WO2020134838A1

WO2020134838A1 - Authority verification method and related device

Info

Publication number: WO2020134838A1
Application number: PCT/CN2019/121604
Authority: WO
Inventors: 李春林; 莫中平; 蓝深; 钟斌
Original assignee: 深圳云天励飞技术有限公司
Priority date: 2018-12-29
Filing date: 2019-11-28
Publication date: 2020-07-02
Also published as: CN109815683A; CN109815683B

Abstract

An authority verification method and a related device, the method comprising: when a start request for a first micro-service instance is detected, calling a first sub-function module among a plurality of sub-function modules corresponding to the first micro-service instance by means of a main function module to obtain an authority identifier (S201); calling a second sub-function module corresponding to an authority verification function by means of the first sub-function module, and verifying whether the authority identifier is valid according to the second sub-function module (S202); and when detected that the authority identifier is valid, executing the first micro-service instance by means of the first sub-function module (S203). The present method is conducive to improving the convenience of authority verification in a micro-service mode and reducing the disorderliness of authority verification codes.

Description

Authority verification method and related device

Technical field

[0001] The present application relates to the field of electronic technology, and in particular, to a method of authorization verification and related devices.

[0002] This application requires the priority of the Chinese patent application filed on December 29, 2018, with the application number 201811640222.4 and the invention titled "Authentication Verification Method and Related Devices", the entire contents of which are incorporated herein by reference Applying.

Background technique

[0003] With the rise of microservice architecture, the challenges of identity authentication and authentication in traditional single-use application scenarios are increasing. Under the monolithic application system, the application is a whole, and the permissions are generally checked for all requests.

[0004] Under the microservices architecture, an application will be split into several microapplications, each microapplication needs to authenticate access, and each microapplication needs to specify the current access user and its permissions. The code is inserted into each microservice to obtain permission information, which leads to code redundancy and large business intrusion. It can be seen that the authentication method under the single application architecture is not particularly suitable.

Summary of the invention

technical problem

Solution to the problem

Technical solution

[0005] Embodiments of the present application provide a permission verification method and related device, with a view to improving the convenience of permission verification in a microservice mode and reducing the complexity of permission verification codes.

[0006] In a first aspect, an embodiment of the present application provides a permission verification method, which is applied to an electronic device, and a target application program is installed on the electronic device, and the target application program includes a main function module and a plurality of sub-function modules. The methods described include:

[0007] When a start request for the first microservice instance is detected, the main function module calls the first subfunction module among the plurality of subfunction modules corresponding to the first microservice instance to obtain the permission identifier [0008] calling the second sub-function module corresponding to the authority verification function through the first sub-function module, and according to the The second sub-function module verifies whether the authority identifier is valid;

[0009] When it is detected that the authority identifier is valid, execute the first microservice instance through the first sub-function module.

[0010] In a second aspect, an embodiment of the present application provides a permission verification apparatus, which is applied to an electronic device, and a target application program is installed on the electronic device, and the target application program includes a main function module and a plurality of sub-function modules. The authority verification device includes an acquisition unit, a verification unit and an execution unit, wherein,

[0011] The acquiring unit is configured to call the first of the plurality of sub-function modules corresponding to the first microservice instance through the main function module when a start request for the first microservice instance is detected A sub-function module to obtain permission identification;

[0012] The verification unit is configured to call a second sub-function module corresponding to a permission verification function through the first sub-function module, and verify whether the permission identifier is valid according to the second sub-function module;

[0013] The execution unit is configured to execute the first microservice instance through the first sub-function module when it is detected that the authority identifier is valid.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, including a processor, a memory, a communication interface, and one or more programs, where the one or more programs are stored in the memory and configured The foregoing processor executes the foregoing program, and the foregoing program includes instructions for executing steps in any method of the first aspect of the embodiments of the present application.

[0015] According to a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, where the computer program causes the computer to execute as described in the present application Part or all of the steps described in any method of the first aspect of the embodiment.

[0016] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium that stores the computer program, and the computer program is operable to cause the computer to execute Part or all of the steps described in any method of the first aspect of the embodiments of the present application. The computer program product may be a software installation package.

[0017] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the second sub-function module according to the second sub-function module Whether the authority identifier is valid, and finally, when it is detected that the authority identifier is valid, the first micro service instance is executed through the first sub-function module. It can be seen that under the microservices architecture, the electronic device does not need to add permission verification code in each microservice sub-function module, and only intercepts the permission identifier when verification is required to verify the sub-module calling the permission verification function, which can save each The code for microservice application permission verification is helpful to reduce the verbosity of each microservice application code and improve the convenience of permission verification under the microservice mode.

Beneficial effects of invention

Brief description of the drawings

BRIEF DESCRIPTION

[0018] In order to more clearly explain the embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required to be used in the technical description of the embodiment or the fifth embodiment. Obviously, the following description The drawings are only some embodiments of the present application. For those of ordinary skill in the art, without paying any creative labor, other drawings can also be obtained based on these drawings.

[0019] FIG. 1 is a schematic structural diagram of a microservice architecture provided by an embodiment of the present application;

[0020] FIG. 2 is a schematic flowchart of a permission verification method provided by an embodiment of the present application;

[0021] FIG. 3 is a schematic flowchart of another authority verification method provided by an embodiment of the present application;

[0022] FIG. 4 is a schematic flowchart of another authority verification method provided by an embodiment of the present application;

[0023] FIG. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application;

[0024] FIG. 6 is a functional block diagram of a functional verification device provided by an embodiment of the present application.

Invention Example

Embodiments of the invention

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described The embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without making creative work fall within the protection scope of the present application.

[0026] The terms “first”, “second”, etc. in the description and claims of the present application and the above drawings are used for Don't describe different objects, not describe specific sequences. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally also includes Other steps or units inherent to these processes, methods, products or equipment.

[0027] Reference herein to "embodiments" means that specific features, structures, or characteristics described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive of other embodiments. Those skilled in the art understand explicitly and implicitly that the embodiments described herein can be combined with other embodiments.

[0028] The electronic devices involved in the embodiments of the present application may include various handheld devices, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to a wireless modem, and various forms of user equipment (User Equipment, UE), mobile station (Mobile

Station, MS), electronic device (terminal device), etc.

[0029] The embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

[0030] The purpose of the Microservices Architecture Pattern is to integrate large, complex

The long-running application is built as a set of mutually coordinated services, and each service can be easily improved locally.

[0031] In short, the microservice architecture is a method of developing a single application as a set of small services, each application runs in its own process, and is linked to a lightweight mechanism (usually HTTP The resource's Application Programming Interface (API) communicates. These services are built around business functions and can be independently deployed through a fully automated deployment mechanism. The centralized management of these services is the least. They can be written in different programming languages and use different data storage technologies.

[0032] The microservice-based architecture may have 5 to 100 or more services. The API gateway can provide a unified entry point for external consumers, regardless of the number and composition of internal microservices. For example, as shown in FIG. 1, an application A based on a microservice architecture, which consists of multiple The composition of the microservice application, each microservice corresponds to a different function in application A, which can be specifically corresponding to function 1 of microservice 1 and corresponding to microservice 2 Function 2, microservice 3 corresponds to function 3, microservice 4 corresponds to function 4, microservice 5 corresponds to function 5, etc. Each microservice can be designed by a different design team, that is to say, each microservice is independent , And each microservice can be written in a different programming language.

[0033] The following describes the embodiments of the present invention in detail.

[0034] Please refer to FIG. 2, FIG. 2 is a schematic flow chart of a method for verifying permission provided by an embodiment of the present application, which is applied to an electronic device, a target application program is installed on the electronic device, and the target application program includes a main function The module and multiple sub-function modules, as shown in the figure, this permission verification method includes:

[0035] S201, when detecting an activation request for a first microservice instance, the electronic device calls the first subfunction of the plurality of subfunction modules corresponding to the first microservice instance through the main function module The module obtains the permission identifier.

[0036] Wherein, the first microservice instance is an object corresponding to any function in the target application program, and the specific implementation manner of the electronic device when the startup request for the first microservice instance is detected may be that the electronic device detects the user For the selection operation of the first microservice instance, the selection operation may be a touch operation, a voice operation, etc., which is not limited herein.

[0037] Wherein, the permission identifier is Token, and the main function module and the multiple sub-function modules belong to the relationship between calling and called.

[0038] S202, the electronic device calls a second sub-function module corresponding to a permission verification function through the first sub-function module, and verifies whether the permission identifier is valid according to the second sub-function module.

[0039] Wherein, under the microservice architecture, the permission verification program corresponds to a separate microservice application, without the need to add the same permission verification program to each other microservice application, the microservice application corresponds to the second sub Function module, the permission verification function of the second sub-function module can verify the validity of any token

[0040] S203, when detecting that the authority identifier is valid, the electronic device executes the first microservice instance through the first sub-function module.

[0041] Wherein, the permission identifier is used by the first sub-function module to verify the startup request, that is, when the verification is successful, it proves that the target application has the permission to call and access the first microservice instance interface, and then Jump to the function page corresponding to the first microservice instance. If the verification fails, the jump response is not executed. When the corresponding first sub-function module can feed back the verification failure message to the main function module, the main The function module can display information such as a failed jump on the page before the jump.

[0042] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the permission identifier according to the second sub-function module Whether it is valid, and finally, when it is detected that the authority identifier is valid, executing the first microservice instance through the first sub-function module. It can be seen that under the microservices architecture, the electronic device does not need to add permission verification code in each microservice sub-function module, and only intercepts the permission identifier when verification is required to verify the sub-module calling the permission verification function, which can save each The code for microservice application permission verification is helpful to reduce the verbosity of each microservice application code and improve the convenience of permission verification under the microservice mode.

[0043] In a possible example, before the start request for the first microservice instance is detected, the method further includes:

[0044] When a login request for the target application is detected, the login identifier in the login request is obtained through the main function module;

[0045] when receiving a message that the server successfully authenticates the login ID, log in to the target application;

[0046] receiving the authority identifier from the server through the main function module, the authority identifier being a authority identifier pre-configured by the server according to the login identifier.

[0047] Wherein, different target applications correspond to different servers, and the permission identifier is assigned by the server, that is, the server obtains the permission identifier according to the user name when logging in the user name and password, that is, one account corresponds to one permission identifier value .

[0048] Wherein, the main function module stores the authority identifier when receiving the authority identifier.

[0049] It can be seen that, in this example, when logging in the target application, the electronic device can obtain the permission identifier unique to the logon identifier from the server, and store the permission identifier, which is beneficial to enhancing the permission of other microservices when using the permission identifier Logo convenience.

[0050] In a possible example, after the start request for the first microservice instance is detected, the method further includes:

[0051] calling the first sub-function module corresponding to the first microservice instance through the main function module; [0052] An interceptor and a fuse are preloaded through the first sub-function module, the interceptor is used by the first sub-function module to obtain the permission identifier, and the fuse is used to enable the third sub-function module to obtain The permission identifier, the second microservice instance corresponding to the third sub-function module is independent of the first microservice instance

[0053] Wherein, the interceptor is used to intercept before a method or field is accessed, and then add certain operations before or after, here, the first sub-function module preloads the interceptor, so that the interceptor is in the first sub The function obtains the permission identifier before executing the corresponding first microservice instance.

[0054] Wherein, the fuse is a rewriting fuse, and the method is implemented by configuring a processing class to implement the interface to rewrite its method, and the authority identifier is passed to the third sub-function.

[0055] wherein the second microservice instance corresponding to the third sub-function module is independent of the first microservice instance, that is, the second microservice instance and the first microservice instance are two independent and unrelated microservices It can be understood that the thread executing the second microservice instance and the thread executing the first microservice instance are not the same thread.

[0056] It can be seen that, in this example, after the electronic device calls the first sub-function module through the main function, the first sub-function module will pre-load the interceptor and fuse instead of using the interceptor and fuse. Carrying out loading is beneficial to improving the timeliness of authorization verification.

[0057] In a possible example, after executing the first microservice instance through the first sub-function module, the method further includes:

[0058] when a start request for the third microservice instance is detected, determine a first relationship between the third microservice instance and the first microservice instance;

[0059] calling the first sub-function module to send the permission identifier to the fourth sub-function module corresponding to the third microservice instance according to the first relationship;

[0060] obtaining the permission identifier through the fourth sub-function module, and verifying whether the permission identifier is valid by calling the second sub-function module;

[0061] When it is detected that the authority identifier is valid, execute the third microservice instance through the fourth sub-function module.

[0062] wherein, the first relationship includes a mutually independent relationship and a subordinate relationship, and the subordinate relationship, that is, two microservice instances belong to microservice instances performed by the same thread.

[0063] Wherein, the first sub-function module will send the fourth sub-function through different methods according to different first relationships The module sends the permission identifier, and the method is preset in the first sub-function module.

[0064] It can be seen that in this example, when the electronic device executes the first microservice instance and detects a start request of another microservice instance, it sends a permission identifier according to the correspondence between the microservice instance and the first microservice instance It is beneficial to ensure that any microservice instance can obtain a permission identifier, and the security of permission verification is improved.

[0065] In this possible example, the first relationship is that the third microservice instance is subordinate to the first microservice instance, and the invoking the first sub-function module according to the first relationship will The permission identifier sent to the fourth sub-function module corresponding to the third microservice instance includes:

[0066] When the first relationship is a subordinate relationship, call the first sub-function module to inject the permission identifier to the F client in the main function module;

[0067] sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the F client.

[0068] Among them, the F client, that is, Feign, is a declarative web service client, which is more convenient than writing a web service client, use Feign to create an interface, and only need to use the annotation method to configure and define, then Completing the interface binding to the service provider simplifies the development of self-packaged service call clients.

[0069] Wherein, the first sub-function module may send the permission identifier to the fourth sub-function module through the interface created by the F client.

[0070] where the permission identifier is sent to the fourth sub-function module corresponding to the third microservice instance through the F client, which may be that the permission identifier is set to the header of the http request, which is the fourth The sub-function module provides the basis for permission verification.

[0071] It can be seen that, in this example, when the first relationship is a subordinate relationship, the electronic device can directly send the permission identifier to the fourth sub-function module through the F client, and the F client is an annotation, which is beneficial to reduce the third The code of the microservice instance is too verbose to avoid code intrusion into the third microservice instance.

[0072] In a possible example, the first relationship is that the third microservice instance is independent of the first microservice instance, the calling the first sub-function module according to the first relationship will The permission identifier sent to the fourth sub-function module corresponding to the third microservice instance includes:

[0073] When the first relationship is an independent relationship, the preset policy of calling the first sub-function module through the fuse Slightly pass the permission identifier to the fourth sub-function module corresponding to the third microservice instance, so that the fourth sub-function module injects the permission identifier to the F client to implement the F client Start multiple microservice instances subordinate to the third microservice instance.

[0074] The specific implementation of the first sub-function module passing the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the preset policy of the fuse may be to create a An interface, through which an authority identifier is transferred to the fourth sub-function module, where the preset strategy may be an isolation strategy for rewriting the fuse.

[0075] Wherein, when it is necessary to start the first microservice instance and the third microservice instance in an independent relationship at the same time, the permission identification transfer between two microservice instances with different threads can be achieved by rewriting the isolation policy of the fuse .

[0076] It can be seen that in this example, when the electronic device needs to start a third microservice instance that does not belong to the same thread as the first microservice instance during the execution of the first microservice instance, it is achieved by rewriting the isolation policy of the fuse The fourth sub-function module obtains the permission identifier, which is beneficial to improve the permission verification and startup reliability of each microservice instance.

[0077] In a possible example, the calling the first sub-function module among the plurality of sub-function modules corresponding to the first microservice instance through the main function module to obtain the permission identifier includes:

[0078] calling the first sub-function module among the plurality of sub-function modules corresponding to the first microservice instance through the main function module to obtain a request header for the start request of the first microservice instance;

[0079] determining the authority identifier in the request header.

[0080] Wherein, the request header is an http request header.

[0081] It can be seen that in this example, when the electronic device needs to start the first microservice instance, the first subfunction only needs to obtain the request header of the start request to obtain the permission identifier, which is beneficial to improve the microservice architecture. A microservice permission verification can be realized and convenient.

[0082] For the embodiment shown in FIG. 2 above, a specific embodiment will be described as an example, where the target application is application A, and application A includes microservice instance 1, microservice instance 2, and permission verification micro Service, microservice instance 1 includes sub-instance 3, microservice instance 2 includes sub-instance 4, when the user logs in to the application A and enters an account and password, the server also assigns the corresponding account during the process of determining whether to log in successfully through the account and password Authorization flag, when a start request for microservice instance 1 is detected, the micro The first subfunction corresponding to the service instance 1 obtains the permission identifier through the request header, and preloads the interceptor and the fuse, and verifies the micro service by calling the permission verification. When the permission identifier is valid, the micro service instance 1 is executed, and the micro service instance is executed. At 1 o'clock, it is divided into two cases. Case 1: When the start request of sub-instance 3 is detected, the authority identifier is injected into the F client in the main function module by calling the first sub-function module, and the F client The end sends the permission identifier to the sub-function module corresponding to sub-instance 3, so that the sub-function module corresponding to sub-instance 3 can call the permission verification microservice to verify the permission identifier and then execute sub-instance 3; Case 2: A microservice instance is detected In the start request of 2, the permission identifier is injected into the F client in the sub-function module corresponding to the microservice instance 2 by rewriting the isolation policy of the fuse, and sent to the sub-function module corresponding to the sub-instance 3 through the F client The permission identifier enables the sub-function module corresponding to the microservice instance 2 to call the permission verification microservice to verify the permission identifier and then execute the microservice instance 2, and the process of executing the microservice instance 2 can also be divided into the above two This situation will not be repeated here.

[0083] Consistent with the embodiment shown in FIG. 2 above, please refer to FIG. 3, FIG. 3 is a schematic flowchart of a permission verification method provided by an embodiment of the present application, which is applied to an electronic device, and the electronic device is installed with A target application program, the target application program includes a main function module and a plurality of sub-function modules. As shown in the figure, the permission verification method includes:

[0084] S301: When detecting a login request for a target application, the electronic device obtains the login identifier in the login request through the main function module.

[0085] S302, the electronic device logs in to the target application when receiving a message that the server successfully authenticates the logon identifier.

[0086] S303. The electronic device receives a permission identifier from the server through the main function module, where the permission identifier is a permission identifier preconfigured by the server according to the login identifier.

[0087] S304, when detecting an activation request for the first microservice instance, the electronic device calls the first of the plurality of sub-function modules corresponding to the first microservice instance through the main function module The sub-function module obtains the permission identifier.

[0088] S305, the electronic device calls a second sub-function module corresponding to a permission verification function through the first sub-function module, and verifies whether the permission identifier is valid according to the second sub-function module.

[0089] S306: When detecting that the authority identifier is valid, the electronic device executes the first microservice instance through the first sub-function module. [0090] S307, when detecting an activation request for a third microservice instance, the electronic device determines a first relationship between the third microservice instance and the first microservice instance.

[0091] S308: When the first relationship is a subordinate relationship, the electronic device calls the first sub-function module to inject the permission identifier to the F client in the main function module.

[0092] S309: The electronic device sends the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the F client.

[0093] S310: The electronic device obtains the permission identifier through the fourth sub-function module, and verifies whether the permission identifier is valid by calling the second sub-function module.

[0094] S311, when detecting that the authority identifier is valid, the electronic device executes the third microservice instance through the fourth sub-function module.

[0095] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the permission identifier according to the second sub-function module Whether it is valid, and finally, when it is detected that the authority identifier is valid, executing the first microservice instance through the first sub-function module. It can be seen that under the microservices architecture, the electronic device does not need to add permission verification code in each microservice sub-function module, and only intercepts the permission identifier when verification is required to verify the sub-module calling the permission verification function, which can save each The code for microservice application permission verification is helpful to reduce the verbosity of each microservice application code and improve the convenience of permission verification in the microservice mode.

[0096] In addition, when logging in the target application program, the electronic device may obtain a permission identifier unique to the logon identifier from the server, and store the permission identifier, which is beneficial to improve the convenience of obtaining the permission identifier when other microservices use the permission identifier .

[0097] In addition, when the first microservice instance is executed and the electronic device detects a start request of another microservice instance, it sends a permission identifier according to the corresponding relationship between the microservice instance and the first microservice instance, which is beneficial to guarantee Any microservice instance can obtain the permission identification, which improves the security of permission verification, and when the first relationship is a subordinate relationship, the electronic device can directly send the permission identification to the fourth sub-function module through the F client, and the F client As a comment, it is helpful to reduce the code complexity of the third microservice instance To avoid code intrusion into the third microservice instance.

[0098]

[0099] Consistent with the embodiment shown in FIG. 2 above, please refer to FIG. 4, FIG. 4 is a schematic flow chart of a method for authorization verification provided by an embodiment of the present application, which is applied to an electronic device, and the electronic device is installed with A target application program, the target application program includes a main function module and a plurality of sub-function modules. As shown in the figure, the permission verification method includes:

[0100] S401, when detecting an activation request for a first microservice instance, the electronic device calls the first subfunction of the plurality of subfunction modules corresponding to the first microservice instance through the main function module Module

[0101] S402, the electronic device preloads an interceptor and a fuse through the first sub-function module, the interceptor is used by the first sub-function module to obtain a permission identifier, and the fuse is used to enable a third sub-function The function module obtains the permission identifier, and the second microservice instance corresponding to the third sub-function module is independent of the first microservice instance.

[0102] S403: The electronic device calls the first sub-function module to obtain a request header of a start request for the first micro service instance through the interceptor.

[0103] S404, the electronic device determines the authority identifier in the request header.

[0104] S405: The electronic device calls a second sub-function module corresponding to a permission verification function through the first sub-function module, and verifies whether the permission identifier is valid according to the second sub-function module.

[0105] S406: When detecting that the authority identifier is valid, the electronic device executes the first microservice instance through the first sub-function module.

[0106] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the permission identifier according to the second sub-function module Whether it is valid, and finally, when it is detected that the authority identifier is valid, executing the first microservice instance through the first sub-function module. It can be seen that, under the microservice architecture, the electronic device does not need to add permission verification code in the subfunction module of each microservice, and only intercepts the permission ID when verification is required to verify the submodule calling the permission verification function, which can save each Microservice application permission verification The code helps to reduce the verbosity of each microservice application code and improve the convenience of permission verification in the microservice mode.

[0107] In addition, after the electronic device calls the first sub-function module through the main function, the first sub-function module will pre-load the interceptor and the fuse instead of loading it after the interceptor and the fuse need to be used. Conducive to improving the timeliness of authorization verification.

[0108] In addition, when the electronic device needs to start the first microservice instance, the first subfunction only needs to obtain the request header of the start request to obtain the permission identifier, which is beneficial to enhance the permissions of each microservice under the microservice architecture Verification can realize the note and convenience.

[0109] Consistent with the embodiments shown in FIG. 2, FIG. 3, and FIG. 4, please refer to FIG. 5, FIG. 5 is a schematic structural diagram of an electronic device 500 provided by an embodiment of the present application. A target application program is installed. The target application program includes a main function module and a plurality of sub-function modules. As shown in FIG. 5, the electronic device 500 includes an application processor 510, a memory 520, a communication interface 530, and one or more programs 5 21, wherein the one or more programs 521 are stored in the above-mentioned memory 520, and are configured to be executed by the above-mentioned application processor 510, and the one or more programs 521 include instructions for performing the following steps:

[0110] When a start request for the first microservice instance is detected, the main function module calls the first subfunction module among the plurality of subfunction modules corresponding to the first microservice instance to obtain the permission identifier ;

[0111] calling the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifying whether the permission identifier is valid according to the second sub-function module;

[0112] When it is detected that the authority identifier is valid, execute the first microservice instance through the first sub-function module.

[0113] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the permission identifier according to the second sub-function module Whether it is valid, and finally, when it is detected that the authority identifier is valid, executing the first microservice instance through the first sub-function module. It can be seen that, under the microservice architecture, the electronic device does not need to add permission verification code in each microservice sub-function module, and only intercepts the permission label when verification is required. Recognizing the submodules that call the permission verification function can eliminate the code for permission verification of each microservice application, which is helpful to reduce the complexity of each microservice application code and improve the convenience of permission verification in the microservice mode.

[0114] In a possible example, the one or more programs 521 further include instructions for performing the following steps: before the start request for the first microservice instance is detected, when the target application is detected During the login request, obtain the login ID in the login request through the main function module; and when receiving a message that the server successfully authenticates the login ID, log in to the target application; and through the main function The module receives the authority identifier from the server, where the authority identifier is a authority identifier preconfigured by the server according to the login identifier.

[0115] In a possible example, the one or more programs 521 further include instructions for performing the following steps: after the start request for the first microservice instance is detected, called by the main function module A first sub-function module corresponding to the first microservice instance; and pre-loading an interceptor and a fuse through the first sub-function module, the interceptor is used by the first sub-function module to obtain the permission identifier, The fuse is used to enable a third sub-function module to obtain the permission identifier, and the second microservice instance corresponding to the third sub-function module is independent of the first microservice instance.

[0116] In a possible example, the one or more programs 521 further include instructions for performing the following steps: after executing the first microservice instance through the first sub-function module, when detecting When a start request is made for the third microservice instance, determine the first relationship between the third microservice instance and the first microservice instance; and call the first sub-function module to change the location according to the first relationship Sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance; and obtaining the permission identifier through the fourth sub-function module, and verifying the permission identifier by calling the second sub-function module Whether it is valid; and when it is detected that the authority identifier is valid, executing the third microservice instance through the fourth sub-function module.

[0117] In this possible example, the first relationship is that the third microservice instance is subordinate to the first microservice instance, and the calling the first sub-function module according to the first relationship In terms of sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance, the instructions in the one or more programs 521 are specifically used to perform the following operations: When the first relationship is a slave During the relationship, invoking the first sub-function module to inject the permission identifier to the F client in the main function module; Sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the F client.

[0118] In a possible example, the first relationship is that the third microservice instance is independent of the first microservice instance, and the calling the first sub-function module according to the first relationship In terms of sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance, the instructions in the one or more programs 521 are specifically used to perform the following operations: When the first relationship is independent In the relationship, the first sub-function module is called to send the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the preset policy of the fuse, so that the fourth sub-function module passes the F The manner in which the client injects the permission identifier enables the F client to start multiple microservice instances subordinate to the third microservice instance.

[0119] In a possible example, in terms of acquiring the permission identifier by the first sub-function module among the plurality of sub-function modules corresponding to the first microservice instance called by the main function module, the The instructions in one or more programs 521 are specifically used to perform the following operations: call the first sub-function module among the plurality of sub-function modules corresponding to the first microservice instance through the main function module to obtain the A request header for initiating the request of the first microservice instance; and the permission identifier used for determining the request header.

[0120] The above describes the solutions of the embodiments of the present application mainly from the perspective of the execution process on the method side. It can be understood that, in order to realize the above-mentioned functions, the electronic device includes a hardware structure and/or a software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of the examples described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed by hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0121] The embodiments of the present application may divide the functional unit of the electronic device according to the above method example, for example, each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit. The above integrated unit may be implemented in the form of hardware or a software functional unit. It should be noted that the division of units in the embodiments of the present application is a schematic Sexually, it is only a division of logical functions, and there may be other divisions in actual implementation.

[0122] FIG. 6 is a block diagram of the functional units of the authority verification device 600 involved in the embodiment of the present application. The permission verification device 600 is applied to an electronic device, and a target application program is installed on the electronic device, the target application program includes a main function module and a plurality of sub-function modules, and the permission verification device 600 includes an acquisition unit 601, a verification unit 602, and Execution unit 603, where:

[0123] The acquiring unit 601 is configured to call the plurality of sub-function modules corresponding to the first microservice instance through the main function module when a start request for the first microservice instance is detected The first sub-function module obtains the permission identifier;

[0124] The verification unit 602 is configured to call a second sub-function module corresponding to a permission verification function through the first sub-function module, and verify whether the permission identifier is valid according to the second sub-function module;

[0125] The execution unit 603 is configured to execute the first microservice instance through the first sub-function module when it is detected that the authority identifier is valid.

[0126] It can be seen that in the embodiment of the present application, when the electronic device first detects a start request for the first microservice instance, the main function module invokes a plurality of the corresponding ones of the first microservice instance The first sub-function module in the sub-function module obtains the permission identifier, and then, calls the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifies the permission identifier according to the second sub-function module Whether it is valid, and finally, when it is detected that the authority identifier is valid, executing the first microservice instance through the first sub-function module. It can be seen that, under the microservice architecture, the electronic device does not need to add permission verification code in the subfunction module of each microservice, and only intercepts the permission ID when verification is required to verify the submodule calling the permission verification function, which can save each The code for microservice application permission verification is helpful to reduce the verbosity of each microservice application code and improve the convenience of permission verification in the microservice mode.

[0127] In a possible example, before the detecting the start request for the first microservice instance, the acquiring unit 601 is further configured to: when a login request for the target application is detected, pass the The main function module obtains the login identifier in the login request;

[0128] The execution unit 603 is further configured to: when receiving a message that the server successfully authenticates the login identifier, log in to the target application; and receive the authority from the server through the main function module ID, the permission ID is a permission ID pre-configured by the server according to the login ID [0129] In a possible example, after the detection of the start request for the first microservice instance is performed, the execution unit 603 is further configured to: call the first microservice instance corresponding to the main function module A first sub-function module; and pre-loading an interceptor and a fuse through the first sub-function module, the interceptor is used by the first sub-function module to obtain the permission identifier, and the fuse is used to enable the third The sub-function module obtains the permission identifier, and the second microservice instance corresponding to the third sub-function module is independent of the first microservice instance.

[0130] In a possible example, after the execution of the first microservice instance by the first sub-function module, the execution unit 603 is further used to: When initiating a request, determine a first relationship between the third microservice instance and the first microservice instance; and call the first sub-function module to send the permission identifier to the first according to the first relationship The fourth sub-function module corresponding to the three microservice instances;

[0131] The obtaining unit 601 is further configured to: obtain the permission identifier through the fourth sub-function module;

[0132] The verification unit 602 is further configured to: verify whether the authority identifier is valid by calling the second sub-function module;

[0133] The execution unit 603 is further configured to: when it is detected that the authority identifier is valid, execute the third microservice instance through the fourth sub-function module.

[0134] In this possible example, the first relationship is that the third microservice instance is subordinate to the first microservice instance, and the calling the first sub-function module according to the first relationship In terms of sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance, the execution unit 603 is specifically configured to: when the first relationship is a subordinate relationship, call the first sub-function The module injects the permission identifier to the _F client in the main function module; and is used to send the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the F client.

[0135] In a possible example, the first relationship is that the third microservice instance is independent of the first microservice instance, and the calling the first sub-function module according to the first relationship In terms of sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance, the execution unit 603 is specifically configured to: when the first relationship is an independent relationship, call the first sub-function The module sends the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the preset strategy of the fuse, so that The fourth sub-function module injects the permission identifier to the F client to enable the F client to start multiple microservice instances subordinate to the third microservice instance.

[0136] In a possible example, in terms of acquiring the permission identifier by the first sub-function module among the plurality of sub-function modules corresponding to the first microservice instance invoked by the main function module, the The obtaining unit 601 is specifically configured to: use the main function module to call a first sub-function module among the plurality of sub-function modules corresponding to the first micro-service instance to obtain a start request for the first micro-service instance A request header; and a permission identifier used to determine the request header.

[0137] Wherein, the acquisition unit 601 and the execution unit 603 may be a processor, a communication interface or a transceiver, and the verification unit 602 may be a processor.

[0138]

[0139] Embodiments of the present application also provide a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program causes the computer to perform part of any method described in the foregoing method embodiments Or all steps, the computer includes electronic equipment.

[0140] Embodiments of the present application also provide a computer program product, where the computer program product includes a non-transitory computer-readable storage medium that stores the computer program, and the computer program is operable to cause the computer to perform as described in the foregoing method embodiments Part or all of the steps of any method. The computer program product may be a software installation package, and the computer includes electronic equipment.

[0141] It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that this application is not affected by the described action sequence Because of this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the involved actions and modules are not necessarily required by this application.

[0142] In the above embodiments, the description of each embodiment has its own emphasis. For a part that is not detailed in an embodiment, you can refer to related descriptions in other embodiments.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed device may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above-mentioned units is only a division of logical functions. In actual implementation, there may be other division modes, for example, multiple units or components may be combined or integrated To another system, or some features can be ignored, or Not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, and the indirect coupling or communication connection of the device or unit may be in electrical or other forms.

[0144] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units on. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0145] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware, or in the form of a software functional unit.

[0146] If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer readable memory. Based on such an understanding, the technical solution of the present application may essentially be a part that contributes to the existing technology or all or part of the technical solution may be embodied in the form of a software product, and the computer software product is stored in a memory, Several instructions are included to enable a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the above methods in various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only

Memory), Random Access Memory (RAM, Random Access Memory), removable hard drives, magnetic disks, or optical disks and other media that can store program codes.

[0147] Those of ordinary skill in the art may understand that all or part of the steps in the various methods of the foregoing embodiments may be completed by instructing relevant hardware through a program, and the program may be stored in a computer-readable memory, and the memory may include : Flash disk, Read-Only Memory (English: Read-Only Memory, abbreviation: ROM), Random Access Device (English: Random Access Memory, abbreviation: RAM), magnetic disk or optical disk, etc.

[0148] The embodiments of the present application are described in detail above, and specific examples are used herein to explain the principles and implementation manners of the present application. The descriptions of the above embodiments are only used to help understand the method and the core idea of the present application; At the same time, for ordinary technicians in this field, according to the ideas of this application, in specific There will be changes in the implementation mode and the scope of application. In summary, the content of this specification should not be construed as limiting the application.

Claims

[Claim 1] A permission verification method, which is applied to an electronic device, a target application program is installed on the electronic device, the target application program includes a main function module and a plurality of sub-function modules, and the method includes :

When a start request for the first microservice instance is detected, the main function module calls the first subfunction module among the plurality of subfunction modules corresponding to the first microservice instance to obtain the permission identifier;

Calling the second sub-function module corresponding to the permission verification function through the first sub-function module, and verifying whether the permission identifier is valid according to the second sub-function module;

When it is detected that the authority identifier is valid, the first micro service instance is executed through the first sub-function module.

[Claim 2] The method according to claim 1, characterized in that before the start request for the first microservice instance is detected, the method further comprises:

When a login request for the target application is detected, the login identifier in the login request is obtained through the main function module;

When receiving a message that the server successfully authenticates the login ID, log in to the target application;

Receiving the authority identifier from the server through the main function module, where the authority identifier is a authority identifier pre-configured by the server according to the login identifier.

[Claim 3] The method according to claim: 1 or 2, characterized in that after the start request for the first microservice instance is detected, the method further comprises:

Calling the first sub-function module corresponding to the first microservice instance through the main function module, pre-loading the interceptor and the fuse through the first sub-function module, the interceptor is used for obtaining by the first sub-function module The permission identifier, the fuse is used to enable a third sub-function module to obtain the permission identifier, and the second microservice instance corresponding to the third subfunction module is independent of the first microservice instance.

[Claim 4] The method according to claim 1, characterized in that the passing of the first sub-function After the module executes the first microservice instance, the method further includes: when a start request for the third microservice instance is detected, determine the first of the third microservice instance and the first microservice instance relationship;

Calling the first sub-function module to send the permission identifier to the fourth sub-function module corresponding to the third microservice instance according to the first relationship;

Acquiring the permission identifier through the fourth sub-function module, and verifying whether the permission identifier is valid by calling the second sub-function module;

When it is detected that the authority identifier is valid, the third micro service instance is executed through the fourth sub-function module.

[Claim 5] The method of claim 4, wherein the first relationship is that the third microservice instance is subordinate to the first microservice instance, and the calling the first subfunction The module sends the permission identifier to the fourth sub-function module corresponding to the third microservice instance according to the first relationship, including:

When the first relationship is a subordinate relationship, invoking the first sub-function module to inject the permission identifier to the _F client in the main function module;

Sending the permission identifier to the fourth sub-function module corresponding to the third microservice instance through the F client.

[Claim 6] The method of claim 4, wherein the first relationship is that the third microservice instance is independent of the first microservice instance, and the calling the first subfunction The module sends the permission identifier to the fourth sub-function module corresponding to the third microservice instance according to the first relationship, including:

When the first relationship is an independent relationship, the first sub-function module is called to send the permission identifier to the fourth sub-function module corresponding to the third microservice instance through a preset policy of a fuse, so that the The fourth sub-function module injects the permission identifier to the F client to enable the F client to start multiple microservice instances subordinate to the third microservice instance.

[Claim 7] The method according to claim 1, wherein the calling of the first sub-function among the plurality of sub-function modules corresponding to the first microservice instance by the main function module The module obtains the permission identification, including:

Acquiring, by the main function module, a first sub-function module among the plurality of sub-function modules corresponding to the first micro-service instance, a request header for a start request of the first micro-service instance;

Determine the authority identifier in the request header.

[Claim 8] A permission verification device, characterized in that it is applied to an electronic device, a target application program is installed on the electronic device, the target application program includes a main function module and a plurality of sub-function modules, and the permission verification The device includes an acquisition unit, a verification unit and an execution unit, wherein,

The acquiring unit is configured to call the first sub-function of the plurality of sub-function modules corresponding to the first micro-service instance through the main function module when a start request for the first micro-service instance is detected The module obtains the permission identification;

The verification unit is configured to call the second sub-function module corresponding to the permission verification function through the first sub-function module, and verify whether the permission identifier is valid according to the second sub-function module;

The execution unit is configured to execute the first microservice instance through the first sub-function module when it is detected that the authority identifier is valid.

[Claim 9] An electronic device, comprising a processor, a memory, a communication interface, and one or more programs, the one or more programs are stored in the memory, and are configured by all The processor executes, and the program includes instructions for performing the steps in the method according to any one of claims 1-7.

[Claim 10] A computer-readable storage medium, characterized by storing a computer program for electronic data exchange, wherein the computer program causes a computer to execute the method according to any one of claims 1-7.