WO2020233361A1

WO2020233361A1 - Internal service invoking method and apparatus based on gateway, and terminal device

Info

Publication number: WO2020233361A1
Application number: PCT/CN2020/087383
Authority: WO
Inventors: 李晨光
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-05-21
Filing date: 2020-04-28
Publication date: 2020-11-26
Also published as: CN110266764B; CN110266764A

Abstract

The present application is applicable to the technical field of massive data processing, and provides an internal service invoking method and apparatus based on a gateway, and a terminal device and a computer-readable storage medium. The method comprises: setting an invoking object invoked by an invoking party as a gateway layer address; storing exposure information of all internal services in a gateway layer; checking, according to all pieces of exposure information, an invoking request received by the gateway layer, and after the checking is passed, determining a corresponding internal service as a target service, and configuring the invoking request according to a platform forwarding rule to obtain a request to be forwarded; if there is token information, corresponding to the request to be forwarded, in a cache, splicing the token information with the request to be forwarded, and sending a spliced request to be forwarded to an internal network platform; and authenticating the token information, and after the authentication is passed, forwarding the request to be forwarded to the target service. According to the present application, by means of configuring the gateway layer, manual operation is reduced, and the efficiency of invoking the internal service is improved.

Description

Gateway-based internal service calling method, device and terminal equipment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on May 21, 2019, the application number is 201910422745.X, and the invention title is "gateway-based internal service invocation method, device and terminal equipment", and its entire content Incorporated in this application by reference.

Technical field

This application belongs to the technical field of massive data processing, and particularly relates to a gateway-based internal service invocation method, device, terminal device, and computer-readable storage medium.

Background technique

With the rapid development of computer technology and communication technology, in response to the data confidentiality requirements of current units or government departments, network isolation solutions are usually applied in the network architecture of the unit or government department, making different sub-units (internal network areas) ) Are isolated from each other to ensure that users cannot disclose secrets privately. However, there are usually certain communication requirements between different internal network areas. For example, internal network A needs to obtain statistical data from internal network B for program development. Therefore, based on the applied network isolation scheme, it is usually built An intranet platform for data exchange.

If an internal network wants to access the internal services provided by another internal network, it must pass the authentication and forwarding of the internal network platform. In the prior art, considering the security of access, the internal network platform often has special format requirements. , And when the intranet platform receives the request, it will allocate a token to the request to verify whether the request has the authority to access internal services. Based on the access characteristics of the intranet platform, the caller of the internal service must manually configure the request according to the format requirements, and then wait for the intranet platform to allocate a token for the request before successfully accessing the internal service. The inventor found that the existing process of invoking internal services is cumbersome, has a long operation time, and has low invocation efficiency.

technical problem

In view of this, the embodiments of the present application provide a gateway-based method, device, terminal device, and computer-readable storage medium for invoking internal services to solve the cumbersome process of invoking internal services in the prior art, complicated manual operations, and low invocation efficiency. The problem.

Technical solutions

The first aspect of the embodiments of the present application provides a gateway-based internal service invocation method, including:

Setting the calling object called by the caller as a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

Determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, where the exposure information includes the address of the internal service;

If a call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined as the target service after the verification is passed, And configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

Judging whether there is token information corresponding to the request to be forwarded in the cache;

If the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced request to be forwarded The forwarding request is sent to the intranet platform;

The token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.

The second aspect of the embodiments of the present application provides a gateway-based internal service invocation device, including:

The setting unit is configured to set the calling object called by the caller to a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

The storage unit is configured to determine all internal services that have been exposed to services on the intranet platform, and store the exposure information of all the internal services in the gateway layer, and the exposure information includes the address of the internal service;

The configuration unit is configured to, if a call request is received in the gateway layer, verify the call request according to all the exposure information, and after the verification is passed, the internal service requested by the call request Determine it as a target service, configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

A judging unit, configured to judge whether there is token information corresponding to the request to be forwarded in the cache;

The splicing unit is configured to, if the token information corresponding to the request to be forwarded exists in the cache, splicing the token information with the request to be forwarded in the gateway layer, and splicing The subsequent request to be forwarded is sent to the intranet platform;

The forwarding unit is configured to authenticate the token information in the spliced request to be forwarded, and after the authentication is passed, forward the request to be forwarded to the target service.

A third aspect of the embodiments of the present application provides a terminal device. The terminal device includes a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor executes all When the computer program is described, the following steps are implemented:

The fourth aspect of the embodiments of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

Beneficial effect

Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

In the embodiment of the present invention, the calling object is set to the gateway layer address, and the exposure information of all internal services is stored in the gateway layer. If the calling request is received in the gateway layer, the calling request is verified according to all the exposure information, and the After the verification is passed, configure the format of the transfer request to obtain the request to be forwarded, and then find the token information corresponding to the request to be forwarded in the cache, splice the token information with the request to be forwarded, and finally combine the spliced request to be forwarded Send to the intranet platform. If the authentication of the spliced request to be forwarded is passed, the request to be forwarded is forwarded to the target service. The embodiment of the present invention configures the gateway layer, thereby realizing the automatic format configuration of the call request and reducing Manual operation simplifies the process of allocating tokens and improves the efficiency of calling internal services.

Description of the drawings

FIG. 1 is an implementation flowchart of a gateway-based internal service invocation method provided by Embodiment 1 of the present application;

FIG. 2 is an implementation flowchart of a gateway-based internal service invocation method provided by Embodiment 2 of the present application;

FIG. 3 is an implementation flowchart of a gateway-based internal service invocation method provided by Embodiment 3 of the present application;

4 is an implementation flowchart of a gateway-based internal service invocation method provided by Embodiment 4 of the present application;

FIG. 5 is a structural block diagram of a gateway-based internal service invoking device provided by Embodiment 5 of the present application;

FIG. 6 is a schematic diagram of a terminal device provided in Embodiment 6 of the present application.

Embodiments of the invention

In order to illustrate the technical solutions described in the present application, specific embodiments are used for description below.

Figure 1 shows the implementation process of the gateway-based internal service invocation method provided by the embodiment of the present application, which is detailed as follows:

In S101, the calling object called by the caller is set as a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is a preset gateway layer address.

Today’s enterprises and institutions often have confidentiality requirements. For example, data isolation must be ensured between the development department and the business department to ensure that the data of the development department is not leaked. In order to achieve the above purpose, the network isolation solution is usually applied in the organization, such as The machines of the development department are divided into one internal network, the machines of the business department are divided into another internal network, and different internal networks are set up to isolate each other. Specifically, firewalls or hardware isolation can be used to achieve isolation. On this basis, because there may be communication requirements between different internal networks, for example, the development department needs to obtain business department data as background data for application development, so an intranet platform is usually set up to implement different internal networks Communication between. The embodiment of this application is aimed at the above scenario. A gateway layer is set between the internal network and the internal network platform. The gateway layer refers to an intermediate module that packages requests and forwards requests according to specific routing rules. The specific architecture of the intranet platform and gateway layer is not limited, as long as the intranet platform and gateway layer that can implement the corresponding functions can be applied in the embodiments of the present application

Compared with the traditional method, the manually configured call request is directly sent to the intranet platform, which is forwarded by the intranet platform. In the embodiment of this application, the call object called by the caller is set to the preset gateway layer address , So that the call request initiated by the caller can be sent to the gateway layer, where the caller refers to the subject that initiates the call from an internal network, and the caller is an abstract name, which can be a certain piece of code in a machine located in the internal network Or a certain file, etc., the gateway layer address is the Internet protocol address of the set gateway layer, which can be customized in advance.

In S102, determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, and the exposure information includes the address of the internal service.

Internal networks often provide external services (in order to distinguish the services provided by the internal network as internal services), such as data acquisition services or data modification services, and for internal services, they must be performed on the internal network platform Service exposure can enable the intranet platform to display and call the internal service. Service exposure refers to uploading the exposure information of the internal service to the intranet platform for registration. Only after the internal service registration is successful, the intranet platform can call the internal service. Requests for internal services are forwarded. The embodiments of this application do not limit the service exposure requirements and the format of the exposed information, but the exposure information is limited to include at least the Internet Protocol address of the internal service. For example, in a practical application scenario, the exposed information also includes the port number and the name of the internal service. Wait. While setting up the gateway layer, determine all internal services that have been exposed on the internal network platform, and store the exposure information of all internal services in the gateway layer. In order to facilitate subsequent request forwarding, the exposure information can also be stored in the gateway layer Establish the mapping relationship between the gateway layer address and all exposed information.

In S103, if a call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined after the verification is passed. For the target service, the call request is configured according to the platform forwarding rule corresponding to the intranet platform, and the configured call request is determined as a request to be forwarded.

Compared with the traditional method of manually configuring the call request to meet the format requirements of the intranet platform and internal services, in this embodiment of the application, since the call object has been set to the gateway layer address, the caller directly configures the original The unconfigured call request is sent to the gateway layer, and the call request is configured in the gateway layer. Specifically, if a call request is received in the gateway layer, the call request is verified according to all the exposed information, and the internal service requested by the call request is determined as the target service after the verification is passed. The verification process can be It depends on the format of the exposure information and the call request. For example, when the call request carries the name of the internal service, the call request can be verified according to the name of the internal service in all the exposed information to determine whether the call request contains one of the exposed information. The name of the internal service.

Optionally, obtain the target address in the call request, and determine whether there is exposure information containing the target address; if there is exposure information containing the target address, it is determined that the call request verification is passed, and the internal service corresponding to the exposed information is determined The internal service requested for the call request; if there is no exposed information containing the target address, the call request is discarded and an error message is output. For the call request initiated by the caller, it usually contains the source address (usually the address of the caller) and the target address (the target address indicates the address of the internal service requested by the call request, and the aforementioned call object is only used to indicate the caller Initiating a call to the calling object has different meanings), so in this step, the target address in the call request can be obtained, and the acquisition location of the target address is related to the underlying protocol of the call request, which is not repeated in the embodiment of the application. For the obtained target address, compare it with the address of the internal service in all exposed information. If the target address is the same as the address of one of the internal services, it is determined that the call request is verified and the address of the internal service is The corresponding internal service is determined as the internal service requested by the call request; on the contrary, if the target address is different from the addresses of all internal services, the call request is discarded, and an error message is output to the caller, indicating that the caller does not exist and the call Request the corresponding internal service. Since the address is exclusive, that is, the addresses of different internal services are usually different, the accuracy of the verification based on the target address in the call request in the above method is relatively high.

After the call request is verified, the internal service requested by the call request is determined as the target service, and the call request is configured according to the platform forwarding rules preset in the intranet platform to ensure that the configured call request can be used by the intranet The platform was successfully identified. Among them, the platform forwarding rule is a common rule for all requests that can be recognized by the intranet platform. It is related to the characteristics of the intranet platform and can be set according to actual application scenarios. For example, the platform forwarding rule can be set to the field "ESG". That is, only the request whose name contains the field "ESG" can be successfully recognized by the intranet platform. In this step, the field "ESG" is added to the name of the call request to complete the configuration of the call request. The configuration process based on platform forwarding rules can be pre-stored in the gateway layer in code form, so as to realize the automatic configuration of the call request that passes the verification. In order to facilitate the distinction, the configured call request is determined as the request to be forwarded.

In S104, it is determined whether there is token information corresponding to the request to be forwarded in the cache.

Since the networks involved in the embodiments of this application are all internal networks and have relatively large operation rights, in this embodiment of the application, token authentication is performed on the request to be forwarded, specifically, the verification information in the request to be forwarded is extracted and viewed Whether there is token information corresponding to the verification information in the cache, the token information is used to indicate that the request to be forwarded has the right to call the target service. The type of verification information can be determined according to the actual application scenario. For example, the verification information can be The username and password in the request to be forwarded. It is worth mentioning that the cache stores the token information corresponding to the verification information of the request that has successfully accessed the target service. The token information is usually set with an expiration time (such as one hour), and a new token information is added to the cache. Later, if the storage time of the token information exceeds the expiration time, the token information is discarded. The embodiment of the application does not limit the generation of token information. For example, when the authentication information is a user name and password, the token can be generated based on the user name, password, and timestamp through MD5 encryption algorithm or other irreversible encryption algorithm information.

Optionally, it is determined whether there is token information corresponding to the request to be forwarded in the cached token information corresponding to the target service. Since the internal services provided by different internal networks may be different for users, the cached token information corresponding to different internal services may also be different. Therefore, in the embodiment of the present application, when the token information is stored in the cache, The internal service corresponding to the token information is also marked, and in this step, the token information corresponding to the target service in the cache is determined, and it is determined whether there is token information corresponding to the request to be forwarded. The accuracy of judgment.

In S105, if the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced The request to be forwarded is sent to the intranet platform.

If the token information corresponding to the request to be forwarded exists in the cache, it proves that the same request has been used to call the target service, and for the request that has already called the target service, the corresponding token information will also be stored in the database, then In order to simplify the call process, the token information is spliced with the request to be forwarded in the gateway layer, and the spliced call request is sent to the intranet platform, where the token information is spliced in the request header of the request to be forwarded. In addition, in order to successfully send the spliced request to be forwarded to the intranet platform, the mapping relationship from the gateway layer address to the address of the intranet platform is stored in the gateway layer in advance.

Optionally, if the service access rules corresponding to all internal services are also stored in the gateway layer, the service access rules are used to indicate the access format of the internal services, then the spliced request to be forwarded is configured according to the service access rules corresponding to the target service , Send the configured request to be forwarded to the intranet platform. In addition to making the call request comply with the call specifications of the intranet platform, since different internal services often have different access formats, in the embodiment of this application, while storing the exposure information of all internal services in the gateway layer, the The service access rules corresponding to each internal service are stored at the gateway layer. For the case where the gateway layer stores the service access rules corresponding to each internal service, after the token information is spliced with the request to be forwarded, the spliced request to be forwarded is configured according to the service access rule corresponding to the target service , And send the configured request to be forwarded to the intranet platform. The embodiments of this application do not limit the types of service access rules. For example, the target service can only recognize requests sent from a specific address, and the service access rules can be set to replace the source address in the spliced request to be forwarded with the above For example, the target service can only recognize requests using the Hypertext Transfer Protocol Secure (HTTPS) protocol, you can set the service access rule to encapsulate the spliced request to be forwarded according to the HTTPS protocol; for example, the target The service can only identify requests encrypted according to a specific key and a specific encryption algorithm, and the service access rule can be set to encrypt the spliced request to be forwarded according to the specific key and the specific encryption algorithm. The above method configures the request according to the pre-stored service access rule, so that the configured request conforms to the access specification of the target service, which improves the success rate of internal service invocation.

In S106, the token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.

For the spliced call request sent to the intranet platform, the verification information and token information therein are extracted for authentication, and it is specifically determined whether the verification information and token information are consistent with those in the database. If it is judged to be consistent, the authentication is passed, the request to be forwarded is forwarded to the target service, the target service is called according to the specific content of the request to be forwarded, and the entire internal service invocation process is completed; if it is inconsistent, it is the to be forwarded in the intranet platform Request to reallocate a token information.

It can be seen from the embodiment shown in Figure 1 that in the embodiment of this application, the calling object is set to the gateway layer address and the exposure information of all internal services is stored in the gateway layer. If the calling request is received in the gateway layer, then The call request is verified according to all the exposed information, and after the verification is passed, the transfer request is formatted to obtain the request to be forwarded, and then the token information corresponding to the request to be forwarded is found in the cache, and the token information is compared with the request to be forwarded. The forwarding request is spliced, and the spliced request to be forwarded is finally sent to the intranet platform. If the spliced request to be forwarded is authenticated, the forwarded request is forwarded to the target service. The embodiment of the application configures the gateway layer , Intercept the call request in the gateway layer, and automatically configure the call request, reducing manual configuration operations, and simplifying the process of assigning tokens in the follow-up, and improving the efficiency of calling internal services.

Figure 2 shows an internal service invocation method obtained by extending the process of judging whether the token information corresponding to the request to be forwarded exists in the cache based on the first embodiment of the present application. The embodiment of the present application provides an implementation flowchart of a gateway-based internal service invocation method. As shown in FIG. 2, the internal service invocation method may include the following steps:

In S201, if the token information corresponding to the request to be forwarded does not exist in the cache, the request to be forwarded is sent to the intranet platform in the gateway layer.

After the judgment is made, if the token information corresponding to the request to be forwarded does not exist in the cache, the forwarding request is not spliced in the gateway layer, but the request to be forwarded is directly sent to the intranet platform.

In S202, the token information is created and allocated for the request to be forwarded, and the allocated token information is spliced with the request to be forwarded.

For the pending forwarding request sent to the intranet platform, extract the verification information in the pending forwarding request, determine whether the verification information is valid, and after determining that the verification information is valid, generate token information based on the verification information, for example, when the verification information is In the case of the user name and password in the request to be forwarded, if it is determined that the user name is stored in the database, and the password matches the user name and is valid, based on the user name, the password and the timestamp, the MD5 encryption algorithm is used Or other irreversible encryption algorithms to generate token information. For the generated token information, it is spliced with the request to be forwarded.

It can be seen from the embodiment shown in FIG. 2 that in the embodiment of this application, if the token information corresponding to the request to be forwarded does not exist in the cache, the request to be forwarded is sent to the intranet platform in the gateway layer, which is the request to be forwarded Create token information, and splice the created token information with the request to be forwarded. The embodiment of the application creates new token information in the intranet platform, completes the token information distribution mechanism, and improves the service call Comprehensiveness.

Figure 3 shows an internal service invoking method obtained after refining the process of setting the calling object called by the caller to the preset gateway layer address on the basis of the first embodiment of the present application. The embodiment of the present application provides an implementation flowchart of a gateway-based internal service invocation method. As shown in FIG. 3, the internal service invocation method may include the following steps:

In S301, search in the bottom-level code of the caller according to the platform address, and determine each line of the bottom-level code that contains the platform address as the calling code, where the platform address is the intranet The address of the platform.

Since the caller directly initiates a call to the intranet platform in the traditional way, that is, the call object of the caller is the address of the intranet platform (for the sake of distinction, the address is named the platform address), so in this application embodiment The traditional method is improved, the caller's bottom code is searched according to the platform address, and each line of bottom code containing the platform address is determined as the calling code.

In S302, the platform address in all the calling codes is replaced with the gateway layer address.

For the found calling code, the platform address is the calling object of the calling code. Therefore, in this step, the platform address in all calling codes is replaced with the gateway layer address to complete the replacement of the calling object. After the replacement is completed, when the calling code is run, the calling request can be automatically sent to the gateway layer.

It can be seen from the embodiment shown in FIG. 3 that in the embodiment of the present application, the caller’s underlying code is searched according to the platform address, and each line of underlying code containing the platform address is determined as the calling code, and all the calling codes are The platform addresses of are replaced with gateway-layer addresses. The embodiment of the present application improves the convenience of setting call objects by performing batch replacement of platform addresses.

Figure 4 shows an internal service invoking method obtained by extending the process before configuring the invocation request according to the platform forwarding rules corresponding to the intranet platform on the basis of the first embodiment of the present application. The embodiment of the present application provides an implementation flowchart of a gateway-based internal service invocation method. As shown in FIG. 4, the internal service invocation method may include the following steps:

In S401, a permission address set corresponding to each internal service in the intranet platform is obtained, and the source address in the call request is obtained, wherein the permission address set includes at least one permission to access the The address of the internal service, where the source address is the address of the caller that initiated the call request.

In addition to storing the exposure information of each internal service in the gateway layer, in the embodiment of the present application, the authority address set corresponding to the internal service can also be stored together. The authority address set includes at least one authorized access to the internal service. The address and authority address set can be set by the internal service manager. At the same time, the source address in the call request is obtained to facilitate subsequent analysis. The source address is the address of the caller who initiated the call request.

In S402, if the source address is in the authority address set corresponding to the target service, the operation of configuring the call request according to the platform forwarding rule preset in the intranet platform is performed.

If the source address in the call request is located in the permission address set corresponding to the target service, it proves that the call request has the permission to access the target service, then continue to perform the subsequent operation of configuring the call request according to the platform forwarding rules preset in the intranet platform .

In S403, if the source address is not located in the authority address set corresponding to the target service, the call request is intercepted, and a prompt of unauthorized access is output to the caller who initiated the call request.

Conversely, if the source address in the call request is not located in the permission address set corresponding to the target service, under the premise that the call request will be rejected by the target service later, in order to avoid resource waste caused by processing the call request, The gateway layer intercepts the call request, and outputs a prompt of unauthorized access to the caller who initiated the call request. The prompt can be sent in a front-end prompt box, SMS, or email, which is not limited in the embodiment of the application.

It can be seen from the embodiment shown in FIG. 4 that in the embodiment of this application, it is determined whether the source address in the call request is located in the authority address set corresponding to the target service. If the source address is located in the authority address set, the subsequent steps according to the intranet platform will be executed normally. The platform forwarding rules preset in the platform configure the operation of the call request; if the source address is not located in the authority address set, the call request is intercepted, and the caller is notified that there is no right to access. The embodiment of this application has no right to access according to the call request Intercept the call request in time when accessing the target service, saving computing resources.

It should be understood that the size of the sequence number of each step in the foregoing embodiment does not mean the order of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiment of the present application.

Corresponding to the gateway-based internal service invocation method described in the above embodiment, FIG. 5 shows a structural block diagram of the gateway-based internal service invocation device provided in an embodiment of the present application. Referring to FIG. 5, the internal service invocation device includes:

The setting unit 51 is configured to set the calling object called by the caller to a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is a preset gateway layer address;

The storage unit 52 is configured to determine all internal services that have been exposed to services on the intranet platform, and store the exposure information of all the internal services in the gateway layer, and the exposure information includes the address of the internal service;

The configuration unit 53 is configured to, if a call request is received in the gateway layer, verify the call request according to all the exposure information, and after the verification is passed, the internal information requested by the call request The service is determined as the target service, and the invocation request is configured according to the platform forwarding rules corresponding to the intranet platform, and the configured invocation request is determined as the request to be forwarded;

The judging unit 54 is configured to judge whether there is token information corresponding to the request to be forwarded in the cache;

The splicing unit 55 is configured to splice the token information with the request to be forwarded in the gateway layer if the token information corresponding to the request to be forwarded exists in the cache, and Sending the spliced request to be forwarded to the intranet platform;

The forwarding unit 56 is configured to authenticate the token information in the spliced request to be forwarded, and after the authentication is passed, forward the request to be forwarded to the target service.

Optionally, the configuration unit 53 includes:

The target address obtaining unit is configured to obtain the target address in the call request, and determine whether the exposure information including the target address exists;

The verification passing unit is configured to, if the exposure information including the target address exists, determine that the invocation request has passed the verification, and determine that the internal service corresponding to the exposure information is the source of the invocation request The internal service requested;

The discarding unit is configured to discard the call request and output an error prompt if the exposed information including the target address does not exist.

Optionally, the gateway layer also stores service access rules corresponding to all internal services, and the service access rules are used to indicate the access format of the internal services, and the splicing unit 55 includes:

The rule configuration unit is configured to configure the spliced request to be forwarded according to the service access rule corresponding to the target service, and send the configured request to be forwarded to the intranet platform.

Optionally, the judging unit 54 further includes:

A sending unit, configured to send the request to be forwarded to the intranet platform in the gateway layer if the token information corresponding to the request to be forwarded does not exist in the cache;

The creation unit is configured to create the token information for the request to be forwarded, and to splice the created token information with the request to be forwarded.

Optionally, the setting unit 51 includes:

The search unit is configured to search in the bottom-level code of the caller according to the platform address, and determine that each line of the bottom-level code containing the platform address is the calling code, where the platform address is the internal The address of the network platform;

The replacement unit is used to replace the platform address in all the calling codes with the gateway layer address.

Optionally, the configuration unit 53 further includes:

The source address obtaining unit is configured to obtain the authority address set corresponding to each of the internal services in the intranet platform, and obtain the source address in the call request, wherein the authority address set includes at least one authority An address for accessing the internal service, where the source address is the address of the caller who initiated the call request;

An execution unit, configured to execute the operation of configuring the call request according to a platform forwarding rule preset in the intranet platform if the source address is in the authority address set corresponding to the target service;

The interception unit is configured to intercept the call request if the source address is not located in the authority address set corresponding to the target service, and output a prompt of unauthorized access to the caller who initiated the call request.

Therefore, the gateway-based internal service invocation device provided by the embodiment of the present invention reduces manual configuration operations by setting the gateway layer, and simplifies the token distribution process by distributing token information in the cache, and improves the internal The convenience and efficiency of the service.

Fig. 6 is a schematic diagram of a terminal device provided by an embodiment of the present application. As shown in FIG. 6, the terminal device 6 of this embodiment includes: a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and running on the processor 60, such as a gateway-based internal service Call the program. When the processor 60 executes the computer program 62, the steps in the above embodiments of the gateway-based internal service invoking method are implemented, and the steps include: S101. Setting the calling object called by the caller as a preset gateway layer Address, where the caller is located in an internal network, and the gateway layer address is a preset gateway layer address; S102. Determine all internal services that have been exposed to services on the internal network platform, in the gateway layer All the exposure information of the internal service is stored in the internal service, and the exposure information includes the address of the internal service; S103. If a call request is received in the gateway layer, the call request is performed according to all the exposure information After the verification is passed, the internal service requested by the invocation request is determined as the target service, and the invocation request is configured according to the platform forwarding rules corresponding to the intranet platform, and the configured all The calling request is determined to be a request to be forwarded; S104. Determine whether there is token information corresponding to the request to be forwarded in the cache; S105. If the token information corresponding to the request to be forwarded exists in the cache, Then, in the gateway layer, the token information is spliced with the request to be forwarded, and the spliced request to be forwarded is sent to the intranet platform; S106. For the spliced request to be forwarded The token information in the request is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.

Exemplarily, the computer program 62 may be divided into one or more units, and the one or more units are stored in the memory 61 and executed by the processor 60 to complete the application. The one or more units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 62 in the terminal device 6. For example, the computer program 62 can be divided into a setting unit, a storage unit, a configuration unit, a judgment unit, a splicing unit, and a forwarding unit. The specific functions of each unit are as follows:

The terminal device 6 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The terminal device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that FIG. 6 is only an example of the terminal device 6 and does not constitute a limitation on the terminal device 6. It may include more or less components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

The so-called processor 60 may be a central processing unit (Central Processing Unit, CPU), it can also be other general-purpose processors, Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 61 may be an internal storage unit of the terminal device 6, such as a hard disk or memory of the terminal device 6. The memory 61 may also be an external storage device of the terminal device 6, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), or a secure digital (Secure Digital, SD) equipped on the terminal device 6. Card, Flash Card, etc. Further, the memory 61 may also include both an internal storage unit of the terminal device 6 and an external storage device. The memory 61 is used to store the computer program and other programs and data required by the terminal device. The memory 61 can also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that for the convenience and conciseness of description, only the division of the above-mentioned functional units is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units as required, namely The internal structure of the terminal device is divided into different functional units to complete all or part of the functions described above. The functional units in the embodiments can be integrated in one processing unit, or each unit can exist alone physically, or two or more units can be integrated in one unit. The above-mentioned integrated units can be implemented in the form of hardware. It can also be implemented in the form of software functional units. In addition, the specific names of the functional units are only used to facilitate distinguishing from each other, and are not used to limit the protection scope of this application. For the specific working process of the units in the foregoing system, reference may be made to the corresponding process in the foregoing method embodiment, which is not repeated here.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail or recorded in an embodiment, reference may be made to related descriptions of other embodiments.

A person of ordinary skill in the art may be aware that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.

In the embodiments provided by the present invention, it should be understood that the disclosed terminal device and method may be implemented in other ways. For example, the terminal device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be combined. Or it can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium may be volatile or It can be non-volatile. Based on this understanding, this application implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the program is executed by the processor, the steps of the foregoing method embodiments can be implemented. The steps include: S101. Setting the calling object called by the caller to a preset gateway layer address, wherein the caller is located in an internal network, and the gateway layer address is a preset gateway layer address; S102. Determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, where the exposure information includes the address of the internal service; S103. If the call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined as the target service after the verification is passed. The platform forwarding rule corresponding to the intranet platform configures the call request, and determines the configured call request as a request to be forwarded; S104. Determine whether there is token information corresponding to the request to be forwarded in the cache; S105. If the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced all The request to be forwarded is sent to the intranet platform; S106. The token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the The target service. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (Read-Only Memory, ROM) , Random Access Memory (Random Access Memory, RAM), electrical carrier signal, telecommunications signal, and software distribution media. It should be noted that the content contained in the computer-readable medium can be appropriately added or deleted according to the requirements of the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to the legislation and patent practice, the computer-readable medium Does not include electrical carrier signals and telecommunication signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still implement the foregoing The technical solutions recorded in the examples are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included Within the protection scope of the present invention.

Claims

A gateway-based internal service invocation method, which includes:

Setting the calling object called by the caller as a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

Determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, where the exposure information includes the address of the internal service;

If a call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined as the target service after the verification is passed, And configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

Judging whether there is token information corresponding to the request to be forwarded in the cache;

If the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced request to be forwarded The forwarding request is sent to the intranet platform;

The token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.
The method for invoking internal services according to claim 1, wherein said verifying said invoking request according to all said exposure information comprises:

Acquiring the target address in the call request, and determining whether there is the exposed information including the target address;

If the exposure information including the target address exists, determining that the call request is verified, and the internal service corresponding to the exposure information is determined as the internal service requested by the call request;

If the exposure information including the target address does not exist, discard the call request and output an error prompt.
The method for invoking internal services according to claim 1, wherein the gateway layer also stores all service access rules corresponding to the internal services, and the service access rules are used to indicate the access format of the internal services;

The splicing the token information with the request to be forwarded in the gateway layer, and sending the spliced request to be forwarded to the intranet platform includes:

Configure the spliced request to be forwarded according to the service access rule corresponding to the target service, and send the configured request to be forwarded to the intranet platform.
The method for invoking an internal service according to claim 1, wherein after determining whether there is token information corresponding to the request to be forwarded in the cache, the method further comprises:

If the token information corresponding to the request to be forwarded does not exist in the cache, sending the request to be forwarded to the intranet platform in the gateway layer;

The token information is created for the request to be forwarded, and the created token information is spliced with the request to be forwarded.
The method for invoking internal services according to claim 1, wherein said setting the calling object called by the caller as a preset gateway layer address comprises:

Searching in the bottom-level code of the caller according to the platform address, and determining each line of the bottom-level code containing the platform address as the calling code, where the platform address is the address of the intranet platform;

Replace the platform address in all the calling codes with the gateway layer address.
The method for invoking internal services according to claim 1, wherein before the configuring the invoking request according to the platform forwarding rules corresponding to the intranet platform, the method further comprises:

Obtain the authority address set corresponding to each of the internal services in the intranet platform, and obtain the source address in the call request, wherein the authority address set includes at least one address that has the authority to access the internal service , The source address is the address of the caller who initiated the call request;

If the source address is in the authority address set corresponding to the target service, perform the operation of configuring the call request according to the platform forwarding rules preset in the intranet platform;

If the source address is not located in the authority address set corresponding to the target service, intercept the call request, and output a prompt of unauthorized access to the caller who initiated the call request.
A gateway-based internal service invocation device, which includes:

The setting unit is configured to set the calling object called by the caller to a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

The storage unit is configured to determine all internal services that have been exposed to services on the intranet platform, and store the exposure information of all the internal services in the gateway layer, and the exposure information includes the address of the internal service;

The configuration unit is configured to, if a call request is received in the gateway layer, verify the call request according to all the exposure information, and after the verification is passed, the internal service requested by the call request Determine it as a target service, configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

A judging unit, configured to judge whether there is token information corresponding to the request to be forwarded in the cache;

The splicing unit is configured to, if the token information corresponding to the request to be forwarded exists in the cache, splicing the token information with the request to be forwarded in the gateway layer, and splicing The subsequent request to be forwarded is sent to the intranet platform;

The forwarding unit is configured to authenticate the token information in the spliced request to be forwarded, and after the authentication is passed, forward the request to be forwarded to the target service.
A terminal device, wherein the terminal device includes a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the following steps when the processor executes the computer program:

Setting the calling object called by the caller as a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

Determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, where the exposure information includes the address of the internal service;

If a call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined as the target service after the verification is passed, And configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

Judging whether there is token information corresponding to the request to be forwarded in the cache;

If the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced request to be forwarded The forwarding request is sent to the intranet platform;

The token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.
The terminal device according to claim 8, wherein the verifying the call request according to all the exposure information includes:

Acquiring the target address in the call request, and determining whether there is the exposed information including the target address;

If the exposure information including the target address exists, determining that the call request is verified, and the internal service corresponding to the exposure information is determined as the internal service requested by the call request;

If the exposure information including the target address does not exist, discard the call request and output an error prompt.
8. The terminal device according to claim 8, wherein the gateway layer also stores all service access rules corresponding to the internal services, and the service access rules are used to indicate the access format of the internal services;

The splicing the token information with the request to be forwarded in the gateway layer, and sending the spliced request to be forwarded to the intranet platform includes:

Configure the spliced request to be forwarded according to the service access rule corresponding to the target service, and send the configured request to be forwarded to the intranet platform.
The terminal device according to claim 8, wherein, after determining whether there is token information corresponding to the request to be forwarded in the cache, the method further comprises:

If the token information corresponding to the request to be forwarded does not exist in the cache, sending the request to be forwarded to the intranet platform in the gateway layer;

The token information is created for the request to be forwarded, and the created token information is spliced with the request to be forwarded.
The terminal device according to claim 8, wherein said setting the calling object called by the caller as a preset gateway layer address comprises:

Searching in the bottom-level code of the caller according to the platform address, and determining each line of the bottom-level code containing the platform address as the calling code, where the platform address is the address of the intranet platform;

Replace the platform address in all the calling codes with the gateway layer address.
The terminal device according to claim 8, wherein, before the configuration of the call request according to the platform forwarding rules corresponding to the intranet platform, the method further comprises:

Obtain the authority address set corresponding to each of the internal services in the intranet platform, and obtain the source address in the call request, wherein the authority address set includes at least one address that has the authority to access the internal service , The source address is the address of the caller who initiated the call request;

If the source address is in the authority address set corresponding to the target service, perform the operation of configuring the call request according to the platform forwarding rules preset in the intranet platform;

If the source address is not located in the authority address set corresponding to the target service, intercept the call request, and output a prompt of unauthorized access to the caller who initiated the call request.
A computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the following steps:

Setting the calling object called by the caller as a preset gateway layer address, where the caller is located in an internal network, and the gateway layer address is the preset gateway layer address;

Determine all internal services that have been exposed to services on the intranet platform, and store exposure information of all internal services in the gateway layer, where the exposure information includes the address of the internal service;

If a call request is received in the gateway layer, the call request is verified according to all the exposure information, and the internal service requested by the call request is determined as the target service after the verification is passed, And configure the call request according to the platform forwarding rules corresponding to the intranet platform, and determine the configured call request as a request to be forwarded;

Judging whether there is token information corresponding to the request to be forwarded in the cache;

If the token information corresponding to the request to be forwarded exists in the cache, the token information and the request to be forwarded are spliced in the gateway layer, and the spliced request to be forwarded The forwarding request is sent to the intranet platform;

The token information in the spliced request to be forwarded is authenticated, and after the authentication is passed, the request to be forwarded is forwarded to the target service.
15. The computer-readable storage medium of claim 14, wherein the verifying the call request according to all the exposure information comprises:

Acquiring the target address in the call request, and determining whether there is the exposed information including the target address;

If the exposure information including the target address exists, determining that the call request is verified, and the internal service corresponding to the exposure information is determined as the internal service requested by the call request;

If the exposure information including the target address does not exist, discard the call request and output an error prompt.
14. The computer-readable storage medium of claim 14, wherein the gateway layer also stores all service access rules corresponding to the internal services, and the service access rules are used to indicate the access format of the internal services;

The splicing the token information with the request to be forwarded in the gateway layer, and sending the spliced request to be forwarded to the intranet platform includes:

Configure the spliced request to be forwarded according to the service access rule corresponding to the target service, and send the configured request to be forwarded to the intranet platform.
15. The computer-readable storage medium according to claim 14, wherein after determining whether there is token information corresponding to the request to be forwarded in the cache, the method further comprises:

If the token information corresponding to the request to be forwarded does not exist in the cache, sending the request to be forwarded to the intranet platform in the gateway layer;

The token information is created for the request to be forwarded, and the created token information is spliced with the request to be forwarded.
15. The computer-readable storage medium of claim 14, wherein the setting the calling object called by the caller as a preset gateway layer address comprises:

Searching in the bottom-level code of the caller according to the platform address, and determining each line of the bottom-level code containing the platform address as the calling code, where the platform address is the address of the intranet platform;

Replace the platform address in all the calling codes with the gateway layer address.
The computer-readable storage medium according to claim 14, wherein before the configuring the call request according to the platform forwarding rule corresponding to the intranet platform, the method further comprises:

Obtain the authority address set corresponding to each of the internal services in the intranet platform, and obtain the source address in the call request, wherein the authority address set includes at least one address that has the authority to access the internal service , The source address is the address of the caller who initiated the call request;

If the source address is in the authority address set corresponding to the target service, perform the operation of configuring the call request according to the platform forwarding rules preset in the intranet platform;

If the source address is not located in the authority address set corresponding to the target service, intercept the call request, and output a prompt of unauthorized access to the caller who initiated the call request.
The computer-readable storage medium according to any one of claims 14 to 19, wherein the computer-readable storage medium is a volatile computer-readable storage medium or a non-volatile computer-readable storage medium.