WO2021139788A1

WO2021139788A1 - Cloud gateway configuration method, system, apparatus, and computer readable storage medium

Info

Publication number: WO2021139788A1
Application number: PCT/CN2021/070925
Authority: WO
Inventors: 梁党卫; 臧磊
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2020-01-09
Filing date: 2021-01-08
Publication date: 2021-07-15
Also published as: CN111049695A

Abstract

An embodiment of the present application provides a cloud gateway configuration method. The cloud gateway configuration method comprises: monitoring gateway configuration data stored as a tree structure in a cooperative service cluster, wherein the tree structure comprises multiple nodes in one-to-one correspondence with multiple APIs; determining whether the multiple nodes comprise one or more target nodes, wherein the one or more target nodes comprise a data change node and/or an addition node; if the multiple nodes comprise the one or more target nodes, updating a gateway configuration of APIs corresponding to each of the one or more target nodes to obtain an up-to-date network configuration for each API; and configuring a gateway processing logic model according to the up-to-date network configuration for each API. The embodiment of the present application enables open configuration of cloud gateways and improves the level of integration for various systems accessing the cloud gateways.

Description

Cloud gateway configuration method, system, equipment and computer readable storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is CN202010023851.3, and the name is "Cloud Gateway Configuration Method and System" on January 9, 2020, the entire content of which is incorporated into this application by reference .

Technical field

The embodiments of the present application relate to the field of cloud technology, and in particular, to a cloud gateway configuration method, system, device, and computer-readable storage medium.

Background technique

With the rapid development of the Internet, more companies have completed their internal API (application Programming interface, application program interface), but under the strong demand of enterprise supply chain and social open data and capabilities, security, isolation, sharing and other aspects have become important requirements. Therefore, cloud gateways have become important for connecting internal and external services of enterprises. Character. The so-called cloud gateway refers to the cloud storage gateway in cloud storage technology, which allows users to access cloud services provided by cloud service providers without changing the interface design and using the original access method.

As the export of enterprise data and services, the cloud gateway can provide various services such as voice, video, information security, information management, and information monitoring. For example, the cloud gateway can be used to receive user-side requests, request the cloud service provider for the content required by the user-side according to the user-side request, and can also be used to provide cloud service providers with signature authentication, log records, and other various types. service.

technical problem

The inventor realizes that there is currently no connection solution based on an open cloud gateway, and the degree of integration of the systems of the connected parties is low.

Technical solutions

An aspect of the embodiments of the present application provides a cloud gateway configuration method. The cloud gateway configuration method includes: monitoring gateway configuration data stored in a tree structure in a collaborative service cluster, wherein the tree structure includes multiple One API corresponds to multiple nodes; determine whether the multiple nodes include at least one target node, wherein the at least one target node includes a data change node and/or a new node; if the multiple nodes include The at least one target node updates the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API; and configures the gateway processing according to the latest network configuration of each API Logical model.

An aspect of the embodiments of the present application further provides a cloud gateway configuration system. The cloud gateway configuration system includes a monitoring module for monitoring gateway configuration data stored in a tree structure in a collaborative service cluster, wherein the tree The state structure includes multiple nodes corresponding to multiple APIs one-to-one; a judging module is used to judge whether the multiple nodes include at least one target node, wherein the at least one target node includes a data change node and/or a new Adding a node; an update module, configured to update the gateway configuration of the API corresponding to each target node in the at least one target node if the at least one target node is included in the plurality of nodes, so as to obtain the latest network of each API Configuration; The configuration module is used to configure the gateway processing logic model according to the latest network configuration of each API.

An aspect of the embodiments of the present application further provides a computer device. The computer device includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer The program is used to implement the following steps:

Monitoring gateway configuration data stored in a tree structure in the collaborative service cluster, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one;

Judging whether the multiple nodes include at least one target node, where the at least one target node includes a data change node and/or a newly added node;

If the at least one target node is included in the plurality of nodes, updating the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API; and

According to the latest network configuration of each API, the gateway processing logic model is configured.

An aspect of the embodiments of the present application further provides a computer-readable storage medium having a computer program stored in the computer-readable storage medium, and the computer program may be executed by at least one processor, so that the at least one The processor performs the following steps:

Description of the drawings

FIG. 1 schematically shows an application environment diagram of a cloud gateway configuration method according to Embodiment 1 of the present application;

FIG. 2 schematically shows a flowchart of a cloud gateway configuration method according to Embodiment 1 of the present application;

FIG. 3 schematically shows a newly added flowchart of a cloud gateway configuration method according to Embodiment 1 of the present application;

Fig. 4 schematically shows a block diagram of a cloud gateway configuration system according to the second embodiment of the present application; and

Fig. 5 schematically shows a schematic diagram of a hardware architecture of a computer device suitable for implementing a cloud gateway configuration method according to the third embodiment of the present application.

Embodiments of the present invention

In order to make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following further describes the embodiments of the present application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the embodiments of the present application.

It should be noted that the descriptions related to "first", "second", etc. in the embodiments of this application are only for descriptive purposes, and cannot be understood as indicating or implying their relative importance or implicitly specifying the indicated technical features quantity. Therefore, the features defined with "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on what can be achieved by a person of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that this combination of technical solutions does not exist. , Also does not fall within the scope of protection required by the embodiments of this application.

Fig. 1 schematically shows an environmental application diagram of the cloud gateway configuration method according to the first embodiment of the present application. In an exemplary embodiment, the environmental application diagram includes a computer device 2, a collaborative service cluster 4, a gateway management platform 6, a service consumer 8 and a service provider 10. among them:

Computer equipment 2 is a cloud gateway or an electronic device with cloud gateway function, used as an export of enterprise data and services, and can provide various services such as voice, video, information security, information management, and information monitoring.

Cooperative service cluster 4 can be a zookeeper cluster. Among them, zookeeper is developed by Yahoo, mainly used to support distributed systems, used to solve the coordination of distributed systems (coordinating tasks), by providing general functions, so that application developers can focus on their own business functions, Instead of paying attention to the coordination of distributed systems. The zookeeper cluster is used to provide coordination services for users' distributed applications.

The gateway management platform 6 may be used to receive user operations, and the user operations include API (Application Programming Interface, application programming interface) management, configuration, testing, release, offline, etc.

Service consumer 8, which can be a smart phone, a tablet personal computer (tablet personal computer), laptop computer (laptop computer), desktop computers, workstations, virtual reality devices, game devices, set-top boxes, digital streaming media devices, vehicle terminals, smart TVs, set-top boxes, e-book readers and other electronic devices, can also be virtualized computing instances.

The service provider 10 is used to provide services for service consumers. The service provider 10 may be a rack server, a blade server, a tower server or a cabinet server (including an independent server or a server cluster composed of multiple servers). The service provider 10 provides an API interface for real-time calling. The service provider 10 may be various enterprise servers, such as banks and other financial institutions, technology companies, and so on.

Example one

Fig. 2 schematically shows a flowchart of a cloud gateway configuration method according to Embodiment 1 of the present application. It can be understood that the flowchart in this method embodiment is not used to limit the order of execution of the steps. The following exemplarily describes the computer device 2 as the execution subject.

As shown in Figure 2, the cloud gateway configuration method may include steps S200 to S206, where:

Step S200: Monitor the gateway configuration data stored in a tree structure in the collaborative service cluster 4, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one.

The collaborative service cluster 4 stores gateway configuration data through a tree structure, for example: /gateway/org/group/api; if a certain API changes, update the version information of the corresponding node in the tree structure to complete The event registration operation of the API change event.

The computer equipment 2 is connected to the collaborative service cluster 4 and the gateway management platform 6 respectively.

If the API modification information or API addition information submitted from the service provider 10 is received, the gateway management platform 6 will modify the API parameters of the corresponding API, or add an API, etc. When an API in the gateway management platform 6 is changed or an API is added, the gateway management platform 6 will initiate an API change event and send the API change event to the collaborative service cluster 4. After the collaborative service cluster 4 receives the API change event sent by the gateway management platform 6, it will modify the version information of the corresponding node in the tree structure to update the gateway configuration data, that is, update the corresponding node in the data structure. Version information to complete event registration.

The changed API is the API whose interface description, interface address, request method, request parameter, etc. have changed.

Step S202: Determine whether the plurality of nodes include at least one target node, where the at least one target node includes a data change node and/or a newly added node.

The computer device 2 can monitor whether the gateway configuration data in the collaborative service cluster 4 has changed through an event listener, for example, monitor whether the collaborative service cluster 4 has a new registration event, and determine the target according to the new registration event node.

Since the version information of each node is updated according to the API change event sent by the gateway management platform connected to the collaborative service cluster 4, the API change event indicates that the API in the gateway management platform 6 has changed or added API. In an exemplary embodiment, the step S202 may include the following steps: detecting whether the version information of each of the multiple nodes has changed; and if the node includes a node whose version information has changed, then The node whose version information has changed is determined as the target node.

Step S204: If the at least one target node is included in the multiple nodes, update the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API.

The computer device 2 can obtain the network configuration of the API corresponding to each target node in various ways, such as sending a download request directly. In an exemplary embodiment, a management platform interface is configured in the gateway management platform 6 through which relevant information can be obtained. Therefore, the computer device 2 can request the gateway management platform 6 to feed back the corresponding network configuration according to the node information of the target node (for example, the identification number of the API corresponding to the target node, etc.). Specifically, the step S204 may include the following steps: sending a gateway configuration update request to the gateway management platform 6, so that the gateway management platform 6 returns the latest gateway configuration of the API corresponding to each target node; and receiving the gateway management platform 6 The latest gateway configuration of the API corresponding to each target node is returned; and according to the latest gateway configuration of the API corresponding to each target node, the current gateway configuration of the API corresponding to the target node is updated.

Step S206: Configure the gateway processing logic model according to the latest network configuration of each API.

In an exemplary embodiment, the computer device 2 may load the latest network configuration of each API into the memory, and configure the gateway processing logic model: configure a filter chain for each API and filter the Multiple filters in the filter chain are instantiated to obtain multiple corresponding instances. That is, each API can only have at least one filter chain. Each filter chain can include multiple instances, and each instance corresponds to a business logic.

The so-called filter chain includes multiple filters in a sequential order to achieve layer-by-layer filtering. Specifically: It is used to perform filtering operations on user requests according to the order defined in the filter chain, that is, to do some pre-processing/post-processing on application requests or responses. The filter chain can be used for authentication/authorization/logging, etc.

The so-called instance can include priority attribute, assertion attribute and run method. The priority attribute is used to determine the order in which each instance is executed in the filter chain; the assertion attribute is used to determine whether the instance is executed; the run method is used to start or create threads for processing business logic, such as signatures Verification, authorization verification, concurrent current limiting, URI rewriting, etc.

The instance needs to rely on the component or call the component to complete the corresponding operation.

In an exemplary embodiment, the computer device 2 may be configured for multiple components to be invoked by the multiple instances. The multiple components include one or more of the following: a routing component, a parameter conversion component, an API orchestration component, a current limiting protection component, a fuse protection component, a service degradation component, an encryption signature component, an authorization verification component, a logging component, etc.

In an exemplary embodiment, the computer device 2 may be configured with a plug-in component, and the plug-in may be abstractly defined according to various business rules.

Each plug-in corresponds to a business rule, for example: plug-in 1, which authorizes each service consumer 8 according to the time zone; plug-in 2, which authorizes each service consumer 8 according to the number of calls; this plug-in 1 and plug-in 2 are based on different The authorization rules are defined.

Among them, the instance is used to execute business logic according to pre-defined rules, and its specific business level can be completed by calling one or more plug-ins.

Through the combination of instances and plug-ins, business logic and business rules can be unbound, thereby facilitating configuration and combination.

In an exemplary embodiment, the computer device 2 may be configured with an API orchestration component. The API orchestration component is configured to: according to the orchestration JSON template provided by the gateway service platform, call various API services in order for user requests.

The gateway service platform 6 performs an orchestration operation on the API according to user operations, and generates an orchestration JSON template. The layout JSON template includes: a, calling methods: serial calling and parallel calling; b, setting parameter conversion and processing logic for each API.

According to the arrangement JSON template provided by the gateway service platform 6, the computer device 2 processes serial arrangement one by one in order, and each call includes pre-processing, routing and post-processing; for parallel arrangement, it uses thread pool to process each in parallel. A proxy service is called, and then the aggregation result is returned to the service consumer8. That is, when the computer device 2 receives a user request, it will call multiple API services according to the orchestration operation to obtain feedback data from the service provider 10, and process the feedback data (for example, integrate the feedback data), and Return the integrated data to the service consumer8.

In an exemplary embodiment, the computer device 2 may be configured with a current limiting protection component. The current limit protection component is configured to monitor the request count of the request count window based on the sliding window algorithm to obtain the request count of the current window, and determine whether to execute the limit according to the request count of the current window and the request count of the previous window. Stream operations.

In this embodiment, the current limiting protection component is configured to perform the following steps: taking N seconds as a request counting window, monitoring the request count of each request counting window based on a sliding window algorithm; when a request arrives, calculating according to the request time In the proportion of the current window, the request count of the previous window and the current window is accumulated and counted according to the weight. If it does not exceed the limit, it will be processed normally, otherwise it will directly refuse to process and return the current limit response code.

The current limiting protection component can be used to avoid service downtime of the service provider 10 caused by a sudden increase in the amount of requests. The above request count based on the sliding window algorithm is only one of the measures for current limiting protection. Some values of IP, interface, user dimension, and request parameters can also be used as decision parameters for current limiting protection.

For example, to classify requests, guarantee the processing of high-priority requests and reject the processing of low-priority requests when the amount of requests increases suddenly.

In an exemplary embodiment, the computer device 2 may be equipped with a fuse protection component. The fuse protection component includes a closed state, a half-open state, and an open state, and is configured to enter the half-open state if the number of failed API calls within a preset time window reaches a preset threshold if it is in the closed state; if In the half-open state, if each call to the API is successful, it will be restored from the half-open state to the closed state; if it is in the open state, the timer operation will be started, and when the timer reaches the predetermined time, it will be restored from the open state to the half-open state status.

The computer device 2 may adopt a fuse model, and configure the fuse to be configured with three state machines: closed, half-open, and open. The fuse is further configured as:

a. If the number of failed calls to the API reaches the preset threshold within a given time window, it will automatically enter the half-open state, that is, a certain number of calls are allowed;

b. In the half-open state, if every API call is successful, the half-open state will be restored to the closed state;

c. If the fuse is in the disconnected state, start the timer operation, and restore from the disconnected state to the half-open state when the timer reaches a predetermined time.

Through the above configuration, the service efficiency of the service provider 10 can be effectively improved, and a system avalanche that may be caused by service overload can be avoided.

The fuse protection is used to: when the service provider 10 is overloaded or the interface is unavailable, the service consumer 8 may continue to send requests due to request failures, resulting in an avalanche of the service provider 10. When the fuse is in the disconnected state, the fuse blocks the service consumer's access to the service provider 10, and directly returns a failure message to the service consumer 8 or returns a degraded response.

In an exemplary embodiment, the computer device 2 may be configured with a service degradation component. The service degradation component is configured to stop data processing and return a degraded return code or message when the service state of the service provider is in a degraded state.

In the service degradation, when the service provider 10 is overloaded, some services and pages are strategically degraded according to current business conditions and traffic, so as to release service resources to ensure the normal operation of core tasks. The service degradation component may be configured to: through the service status and a custom degraded return code and message, when the service status is in the degraded state, no service is processed and the degraded return code and message are directly returned.

In an exemplary embodiment, the computer device 2 may be configured with a cryptographic signature component. As shown in Figure 3, the cryptographic signature component is configured as:

Step S300: Receive an encryption request carrying the first signature private key SK1 sent by the service consumer 8. The encryption request carrying the signature private key SK1 is obtained based on the service consumer identification number and the first signature private key SK1.

The service consumer 8 obtains the corresponding service consumer identification number (ID) and the first signature private key SK1 by registering the application of the service provider; when the service consumer 8 wants to access the service provider 10, the service parameter And ID are arranged in a natural order and then hashed to generate signature content, the signature content is cryptographically signed with the first signature private key SK1 to generate the encryption request carrying the first signature private key SK1; and The encryption request carrying the first signature private key SK1 is sent to the computer device 2 through the HTTPS protocol.

The service parameters depend on the scenario. Taking face authentication as an example, the service parameters include ID number, face image, and system parameters, such as calling agency code, service agency code, and so on. As the platform side, the gateway can be applied to various scenarios, which will not be repeated here.

Step S302: Perform signature verification with the first signature public key PK1 corresponding to the first signature private key SK1 to obtain the decrypted service parameters and the service consumer identification number.

Step S304, encrypt the decrypted service parameters and the service consumer identification number according to the second signature private key SK2, and generate an encryption request carrying the second signature private key SK2.

The second signature private key SK2 is predefined by the API, and it corresponds to the second signature public key PK2 of the service provider 10; the service provider 10 creates an API group, registers the API, and obtains the second signature public key of the API PK2;

Step S306: Forward the encryption request carrying the second signature private key SK2 to the service provider 10, so that the service provider 10 performs a decryption operation through the second signature public key PK2 to carry the second signature private key The encryption request of SK2 performs the corresponding operation.

For example: if the service provider 10 determines that the encryption request carrying the second signature private key SK2 comes from the computer device 2, the corresponding processing operation is executed according to the service parameters; if it is determined that the second signature private key SK2 is carried If the encryption request does not come from the computer device 2, the encryption request carrying the second signature private key SK2 is rejected.

In an exemplary embodiment, the computer device 2 may be configured with an authorization verification component. The authorization verification component is configured to verify authorization according to a preset authorization rule through the authorization filter, and return a code value that rejects the request when the authorization is invalid; the preset authorization rule includes call time, call times, and/or Concurrent number.

Specifically: the authorization filter will verify the authorization according to the preset authorization rules, and when the authorization is invalid, the code value that rejects the request will be returned; the preset authorization rules are configured by the service provider 10 on the gateway management platform 6, the The preset authorization rules include call time, call times, concurrent numbers, etc.; when the computer device 2 receives an API docking request from the service consumer 8, it performs authorization verification on the request according to the preset authorization rule.

In an exemplary embodiment, the computer device 2 may be configured with a logging component.

The log recording component is configured to generate a serial number for each call event, and asynchronously send the associated information associated with the call event to the message platform.

Specifically, the log recording component may be configured to generate a transNo serial number according to each call event, and asynchronously send information such as appId, signature, response code, and error message to the message platform, so that the log audit system can record ; According to the request status, parameter processing, flow restriction, business processing, billing status, etc., different response codes are returned, so that, for example, the audit billing system can calculate according to business rules.

The embodiment of the present application can implement an open gateway configuration for the computer device 2 through the integrated architecture between the collaborative service cluster 4, the gateway management platform 6 and the computer device 2. Among them, financial institutions and technology companies can develop apps according to their own needs and modify or add APIs on the gateway management platform 6. The gateway management platform 6 will synchronize all API modifications or new messages to the tree structure of the collaborative service cluster 4. , In order to facilitate the computer device 2 to monitor each node in the tree structure, so that the computer device 2 can obtain the latest network configuration of each API from the gateway management platform 4 in real time according to the node information of each node.

In addition, in view of the fact that each service provider can write the network configuration of the API developed or modified by itself into the computer device 2, and each party can use the computer device 2 as the center to call a third-party API to meet its own business needs, that is, each party The computer equipment 2 can be used as the center for integration to improve the degree of integration of all connected systems.

The embodiment of the application can obtain the modified or newly added information of the API in real time by monitoring the collaborative service cluster, and then obtain the latest network configuration of each node, so that the API developed or modified by each service provider can be automatically configured to the cloud in an open manner. In the gateway, the open configuration of the cloud gateway is realized. In addition, in view of the fact that each service provider can write the network configuration of the API developed or modified by itself into the cloud gateway, so that all parties can integrate with the cloud gateway as the center, and improve the degree of integration of the systems of all parties connected.

Example two

Fig. 4 schematically shows a block diagram of a cloud gateway configuration system according to Embodiment 2 of the present application. The cloud gateway configuration system can be divided into one or more program modules, and the one or more program modules are stored in a storage medium, It is executed by one or more processors to complete the embodiments of the present application. The program module referred to in the embodiment of the present application refers to a series of computer program instruction segments that can complete specific functions. The following description will specifically introduce the function of each program module in this embodiment.

As shown in FIG. 4, the cloud gateway configuration system 400 may include a monitoring module 410, a judgment module 420, an update module 430, and a configuration module 440, where:

The monitoring module 410 is configured to monitor gateway configuration data stored in a tree structure in the collaborative service cluster, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one.

The determining module 420 is configured to determine whether the plurality of nodes includes at least one target node, where the at least one target node includes a data change node and/or a newly added node.

The update module 430 is configured to, if the at least one target node is included in the plurality of nodes, update the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API.

The configuration module 440 is configured to configure the gateway processing logic model according to the latest network configuration of each API.

In an exemplary embodiment, the judging module 420 is further configured to: detect whether the version information of each node among the multiple nodes has changed; if the node includes a node whose version information has changed, use the version The node whose information has changed is determined as the target node.

The version information of each node is updated according to an API change event sent by a gateway management platform connected to the collaborative service cluster, and the API change event indicates that an API in the gateway management platform is changed or an API is added.

In an exemplary embodiment, the update module 430 is further configured to: send a gateway configuration update request to the gateway management platform, so that the gateway management platform returns the latest gateway configuration of the API corresponding to each target node; The latest gateway configuration of the API corresponding to each target node returned by the management platform; and, according to the latest gateway configuration of the API corresponding to each target node, update the current gateway configuration of the API corresponding to the target node.

In an exemplary embodiment, the configuration module 440 is further used to: load the latest network configuration of each API into the memory, configure the gateway processing logic model: configure a filter chain for each API, and Multiple filters in the filter chain are instantiated to obtain corresponding multiple instances.

In an exemplary embodiment, the configuration module 440 is further configured to: configure multiple components for the multiple instances to call; the multiple components include one or more of the following: routing components, parameter conversion components, API orchestration component, current limiting protection component, fuse protection component, service degradation component, cryptographic signature component, authorization verification component, and logging component; wherein: the API orchestration component is configured to: according to the orchestration provided by the gateway service platform The JSON template calls each API service in order for user requests; the current limiting protection component is configured to monitor the request count of the request count window based on the sliding window algorithm to obtain the request count of the current window, and the request count of the current window And the request count of the previous window to determine whether to perform the current limiting operation; the fuse protection component, including the closed state, the half-open state, and the open state, is configured to: if it is in the closed state, the API will be processed within a preset time window. If the number of call failures reaches the preset threshold, it will enter the half-open state; if it is in the half-open state, if every API call is successful, it will be restored from the half-open state to the closed state; if it is in the open state, the timer operation will be started After the timer reaches a predetermined time, it is restored from the disconnected state to the half-open state; the service degradation component is configured to: when the service state of the service provider is in the degraded state, stop data processing and return a degraded return code or message; The authorization verification component is configured to verify authorization according to preset authorization rules through the authorization filter, and return a code value that rejects the request when the authorization is invalid; the preset authorization rules include call time, call times, and/or Concurrent number; the logging component is configured to generate a serial number for each call event, and asynchronously send the associated information associated with the call event to the message platform.

In an exemplary embodiment, the encryption signature component is configured to: receive an encryption request carrying a first signature private key sent by a service consumer, and the encryption request carrying a signature private key is based on the service consumer identification number and the first signature private key. A signature private key is obtained; signature verification is performed through the first signature public key corresponding to the first signature private key, and the decrypted service parameters and service consumer identification number are obtained; the decrypted service parameters are obtained according to the second signature private key The service parameters and the service consumer identification number are encrypted to generate an encryption request carrying the second signature private key; and the encryption request carrying the second signature private key is forwarded to the service provider so that the service provider can pass the second signature private key The signature public key performs a decryption operation to perform a corresponding operation according to the encryption request carrying the second signature private key.

In an exemplary embodiment, the configuration module 440 is further configured to: configure multiple plug-ins for invocation of the multiple instances, wherein each plug-in corresponds to one business rule.

Example three

FIG. 5 schematically shows a schematic diagram of the hardware architecture of a computer device 2 suitable for implementing the cloud gateway configuration method according to the third embodiment of the present application. In this embodiment, the computer device 2 is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. For example, it can be a rack server, a blade server, a tower server, or a cabinet server (including an independent server or a server cluster composed of multiple servers) with a gateway function. As shown in FIG. 5, the computer device 6 at least includes but is not limited to: a memory 510, a processor 520, and a network interface 530 that can communicate with each other through a system bus. among them:

The memory 510 may be volatile or non-volatile. The memory 510 includes at least one type of computer-readable storage medium. The readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), and static random access memory. (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disks, optical disks, etc. In some embodiments, the memory 510 may be an internal storage module of the computer device 2, for example, the hard disk or memory of the computer device 2. In other embodiments, the memory 510 may also be an external storage device of the computer device 2, for example, a plug-in hard disk equipped on the computer device 2, a smart memory card (Smart Media Card, referred to as SMC), and a secure digital (Secure Digital). Digital, abbreviated as SD) card, flash card (Flash Card), etc. Of course, the memory 510 may also include both the internal storage module of the computer device 2 and its external storage device. In this embodiment, the memory 510 is generally used to store the operating system and various application software installed in the computer device 2, such as the program code of the cloud gateway configuration method. In addition, the memory 510 may also be used to temporarily store various types of data that have been output or will be output.

The processor 520 may be a central processing unit (Central Processing Unit) in some embodiments. Processing Unit, referred to as CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 520 is generally used to control the overall operation of the computer device 2, for example, to perform data interaction or communication-related control and processing with the computer device 2. In this embodiment, the processor 520 is configured to run program codes stored in the memory 510 or process data.

The network interface 530 may include a wireless network interface or a wired network interface, and the network interface 530 is generally used to establish a communication link between the computer device 2 and other computer devices. For example, the network interface 530 is used to connect the computer device 2 to an external terminal through a network, and to establish a data transmission channel and a communication link between the computer device 2 and the external terminal. The network can be an intranet (Intranet), the Internet (Internet), a global system of mobile communications (Global System of Mobile communication, GSM for short), Wideband Code Division Multiple Access (WCDMA for short), 4G network, 5G network, Bluetooth, Wi-Fi and other wireless or wired networks.

It should be pointed out that FIG. 5 only shows a computer device with components 510-530, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

In this embodiment, the cloud gateway configuration method stored in the memory 510 can also be divided into one or more program modules and executed by one or more processors (the processor 520 in this embodiment) to complete Examples of this application.

Example four

This embodiment also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

In this embodiment, the computer-readable storage medium may be volatile or non-volatile. Computer-readable storage media include flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electronic memory Erase programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disks, optical disks, etc. In some embodiments, the computer-readable storage medium may be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. In other embodiments, the computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk or a smart memory card (Smart Memory Card) equipped on the computer device. Media Card, referred to as SMC), Secure Digital (Secure Digital, referred to as SD) card, flash memory card (Flash Card) and so on. Of course, the computer-readable storage medium may also include both the internal storage unit and the external storage device of the computer device. In this embodiment, the computer-readable storage medium is generally used to store the operating system and various application software installed in the computer device, such as the program code of the cloud gateway configuration method in the embodiment. In addition, the computer-readable storage medium can also be used to temporarily store various types of data that have been output or will be output.

Obviously, those skilled in the art should understand that the modules or steps of the embodiments of the present application described above can be implemented by a general computing device, and they can be concentrated on a single computing device or distributed among multiple computing devices. Optionally, they can be implemented by the program code executable by the computing device, so that they can be stored in the storage device for execution by the computing device, and in some cases, they can be different from here The steps shown or described are executed in the order of, or they are respectively fabricated into individual integrated circuit modules, or multiple modules or steps of them are fabricated into a single integrated circuit module to achieve. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

The above are only the preferred embodiments of the embodiments of the application, and do not limit the scope of the patents of the embodiments of the application. Any equivalent structure or equivalent process transformation made by using the description and drawings of the embodiments of the application, or directly or indirectly used In other related technical fields, the same is included in the scope of patent protection of the embodiments of this application.

Claims

A cloud gateway configuration method, wherein the method includes:

Monitoring gateway configuration data stored in a tree structure in the collaborative service cluster, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one;

Judging whether the multiple nodes include at least one target node, where the at least one target node includes a data change node and/or a newly added node;

If the at least one target node is included in the plurality of nodes, updating the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API; and

According to the latest network configuration of each API, the gateway processing logic model is configured.
The cloud gateway configuration method according to claim 1, wherein determining whether at least one target node is included in the plurality of nodes comprises:

Detecting whether the version information of each of the multiple nodes has changed; and

If the node includes a node whose version information has changed, the node whose version information has changed is determined as the target node.
The cloud gateway configuration method according to claim 1, wherein updating the gateway configuration of the API corresponding to each of the at least one target node comprises:

Sending the gateway configuration update request to the gateway management platform, so that the gateway management platform returns the latest gateway configuration of the API corresponding to each target node;

Receiving the latest gateway configuration of the API corresponding to each target node returned by the gateway management platform; and

According to the latest gateway configuration of the API corresponding to each target node, update the current gateway configuration of the API corresponding to the target node.
The cloud gateway configuration method according to claim 1, wherein, according to the latest network configuration of each API, configuring the gateway processing logic model comprises:

Load the latest network configuration of each API into the memory, and configure the gateway processing logic model:

Configure a filter chain for each API and instantiate multiple filters in the filter chain to obtain corresponding multiple instances.
The cloud gateway configuration method according to claim 4, wherein the step of configuring the gateway processing logic model further comprises:

Configure multiple components for the multiple instances to call;

The multiple components include one or more of the following: a routing component, a parameter conversion component, an API orchestration component, a current limiting protection component, a fuse protection component, a service degradation component, an encryption signature component, an authorization verification component, and a logging component; wherein :

The API orchestration component is configured to: according to the orchestration JSON template provided by the gateway service platform, call each API service in order for user requests;

The current limit protection component is configured to monitor the request count of the request count window based on the sliding window algorithm to obtain the request count of the current window; and determine whether to execute the limit according to the request count of the current window and the request count of the previous window. Stream operation

The fuse protection component includes a closed state, a half-open state, and an open state, and is configured to enter the half-open state if the number of failed API calls within a preset time window reaches a preset threshold if it is in the closed state; if In the half-open state, if each call to the API is successful, it will be restored from the half-open state to the closed state; if it is in the open state, the timer operation will be started, and when the timer reaches the predetermined time, it will be restored from the open state to the half-open state status;

The service degradation component is configured to: when the service state of the service provider is in a degraded state, stop data processing and return a degraded return code or message;

The authorization verification component is configured to verify authorization according to a preset authorization rule through the authorization filter, and return a code value that rejects the request when the authorization is invalid; the preset authorization rule includes call time, call times, and/or Concurrent number;

The log recording component is configured to generate a serial number for each call event, and asynchronously send the associated information associated with the call event to the message platform.
The cloud gateway configuration method according to claim 5, wherein the cryptographic signature component is configured to:

Receiving an encryption request carrying the first signature private key sent by the service consumer, where the encryption request carrying the signature private key is obtained based on the service consumer identification number and the first signature private key;

Perform signature verification by using the first signature public key corresponding to the first signature private key to obtain the decrypted service parameters and service consumer identification number;

Encrypt the decrypted service parameters and service consumer identification number according to the second signature private key, and generate an encryption request carrying the second signature private key; and

Forward the encryption request carrying the second signature private key to the service provider, so that the service provider performs a decryption operation through the second signature public key to perform corresponding operations according to the encryption request carrying the second signature private key .
The cloud gateway configuration method according to claim 4, wherein the step of configuring the gateway processing logic model further comprises:

Configure multiple plug-ins for the multiple instances to call, wherein each plug-in corresponds to a business rule.
A cloud gateway configuration system, which includes:

The monitoring module is used to monitor the gateway configuration data stored in a tree structure in the collaborative service cluster, wherein the tree structure includes multiple nodes corresponding to multiple APIs one-to-one;

A judging module, configured to judge whether the multiple nodes include at least one target node, wherein the at least one target node includes a data change node and/or a newly added node;

The update module is configured to update the gateway configuration of the API corresponding to each target node in the at least one target node if the at least one target node is included in the plurality of nodes to obtain the latest network configuration of each API; and

The configuration module is used to configure the gateway processing logic model according to the latest network configuration of each API.
A computer device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor is used to implement the following steps when the computer program is executed:

Monitoring gateway configuration data stored in a tree structure in the collaborative service cluster, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one;

Judging whether the multiple nodes include at least one target node, where the at least one target node includes a data change node and/or a newly added node;

If the at least one target node is included in the plurality of nodes, updating the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API; and

According to the latest network configuration of each API, the gateway processing logic model is configured.
The computer device according to claim 9, wherein determining whether at least one target node is included in the plurality of nodes comprises:

Detecting whether the version information of each of the multiple nodes has changed; and

If the node includes a node whose version information has changed, the node whose version information has changed is determined as the target node.
The computer device according to claim 9, wherein updating the gateway configuration of the API corresponding to each of the at least one target node comprises:

Sending the gateway configuration update request to the gateway management platform, so that the gateway management platform returns the latest gateway configuration of the API corresponding to each target node;

Receiving the latest gateway configuration of the API corresponding to each target node returned by the gateway management platform; and

According to the latest gateway configuration of the API corresponding to each target node, update the current gateway configuration of the API corresponding to the target node.
The computer device according to claim 9, wherein, according to the latest network configuration of each API, configuring the gateway processing logic model comprises:

Load the latest network configuration of each API into the memory, and configure the gateway processing logic model:

Configure a filter chain for each API and instantiate multiple filters in the filter chain to obtain corresponding multiple instances.
The computer device according to claim 12, wherein the step of configuring the gateway processing logic model further comprises:

Configure multiple components for the multiple instances to call;

The multiple components include one or more of the following: a routing component, a parameter conversion component, an API orchestration component, a current limiting protection component, a fuse protection component, a service degradation component, an encryption signature component, an authorization verification component, and a logging component; wherein :

The API orchestration component is configured to: according to the orchestration JSON template provided by the gateway service platform, call each API service in order for user requests;

The current limit protection component is configured to monitor the request count of the request count window based on the sliding window algorithm to obtain the request count of the current window; and determine whether to execute the limit according to the request count of the current window and the request count of the previous window. Stream operation

The fuse protection component includes a closed state, a half-open state, and an open state, and is configured to enter the half-open state if the number of failed API calls within a preset time window reaches a preset threshold if it is in the closed state; if In the half-open state, if each call to the API is successful, it will be restored from the half-open state to the closed state; if it is in the open state, the timer operation will be started, and when the timer reaches the predetermined time, it will be restored from the open state to the half-open state status;

The service degradation component is configured to: when the service state of the service provider is in a degraded state, stop data processing and return a degraded return code or message;

The authorization verification component is configured to verify authorization according to a preset authorization rule through the authorization filter, and return a code value that rejects the request when the authorization is invalid; the preset authorization rule includes call time, call times, and/or Concurrent number;

The log recording component is configured to generate a serial number for each call event, and asynchronously send the associated information associated with the call event to the message platform.
The computer device of claim 13, wherein the cryptographic signature component is configured to:

Receiving an encryption request carrying the first signature private key sent by the service consumer, where the encryption request carrying the signature private key is obtained based on the service consumer identification number and the first signature private key;

Perform signature verification by using the first signature public key corresponding to the first signature private key to obtain the decrypted service parameters and service consumer identification number;

Encrypt the decrypted service parameters and service consumer identification number according to the second signature private key, and generate an encryption request carrying the second signature private key; and

Forward the encryption request carrying the second signature private key to the service provider, so that the service provider performs a decryption operation through the second signature public key to perform corresponding operations according to the encryption request carrying the second signature private key .
The computer device according to claim 12, wherein the step of configuring the gateway processing logic model further comprises:

Configure multiple plug-ins for the multiple instances to call, wherein each plug-in corresponds to a business rule.
A computer-readable storage medium in which a computer program is stored, and the computer program can be executed by at least one processor, so that the at least one processor executes the following steps:

Monitoring gateway configuration data stored in a tree structure in the collaborative service cluster, where the tree structure includes multiple nodes corresponding to multiple APIs one-to-one;

Judging whether the multiple nodes include at least one target node, where the at least one target node includes a data change node and/or a newly added node;

If the at least one target node is included in the plurality of nodes, updating the gateway configuration of the API corresponding to each target node in the at least one target node to obtain the latest network configuration of each API; and

According to the latest network configuration of each API, the gateway processing logic model is configured.
The computer-readable storage medium according to claim 16, wherein determining whether at least one target node is included in the plurality of nodes comprises:

Detecting whether the version information of each of the multiple nodes has changed; and

If the node includes a node whose version information has changed, the node whose version information has changed is determined as the target node.
The computer-readable storage medium according to claim 16, wherein updating the gateway configuration of the API corresponding to each of the at least one target node comprises:

Sending the gateway configuration update request to the gateway management platform, so that the gateway management platform returns the latest gateway configuration of the API corresponding to each target node;

Receiving the latest gateway configuration of the API corresponding to each target node returned by the gateway management platform; and

According to the latest gateway configuration of the API corresponding to each target node, update the current gateway configuration of the API corresponding to the target node.
The computer-readable storage medium according to claim 16, wherein, according to the latest network configuration of each API, configuring the gateway processing logic model comprises:

Load the latest network configuration of each API into the memory, and configure the gateway processing logic model:

Configure a filter chain for each API and instantiate multiple filters in the filter chain to obtain corresponding multiple instances.
The computer-readable storage medium of claim 19, wherein the step of configuring the gateway processing logic model further comprises:

Configure multiple components for the multiple instances to call;

The multiple components include one or more of the following: a routing component, a parameter conversion component, an API orchestration component, a current limiting protection component, a fuse protection component, a service degradation component, an encryption signature component, an authorization verification component, and a logging component; wherein :

The API orchestration component is configured to: according to the orchestration JSON template provided by the gateway service platform, call each API service in order for user requests;

The current limit protection component is configured to monitor the request count of the request count window based on the sliding window algorithm to obtain the request count of the current window; and determine whether to execute the limit according to the request count of the current window and the request count of the previous window. Stream operation

The fuse protection component includes a closed state, a half-open state, and an open state, and is configured to enter the half-open state if the number of failed API calls within a preset time window reaches a preset threshold if it is in the closed state; if In the half-open state, if each call to the API is successful, it will be restored from the half-open state to the closed state; if it is in the open state, the timer operation will be started, and when the timer reaches the predetermined time, it will be restored from the open state to the half-open state status;

The service degradation component is configured to stop data processing and return a degraded return code or message when the service state of the service provider is in a degraded state;

The authorization verification component is configured to verify authorization according to a preset authorization rule through the authorization filter, and return a code value that rejects the request when the authorization is invalid; the preset authorization rule includes call time, call times, and/or Concurrent number;

The log recording component is configured to generate a serial number for each call event, and asynchronously send the associated information associated with the call event to the message platform.