Full-link business service security protection method and related device

Abstract

The present disclosure provides a full-link business service security protection method and a related device. The method comprises: on the basis of a proxy service gateway, acquiring an initial business request sent by an external user; when the initial business request meets an extranet security policy configured in the proxy service gateway, determining that the initial business request passes security authentication; performing preliminary processing on the initial business request to obtain a first business request; issuing the first business request to a corresponding business service; when the first business request meets an intranet security policy configured in the business service, determining that the first business request passes security authentication; controlling the business service to complete corresponding business processing, and generating a second business request for an unprocessed business; and issuing the second business request to a downstream business service for security authentication and business processing. The present disclosure achieves full-link extranet security protection by means of the extranet security policy in the proxy service gateway, and achieves full-link intranet security protection by means of the intranet security policy in each business service, thereby improving the security of business services, and meeting full-link business service security protection requirements.

Description

A full-link business service security protection method and related equipment

[0001] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on March 19, 2024, with application number 202410315973.8 and application name “A full-link business service security protection method and related equipment”, the entire content of which is incorporated by reference into this disclosure. Technical Field

[0002] The present disclosure relates to the field of security protection technology, and more specifically, to a full-link business service security protection method and related equipment. Background Art

[0003] With the rapid growth of enterprise businesses and the massive increase in internet users, traditional monolithic business services can no longer meet the needs of enterprise development. Monolithic business services are defined as all business services encapsulated in a single project, without any sub-projects or sub-services. With the advancement of microservices architecture technology and the need for enterprise growth, more and more enterprises are adopting microservices architectures for secondary upgrades. This has resulted in the splitting of monolithic business services into multiple sub-module services, transforming calls between full-link business services in a microservices architecture into interface-level calls between services. Consequently, service interfaces, protocols, and the traffic generated by these calls are exposed online and can be directly called by any business service, script, or other caller that understands these interfaces. This significantly reduces the security of business services and poses significant security risks.

[0004] Therefore, how to provide a full-link business service security protection method has become a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] In view of this, the present disclosure provides a full-link business service security protection method and related equipment to achieve full-link external network security protection through the external network security policy in the proxy service gateway, and achieve full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of business services and meeting the full-link business service security protection needs.

[0006] A full-link business service security protection method, comprising:

[0007] Obtaining the initial service request sent by the external user based on the proxy service gateway;

[0008] When the initial service request satisfies the extranet security policy configured in the proxy service gateway, determining that the initial service request passes the security authentication of the proxy service gateway;

[0009] Preliminarily processing the initial service request in the proxy service gateway to obtain a first service request;

[0010] Sending the first business request to the corresponding business service;

[0011] When the first business request satisfies the intranet security policy configured in the business service, determining that the first business request passes the security authentication of the business service;

[0012] Controlling the business service to complete corresponding business processing according to the first business request, and generating a second business request for unprocessed business;

[0013] Sending the second business request to the downstream business service of the business service according to the business process;

[0014] The downstream business service is controlled to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication passes.

[0015] A full-link business service security protection device, comprising:

[0016] A request acquisition unit, configured to acquire an initial service request sent by an external user based on the proxy service gateway;

[0017] A first security authentication determination unit is configured to determine that the initial service request passes the security authentication of the proxy service gateway when the initial service request satisfies the external network security policy configured in the proxy service gateway;

[0018] A request processing unit, configured to perform preliminary processing on the initial service request in the proxy service gateway to obtain a first service request;

[0019] A first issuing unit, configured to issue the first service request to a corresponding service service;

[0020] A second security authentication determination unit is configured to determine that the first service request passes the security authentication of the business service when the first service request satisfies the intranet security policy configured in the business service;

[0021] a business processing unit configured to control the business service to complete corresponding business processing according to the first business request, and generate a second business request for unprocessed business;

[0022] A second issuing unit is configured to issue the second business request to a downstream business service of the business service according to a business process;

[0023] The control unit is configured to control the downstream business service to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication is passed.

[0024] An electronic device, comprising: a memory and a processor;

[0025] The memory is used to store at least one instruction;

[0026] The processor is used to execute the at least one instruction to implement the above-mentioned full-link business service security protection method.

[0027] A computer-readable storage medium stores at least one instruction, which, when executed by a processor, implements the above-mentioned full-link business service security protection method.

[0028] It can be seen from the above technical solution that the present disclosure provides a full-link business service security protection method and related equipment, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it is determined that the initial business request has passed the security authentication of the proxy service gateway, and the initial business request is preliminarily processed in the proxy service gateway to obtain the first business request, and is sent to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it is determined that the first business request has passed the security authentication of the business service, and the business service is controlled to complete the corresponding business processing according to the first business request. A second business request is generated for the unprocessed business, and is sent to the downstream business service for security authentication, and the corresponding business processing is performed after the security authentication is passed. The present disclosure realizes full-link external network security protection through the external network security policy in the proxy service gateway, and realizes full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0030] FIG1 is a flow chart of a full-link business service security protection method disclosed in an embodiment of the present disclosure;

[0031] FIG2 is a schematic diagram of the structure of a full-link business service security protection device disclosed in an embodiment of the present disclosure;

[0032] FIG3 is a schematic structural diagram of an electronic device disclosed in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0034] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0035] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0036] The embodiment of the present disclosure discloses a full-link business service security protection method and related equipment, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it is determined that the initial business request passes the security authentication of the proxy service gateway, and the initial business request is preliminarily processed in the proxy service gateway to obtain a first business request, and is sent to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it is determined that the first business request passes the security authentication of the business service, and the business service is controlled to complete the corresponding business processing according to the first business request. A second business request is generated for the unprocessed business, and is sent to the downstream business service for security authentication, and the corresponding business processing is performed after the security authentication is passed. The present disclosure realizes full-link external network security protection through the external network security policy in the proxy service gateway, and realizes full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

[0037] 1 is a flowchart of a full-link business service security protection method disclosed in an embodiment of the present disclosure. The method includes:

[0038] Step S101: obtaining an initial service request sent by an external user based on a proxy service gateway;

[0039] In actual applications, when external users initiate initial business requests, all requests will be sent to the proxy service gateway.

[0040] Step S102: When the initial service request satisfies the external network security policy configured in the proxy service gateway, determining that the initial service request passes the security authentication of the proxy service gateway;

[0041] When the proxy service gateway receives an initial service request, it will match the initial service request with the external network security policy configured by itself. When the initial service request meets the external network security policy configured in the proxy service gateway, it is determined that the initial service request has passed the security authentication of the proxy service gateway.

[0042] In actual applications, the proxy service gateway performs security authentication on the initial business request through the security SDK module.

[0043] Step S103: Preliminary processing is performed on the initial service request in the proxy service gateway to obtain a first service request;

[0044] When the initial service request passes the security authentication of the proxy service gateway, the initial service request is preliminarily processed and then sent to the corresponding service.

[0045] The content of the preliminary processing of the initial service request depends on actual needs, such as format conversion, which is not limited in this disclosure.

[0046] Step S104: Send the first business request to the corresponding business service;

[0047] In actual applications, the first business request carries a unique identifier of a corresponding business service, and the business service corresponding to the first business request can be determined according to the unique identifier.

[0048] Step S105: When the first service request satisfies the intranet security policy configured in the service, determine that the first service request passes the security authentication of the service.

[0049] When the business service receives the first business request, the business service will match the first business request with the intranet security policy configured in the business service. When the first business request meets the intranet security policy configured in the business service, it is determined that the first business request passes the security authentication of the business service.

[0050] In actual applications, the business service performs security authentication on the first business request through the security SDK module.

[0051] It should be noted that the business service in this embodiment is a business service that can process the first business request among all business services.

[0052] Step S106: Control the business service to complete corresponding business processing according to the first business request, and generate a second business request for the unprocessed business;

[0053] After the first service request passes the security authentication of the business service, the security SDK module in the business service sends the first service request to the business module, which then completes the corresponding business processing according to the first service request. The security protection process of the business service for the first service request is transparent to the business service.

[0054] For the business that is not processed by the current business service, that is, the business that needs to be processed by the subsequent business service, a corresponding second business request can be generated.

[0055] Step S107: Send the second business request to the downstream business service of the business service according to the business process;

[0056] In actual applications, each business service may correspond to one or more downstream business services.

[0057] The second business request carries a unique identifier of the downstream business service, so that the second business request can be sent to the downstream business service according to the business process.

[0058] For example, business service A and business service B are in an upstream-downstream relationship. After business service A processes a first business request, it sends a second business request to business service B.

[0059] Step S108: Control the downstream business service to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication passes.

[0060] After receiving the second service request, the downstream service will again perform security authentication on the second service request based on its own configured intranet security policy, and perform corresponding service processing after the security authentication passes.

[0061] Among them, after the downstream business service completes business processing, there is still business that needs to be processed by subsequent business services. The downstream business service will continue to generate a third business request for the business to be processed and send the third business request to other business services according to the business process.

[0062] The security protection process of each business service is transparent to that business service.

[0063] In summary, the present disclosure provides a full-link business service security protection method, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it is determined that the initial business request passes the security authentication of the proxy service gateway, and the initial business request is preliminarily processed in the proxy service gateway to obtain the first business request, and sent to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it is determined that the first business request passes the security authentication of the business service, and the business service is controlled to complete the corresponding business processing according to the first business request. A second business request is generated for the unprocessed business, and is sent to the downstream business service for security authentication, and the corresponding business processing is performed after the security authentication is passed. The present disclosure realizes full-link external network security protection through the external network security policy in the proxy service gateway, and realizes full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

[0064] It should be noted that in this embodiment, the proxy service gateway and each business service are all protected by the integrated security SDK module, and the security protection of the business services can be made transparent, reducing labor costs.

[0065] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0066] To further optimize the above embodiment, the full-link business service security protection method may further include:

[0067] When all downstream business services complete the corresponding business processing, the business response results are returned to the business services according to the business process;

[0068] After the business service integrates the business response results, the business response integration results are output to the front-end interface through the proxy service gateway.

[0069] Assume that business service A receives a first business request sent by a proxy service gateway, and business service B serves as a downstream business service of business service A.

[0070] After Business Service B completes the business processing, it returns the business response results to Business Service A according to the business process. Business Service A integrates the results and returns them to the proxy service gateway. The proxy service gateway finally notifies the user of the business processing success and results. The above security protection process is transparent to Business Service B.

[0071] To further optimize the above embodiment, the initial service request satisfies the external network security policy configured in the proxy service gateway, specifically including:

[0072] The source IP address of the initial service request belongs to the proxy service gateway's accessible IP whitelist and is not on the IP blacklist;

[0073] The business service and service interface corresponding to the initial business request are exposed through the proxy service gateway;

[0074] The access token carried in the initial service request is correct;

[0075] All data carried in the initial service request has not been modified;

[0076] The initial service request does not exceed the upper limit of the current limiting protection policy of the proxy service gateway.

[0077] First, determine that the source IP address of the initial business request belongs to the accessible IP whitelist and is not on the IP blacklist. Then determine that the business service and service interface corresponding to the initial business request are exposed through the proxy gateway. Then determine that the access password carried in the initial business request is correct. Then, determine through the signature that all data of the initial business request has not been modified. Finally, determine through the current limiting protection policy that the initial business request does not exceed the current limiting protection policy upper limit of the proxy service gateway. If all of the above are met, the security authentication is successful, otherwise the security authentication fails.

[0078] To further optimize the above embodiment, the first service request satisfies the intranet security policy configured in the service service, specifically including:

[0079] The proxy service gateway that issues the first service request is in the accessible service list of the service request;

[0080] The service interface required by the first service request is in the accessible interface set list of the proxy service;

[0081] The access IP of the proxy service gateway that issues the first service request is in the IP whitelist of the service service;

[0082] The request password carried in the first service request is correct;

[0083] All data carried in the first service request has not been modified;

[0084] The first service request does not exceed the service capacity upper limit of the proxy service.

[0085] First, it is determined that the proxy service gateway belongs to the accessible service list of the business service, the business interface of the first business request is in the accessible interface set list of the business service, the access IP of the business service gateway is in the IP whitelist list, and the request password carried is correct. Then, the signature is used to determine that all data carried in the first business request has not been modified. Finally, the current limiting protection policy is used to determine that the first business request does not exceed the service capacity limit of the proxy service. If all of the above are met, the security authentication is successful, otherwise the security authentication fails.

[0086] To further optimize the above embodiment, the full-link business service security protection method may further include:

[0087] When the initial service request does not meet the external network security policy configured in the proxy service gateway, determine that the initial service request has not passed the security authentication of the proxy service gateway, and output a prompt message indicating that the security authentication of the initial service request has failed;

[0088] as well as,

[0089] When the first service request does not meet the intranet security policy configured in the service service, it is determined that the first service request has failed the security authentication of the service service, and prompt information indicating that the first service request security authentication has failed is output through the proxy service gateway.

[0090] In actual applications, operation and maintenance personnel use the visualization function of the security management service and its visualization page to query the external network security policy of the existing proxy service gateway and the internal network security policy of each business service (including IP blacklist and whitelist, interface password and circuit breaker and current limit, etc.), and configure the external network security policy of the proxy service gateway and the internal network security policy of each business service according to the latest requirements of the production environment.

[0091] When the external network security policy of the proxy service gateway and the internal network security policy of each business service are changed, the changed external network security policy and internal network security policy will be synchronized to the configuration center.

[0092] After the proxy service gateway is started, it will start a separate thread through its own security SDK (Software Development Kit) module to monitor the configuration center in real time. When it detects that the external network security policy configuration of the configuration center has changed, it will immediately pull the changed external network security policy to the proxy service gateway and make it take effect.

[0093] Therefore, to further optimize the above embodiment, the full-link business service security protection method may further include:

[0094] When the proxy service gateway detects that the external network security policy of the configuration center has changed, the changed external network security policy is pulled to the proxy service gateway and becomes the latest external network security policy and takes effect.

[0095] In actual applications, when the business service is started, the business service will start a thread through the security SDK module to monitor the configuration center in real time. When it is detected that the intranet security policy of the business service corresponding to the configuration center has changed, the new intranet security policy will be immediately pulled to the business service and take effect.

[0096] Therefore, to further optimize the above embodiment, the full-link business service security protection method may further include:

[0097] When the intranet security policy in the configuration center is detected to have changed based on business service monitoring, the changed intranet security policy is pulled to the business service and becomes the latest intranet security policy and takes effect.

[0098] It should be noted that in actual applications, the intranet security policies for different business services may be different.

[0099] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0100] Corresponding to the above method embodiments, the present disclosure also discloses a full-link business service security protection device.

[0101] 2 is a schematic diagram of the structure of a full-link business service security protection device disclosed in an embodiment of the present disclosure, which includes:

[0102] The request obtaining unit 201 is configured to obtain an initial service request sent by an external user based on the proxy service gateway;

[0103] In actual applications, when external users initiate initial business requests, all requests will be sent to the proxy service gateway.

[0104] The first security authentication determination unit 202 is configured to determine that the initial service request passes the security authentication of the proxy service gateway when the initial service request satisfies the external network security policy configured in the proxy service gateway;

[0105] When the proxy service gateway receives an initial service request, it will match the initial service request with the external network security policy configured by itself. When the initial service request meets the external network security policy configured in the proxy service gateway, it is determined that the initial service request has passed the security authentication of the proxy service gateway.

[0106] In actual applications, the proxy service gateway performs security authentication on the initial business request through the security SDK module.

[0107] The request processing unit 203 is configured to perform preliminary processing on the initial service request in the proxy service gateway to obtain a first service request;

[0108] When the initial service request passes the security authentication of the proxy service gateway, the initial service request is preliminarily processed and then sent to the corresponding service.

[0109] The content of the preliminary processing of the initial service request depends on actual needs, such as format conversion, which is not limited in this disclosure.

[0110] A first issuing unit 204 is configured to issue the first service request to a corresponding service;

[0111] In actual applications, the first business request carries a unique identifier of a corresponding business service, and the business service corresponding to the first business request can be determined according to the unique identifier.

[0112] The second security authentication determination unit 205 is configured to determine that the first service request passes the security authentication of the business service when the first service request satisfies the intranet security policy configured in the business service;

[0113] When the business service receives the first business request, the business service will match the first business request with the intranet security policy configured in the business service. When the first business request meets the intranet security policy configured in the business service, it is determined that the first business request passes the security authentication of the business service.

[0114] In actual applications, the business service performs security authentication on the first business request through the security SDK module.

[0115] It should be noted that the business service in this embodiment is a business service that can process the first business request among all business services.

[0116] The business processing unit 206 is configured to control the business service to complete the corresponding business processing according to the first business request, and generate a second business request for the unprocessed business;

[0117] After the first service request passes the security authentication of the business service, the security SDK module in the business service sends the first service request to the business module, which then completes the corresponding business processing according to the first service request. The security protection process of the business service for the first service request is transparent to the business service.

[0118] For the business that is not processed by the current business service, that is, the business that needs to be processed by the subsequent business service, a corresponding second business request can be generated.

[0119] The second issuing unit 207 is configured to issue the second business request to a downstream business service of the business service according to a business process;

[0120] In actual applications, each business service may correspond to one or more downstream business services.

[0121] The second business request carries a unique identifier of the downstream business service, so that the second business request can be sent to the downstream business service according to the business process.

[0122] For example, business service A and business service B are in an upstream-downstream relationship. After business service A processes a first business request, it sends a second business request to business service B.

[0123] The control unit 208 is configured to control the downstream business service to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication is passed.

[0124] After receiving the second service request, the downstream service will again perform security authentication on the second service request based on its own configured intranet security policy, and perform corresponding service processing after the security authentication passes.

[0125] Among them, after the downstream business service completes business processing, there is still business that needs to be processed by subsequent business services. The downstream business service will continue to generate a third business request for the business to be processed and send the third business request to other business services according to the business process.

[0126] The security protection process of each business service is transparent to that business service.

[0127] In summary, the present disclosure provides a full-link business service security protection device, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it determines that the initial business request passes the security authentication of the proxy service gateway, performs preliminary processing on the initial business request in the proxy service gateway to obtain the first business request, and sends it to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it determines that the first business request passes the security authentication of the business service, controls the business service to complete the corresponding business processing according to the first business request, generates a second business request for the unprocessed business, and sends it to the downstream business service for security authentication, and performs the corresponding business processing after the security authentication passes. The present disclosure realizes full-link external network security protection through the external network security policy in the proxy service gateway, and realizes full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

[0128] The units involved in the embodiments described in this disclosure may be implemented in software or hardware. In some cases, the name of a unit does not limit the unit itself. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses."

[0129] It should be noted that in this embodiment, the proxy service gateway and each business service are all protected by the integrated security SDK module, and the security protection of the business services can be made transparent, reducing labor costs.

[0130] To further optimize the above embodiment, the full-link business service security protection device may further include:

[0131] A return unit is configured to return the obtained business response results to the business service according to the business process after all the downstream business services complete the corresponding business processing;

[0132] The integration unit is configured to output the business response integration result to the front-end interface through the proxy service gateway after the business service integrates the business response result.

[0133] To further optimize the above embodiment, the full-link business service security protection device also includes:

[0134] Authentication failure prompt information is set to, when the initial service request does not meet the external network security policy configured in the proxy service gateway, determine that the initial service request has not passed the security authentication of the proxy service gateway, and output a prompt information of the initial service request security authentication failure;

[0135] as well as,

[0136] When the first business request does not meet the intranet security policy configured in the business service, it is determined that the first business request has failed the security authentication of the business service, and prompt information indicating that the first business request security authentication has failed is output through the proxy service gateway.

[0137] To further optimize the above embodiment, the full-link business service security protection device may further include:

[0138] The first changing unit is configured to pull the changed external network security policy to the proxy service gateway as the latest external network security policy and make it effective when the proxy service gateway monitors that the external network security policy of the configuration center has changed.

[0139] To further optimize the above embodiment, the full-link business service security protection device may further include:

[0140] The second changing unit is configured to pull the changed intranet security policy to the business service as the latest intranet security policy and make it effective when the intranet security policy of the configuration center is changed based on the monitoring of the business service.

[0141] It should be noted that, for the specific working principles of the various components in the device embodiment, please refer to the corresponding parts of the method embodiment, which will not be repeated here.

[0142] Corresponding to the above embodiment, as shown in FIG3 , the present disclosure further provides an electronic device, which may include: a processor 1 and a memory 2;

[0143] The processor 1 and the memory 2 communicate with each other via a communication bus 3.

[0144] Processor 1, configured to execute at least one instruction;

[0145] Memory 2, configured to store at least one instruction;

[0146] The processor 1 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present disclosure.

[0147] The memory 2 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0148] Among them, the processor executes at least one instruction to implement the steps shown in the embodiment of the full-link business service security protection method.

[0149] In summary, the present disclosure provides an electronic device, which obtains the initial business request sent by the external user based on the proxy service gateway, and when the initial business request meets the external network security policy configured in the proxy service gateway, determines that the initial business request passes the security authentication of the proxy service gateway, performs preliminary processing on the initial business request in the proxy service gateway to obtain a first business request, and sends it to the corresponding business service, and when the first business request meets the internal network security policy configured in the business service, determines that the first business request passes the security authentication of the business service, controls the business service to complete the corresponding business processing according to the first business request, generates a second business request for the unprocessed business, and sends it to the downstream business service for security authentication, and performs the corresponding business processing after the security authentication passes. The present disclosure implements full-link external network security protection through the external network security policy in the proxy service gateway, and implements full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

[0150] To further optimize the above embodiment, the present disclosure also discloses a computer-readable storage medium, which stores at least one instruction. When the at least one instruction is executed by a processor, the steps shown in the embodiment of the full-link business service security protection method are implemented.

[0151] In the context of the present disclosure, a computer-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] In summary, the present disclosure provides a computer-readable storage medium, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it is determined that the initial business request passes the security authentication of the proxy service gateway, and the initial business request is preliminarily processed in the proxy service gateway to obtain the first business request, and sent to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it is determined that the first business request passes the security authentication of the business service, and the business service is controlled to complete the corresponding business processing according to the first business request. A second business request is generated for the unprocessed business, and is sent to the downstream business service for security authentication, and the corresponding business processing is performed after the security authentication is passed. The present disclosure realizes the full-link external network security protection through the external network security policy in the proxy service gateway, and realizes the full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

[0153] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0154] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0155] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

[0156] Although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0157] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure. Industrial Applicability

[0158] The present disclosure provides a full-link business service security protection method and related equipment, which obtains the initial business request sent by the external user based on the proxy service gateway. When the initial business request meets the external network security policy configured in the proxy service gateway, it is determined that the initial business request has passed the security authentication of the proxy service gateway, and the initial business request is preliminarily processed in the proxy service gateway to obtain the first business request, and sent to the corresponding business service. When the first business request meets the internal network security policy configured in the business service, it is determined that the first business request has passed the security authentication of the business service, and the business service is controlled to complete the corresponding business processing according to the first business request. A second business request is generated for the unprocessed business, and sent to the downstream business service for security authentication, and the corresponding business processing is performed after the security authentication is passed. The present disclosure realizes full-link external network security protection through the external network security policy in the proxy service gateway, and realizes full-link internal network security protection through the internal network security policy of each business service, thereby improving the security of the business service and meeting the full-link business service security protection requirements.

Claims

1. A full-link business service security protection method, comprising: Obtaining the initial service request sent by the external user based on the proxy service gateway; When the initial service request satisfies the extranet security policy configured in the proxy service gateway, determining that the initial service request passes the security authentication of the proxy service gateway; Preliminarily processing the initial service request in the proxy service gateway to obtain a first service request; Sending the first business request to the corresponding business service; When the first business request satisfies the intranet security policy configured in the business service, determining that the first business request passes the security authentication of the business service; Controlling the business service to complete corresponding business processing according to the first business request, and generating a second business request for unprocessed business; Sending the second business request to the downstream business service of the business service according to the business process; The downstream business service is controlled to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication passes.

2. The full-link business service security protection method according to claim 1, wherein: Also includes: When all the downstream business services complete the corresponding business processing, the business response results are returned to the business services according to the business process; After the business service integrates the business response results, the business response integration results are output to the front-end interface through the proxy service gateway.

3. The full-link business service security protection method according to claim 1, wherein: The initial service request satisfies the external network security policy configured in the proxy service gateway, specifically including: The source IP address of the initial service request belongs to the accessible IP whitelist of the proxy service gateway and does not belong to the IP blacklist; The business service and service interface corresponding to the initial business request are exposed through the proxy service gateway; The access password carried in the initial service request is correct; All data carried in the initial service request has not been modified; The initial service request does not exceed the upper limit of the current limiting protection policy of the proxy service gateway.

4. The full-link business service security protection method according to claim 1, wherein: The first service request satisfies the intranet security policy configured in the service service, specifically including: The proxy service gateway that issues the first service request is in the accessible service list of the service request; The service interface required by the first service request is in the accessible interface set list of the proxy service; The access IP of the proxy service gateway that issues the first service request is in the IP whitelist of the service service; The request password carried in the first service request is correct; All data carried in the first service request has not been modified; The first service request does not exceed the service capacity upper limit of the proxy service.

5. The full-link business service security protection method according to claim 1, wherein: Also includes: When the initial service request does not meet the external network security policy configured in the proxy service gateway, determining that the initial service request has not passed the security authentication of the proxy service gateway, and outputting a prompt message indicating that the security authentication of the initial service request has failed; as well as, When the first business request does not meet the intranet security policy configured in the business service, it is determined that the first business request has failed the security authentication of the business service, and prompt information indicating that the first business request security authentication has failed is output through the proxy service gateway.

6. The full-link business service security protection method according to claim 1, wherein: Also includes: When the proxy service gateway monitors that the extranet security policy of the configuration center has changed, the changed extranet security policy is pulled to the proxy service gateway as the latest extranet security policy and takes effect.

7. The full-link business service security protection method according to claim 1, wherein: Also includes: When the intranet security policy of the configuration center is detected to have changed based on the business service monitoring, the changed intranet security policy is pulled to the business service as the latest intranet security policy and takes effect.

8. A full-link business service security protection device, comprising: A request acquisition unit, configured to acquire an initial service request sent by an external user based on the proxy service gateway; A first security authentication determination unit is configured to determine that the initial service request passes the security authentication of the proxy service gateway when the initial service request satisfies the external network security policy configured in the proxy service gateway; A request processing unit, configured to perform preliminary processing on the initial service request in the proxy service gateway to obtain a first service request; A first issuing unit, configured to issue the first service request to a corresponding service service; A second security authentication determination unit is configured to determine that the first service request passes the security authentication of the business service when the first service request satisfies the intranet security policy configured in the business service; a business processing unit configured to control the business service to complete corresponding business processing according to the first business request, and generate a second business request for unprocessed business; A second issuing unit is configured to issue the second business request to a downstream business service of the business service according to a business process; The control unit is configured to control the downstream business service to perform security authentication on the second business request based on the intranet security policy configured by itself, and perform corresponding business processing after the security authentication is passed.

9. An electronic device, wherein: The electronic device includes: a memory and a processor; The memory is used to store at least one instruction; The processor is used to execute the at least one instruction to implement the full-link business service security protection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by the processor, it implements the full-link business service security protection method according to any one of claims 1 to 7.

Images