based on the identification information and forwards the access request to the target access interface based on the access address.

[0085] According to the embodiments of the present application, the above embodiments are for the security access control performed by the central gateway and the edge gateway when the edge application running in the edge node accesses the target access interface. It can be understood that when the target access interface requests access to the edge application, security access control can also be performed by the central gateway and the edge gateway, which will not be repeated here.

[0086] Another embodiment of the present application also provides an access method, which is applied to an edge gateway, which is deployed at an edge node. The method can be implemented as follows: sending an access request for a target access interface to a central gateway deployed at a central node, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, forwarding the access request to the target access interface.

[0087] According to an embodiment of the present application, the access method also includes: receiving an access request sent by an edge application deployed in an edge node; sending an access request for a target access interface to a central gateway deployed in a central node includes: forwarding the received access request to the central gateway.

[0088] According to an embodiment of the present application, forwarding the received access request to the central gateway can be specifically implemented as follows: encrypting the identity information of the edge gateway according to a preset encryption method to obtain encrypted identity information; forwarding the access request carrying the encrypted identity information to the central gateway, so that the central gateway determines whether the edge node has access rights to the central node based on the encrypted identity.

[0089] According to an embodiment of the present application, forwarding the received access request to the central gateway can be specifically implemented as follows: parsing the access request to determine whether the access request carries the identity information of the edge application and the interface identifier of the target access interface; if it is determined that the access request carries the identity information of the edge application and the interface identifier of the target access interface, forwarding the access request to the central gateway.

[0090] Another embodiment of the present application also provides an access method, which is applied to edge applications. The edge applications are deployed on edge nodes, and an edge gateway is also deployed on the edge nodes. The access method can be implemented as follows: sending an access request for a target access interface deployed on a central node to the edge gateway, so that the edge gateway forwards the access request to the central gateway, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

[0091] Another embodiment of the present application also provides an access method, which is applied to a target access interface. The target access interface is deployed on a central node, and a central gateway is also deployed on the central node. The access method can be implemented as follows: receiving an access request sent by the central gateway, after the central gateway receives the access request sent by the edge gateway deployed on the edge node, it determines whether the edge node has access rights to the target access interface, and sends it to the target access interface if it is determined that the edge node has access rights to the target access interface.

[0092] An embodiment of the present application provides an access method, which is applied to a central gateway deployed at a central node. The method adopts a technical solution of receiving an access request for requesting access to a target access interface, the target access interface being deployed at the central node, and the access request being sent by an edge gateway deployed at an edge node; determining whether the edge node has access rights to the target access interface; and forwarding the access request to the target access interface if the edge node has access rights to the target access interface. In this way, the access request for requesting access to the central node is first received by the central gateway, and the access request is forwarded to the central node only if the central gateway determines that the edge node sending the access request has access rights. This achieves the technical effect of improving the security of access to the central node and preventing the central node from being subjected to network attacks from edge nodes.

[0093] Figure 5 schematically shows a block diagram of an access device provided by an embodiment of the present application. The access device 500 is applied to a central gateway, which is deployed at a central node. The access device 500 may include: a first request receiving module 501, for receiving an access request for requesting access to a target access interface, the target access interface is deployed at the central node, and the access request is sent by an edge gateway deployed at an edge node; an authority determination module 502, for determining whether the edge node has access rights to the target access interface; and a request forwarding module 503, for forwarding the access request to the target access interface if the edge node has access rights to the target access interface.

[0094] According to an embodiment of the present application, the authority determination module 502 includes: a first authority determination sub-module, which is used to determine whether the edge node has access rights to the central node based on the encrypted identity information carried in the access request; and a second authority determination sub-module, which is used to determine whether the edge node has access rights to the target access interface based on the access request when determining whether the edge node has access rights to the central node.

[0095] According to an embodiment of the present application, the encrypted identity information is generated by encrypting the identity information of the edge gateway based on a preset encryption method.

[0096] According to an embodiment of the present application, the first authority determination submodule includes: a decryption unit, used to decrypt the encrypted identity information according to a preset decryption method corresponding to the preset encryption method to obtain identity information; a verification information acquisition unit, used to obtain pre-stored verification identity information; an identity authentication unit, used to verify the identity information using the verification identity information; a first authority confirmation unit, used to determine that the edge node has access rights to the central node when the verification is passed.

[0097] According to an embodiment of the present application, the edge gateway receives an access request sent by an edge application deployed in an edge node and forwards it to the central gateway. The access request also carries application information of the edge application.

[0098] According to an embodiment of the present application, the second permission determination submodule includes: a whitelist acquisition unit, used to obtain an access whitelist, the access whitelist storing target application information of at least one target application that is allowed to access the target access node; an information matching unit, used to determine whether the application information matches at least one target application information; a second permission confirmation unit, used to determine that the edge node has access rights to the target access interface when the application information matches at least one target application information.

[0099] According to an embodiment of the present application, the request forwarding module 503 includes: an identification acquisition unit, used to obtain the interface identification of the target access interface carried in the access request; an address search unit, used to search for the access address of the target access interface based on the interface identification; and a forwarding unit, used to forward the access request to the target access interface based on the access address.

[0100] According to an embodiment of the present application, the access device 500 also includes: a permission revocation module, which is used to revoke the access rights of the edge gateway carrying identity information to the central node in response to the permission configuration instruction, so that the central gateway denies the edge gateway's access to the central node.

[0101] The access device of FIG5 can execute the access method of the embodiment shown in FIG1, and its implementation principle and technical effect are not described in detail. The specific manner in which each module and unit of the access device in the above embodiment performs operations has been described in detail in the embodiment of the method, and will not be described in detail here.

[0102] Another embodiment of the present application also provides an access device, which can be applied to an edge gateway, which is deployed at an edge node. The access device includes: a first request sending module, which is used to send an access request for a target access interface to a central gateway deployed at a central node, so that the central gateway can determine whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

[0103] According to an embodiment of the present application, the access device also includes: a third request receiving module, used to receive an access request sent by an edge application deployed in an edge node; according to an embodiment of the present application, the first request sending module includes: a first request sending sub-module, used to forward the received access request to the central gateway.

[0104] According to an embodiment of the present application, the first request sending submodule includes: an encryption unit, used to encrypt the identity information of the edge gateway according to a preset encryption method to obtain encrypted identity information; a first forwarding unit, used to forward the access request carrying the encrypted identity information to the central gateway, so that the central gateway can determine whether the edge node has access rights to the central node based on the encrypted identity.

[0105] According to an embodiment of the present application, the first request sending sub-module includes: a parsing unit, used to parse the access request and determine whether the access request carries the identity information of the edge application and the interface identifier of the target access interface; a second forwarding unit, used to forward the access request to the central gateway when it is determined that the access request carries the identity information of the edge application and the interface identifier of the target access interface.

[0106] Another embodiment of the present application also provides an access device, which can be applied to edge applications. The edge applications are deployed on edge nodes, and an edge gateway is also deployed on the edge nodes. The access device includes: a second request sending module, used to send an access request for a target access interface deployed on a central node to the edge gateway, so that the edge gateway forwards the access request to the central gateway, so that the central gateway determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

[0107] Another embodiment of the present application also provides an access device, which can be applied to a target access interface. The target access interface is deployed on a central node, and a central gateway is also deployed on the central node. The access device includes: a second request receiving module, which is used to receive an access request sent by the central gateway. After the central gateway receives the access request sent by the edge gateway deployed on the edge node, it determines whether the edge node has access rights to the target access interface; if the edge node has access rights to the target access interface, it sends it to the target access node.

[0108] In one possible design, the access device provided in the embodiment of the present application can be implemented as a computing device. As shown in Figure 6, the computing device may include a storage component 601 and a processing component 602; the storage component 601 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 602 to implement the access method provided in the embodiment of the present application.

[0109] Of course, a computing device may also include other components, such as input / output interfaces and communication components. The input / output interface provides an interface between the processing component and peripheral interface modules, such as output devices and input devices. The communication component is configured to facilitate wired or wireless communication between the computing device and other devices.

[0110] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0111] When the computing device is a physical device, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device.

[0112] An embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a computer, can implement the access method provided in the embodiment of the present application.

[0113] An embodiment of the present application further provides a computer program product, including a computer program, which, when executed by a computer, can implement the access method provided in the embodiment of the present application.

[0114] The processing components in the above embodiments may include one or more processors to execute computer instructions to complete all or part of the steps in the above methods. Of course, the processing components may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0115] The memory component is configured to store various types of data to support operations in the device. The memory component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0116] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0117] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0118] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An access method, applied to a central gateway, wherein the central gateway is deployed at a central node, and the method include: Receiving an access request for requesting access to a target access interface, the target access interface being deployed at the central node, the access request being sent by an edge gateway deployed at an edge node; Determining whether the edge node has access rights to the target access interface; If the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

2. The method according to claim 1, in, The determining whether the edge node has access rights to the target access interface includes: Determining whether the edge node has access rights to the central node based on the encrypted identity information carried in the access request; In the case of determining whether the edge node has the access right to the central node, determining whether the edge node has the access right to the target access interface based on the access request.

3. The method according to claim 2, in, The encrypted identity information is generated by encrypting the identity information of the edge gateway based on a preset encryption method; The determining whether the edge node has access rights to the central node based on the identity authentication information carried in the access request includes: Decrypting the encrypted identity information according to a preset decryption method corresponding to the preset encryption method to obtain the identity information; Obtain pre-stored verification identity information; Verifying the identity information using the verification identity information; If the verification is successful, it is determined that the edge node has access rights to the central node.

4. The method according to claim 3, in, After the edge gateway receives the access request sent by the edge application deployed in the edge node, the access request is forwarded by the edge gateway to the central gateway, and the access request also carries the application information of the edge application; The determining, based on the access request, whether the edge node has access rights to the target access interface comprises: Acquire an access whitelist, wherein the access whitelist stores target application information of at least one target application that is allowed to access the target access node; Determining whether the application information matches at least one of the target application information; In a case where the application information matches at least one of the target application information, it is determined that the edge node has access rights to the target access interface.

5. The method according to claim 1, in, The forwarding the access request to the target access interface comprises: Obtaining the interface identifier of the target access interface carried in the access request; Based on the interface identifier, searching for an access address of the target access interface; The access request is forwarded to the target access interface based on the access address.

6. The method according to claim 3, in, The method further comprises: In response to the permission configuration instruction, the access permission of the edge gateway carrying the identity information to the central node is released, so that the central gateway denies the access of the edge gateway to the central node.

7. An access method, applied to an edge gateway, wherein the edge gateway is deployed at an edge node, and the method include: Sending an access request for a target access interface to a central gateway deployed at a central node, so that the central gateway determines whether the edge node has access rights to the target access interface; If the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

8. The method according to claim 7, in, The method further comprises: Receiving the access request sent by the edge application deployed in the edge node; The sending of an access request for a target access interface to a central gateway deployed at a central node includes: The received access request is forwarded to the central gateway.

9. The method according to claim 8, in, The step of forwarding the received access request to the central gateway comprises: Encrypting the identity information of the edge gateway according to a preset encryption method to obtain encrypted identity information; The access request carrying the encrypted identity information is forwarded to the central gateway, so that the central gateway determines whether the edge node has access rights to the central node based on the encrypted identity.

10. The method according to claim 8, in, The step of forwarding the received access request to the central gateway comprises: Parsing the access request to determine whether the access request carries the identity information of the edge application and the interface identifier of the target access interface; When it is determined that the access request carries the identity information of the edge application and the interface identifier of the target access interface, the access request is forwarded to the central gateway.

11. An access method, applied to an edge application, wherein the edge application is deployed on an edge node, and an edge gateway is also deployed on the edge node. include: Sending an access request for a target access interface deployed on a central node to the edge gateway so that the edge gateway forwards the access request to the central gateway, so that the central gateway determines whether the edge node has access rights to the target access interface; If the edge node has access rights to the target access interface, the access request is forwarded to the target access interface.

12. An access method, applied to a target access interface, wherein the target access interface is deployed on a central node, and a central gateway is also deployed on the central node. include: Receive an access request sent by the central gateway. After the central gateway receives the access request sent by the edge gateway deployed on the edge node, it determines whether the edge node has access rights to the target access interface, and sends it to the target access interface if it is determined that the edge node has access rights to the target access interface.

13. A computing device comprising a processing component and a storage component; The storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the access method as described in any one of claims 1 to 6, or to implement the access method as described in any one of claims 7 to 10, or to implement the access method as described in claim 11, or to implement the access method as described in claim 12.

14. A computer storage medium storing a computer program, wherein when the computer program is executed by a computer, the computer program implements the access method according to any one of claims 1 to 6, or the access method according to any one of claims 7 to 10, or the access method according to claim 11, or the access method according to claim 12.

Images