CN117997613A - Micro-service access method and system for edge computing environment - Google Patents

Abstract

The invention provides a micro-service access method and a micro-service access system for an edge computing environment, which belong to the technical field of edge computing, wherein the method comprises the following steps: step S1, a security agent maintains a JSON configuration file and a public key; step S2, the client sends HTTP GET REST a request to the security agent, and the security agent generates a service and a route adding request to be sent to the API gateway based on the HTTP GET REST request and the JSON configuration file; step S3, initializing default service, route, ACL and authentication information by the AP I gateway; s4, the client sends a micro-service access request to the security agent, and the security agent sends a JWT acquisition request to the API gateway; s5, the AP I gateway generates a token based on the JWT acquisition request through default service, routing, ACL, authentication information and a private key and sends the token to the security agent; and S6, allowing the client to access the micro service after the security agent carries out JWT authentication on the token through the public key. The invention has the advantages that: on the premise of ensuring the safety, the resource cost of micro service access is greatly reduced.

Description

Micro-service access method and system for edge computing environment

Technical Field

The invention relates to the technical field of edge computing, in particular to a micro-service access method and a micro-service access system for an edge computing environment.

Background

The internet of things has the ability to connect all devices around, heterogeneous devices being interconnected, information being acquired and exchanged by a network infrastructure linked by distributed nodes in order to more reliably and accurately provide network services for internet of things applications. Because of the inherent features of the internet of things, such as large scale, heterogeneous nature of devices, and large amounts of data generated by terminal devices, developing various applications and services is a difficult task, and the operation of each application and service depends on the data generated by the devices. Because of limited network performance of data transmission, centralized cloud computing architectures are becoming increasingly inefficient in processing and analyzing large amounts of data collected by internet of things devices, as computing resources are made available on the network edge (i.e., near the edge device that generated the data) by edge computing, the bandwidth requirements of network performance are reduced.

Micro-service is a software architecture style that breaks down a complex application system into a set of independent services, each service is responsible for only one specific function, can be developed and deployed with different technologies, and has flexibility, scalability and low coupling. However, conventionally, when an edge device in an edge computing environment accesses a micro service, a complex encryption algorithm and a third party mechanism are required to ensure the integrity and credibility of data, which increases the computing overhead and power consumption of the edge device, and a software architecture based on the micro service requires separate authentication and access control for each micro service, which increases the management cost and network overhead.

Therefore, how to provide a method and a system for accessing micro services in an edge computing environment, which can reduce the resource overhead of micro service access on the premise of ensuring the security, is a technical problem to be solved urgently.

Disclosure of Invention

The invention aims to solve the technical problem of providing a micro-service access method and a micro-service access system for an edge computing environment, which can reduce the resource expense of micro-service access on the premise of ensuring the safety.

In a first aspect, the present invention provides a method for micro-service access for an edge computing environment, comprising the steps of:

step S1, a security agent maintains a JSON configuration file and a public key;

Step S2, a client running in an edge computing environment sends HTTP GET REST a request to a security agent, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to an API gateway;

step S3, the API gateway initializes default service, route, ACL and authentication information based on the received service and route addition request;

S4, the client sends a micro-service access request to the security agent, the security agent analyzes the micro-service access request to obtain a user ID, and sends a JWT (joint-wt) obtaining request to the API gateway based on the user ID;

Step S5, the API gateway generates a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request, and sends the token to the security agent;

And S6, allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

Further, in the step S1, the JSON configuration file is used for managing a micro-service list provided by the API gateway; the public key is used for JWT authentication.

Further, the step S2 specifically includes:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent analyzes a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

Further, in the step S3, the authentication information includes at least a user ID, a user name, and a password.

Further, the step S4 specifically includes:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.

In a second aspect, the present invention provides a micro service access system for an edge computing environment, comprising the following modules:

The configuration file and public key maintenance module is used for maintaining a JSON configuration file and a public key by the security agent;

the service and route adding request sending module is used for sending HTTP GET REST a request to the security agent by a client running in the edge computing environment, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to the API gateway;

The configuration initialization module is used for initializing default service, route, ACL and authentication information based on the received service and route addition request by the API gateway;

the micro-service access request sending module is used for sending a micro-service access request to the security agent by the client, analyzing the micro-service access request by the security agent to obtain a user ID, and sending a JWT (just wt) obtaining request to the API gateway based on the user ID;

the token generation module is used for generating a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request by the API gateway, and sending the token to the security agent;

And the JWT authentication module is used for allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

Further, in the configuration file and public key maintenance module, the JSON configuration file is used for managing a micro-service list provided by an API gateway; the public key is used for JWT authentication.

Further, the service and route addition request sending module is specifically configured to:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent analyzes a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

Further, in the configuration initialization module, the authentication information at least includes a user ID, a user name, and a password.

Further, the micro service access request sending module is specifically configured to:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.

The invention has the advantages that:

Maintaining a JSON configuration file for managing a micro-service list provided by the API gateway and a public key for JWT authentication through the security proxy, transmitting HTTP GET REST a request to the security proxy by a client running in the edge computing environment, and transmitting a service and route addition request to the API gateway by the security proxy based on the HTTP GET REST request and the JSON configuration file; the API gateway initializes default service, route, ACL and authentication information based on the service and route addition request; then the client sends a micro-service access request to the security agent, the security agent analyzes the micro-service access request to acquire a user ID, and sends a JWT acquisition request to the API gateway based on the user ID; then the API gateway generates a token based on the JWT acquisition request through default service, route, ACL, authentication information and a private key matched with the public key, sends the token to the security agent, and finally allows the client to access the micro service after the security agent carries out JWT authentication on the token through the public key; the method has the advantages that the API gateway is used as an intermediary between the client and the micro-services, the private network environment is provided, the secure exchange of data is carried out through the token, the integrity and the credibility of the data are ensured without using a complex encryption algorithm and a third party mechanism, independent identity verification and access control on each micro-service are not needed, and finally the resource expenditure of micro-service access is greatly reduced on the premise of ensuring the security.

Drawings

The invention will be further described with reference to examples of embodiments with reference to the accompanying drawings.

FIG. 1 is a flow chart of a method of micro-service access for an edge computing environment of the present invention.

FIG. 2 is a schematic diagram of the architecture of a micro service access system for an edge computing environment of the present invention.

Detailed Description

The technical scheme in the embodiment of the application has the following overall thought: the API gateway is used as an intermediary between the client and the micro-service to provide a private network environment, and the token is used for carrying out secure exchange of data, so that the integrity and the credibility of the data are ensured without using a complex encryption algorithm and a third party mechanism, and independent identity verification and access control on each micro-service are not required, thereby reducing the resource expense of micro-service access on the premise of ensuring the security.

Referring to fig. 1 to 2, a micro service access method for an edge computing environment according to a preferred embodiment of the present invention includes the following steps:

step S1, a security agent maintains a JSON configuration file and a public key;

Step S2, a client running in an edge computing environment sends HTTP GET REST a request to a security agent, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to an API gateway;

Step S3, the API gateway initializes default service, route, ACL (access control list) and authentication information based on the received service and route addition request;

Step S4, the client sends a micro-service access request to the security agent, the security agent analyzes the micro-service access request to obtain a user ID, and sends JWT (JSON Web Token) an acquisition request to the API gateway based on the user ID;

step S5, the API gateway generates a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request, and sends the token to the security agent; the data encrypted by the public key can be decrypted only by the private key, and the data encrypted by the private key can be decrypted only by the public key;

And S6, allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

The framework of the invention is composed of an access server, a security agent and an API gateway; the access server is used for providing a graphical interface, creating a user through the graphical interface and using a micro service of an edge computing environment, wherein the controller is used for receiving a request, generating a response and storing user information; the security agent provides the basic functions required when accessing micro services, manages a JSON profile in which specific configurations are parsed and corresponding instances are created to provide information about the micro services, and also contains processing procedures to provide business logic to generate user-related requests and service-related requests, such as adding services, generating JWT certificates, etc.; the API gateway can provide additional functions through plug-in extensions, such as using JWT authentication services, and provide an HTTP listening service for forwarding requests from clients and performing corresponding management operations.

In the step S1, the JSON configuration file is used for managing a micro-service list provided by an API gateway; the public key is used for JWT authentication.

The step S2 specifically comprises the following steps:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent calls a configuration loader to analyze a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

In the step S3, the authentication information includes at least a user ID, a user name, and a password.

The step S4 specifically includes:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.

When a client submits a user ID, a user name, and a password to an access server, the user information is saved in a database, and then a corresponding gateway request session is sent to the security proxy gateway and associated to a whitelist group, and a JWT acquisition request is sent to generate a token. When a user clicks a delete button on the graphical interface, the access server deletes the corresponding user information according to the user ID, then sends a request to the security proxy to delete the gateway request session in the API gateway, the security proxy generates a delete request with the user ID and delete method to send to the API gateway, and if the selected user ID of the gateway request session is successfully deleted in the API gateway, the access server refreshes the user list.

If the token button is selected on the graphical interface, the access server will send a request to the security agent to generate a JWT get request with the selected user ID to the API gateway, then parse the response of the API gateway, generate a token from the credentials, and the access server will display the token.

If all the information registered in the API gateway needs to be deleted, the client sends a request to the security agent to retrieve the service, route, consumer, plug-in and certificate ID by selecting the reset button of the graphical interface, and sends a delete request to the API gateway for all the generated delete requests to delete the related functions therein.

The invention relates to a micro service access system for an edge computing environment, which comprises the following modules:

The configuration file and public key maintenance module is used for maintaining a JSON configuration file and a public key by the security agent;

the service and route adding request sending module is used for sending HTTP GET REST a request to the security agent by a client running in the edge computing environment, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to the API gateway;

a configuration initialization module, configured to initialize default services, routes, ACLs (access control lists) and authentication information by the API gateway based on the received services and route addition requests;

The micro-service access request sending module is used for sending a micro-service access request to the security agent by the client, analyzing the micro-service access request by the security agent to obtain a user ID, and sending JWT (JSON Web Token) an acquisition request to the API gateway based on the user ID;

the token generation module is used for generating a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request by the API gateway, and sending the token to the security agent; the data encrypted by the public key can be decrypted only by the private key, and the data encrypted by the private key can be decrypted only by the public key;

And the JWT authentication module is used for allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

The framework of the invention is composed of an access server, a security agent and an API gateway; the access server is used for providing a graphical interface, creating a user through the graphical interface and using a micro service of an edge computing environment, wherein the controller is used for receiving a request, generating a response and storing user information; the security agent provides the basic functions required when accessing micro services, manages a JSON profile in which specific configurations are parsed and corresponding instances are created to provide information about the micro services, and also contains processing procedures to provide business logic to generate user-related requests and service-related requests, such as adding services, generating JWT certificates, etc.; the API gateway can provide additional functions through plug-in extensions, such as using JWT authentication services, and provide an HTTP listening service for forwarding requests from clients and performing corresponding management operations.

In the configuration file and public key maintenance module, the JSON configuration file is used for managing a micro-service list provided by an API gateway; the public key is used for JWT authentication.

The service and route addition request sending module is specifically configured to:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent calls a configuration loader to analyze a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

In the configuration initialization module, the authentication information at least comprises a user ID, a user name and a password.

The micro service access request sending module is specifically configured to:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.

When a client submits a user ID, a user name, and a password to an access server, the user information is saved in a database, and then a corresponding gateway request session is sent to the security proxy gateway and associated to a whitelist group, and a JWT acquisition request is sent to generate a token. When a user clicks a delete button on the graphical interface, the access server deletes the corresponding user information according to the user ID, then sends a request to the security proxy to delete the gateway request session in the API gateway, the security proxy generates a delete request with the user ID and delete method to send to the API gateway, and if the selected user ID of the gateway request session is successfully deleted in the API gateway, the access server refreshes the user list.

If the token button is selected on the graphical interface, the access server will send a request to the security agent to generate a JWT get request with the selected user ID to the API gateway, then parse the response of the API gateway, generate a token from the credentials, and the access server will display the token.

If all the information registered in the API gateway needs to be deleted, the client sends a request to the security agent to retrieve the service, route, consumer, plug-in and certificate ID by selecting the reset button of the graphical interface, and sends a delete request to the API gateway for all the generated delete requests to delete the related functions therein.

In summary, the invention has the advantages that:

Maintaining a JSON configuration file for managing a micro-service list provided by the API gateway and a public key for JWT authentication through the security proxy, transmitting HTTP GET REST a request to the security proxy by a client running in the edge computing environment, and transmitting a service and route addition request to the API gateway by the security proxy based on the HTTP GET REST request and the JSON configuration file; the API gateway initializes default service, route, ACL and authentication information based on the service and route addition request; then the client sends a micro-service access request to the security agent, the security agent analyzes the micro-service access request to acquire a user ID, and sends a JWT acquisition request to the API gateway based on the user ID; then the API gateway generates a token based on the JWT acquisition request through default service, route, ACL, authentication information and a private key matched with the public key, sends the token to the security agent, and finally allows the client to access the micro service after the security agent carries out JWT authentication on the token through the public key; the method has the advantages that the API gateway is used as an intermediary between the client and the micro-services, the private network environment is provided, the secure exchange of data is carried out through the token, the integrity and the credibility of the data are ensured without using a complex encryption algorithm and a third party mechanism, independent identity verification and access control on each micro-service are not needed, and finally the resource expenditure of micro-service access is greatly reduced on the premise of ensuring the security.

While specific embodiments of the invention have been described above, it will be appreciated by those skilled in the art that the specific embodiments described are illustrative only and not intended to limit the scope of the invention, and that equivalent modifications and variations of the invention in light of the spirit of the invention will be covered by the claims of the present invention.

Claims (10)

1. A method of micro-service access for an edge computing environment, characterized by: the method comprises the following steps:

step S1, a security agent maintains a JSON configuration file and a public key;

Step S2, a client running in an edge computing environment sends HTTP GET REST a request to a security agent, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to an API gateway;

step S3, the API gateway initializes default service, route, ACL and authentication information based on the received service and route addition request;

S4, the client sends a micro-service access request to the security agent, the security agent analyzes the micro-service access request to obtain a user ID, and sends a JWT (joint-wt) obtaining request to the API gateway based on the user ID;

Step S5, the API gateway generates a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request, and sends the token to the security agent;

And S6, allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

2. A method of microservice access for an edge computing environment as claimed in claim 1, wherein: in the step S1, the JSON configuration file is used for managing a micro-service list provided by an API gateway; the public key is used for JWT authentication.

3. A method of microservice access for an edge computing environment as claimed in claim 1, wherein: the step S2 specifically comprises the following steps:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent analyzes a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

4. A method of microservice access for an edge computing environment as claimed in claim 1, wherein: in the step S3, the authentication information includes at least a user ID, a user name, and a password.

5. A method of microservice access for an edge computing environment as claimed in claim 1, wherein: the step S4 specifically includes:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.

6. A micro service access system for an edge computing environment, characterized by: the device comprises the following modules:

The configuration file and public key maintenance module is used for maintaining a JSON configuration file and a public key by the security agent;

the service and route adding request sending module is used for sending HTTP GET REST a request to the security agent by a client running in the edge computing environment, and the security agent generates a service and route adding request based on the received HTTP GET REST request and the JSON configuration file and sends the service and route adding request to the API gateway;

The configuration initialization module is used for initializing default service, route, ACL and authentication information based on the received service and route addition request by the API gateway;

the micro-service access request sending module is used for sending a micro-service access request to the security agent by the client, analyzing the micro-service access request by the security agent to obtain a user ID, and sending a JWT (just wt) obtaining request to the API gateway based on the user ID;

the token generation module is used for generating a token through the default service, the route, the ACL, the authentication information and the private key matched with the public key based on the received JWT acquisition request by the API gateway, and sending the token to the security agent;

And the JWT authentication module is used for allowing the client to access the micro service after the security agent carries out JWT authentication on the received token through the public key.

7. A micro service access system for an edge computing environment as recited in claim 6, wherein: in the configuration file and public key maintenance module, the JSON configuration file is used for managing a micro-service list provided by an API gateway; the public key is used for JWT authentication.

8. A micro service access system for an edge computing environment as recited in claim 6, wherein: the service and route addition request sending module is specifically configured to:

And the client running in the edge computing environment sends HTTP GET REST a request to the security agent through a graphical interface of an access server, the security agent analyzes a JSON configuration file based on the received HTTP GET REST request, generates a service and a route adding request based on the JSON configuration file, and sends the service and the route adding request to an API gateway.

9. A micro service access system for an edge computing environment as recited in claim 6, wherein: in the configuration initialization module, the authentication information at least comprises a user ID, a user name and a password.

10. A micro service access system for an edge computing environment as recited in claim 6, wherein: the micro service access request sending module is specifically configured to:

The client sends a micro-service access request carrying a user ID, a user name and a password to the security agent through a graphical interface of the access server, the security agent analyzes the micro-service access request to obtain the user ID, the user name and the password, and sends a JWT (joint user wt) obtaining request to the API gateway based on the user ID after authenticating the API gateway based on the user ID, the user name and the password.