CN112416528A - Method for realizing non-invasive micro-service room interface safe calling - Google Patents
Method for realizing non-invasive micro-service room interface safe calling Download PDFInfo
- Publication number
- CN112416528A CN112416528A CN202011405345.7A CN202011405345A CN112416528A CN 112416528 A CN112416528 A CN 112416528A CN 202011405345 A CN202011405345 A CN 202011405345A CN 112416528 A CN112416528 A CN 112416528A
- Authority
- CN
- China
- Prior art keywords
- application
- key
- mscp
- container
- service
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 25
- 238000004891 communication Methods 0.000 claims abstract description 11
- 230000008569 process Effects 0.000 claims description 9
- 238000012795 verification Methods 0.000 claims description 5
- 239000003999 initiator Substances 0.000 claims description 3
- 101000951325 Homo sapiens Mitoferrin-1 Proteins 0.000 abstract 5
- 102100037984 Mitoferrin-1 Human genes 0.000 abstract 5
- 238000012790 confirmation Methods 0.000 abstract 1
- 238000001914 filtration Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008447 perception Effects 0.000 description 2
- 230000009466 transformation Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000009545 invasion Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45587—Isolation or security of virtual machine instances
Abstract
The invention relates to a method for realizing non-invasive micro-service interface safe calling.A main application MS _ A and a main application MS _ B are respectively deployed on different Kubernetes nodes Pod _ A and Pod _ B, and containers correspondingly loaded by the main application are respectively MSC _ A and MSC _ B; configuring an Init container and a companion container on two Pod nodes, and deploying a running function module MSCP on the companion container. The application publishing and deploying system records an application NAME MS _ NAME corresponding to the main application image, an application image MD5 value MS _ MD5, a communication KEY MS _ KEY and other application lists accessed by the application into the Config Server, and the MSCP reads the MD5 value of the main application image to compare with the MD5 value registered by the Config Server, verifies the identity of the main application and ensures that the application is not tampered; the MSCP adds the KEY of the MS _ A and the KEY of the MS _ B to form a combined KEY MS _ KEY _ A + MS _ KEY _ B, the MS _ B intercepts the encrypted message sent to the MS _ B by the MSCP from the MSCP service, checks the MD5 value of the MS _ B again, and forwards the decrypted message to the MS _ B. The invention realizes the application identity confirmation and prevents the main application from being counterfeited or tampered.
Description
Technical Field
The invention relates to the technical field of computer micro-service development, in particular to a method for realizing non-invasive micro-service interface secure calling.
Background
Under the micro-service architecture, the system is divided into a plurality of micro-services with single responsibility according to the service. Each micro-service has its own set of API to provide other micro-service calls, so how to ensure the security of the micro-service API, that is, how to prevent the micro-service API interface from being randomly accessed without authorization, and avoid the security problems of counterfeiting, eavesdropping, tampering, replay attack and the like of the API calls among the micro-services.
The prior technical scheme has the following implementation modes:
1. the JWT or OAuth2 authentication mode is very similar in the two ideas, the two ideas are that the user provides information to an authentication server, the server performs validity authentication according to the transmitted information, if the authentication is successful, a token (the expiration time is set) is returned, then the user carries the token to access when accessing, and the protected interface performs authentication.
2. HTTPS link encryption mode: the micro-services are communicated through an HTTPS protocol, and the HTTPS encrypts a communication link, so that the safety of interface calling and data transmission is ensured.
The JWT or OAuth2 authentication method can only solve the authentication problem of calling between micro services, but cannot solve the problems of interception and falsification of interface message data, and the two authentication methods need to carry out certain invasive modification on micro service application or configuration.
Although the communication link can be encrypted by adopting the HTTPS mode, the method has certain influence on the calling performance of the interface, and if the caller needs to be authenticated, HTTPS bidirectional authentication needs to be used, which puts higher requirements on the performance and the deployment complexity.
Disclosure of Invention
In view of the above, an object of the present invention is to provide a method for implementing non-invasive interface security invocation between micro-services, which solves the problem of access control and data security of invocation between micro-services in a manner that both the intrusion and the perception of an application are small; the purpose of safety communication between applications can be realized by adopting a mode of transparent flow hijacking of an associated container and filtering and intercepting messages.
The invention is realized by adopting the following scheme: a method for realizing non-invasive micro-service room interface security calling comprises the following steps:
step S1: providing two microservice applications MS _ A and MS _ B, respectively deploying the microservice applications on two different Kubernets nodes Pod _ A and Pod _ B, wherein the correspondingly-loaded containers, namely main application containers, are MSC _ A and MSC _ B respectively; meanwhile, one companion container is deployed for each container of the master application on the Pod _ a and Pod _ B nodes, and the companion containers corresponding to the MSC _ A, MSC _ B are PXC _ A, PXC _ a respectively;
step S2: configuring a special container, namely an Init container, on a Pod node, namely nodes Pod _ a and Pod _ B, wherein the container runs before a main application container and a companion container are started, configuring and running an iptables command or script in the Init container, and realizing transparent flow hijacking by the companion container through the iptables command, namely configuring and forwarding an access flow of the main application container to an external micro service and an access flow of the external micro service to the main application container according to a global micro service address field and a port range to the companion container through the iptables command;
step S3: respectively deploying and operating a key function module, namely, a micro service communication proxy Module (MSCP) service on the two companion containers, so as to complete the processes from the step S4 to the step S7;
step S4: when the application publishing and deploying system of Kubernetes updates the main application mirror images of main application containers MSC _ A and MSC _ B every time, the application NAME MS _ NAME corresponding to the mirror image, the application mirror image MD5 value MS _ MD5, the communication KEY MS _ KEY and other application lists which can be accessed by the application are recorded in a Config Server of a micro service framework, the Config Server is used for synchronizing the information to all MSCP services, and then the global MSCP service can acquire the NAMEs, the mirror image MD5 values, the KEYs and the accessible target application lists of all the applications;
step S5: when MS _ A calls MS _ B, the MS _ A service generates a request message and sends the request message to the MS _ B service, and the MSCP service deployed on a companion container PXC _ A of the MS _ A intercepts the request message and performs validity check;
step S6: after confirming the validity and the access authority of the calling initiator main application MS _ A identity through step S5, the MSCP adds the KEY of MS _ A and the KEY of MS _ B to form a combined KEY MS _ KEY _ A + MS _ KEY _ B, then symmetrically encrypts the message by using the combined KEY, and is responsible for sending the encrypted request message to an opposite-end service, namely MS _ B;
step S7: MS _ B intercepts an encrypted message sent to MS _ B by MSCP of MS _ A corresponding to MSCP service deployed in an associated container, firstly performs authentication according to caller identification, decrypts the message by using a combined KEY MS _ KEY _ A + MS _ KEY _ B according to caller application identification after the authentication is passed, and finally forwards the decrypted message to MS _ B after checking the MD5 value of MS _ B again; i.e. a call between the MS _ a application and the MS _ B application is completed.
Further, the performing of the legal verification in step S5 specifically includes the following steps:
step SA: the MSCP reads the MD5 value of the main application mirror image to compare with the MD5 value registered by the main application in the Config Server, if the two MD5 values are consistent, the main application is not tampered, the step SB is continued, otherwise, the MSCP directly returns the error information that the application verification fails to pass to the MS _ A, and the whole process is ended;
step SB: and the MSCP verifies whether the MS _ A can access the MS _ B according to the service list which is recorded in the Config Server and can be accessed by the MS _ A, if the MS _ A can be accessed by the MS _ B, the step S6 is continued, otherwise, the MS _ A directly returns the information that the access authority check fails to pass, and the whole process is ended.
Compared with the prior art, the invention has the following beneficial effects:
(1) the method has no invasion to the application, and does not need any configuration and adaptation transformation of the application; the correspondence is completely transparent and the application does not perceive the presence of the system.
(2) The invention provides a framework security solution, which completely separates security implementation from a service system, and only needs to pay attention to the implementation of the service without paying attention to a security implementation mode.
(3) The invention adopts the transparent flow hijacking mode of the associated container, and realizes the purpose of safety communication between applications by filtering and intercepting the message.
(4) According to the invention, the main application is detected through the MD5, so that the application identity can be confirmed, and the main application is prevented from being counterfeited or tampered.
Drawings
FIG. 1 is a flow chart of an embodiment of the present invention.
Detailed Description
The invention is further explained below with reference to the drawings and the embodiments.
It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the disclosure. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments according to the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.
As shown in fig. 1, the present embodiment provides a method for implementing non-invasive interface security invocation between micro services, which is mainly oriented to a scenario in which a micro service application is deployed in a kubernets container in a mirror image mode, and mainly aims at a security problem that the micro service application is deployed inside a micro service gateway and invoked between micro services deployed on different kubernets Pod; the method comprises the following steps:
step S1: providing two microservice applications MS _ A and MS _ B, respectively deploying the microservice applications on two different Kubernets nodes Pod _ A and Pod _ B, wherein the correspondingly-loaded containers, namely main application containers, are MSC _ A and MSC _ B respectively; meanwhile, one companion container is deployed for each container of the master application on the Pod _ a and Pod _ B nodes, and the companion containers corresponding to the MSC _ A, MSC _ B are PXC _ A, PXC _ a respectively;
at this time, it can be understood that two containers (a primary application container and a companion container) on one Pod share resources such as storage, network and the like, and the Pod can be broadly understood as one host, and the two containers share host resources.
Step S2: configuring a special container, namely an Init container, on a Pod node, namely nodes Pod _ a and Pod _ B, wherein the container runs before a main application container and a companion container are started, configuring and running an iptables command or script in the Init container, and realizing transparent flow hijacking by the companion container through the iptables command, namely configuring and forwarding an access flow of the main application container to an external micro service and an access flow of the external micro service to the main application container according to a global micro service address field and a port range to the companion container through the iptables command;
step S3: respectively deploying and operating a key function module, namely, a micro service communication proxy Module (MSCP) service on the two companion containers, so as to complete the processes from the step S4 to the step S7;
the MSCP service realizes filtering, encryption and decryption of micro-service requests and response flow entering and exiting a main application container, namely, the calling authentication and safe transmission of the calling among the micro-services can be realized under the condition of no invasive transformation and no perception of the main application;
step S4: when updating the main application image (such as the image of MS _ A and MS _ B) of a main application container (such as Pod _ A and Pod _ B), the application publishing and deploying system of Kubernetes records the application NAME MS _ NAME, the application image MD5 value MS _ MD5, the communication KEY MS _ KEY and other application lists which can be accessed by the application corresponding to the image into a Config Server of a micro service framework, and the Config Server is used for synchronizing the information to all MSCP services, so that the global MSCP service can acquire the NAMEs, the image MD5 values, the KEYs and the accessible target application lists of all the applications;
step S5: when MS _ A calls MS _ B, the MS _ A service generates a request message and sends the request message to the MS _ B service, and the MSCP service deployed on a companion container PXC _ A of the MS _ A intercepts the request message and performs validity check;
step S6: after confirming the validity and the access authority of the calling initiator main application MS _ A identity through step S5, the MSCP adds the KEY of MS _ A and the KEY of MS _ B to form a combined KEY MS _ KEY _ A + MS _ KEY _ B, then symmetrically encrypts the message by using the combined KEY, and is responsible for sending the encrypted request message to an opposite-end service, namely MS _ B;
step S7: MS _ B intercepts an encrypted message sent to MS _ B by MSCP of MS _ A corresponding to MSCP service deployed in an associated container, firstly performs authentication according to caller identification, decrypts the message by using a combined KEY MS _ KEY _ A + MS _ KEY _ B according to caller application identification after the authentication is passed, and finally forwards the decrypted message to MS _ B after checking the MD5 value of MS _ B again; i.e. a call between the MS _ a application and the MS _ B application is completed.
As described above, a call between the MS _ a application and the MS _ B application is completed, while the authentication, and encryption/decryption involved therein is completely transparent to the master application.
In this embodiment, the performing the validity check in step S5 specifically includes the following steps:
step SA: the MSCP reads the MD5 value of the main application mirror image to compare with the MD5 value registered by the main application in the Config Server, if the two MD5 values are consistent, the main application is not tampered, the step SB is continued, otherwise, the MSCP directly returns the error information that the application verification fails to pass to the MS _ A, and the whole process is ended;
step SB: and the MSCP verifies whether the MS _ A can access the MS _ B according to the service list which is recorded in the Config Server and can be accessed by the MS _ A, if the MS _ A can be accessed by the MS _ B, the step S6 is continued, otherwise, the MS _ A directly returns the information that the access authority check fails to pass, and the whole process is ended.
The above description is only a preferred embodiment of the present invention, and all equivalent changes and modifications made in accordance with the claims of the present invention should be covered by the present invention.
Claims (2)
1. A method for realizing non-invasive micro-service room interface safe calling is characterized in that: the method comprises the following steps:
step S1: providing two microservice applications MS _ A and MS _ B, respectively deploying the microservice applications on two different Kubernets nodes Pod _ A and Pod _ B, wherein the correspondingly-loaded containers, namely main application containers, are MSC _ A and MSC _ B respectively; meanwhile, one companion container is deployed for each container of the master application on the Pod _ a and Pod _ B nodes, and the companion containers corresponding to the MSC _ A, MSC _ B are PXC _ A, PXC _ a respectively;
step S2: configuring a special container, namely an Init container, on a Pod node, namely nodes Pod _ a and Pod _ B, wherein the container runs before a main application container and a companion container are started, configuring and running an iptables command or script in the Init container, and realizing transparent flow hijacking by the companion container through the iptables command, namely configuring and forwarding an access flow of the main application container to an external micro service and an access flow of the external micro service to the main application container according to a global micro service address field and a port range to the companion container through the iptables command;
step S3: respectively deploying and operating a key function module, namely, a micro service communication proxy Module (MSCP) service on the two companion containers, so as to complete the processes from the step S4 to the step S7;
step S4: when the application publishing and deploying system of Kubernetes updates the main application mirror images of main application containers MSC _ A and MSC _ B every time, the application NAME MS _ NAME corresponding to the mirror image, the application mirror image MD5 value MS _ MD5, the communication KEY MS _ KEY and other application lists which can be accessed by the application are recorded in a Config Server of a micro service framework, the Config Server is used for synchronizing the information to all MSCP services, and then the global MSCP service can acquire the NAMEs, the mirror image MD5 values, the KEYs and the accessible target application lists of all the applications;
step S5: when MS _ A calls MS _ B, the MS _ A service generates a request message and sends the request message to the MS _ B service, and the MSCP service deployed on a companion container PXC _ A of the MS _ A intercepts the request message and performs validity check;
step S6: after confirming the validity and the access authority of the calling initiator main application MS _ A identity through step S5, the MSCP adds the KEY of MS _ A and the KEY of MS _ B to form a combined KEY MS _ KEY _ A + MS _ KEY _ B, then symmetrically encrypts the message by using the combined KEY, and is responsible for sending the encrypted request message to an opposite-end service, namely MS _ B;
step S7: MS _ B intercepts an encrypted message sent to MS _ B by MSCP of MS _ A corresponding to MSCP service deployed in an associated container, firstly performs authentication according to caller identification, decrypts the message by using a combined KEY MS _ KEY _ A + MS _ KEY _ B according to caller application identification after the authentication is passed, and finally forwards the decrypted message to MS _ B after checking the MD5 value of MS _ B again; i.e. a call between the MS _ a application and the MS _ B application is completed.
2. The method of claim 1, wherein the method further comprises the steps of: the legal verification in step S5 specifically includes the following steps:
step SA: the MSCP reads the MD5 value of the main application mirror image to compare with the MD5 value registered by the main application in the Config Server, if the two MD5 values are consistent, the main application is not tampered, the step SB is continued, otherwise, the MSCP directly returns the error information that the application verification fails to pass to the MS _ A, and the whole process is ended;
step SB: and the MSCP verifies whether the MS _ A can access the MS _ B according to the service list which is recorded in the Config Server and can be accessed by the MS _ A, if the MS _ A can be accessed by the MS _ B, the step S6 is continued, otherwise, the MS _ A directly returns the information that the access authority check fails to pass, and the whole process is ended.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011405345.7A CN112416528B (en) | 2020-12-04 | 2020-12-04 | Method for realizing non-invasive micro service interface safety call |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011405345.7A CN112416528B (en) | 2020-12-04 | 2020-12-04 | Method for realizing non-invasive micro service interface safety call |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112416528A true CN112416528A (en) | 2021-02-26 |
| CN112416528B CN112416528B (en) | 2024-03-22 |
Family
ID=74830188
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011405345.7A Active CN112416528B (en) | 2020-12-04 | 2020-12-04 | Method for realizing non-invasive micro service interface safety call |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112416528B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115801569A (en) * | 2023-02-07 | 2023-03-14 | 苏州浪潮智能科技有限公司 | Access rule deployment method, device, equipment, medium and cloud platform |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109756448A (en) * | 2017-11-02 | 2019-05-14 | 广东亿迅科技有限公司 | API gateway method for managing security and its system based on micro services |
| CN109787988A (en) * | 2019-01-30 | 2019-05-21 | 杭州恩牛网络技术有限公司 | A kind of identity reinforces certification and method for authenticating and device |
| US20190273746A1 (en) * | 2018-03-02 | 2019-09-05 | Syntegrity Networks Inc. | Microservice architecture for identity and access management |
| CN110730077A (en) * | 2019-10-09 | 2020-01-24 | 北京华宇信息技术有限公司 | Method and system for micro-service identity authentication and interface authentication |
| CN110781476A (en) * | 2019-10-15 | 2020-02-11 | 南京南瑞信息通信科技有限公司 | Flexible micro-service security access control method and system |
| US20200059360A1 (en) * | 2018-08-20 | 2020-02-20 | Jpmorgan Chase Bank, N.A. | System and method for service-to-service authentication |
| CN111783051A (en) * | 2020-07-08 | 2020-10-16 | 支付宝(杭州)信息技术有限公司 | Identity authentication method and device and electronic equipment |
| CN112000448A (en) * | 2020-07-17 | 2020-11-27 | 北京计算机技术及应用研究所 | Micro-service architecture-based application management method |
-
2020
- 2020-12-04 CN CN202011405345.7A patent/CN112416528B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109756448A (en) * | 2017-11-02 | 2019-05-14 | 广东亿迅科技有限公司 | API gateway method for managing security and its system based on micro services |
| US20190273746A1 (en) * | 2018-03-02 | 2019-09-05 | Syntegrity Networks Inc. | Microservice architecture for identity and access management |
| US20200059360A1 (en) * | 2018-08-20 | 2020-02-20 | Jpmorgan Chase Bank, N.A. | System and method for service-to-service authentication |
| CN109787988A (en) * | 2019-01-30 | 2019-05-21 | 杭州恩牛网络技术有限公司 | A kind of identity reinforces certification and method for authenticating and device |
| CN110730077A (en) * | 2019-10-09 | 2020-01-24 | 北京华宇信息技术有限公司 | Method and system for micro-service identity authentication and interface authentication |
| CN110781476A (en) * | 2019-10-15 | 2020-02-11 | 南京南瑞信息通信科技有限公司 | Flexible micro-service security access control method and system |
| CN111783051A (en) * | 2020-07-08 | 2020-10-16 | 支付宝(杭州)信息技术有限公司 | Identity authentication method and device and electronic equipment |
| CN112000448A (en) * | 2020-07-17 | 2020-11-27 | 北京计算机技术及应用研究所 | Micro-service architecture-based application management method |
Non-Patent Citations (6)
| Title |
|---|
| DUO LU等: "A Secure Microservice Framework for IoT", 《2017 IEEE SYMPOSIUM ON SERVICE-ORIENTED SYSTEM ENGINEERING(SOSE)》, 8 June 2017 (2017-06-08) * |
| KANE: "全方面解析微服务架构下的统一身份认证和授权", Retrieved from the Internet <URL:《知乎》> * |
| TETIANA YARYGINA等: "Overcoming Security Challenges in Microservice Architectures", 《2018 IEEE SYMPOSIUM ON SERVICE-ORIENTED SYSTEM ENGINEERING (SOSE)》, 17 May 2018 (2018-05-17) * |
| 付琳琳等: "微服务容器化部署的研究", 《计算技术与自动化》, vol. 38, no. 04, 15 January 2020 (2020-01-15), pages 151 - 155 * |
| 李海波等: "基于容器技术的广电云平台服务框架规划与实现", 《广播电视网络》, vol. 27, no. 11, 28 November 2020 (2020-11-28), pages 35 - 39 * |
| 王焕强等: "基于微服务架构和支持业务过程可靠执行的数据通信方法", 《计算机集成制造系统》, vol. 25, no. 04, 15 April 2019 (2019-04-15), pages 946 - 953 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115801569A (en) * | 2023-02-07 | 2023-03-14 | 苏州浪潮智能科技有限公司 | Access rule deployment method, device, equipment, medium and cloud platform |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112416528B (en) | 2024-03-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6262278B2 (en) | Method and apparatus for storage and computation of access control client | |
| US8156231B2 (en) | Remote access system and method for enabling a user to remotely access terminal equipment from a subscriber terminal | |
| CN112422532B (en) | Service communication method, system and device and electronic equipment | |
| US20050188219A1 (en) | Method and a system for communication between a terminal and at least one communication equipment | |
| JP2017050875A (en) | Mobile apparatus supporting plural access control clients, and corresponding methods | |
| CA2968051A1 (en) | Systems and methods for authentication using multiple devices | |
| TW201338606A (en) | Network assisted fraud detection apparatus and methods | |
| US9443069B1 (en) | Verification platform having interface adapted for communication with verification agent | |
| CN113472807B (en) | Private communication method and device between users | |
| US11936689B2 (en) | Transmission of data or messages on board a vehicle using a SOME/IP communication protocol | |
| CN111597583B (en) | Data sharing and exchanging method based on block chain | |
| CN107332817B (en) | Mobile device supporting multiple access control clients and corresponding method | |
| WO2023000083A1 (en) | Method and system for indirect sharing of sensor insights | |
| CN112416528B (en) | Method for realizing non-invasive micro service interface safety call | |
| CN117118628A (en) | Lightweight identity authentication method and device for electric power Internet of things and electronic equipment | |
| US20220295281A1 (en) | System, module, circuitry and method | |
| CN115250192A (en) | Robot network authentication system and method | |
| WO2023125642A1 (en) | Authentication and/or key management method, first device, terminal and communication device | |
| CN114338091B (en) | Data transmission method, device, electronic equipment and storage medium | |
| WO2022183427A1 (en) | Method, device, and system for protecting sequence number in wireless network | |
| CN114760628B (en) | Terminal safety access method for railway broadband trunking communication system | |
| CN115037454B (en) | Data protection method and electronic equipment | |
| US11968310B2 (en) | Method and system for providing data security for micro-services across domains | |
| CN117319080A (en) | Mobile terminal for isolating secret communication and communication method | |
| CN117395014A (en) | Secure data exchange system, secure data exchange method, electronic device, and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |