WO2022022253A1 - 一种服务鉴权方法、装置、设备、系统及存储介质 - Google Patents

一种服务鉴权方法、装置、设备、系统及存储介质 Download PDF

Info

Publication number
WO2022022253A1
WO2022022253A1 PCT/CN2021/105174 CN2021105174W WO2022022253A1 WO 2022022253 A1 WO2022022253 A1 WO 2022022253A1 CN 2021105174 W CN2021105174 W CN 2021105174W WO 2022022253 A1 WO2022022253 A1 WO 2022022253A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
microservice
target
request
configuration
Prior art date
Application number
PCT/CN2021/105174
Other languages
English (en)
French (fr)
Inventor
保飞
Original Assignee
北京金山云网络技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京金山云网络技术有限公司 filed Critical 北京金山云网络技术有限公司
Publication of WO2022022253A1 publication Critical patent/WO2022022253A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources

Definitions

  • the present disclosure relates to the field of Internet technologies, and in particular, to a service authentication method, apparatus, device, system, and storage medium.
  • service authentication plays an extremely important role in the process of verifying external requests and verifying call permissions between microservices.
  • Service authentication can verify whether external requests are Be able to access the inside of the microservice cluster and verify whether the calling requester has permission to access the destination microservice.
  • the commonly used service authentication method in the microservice network architecture is based on the authentication gateway set outside the microservice cluster and the Open Authorization (OAuth2) authentication service set inside the microservice cluster.
  • OAuth2 Open Authorization
  • the service authentication method of the related art has the following disadvantages: after the request obtains the token through the authentication gateway, whether the target microservice it wants to access can be reached depends entirely on the business of each microservice. Code, and the business code of each microservice is independent of each other. In many cases, the calling relationship determined by the business code of each microservice within the microservice cluster is often very messy, and there may be many global functions related to the microservice cluster. Implement inconsistent invocation relationships.
  • the embodiments of the present disclosure provide a service authentication method, device, system, device and storage medium, which can make the calling relationship between the microservices in the microservice cluster clearer and ensure compliance with the global function implementation of the microservice cluster.
  • a first aspect of the embodiments of the present disclosure provides a service authentication method, which is applied to a server processing a target microservice in a microservice cluster, the method comprising: obtaining the target microservice and calling the target microservice by using The first request is authenticated according to the first authentication configuration rule; the first authentication configuration rule is generated based on the target authentication configuration entry, and the target authentication configuration entry is The authentication configuration entry configured by the global configuration framework of the decoupling of the microservice cluster and related to the target microservice; if the authentication passes, the first request is sent; if the authentication fails, the transmission is intercepted the first request.
  • a second aspect of the embodiments of the present disclosure provides a service authentication method, which is applied to a server processing a target microservice in a microservice cluster, the method comprising: obtaining a second request used by a source microservice when calling the target microservice ; Authenticate the second request according to the second authentication configuration rule; the second authentication configuration rule is generated based on the target authentication configuration entry, and the target authentication configuration entry is based on the The authentication configuration entry configured by the cluster-decoupled global configuration framework and related to the target microservice; if the authentication passes, the second request is received and processed; if the authentication fails, the first request is rejected. Second request.
  • a third aspect of the embodiments of the present disclosure provides a service authentication apparatus, the apparatus is applied to a server responsible for a target microservice in a microservice cluster, and the apparatus includes: a request acquisition unit configured to acquire the target microservice call The first request used when the target microservice is used; the authentication unit is set to authenticate the first request according to the first authentication configuration rule; the first authentication configuration rule is generated based on the target authentication configuration entry , the target authentication configuration entry is an authentication configuration entry that is configured based on the global configuration framework decoupled from the microservice cluster and is related to the target microservice; the sending processing unit is set to, if the authentication is passed, Then send the first request; if the authentication fails, intercept and send the first request.
  • a fourth aspect of the embodiments of the present disclosure provides a service authentication apparatus, the apparatus is applied to a server responsible for a target microservice in a microservice cluster, and the apparatus includes: a request obtaining unit, configured to obtain a source microservice and invoke the The second request used when the target microservice is used; the authentication unit is set to authenticate the second request according to the second authentication configuration rule; the second authentication configuration rule is generated based on the target authentication configuration entry , the target authentication configuration entry is an authentication configuration entry that is configured based on the global configuration framework decoupled from the microservice cluster and is related to the target microservice; the receiving processing unit is set to, if the authentication is passed, The second request is received and processed; if the authentication fails, the second request is rejected.
  • a fifth aspect of an embodiment of the present disclosure provides a server, where the server is configured to process a target microservice in a microservice cluster, the server includes a proxy module and an interception module; the proxy module is configured to obtain the target microservice The first request used when the service invokes the target microservice; the first request is authenticated according to the first authentication configuration rule, the first authentication configuration rule is generated based on the target authentication configuration entry, and the target The authentication configuration entry is an authentication configuration entry configured based on the global configuration framework decoupled from the microservice cluster and related to the target microservice; if the authentication is passed, the first request is sent; if the authentication is passed, the first request is sent; If the right is not passed, the first request is intercepted and sent; the interception module is set to obtain the second request used when the source microservice calls the target microservice; according to the second authentication configuration rule, the second request is Carry out authentication, and the second authentication configuration rule is generated based on the target authentication configuration entry; if the authentication is passed, then receive and process the second request;
  • a sixth aspect of the embodiments of the present disclosure provides a service authentication system, the system includes: a configuration center and servers corresponding to multiple microservices in a microservice cluster; the configuration center is configured to store data for the microservices Each authentication configuration item of the cluster configuration; each of the servers is configured to execute the service authentication method described in the first aspect or the second aspect.
  • a seventh aspect of an embodiment of the present disclosure provides a server, the server includes: a processor and a memory: the memory is configured to store a computer program, and transmit the computer program to the processor; the processor is configured to To perform the service authentication method according to the first aspect or the second aspect according to the computer program.
  • An eighth aspect of the embodiments of the present disclosure provides a computer-readable storage medium, where the computer-readable storage medium is configured to store a computer program, and the computer program is configured to execute the service authentication described in the first aspect or the second aspect. right method.
  • a ninth aspect of the embodiments of the present disclosure provides a computer program product including instructions, which, when executed on a computer, cause the computer to execute the service authentication method described in the first aspect or the second aspect.
  • the embodiments of the present disclosure provide a service authentication method, in which the server responsible for processing the target microservice in the microservice cluster can be obtained after obtaining After the target microservice invokes the first request used by the target microservice, the first request is authenticated according to the first authentication configuration rule. If the authentication passes, the first request is sent. Otherwise, if the authentication fails, the first request is sent. Then intercept and send the first request.
  • the server responsible for processing the target microservice in the microservice cluster can also authenticate the second request according to the second authentication configuration rule after obtaining the second request used by the source microservice to call the target microservice. If the authentication is passed, the second request is received and processed; otherwise, if the authentication is not passed, the second request is rejected.
  • the first authentication configuration rule based on the above-mentioned authentication of the first request and the second authentication configuration rule based on the authentication of the second request are both generated based on the target authentication configuration entry, and the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • FIG. 1 is a schematic diagram of an implementation architecture of a service authentication method in the related art
  • FIG. 2 is a schematic diagram of the working principle of the service authentication system provided by the present disclosure
  • FIG. 3 is a schematic flowchart of a method for configuring an authentication configuration rule provided by the present disclosure
  • FIG. 4 is a schematic diagram of a target authority division dimension provided by the present disclosure.
  • FIG. 5 is a schematic flowchart of a service authentication method provided by the present disclosure.
  • FIG. 6 is a schematic flowchart of another service authentication method provided by the present disclosure.
  • FIG. 7 is a schematic diagram of an implementation manner of three authentication types provided by the present disclosure.
  • FIG. 8 is a schematic structural diagram of a service authentication device provided by the present disclosure.
  • FIG. 9 is a schematic structural diagram of another service authentication device provided by the present disclosure.
  • FIG. 10 is a schematic structural diagram of a server provided by the present disclosure.
  • the commonly used service authentication method in the microservice network architecture is based on the authentication gateway set outside the microservice cluster and the Open Authorization (OAuth2) authentication service set inside the microservice cluster.
  • the implementation architecture is shown in Figure 1.
  • the administrator can configure the authentication information in the OAuth2 authentication service in advance, and after completing the configuration of the authentication information, cold start the authentication gateway, so that the authentication gateway can read the authentication information configured in the OAuth2 authentication service during the cold start process; in practical applications , requests from outside the microservice cluster will pass through the authentication gateway.
  • the authentication gateway can determine whether to intercept the received request based on the previously read authentication information.
  • call The OAuth2 authentication service authenticates the request, and configures the corresponding token for the request after the authentication is passed, allowing the request to carry the token to access the inside of the microservice cluster, and the request to get the token can be based on the Service code for routing.
  • the inventors of the present disclosure found that the above-mentioned service authentication method has the following disadvantages: after requesting to obtain the token through the authentication gateway, whether the target microservice that it wants to access can be reached depends entirely on the business of each microservice Code, and the business codes of each microservice are independent of each other.
  • microservice A may be allowed to call microservice B in one direction; it can be seen that the calling relationship determined by the business code of each microservice within the microservice cluster is often very messy, and there may be many The global function implementation of the microservice cluster does not match the calling relationship.
  • the calling relationship between microservices is mainly determined by the business code of each microservice in the microservice cluster, which will lead to the call topology complexity of the microservice cluster completely depends on the business code of the microservice, and the business code based on the microservice
  • the determined invocation relationship is often too messy, and there may be a large number of invocation relationships that are inconsistent with the global function implementation of the microservice cluster.
  • the embodiments of the present disclosure provide a service authentication method, which can effectively solve the problems existing in the above-mentioned related technologies, so that the calling relationship between the micro-services in the micro-service cluster is clearer, and Ensure alignment with the global functional implementation of the microservice cluster.
  • the server responsible for processing the target microservice in the microservice cluster can configure the first authentication according to the first request after the target microservice calls the target microservice.
  • the rule authenticates the first request, and if the authentication passes, the first request is sent; otherwise, if the authentication fails, the first request is intercepted and sent.
  • the server responsible for processing the target microservice in the microservice cluster can also authenticate the second request according to the second authentication configuration rule after obtaining the second request used by the source microservice to call the target microservice. If the authentication is passed, the second request is received and processed; otherwise, if the authentication is not passed, the second request is rejected.
  • the first authentication configuration rule based on the above-mentioned authentication of the first request and the second authentication configuration rule based on the authentication of the second request are both generated based on the target authentication configuration entry, and the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • the above service authentication method uses the authentication configuration entries configured based on the global configuration framework decoupled from the microservice cluster to replace the business code of the microservice, and determines the calling relationship between the microservices in the microservice cluster, so that each microservice in the microservice cluster can be made.
  • the calling relationship between services is clearer, and it is guaranteed to be consistent with the global function implementation of the microservice cluster.
  • the global configuration framework decoupled from the microservice cluster corresponds to the overall function implementation of the microservice cluster, which can strictly limit the calling relationship between the microservices in the microservice cluster, so that the microservices The calling relationship between them completely corresponds to the actual functional business implementation of the microservice cluster.
  • the authentication configuration entry configured from the global configuration framework decoupled from the microservice cluster will be specified accordingly. Only microservice A is allowed to call microservice B in one direction, and microservice B is not allowed to call microservice A.
  • the authentication configuration entries configured from the global configuration framework decoupled from the microservice cluster can strictly correspond to the overall function implementation of the microservice cluster, and there is no microservice call inconsistent with the actual business implementation of the microservice cluster. relation.
  • the server configured to execute the above service authentication method may be an application server or a Web server, and in actual deployment, the server may be an independent server or a cluster server.
  • FIG. 2 is a schematic diagram of a working principle of a service authentication system provided by an embodiment of the present disclosure.
  • the service authentication system includes: a configuration center 210, a server 220 corresponding to microservice A and a server 230 corresponding to microservice B in the microservice cluster; wherein, both the server 220 and the server 230 include an agent module and an interception module, the proxy module is set to authenticate requests to be sent by the server, and the interception module is set to authenticate requests to be received by the server.
  • the server 220 and the server 230 can exchange information with the configuration center 210 through the network, and the server 220 and the server 230 can also exchange information through the network.
  • a microservice cluster may include more microservices, and accordingly, the service authentication system provided by the embodiments of the present disclosure may include more servers corresponding to each of the microservices; here for convenience In the description, the service authentication system shown in FIG. 2 only includes the server 220 corresponding to the microservice A and the server 230 corresponding to the microservice B as an example, the embodiment of the present disclosure does not make any actual number of servers included in the microservice cluster. limited.
  • the configuration center 210 is configured to store each authentication configuration entry configured for the microservice cluster.
  • the manager of the microservice cluster can store each authentication configuration entry configured based on the global configuration framework decoupled from the microservice cluster to the configuration center 210, and then the configuration center 210 can issue each authentication configuration entry to the microservice through the network.
  • Each microservice in the service cluster is delivered to the server 220 corresponding to microservice A and the server 230 corresponding to microservice B.
  • the configuration center 210 can also display the authentication configuration items in a unified manner, so that the administrator can know the clear calling relationship between the microservices in the microservice cluster.
  • the server 220 and the server 230 can monitor the configuration center 210 based on the watch mechanism. Once the newly added authentication configuration entry is stored in the configuration center 210, the server 220 and the server 230 can monitor the configuration center 210 in a timely manner. Acquire the newly added authentication configuration entry, and dynamically load the acquired authentication configuration entry into its own memory during the running of the microservice. In addition, the configuration center 210 can also send the newly added authentication configuration entry to the server 220 and the server 220 in a timely manner through a Remote Procedure Call (RPC) interface when it detects that it stores the newly added authentication configuration entry. The server 230, so that the server 220 and the server 230 can dynamically load the newly added authentication configuration entry into its own memory.
  • RPC Remote Procedure Call
  • the second authentication configuration rule implements the service authentication method provided by the embodiments of the present disclosure.
  • the following takes the server 220 executing the service authentication method as an example for description. It should be understood that the execution process of the server 230 is the same as that of the server 220 .
  • the server 220 After the server 220 obtains the authentication configuration entry from the configuration center 210, it can filter out the target authentication configuration entry related to the microservice A from the obtained authentication configuration entry. Target field, select an authentication configuration item matching the above target field from the acquired authentication configuration items as the target authentication configuration item.
  • the corresponding authentication configuration rule of the target authentication configuration entry is injected into the proxy module and/or in the server 220 accordingly.
  • the interception module injects the first authentication configuration rule set to authenticate the first request to be sent into the proxy module, and the second authentication configuration rule set to authenticate the second request to be received into the interception module.
  • the first authentication configuration rule corresponding to the target authentication configuration entry can be injected into the proxy module; for the target authentication configuration whose authentication type is interception after request entry, the second authentication configuration rule corresponding to the target authentication configuration entry can be injected into the interception module; for the target authentication configuration entry whose authentication type is not intercepted, the authentication configuration rule corresponding to the target authentication configuration entry can be Inject the proxy module and the interception module at the same time.
  • the first authentication configuration rule and the second authentication configuration rule take effect immediately after the injection is completed.
  • the server 220 may, through the proxy module and/or interception module therein, correspondingly treat the sent first request and/or
  • the second request to be received is authenticated.
  • the proxy module may authenticate the first request currently to be sent by the server 220 according to the first authentication configuration rule injected therein. If it is determined that the first request passes the authentication, the first request is sent. If the first request does not pass the authentication, the first request can be intercepted and sent; for another example, the interception module can authenticate the second request currently to be received by the server 220 according to the second authentication configuration rule injected therein. If the second request passes the authentication, the second request is received and processed, and if it is determined that the second request does not pass the authentication, the second request may be rejected.
  • the above configuration center 210 and the microservice cluster are essentially decoupled designs. In practical applications, the server 220 and the server 230 do not pay attention to the specific configuration of the configuration center 210.
  • the configuration center 210 only needs to ensure that it can issue the authentication configuration data (such as yaml data, json data, etc.) in a standardized format to the server 220 and the server 230.
  • various open source or self-developed configuration centers can be used to store the authentication configuration data. configuration data, and this embodiment of the present disclosure does not make any limitation on the configuration center 210.
  • FIG. 3 is a schematic flowchart of a method for configuring an authentication configuration rule (including a first authentication configuration rule and a second authentication configuration rule) according to an embodiment of the present disclosure.
  • the method can be applied to the servers corresponding to each microservice in the microservice cluster.
  • the following takes the application of the service authentication method to the server processing the target microservice in the microservice cluster as an example to introduce the service authentication method.
  • the method includes:
  • Step 301 Obtain a target authentication configuration entry; the target authentication configuration entry is an authentication configuration entry configured based on a global configuration framework decoupled from the microservice cluster and related to the target microservice.
  • the prerequisite for the server to be able to authenticate the request is to generate the authentication configuration rules required for authentication based on the target authentication configuration entry related to the target microservice. Therefore, the server needs to obtain the target authentication configuration entry related to the target microservice first.
  • the embodiment of the present disclosure builds a configuration center, which can store the configuration of the global configuration framework based on the microservice cluster. For each authentication configuration item, correspondingly, the server can obtain the target authentication matching item related to the target microservice from the configuration center.
  • the server can obtain all the authentication configuration entries stored in the configuration center, and further, from the configuration center From the obtained authentication configuration entries, an authentication configuration entry related to the target microservice is selected as the target authentication configuration entry.
  • the configuration center can issue an instruction in response to the authentication configuration entry, and distribute all the currently stored authentication configuration entries to the server corresponding to each microservice in the microservice cluster; the server processing the target microservice receives the distribution from the configuration center After receiving the authentication configuration entry, an authentication configuration entry that matches the target field can be selected from the received authentication configuration entries according to the target field corresponding to the target microservice as the target authentication configuration entry.
  • the configuration center after confirming that the configuration center has collected all the authentication configuration entries currently configured based on the global configuration framework decoupled from the microservice cluster, it can accordingly issue authentication to the server corresponding to each microservice in the microservice cluster Configuration entry acquisition instruction; after the server processing the target microservice receives the authentication configuration entry acquisition instruction, it can traverse the configuration center to pull all the authentication configuration entries stored in it, and then the server can Target field, select an authentication configuration item matching the target field from the pulled authentication configuration items, and use it as a target authentication configuration item.
  • the server in addition to obtaining all the authentication configuration entries stored in the server from the configuration center and selecting the target authentication configuration entry, the server can also directly obtain the required target from the configuration center.
  • Authentication configuration entry For example, the configuration center can pre-determine the microservices associated with each authentication configuration entry it stores, and then directly send the authentication configuration entry related to the microservice to the server corresponding to each microservice, or directly send the authentication configuration entry related to the microservice to each microservice.
  • the corresponding server pulls the authentication configuration entry from the configuration center, it directly provides the server with the authentication configuration entry related to the microservice; this embodiment of the present disclosure does not make any changes to the implementation of the server acquiring the target authentication configuration entry in the initial stage. any restrictions.
  • the server can monitor the above-mentioned configuration center, and when monitoring the newly added authentication configuration entry in the configuration center, obtain the newly added authentication configuration entry from the configuration center; In the authorization configuration entry, select the authentication configuration entry related to the target microservice as the target authentication configuration entry.
  • the server can monitor the configuration center based on the watch mechanism. Once a new authentication configuration entry is detected in the configuration center, it will immediately pull the new authentication configuration entry from the configuration center; during the operation of the target microservice, Dynamically load the pulled new authentication configuration entry into the memory, and select the authentication configuration entry that matches the target field from the newly added authentication configuration entries according to the target field corresponding to the target microservice in the memory.
  • the authorization configuration entry is used as the target authentication configuration entry.
  • the configuration center can also monitor itself. Once the newly added authentication configuration entry is monitored, the newly added authentication configuration entry can be delivered to the server corresponding to each microservice in the microservice cluster through the RPC interface; After receiving the newly added authentication configuration entry, the server processing the target microservice can select an authentication configuration entry that matches the target field from the newly added authentication configuration entries according to the target field corresponding to the target microservice. as the target authentication configuration entry.
  • the newly added authentication configuration entry is dynamically obtained, which can effectively avoid the drawbacks caused by cold-starting the server.
  • the server can not only obtain all the newly added authentication configuration items from the configuration center and select the target authentication configuration items from them, but also directly obtain the new authentication configuration items it needs from the configuration center.
  • Added authentication configuration entry For example, the configuration center can determine the microservice related to the newly added authentication configuration entry, and then directly send the newly added authentication configuration entry to the server corresponding to the microservice, or send the new authentication configuration entry to the server corresponding to the microservice from the configuration center.
  • the server is directly provided with the newly added authentication configuration entry related to the microservice; this embodiment of the present disclosure does not describe the implementation of acquiring the target authentication configuration entry in the actual application stage of the server. make any restrictions.
  • Step 302 Based on the target authority division dimension, generate a corresponding authentication configuration rule (including a first authentication configuration rule and a second authentication configuration rule) according to the target authentication configuration entry.
  • the server can process the target authentication configuration entry based on the target authority division dimension for each target authentication configuration entry, so as to generate an authentication configuration corresponding to the target authentication configuration entry. rule.
  • the above-mentioned target authority division dimension is essentially a template required to convert the authentication configuration entry into an authentication configuration rule. Based on the target authority division dimension, the authentication configuration entry can be converted into fine-grained correspondingly. authentication configuration rules to meet the scenario requirements of fine-grained service authentication management.
  • the above-mentioned target authority division dimension may be determined according to an authentication mode, an authentication rule and a matching (Match) rule.
  • the target authority division dimension may be equal to authentication mode*authentication rule*matching rule.
  • the authentication mode can determine whether the request matching the generated authentication configuration rule can pass the authentication; the authentication rule can determine the reference information to be used when authenticating the request; the matching rule can determine whether the request is authenticated the handling of the above-mentioned reference information at the time of authorization.
  • the above authentication mode may include a blacklist (blacklist) or a whitelist (whitelist).
  • blacklist blacklist
  • whitelist whitelist
  • the authentication mode is a blacklist
  • a request matches the generated authentication configuration rule it means that the request has not passed the authentication; otherwise, if a request does not match the generated authentication configuration rule, it means The request is authenticated.
  • the authentication mode is a whitelist, if a request matches the generated authentication configuration rules, it means that the request passes the authentication; otherwise, if a request does not match the generated authentication configuration rules, it means that the The request was not authenticated.
  • the reference information involved in the above authentication rule may include at least one of the following: resource identifier (url), request path (path), request method (method), and destination address (ip) , request name (application-name), request type (application-version), and request service name (service-name).
  • resource identifier url
  • request path path
  • request method method
  • destination address ip
  • request name application-name
  • request type application-version
  • request service name service-name
  • the processing methods involved in the above matching rules may include at least one of the following: prefix-based matching, suffix-based matching, full matching, matching based on contained information, and matching based on regular processing results.
  • the extracted reference information may be processed correspondingly according to the processing method involved in the matching rule, so as to determine the request authentication result according to the processing result.
  • the server may also include a authority division dimension extension interface, and the authority division dimension extension interface can be set as: Extend at least one of the above authentication types, authentication rules and matching rules.
  • the server can receive a dimension expansion request through the above-mentioned authority division dimension expansion interface, and the header of the dimension expansion request can carry a tag corresponding to the factor to be expanded, and the server requests the dimension expansion Perform parsing processing, and then expand the authentication type, authentication rules or matching rules in the target authority division dimension accordingly according to the analysis processing result, so that the target authority division dimension can be easily expanded and accessed, so that the server can meet more fine-grained requirements. requirements for service authentication scenarios.
  • Step 303 Inject the authentication configuration rule into the proxy module and/or the interception module according to the authentication type corresponding to the target authentication configuration entry.
  • the server After the server generates the authentication configuration rule, for the authentication configuration rule corresponding to each target authentication configuration entry, it can determine the authentication configuration rule corresponding to the target authentication configuration entry according to the authentication type corresponding to the target authentication configuration entry Whether the first authentication configuration rule is the second authentication configuration rule, the first authentication configuration rule is correspondingly injected into the proxy module, and the second authentication configuration rule is correspondingly injected into the interception module.
  • the authentication types corresponding to the authentication configuration entries mainly include: pre-request interception, post-request interception, and non-interception; the authentication configuration entry can use the switch mode to represent its corresponding authentication type.
  • the server may determine that the authentication configuration rule corresponding to the target authentication configuration entry is the first authentication configuration rule, and inject the first authentication configuration rule into the
  • the proxy module in the server is used to authenticate the request to be sent by the proxy module before the server sends the request, and decide whether to continue sending the request. In this way, the transmission of invalid requests in the microservice cluster can be avoided, and the bandwidth and traffic occupied by the transmission of invalid requests can be saved.
  • the server may determine that the authentication configuration rule corresponding to the target authentication configuration entry is the second authentication configuration rule, and inject the second authentication configuration rule into
  • the interception module in the server is used to authenticate the request to be received through the interception module before the server processes the incoming request, and decide whether to continue to receive and process the request.
  • the server may determine that the authentication configuration rule corresponding to the target authentication configuration entry is both the first authentication configuration rule and the second authentication configuration rule, and the target The authentication configuration rule corresponding to the authentication configuration entry is injected into the proxy module and the interception module in the server. This scenario can be used as a test environment Debug.
  • requests through the authentication gateway outside the microservice cluster basically require the OAuth2 authentication service to authenticate them, which will cause the OAuth2 authentication service to become the bottleneck component of the entire system, resulting in a single point of failure.
  • the possibility of dragging down the entire system increases.
  • the method provided by the embodiments of the present disclosure supports the identity verification performed by the microservice itself, that is, when the target microservice is a service that needs identity authentication, the server can also deploy the authentication accordingly. module.
  • the authentication configuration rule corresponding to the target authentication configuration entry is the third authentication configuration rule, and the third authentication configuration rule is injected into the authentication module, so that in practical applications, the authentication module performs identity authentication on the request to be authenticated according to the third authentication configuration rule injected therein.
  • the server can inject the OAuth2 authentication service authentication configuration rules into the authentication module of the fund service, so that it can be used in practical applications.
  • the authentication module can authenticate the access request according to the OAuth2 authentication service authentication configuration rules.
  • the calling relationship between the microservices in the microservice cluster can be determined, so that the microservices in the microservice cluster can communicate with each other.
  • the calling relationship is clearer, and it is guaranteed to be consistent with the global function implementation of the microservice cluster.
  • FIG. 5 is a schematic flowchart of a service authentication method provided by an embodiment of the present disclosure.
  • the method can be applied to the servers corresponding to each microservice in the microservice cluster. In some embodiments, for example, it is applied to the proxy module in each server, and the first request to be sent by the server can be authenticated by this method, so as to It is determined whether to send the first request.
  • the following will introduce the service authentication method by taking the method applied to the server processing the target microservice in the microservice cluster as an example. As shown in Figure 5, the service authentication method includes:
  • Step 501 Obtain a first request used by the target microservice when calling the target microservice.
  • the server injects the first authentication configuration rule into the proxy module, the first authentication configuration rule can take effect immediately.
  • the server can directly pass the proxy module, according to the injected first authentication configuration rule, correspondingly The first request to be sent is authenticated.
  • Step 502 Authenticate the first request according to a first authentication configuration rule; the first authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is based on the The authentication configuration entries configured by the microservice cluster decoupling global configuration framework and related to the target microservice.
  • Step 503 If the authentication passes, send the first request; if the authentication fails, intercept and send the first request.
  • the server can perform the first request through the proxy module according to the first authentication configuration rules injected therein. Authentication. If the authentication is passed, the first request is sent normally. If the authentication is not passed, the first request is intercepted and sent.
  • the proxy module can authenticate all requests that pass through the server export based on the first authentication configuration rule whose authentication type is intercepted before the request. If it is determined based on the first authentication configuration rule that a first request to be sent fails the authentication. right, the proxy module needs to intercept and send the first request, that is, it will not continue to send the request to the upper-layer network stack, so as to reduce the bandwidth and traffic occupied by invalid requests in the microservice cluster and meet the application scenarios with very strict traffic requirements. need. Conversely, if it is determined based on the first authentication configuration rule that a certain first request passes the authentication, the proxy module may allow the server to send the first request to the server processing the destination service.
  • the server can also send the third request when the proxy module determines not to intercept the third request to be sent by the server according to the first authentication configuration rule injected therein.
  • the proxy module determines not to intercept the third request to be sent by the server according to the first authentication configuration rule injected therein.
  • the proxy module in the server matches a third request according to the first authentication configuration rule injected therein, it will not intercept and send the third request.
  • the sent third request continues to be sent.
  • the following takes the microservice cluster including microservice A and microservice B as an example, and combines FIG.
  • the authentication implementation manner corresponding to each authentication type is illustrated by an example.
  • the prerequisite for implementation is that the server of microservice A resolves to the target authentication configuration entry to prohibit microservice A from calling microservice B; in this scenario, the server of microservice A will use the target authentication configuration entry based on the
  • the generated first authentication configuration rule is injected into the proxy module, and all requests that pass the exit of microservice A will go through the calculation of this first authentication configuration rule.
  • the proxy module can intercept the request where it is ready to send the request, and will not continue to send the request to the upper network stack.
  • the proxy module will not intercept the request even if it matches the request according to the first authentication configuration rule .
  • the server responsible for processing the target microservice in the microservice cluster may, after obtaining the first request used by the target microservice to call the target microservice, perform the first request according to the first authentication configuration rule. Perform authentication, if the authentication passes, send the first request, otherwise, if the authentication fails, intercept and send the first request.
  • the first authentication configuration rule based on the authentication of the first request is generated based on the target authentication configuration entry.
  • Service-related authentication configuration entries are used. In this way, by using the authentication configuration entries configured based on the global configuration framework decoupled from the microservice cluster to replace the business code of the microservice, the calling relationship between the microservices in the microservice cluster can be determined, so that the microservices in the microservice cluster can communicate with each other. The calling relationship is clearer, and it is guaranteed to be consistent with the global function implementation of the microservice cluster.
  • FIG. 6 is a schematic flowchart of another service authentication method provided by an embodiment of the present disclosure.
  • the method can be applied to the servers corresponding to each microservice in the microservice cluster. In some implementations, for example, it is applied to the interception module in each server, and the second request to be received by the server can be authenticated by this method, so as to It is determined whether to accept and process the second request.
  • the following will introduce the service authentication method by taking the method applied to the server processing the target microservice in the microservice cluster as an example. As shown in Figure 6, the service authentication method includes:
  • Step 601 Obtain a second request used when the source microservice calls the target microservice.
  • the server injects the second authentication configuration rule into the interception module, the second authentication configuration rule can take effect immediately.
  • the server can directly pass the interception module, according to the injected second authentication configuration rule, correspondingly The second request to be received is authenticated.
  • Step 602 Authenticate the second request according to a second authentication configuration rule; the second authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is based on the The authentication configuration entries configured by the microservice cluster decoupling global configuration framework and related to the target microservice.
  • Step 603 If the authentication passes, receive and process the second request; if the authentication fails, refuse to receive the second request.
  • the server can perform the second request through the interception module according to the second authentication configuration rules injected therein. Authentication. If the authentication is passed, the second request is received and processed. If the authentication is not passed, the second request is rejected.
  • the interception module can authenticate all the second requests received by the server based on the second authentication configuration rule whose authentication type is interception after the request. If it is determined based on the second authentication configuration rule that a certain second request fails the authentication, then The interception module needs to refuse to receive the second request. On the contrary, if it is determined based on the second authentication configuration rule that a second request passes the authentication, the interception module allows the server to continue to receive the second request and perform subsequent processing on the second request.
  • the interception module may send a refusal to receive a response to the server processing the source service to notify the server processing the source service that the request has been intercepted.
  • the server may also receive the fourth request when the interception module determines not to intercept the fourth request to be received by the server according to the second authentication configuration rule injected therein.
  • the interception module in the server will not intercept and receive the fourth request even if it matches a fourth request according to the second authentication configuration rule injected therein. Received requests continue to be received.
  • the following takes the microservice cluster including microservice A and microservice B as an example, and combines FIG.
  • the authentication implementation manner corresponding to each authentication type is illustrated by an example.
  • the precondition is that the server of microservice B resolves the target authentication configuration entry to prohibit microservice A from calling microservice B; in this scenario, the server of microservice B will use the target authentication configuration entry
  • the generated second authentication configuration rule is injected into the interception module.
  • the server of microservice A can still send requests to the server of microservice B normally, but all requests through the entrance of microservice B will go through this second authentication
  • the calculation of the configuration rule when it is determined according to the second authentication configuration rule that the authentication of a request fails, the interception module may refuse to receive the request, and respond with a 404 http status code.
  • the interception module will not intercept the request even if it matches the request according to the second authentication configuration rule .
  • the server responsible for processing the target microservice in the microservice cluster may also obtain the second request used when the source microservice calls the target microservice, according to the second authentication
  • the configuration rule authenticates the second request, and if the authentication passes, the second request is received and processed; otherwise, if the authentication fails, the second request is rejected.
  • the second authentication configuration rules based on the above-mentioned authentication of the second request are all generated based on the target authentication configuration entry.
  • the target authentication configuration entry is configured based on the global configuration framework decoupled from the microservice cluster and is related to Authentication configuration entries related to the target microservice.
  • the calling relationship between the microservices in the microservice cluster can be determined, so that the microservices in the microservice cluster can communicate with each other.
  • the calling relationship is clearer, and it is guaranteed to be consistent with the global function implementation of the microservice cluster.
  • FIG. 8 is a schematic structural diagram of the service authentication apparatus 800 .
  • the service authentication device can be applied to the server responsible for the target microservice in the microservice cluster, and the device includes:
  • the request obtaining unit 801 is configured to obtain the first request used when the target microservice invokes the target microservice;
  • the authentication unit 802 is configured to authenticate the first request according to a first authentication configuration rule; the first authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is An authentication configuration entry configured based on a global configuration framework decoupled from the microservice cluster and related to the target microservice;
  • the sending processing unit 803 is configured to send the first request if the authentication passes; intercept and send the first request if the authentication fails.
  • the device further includes:
  • the first authentication configuration rule generation unit is configured to obtain the target authentication configuration entry; based on the target authority division dimension, according to the target authentication configuration entry whose authentication type is intercepted or not intercepted before the request, the first authentication configuration entry is generated.
  • An authentication configuration rule is configured to obtain the target authentication configuration entry; based on the target authority division dimension, according to the target authentication configuration entry whose authentication type is intercepted or not intercepted before the request.
  • FIG. 9 is a schematic structural diagram of the service authentication apparatus 900 .
  • the service authentication device can be applied to the server responsible for the target microservice in the microservice cluster, and the device includes:
  • the request obtaining unit 901 is configured to obtain the second request used when the source microservice invokes the target microservice;
  • the authentication unit 902 is configured to authenticate the second request according to a second authentication configuration rule; the second authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is An authentication configuration entry configured based on a global configuration framework decoupled from the microservice cluster and related to the target microservice;
  • the receiving processing unit 903 is configured to receive and process the second request if the authentication is passed, and refuse to receive the second request if the authentication fails.
  • the device further includes:
  • the second authentication configuration rule generation unit is configured to obtain the target authentication configuration entry; based on the target authority division dimension, according to the target authentication configuration entry whose authentication type is post-request interception or non-interception, the first authentication configuration entry is generated. 2. Authentication configuration rules.
  • the first authentication configuration rule generation unit or the second authentication configuration rule generation unit may be set to:
  • the configuration center is set to store each authentication configuration entry configured for the microservice cluster;
  • the first authentication configuration rule generation unit or the second authentication configuration rule generation unit is specifically set as:
  • the configuration center is set to store each authentication configuration entry configured for the microservice cluster;
  • an authentication configuration entry related to the target microservice is selected as the target authentication configuration entry.
  • the target authority division dimension is determined according to an authentication mode, an authentication rule and a matching rule; the authentication mode is set to determine whether a request matching the authentication configuration rule passes the authentication; The authentication rule is set to determine the reference information used when authenticating the request; the matching rule is set to determine the processing method of the reference information when the request is authenticated.
  • the authentication mode includes: a blacklist or a whitelist
  • the reference information includes at least one of the following: resource locator, request path, request method, destination address, request name, request type, and request service name;
  • the processing methods include at least one of the following: matching based on prefixes, matching based on suffixes, full matching, matching based on contained information, and matching based on regular processing results.
  • the server further includes a rights division dimension extension interface, and the rights division dimension extension interface is configured to extend at least one of the authentication mode, the authentication rule, and the matching rule.
  • the apparatus when the target microservice is a service requiring identity authentication, the apparatus further includes:
  • the identity authentication module is configured to perform identity authentication on the request to be authenticated according to the third authentication configuration rule; the third authentication configuration rule is generated based on the target authentication configuration entry whose authentication type is identity authentication.
  • the server responsible for processing the target microservice in the microservice cluster may configure the first authentication according to the first request after the target microservice calls the target microservice after obtaining the first request.
  • the rule authenticates the first request, and if the authentication passes, the first request is sent; otherwise, if the authentication fails, the first request is intercepted and sent.
  • the server responsible for processing the target microservice in the microservice cluster can also authenticate the second request according to the second authentication configuration rule after obtaining the second request used by the source microservice to call the target microservice. If the authentication is passed, the second request is received and processed; otherwise, if the authentication is not passed, the second request is rejected.
  • the first authentication configuration rule based on the above-mentioned authentication of the first request and the second authentication configuration rule based on the authentication of the second request are both generated based on the target authentication configuration entry, and the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • the embodiment of the present disclosure further provides a server set for service authentication, and the following will introduce the server provided by the embodiment of the present disclosure from the perspective of hardware materialization.
  • FIG. 10 is a schematic structural diagram of a server 1000 according to an embodiment of the present disclosure.
  • the server 1000 may vary greatly due to configuration or performance, and may include one or more central processing units (CPU) 1022 (eg, one or more processors) and memory 1032, one or more
  • the above storage medium 1030 eg, one or more mass storage devices
  • the memory 1032 and the storage medium 1030 may be short-term storage or persistent storage.
  • the program stored in the storage medium 1030 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server.
  • the central processing unit 1022 may be configured to communicate with the storage medium 1030 to execute a series of instruction operations in the storage medium 1030 on the server 1000 .
  • Server 1000 may also include one or more power supplies 1026, one or more wired or wireless network interfaces 1050, one or more input and output interfaces 1058, and/or, one or more operating systems 1041, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and so on.
  • operating systems 1041 such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and so on.
  • the steps performed by the server in the above embodiment may be based on the server structure shown in FIG. 10 .
  • CPU 1022 is set to perform the following steps:
  • the first request is authenticated according to a first authentication configuration rule;
  • the first authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is based on the the authentication configuration entries configured by the decoupled global configuration framework and related to the target microservice;
  • the first request is sent; if the authentication fails, the first request is intercepted and sent.
  • the second request is authenticated according to a second authentication configuration rule;
  • the second authentication configuration rule is generated based on a target authentication configuration entry, and the target authentication configuration entry is based on the the authentication configuration entries configured by the decoupled global configuration framework and related to the target microservice;
  • the second request is received and processed; if the authentication is not passed, the second request is rejected.
  • the CPU 1022 may also be configured to execute the steps of any implementation manner of the service authentication method provided by the embodiment of the present disclosure.
  • An embodiment of the present disclosure further provides a computer-readable storage medium, which is configured to store a computer program, and the computer program is configured to execute any one of the implementation manners of the service authentication methods described in the foregoing embodiments.
  • Embodiments of the present disclosure also provide a computer program product including instructions, which, when run on a computer, cause the computer to execute any one of the implementation manners of the service authentication methods described in the foregoing embodiments.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the embodiments of the present disclosure can be embodied in the form of software products in essence, or the parts that contribute to related technologies, or all or part of the technical solutions, and the computer software products are stored in a storage medium. , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present disclosure.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (full English name: Read-Only Memory, English abbreviation: ROM), random access memory (English full name: Random Access Memory, English abbreviation: RAM), magnetic Various media that can store computer programs, such as discs or optical discs.
  • the service authentication method of the related art has the following disadvantages: after the request obtains the token through the authentication gateway, whether the microservice that it wants to access can be reached depends entirely on the business code of each microservice, and the business code of each microservice They are independent of each other. In many cases, the calling relationship determined by the business code of each microservice within the microservice cluster is often very messy, and there may be many calling relationships that are inconsistent with the global function implementation of the microservice cluster.
  • the embodiments of the present disclosure provide a service authentication method, apparatus, device, system and storage medium, wherein the method includes: a server in a microservice cluster responsible for processing target microservices can be After obtaining the first request used when the target microservice calls the target microservice, authenticate the first request according to the first authentication configuration rule, and after obtaining the second request used when the source microservice calls the target microservice, The second request is authenticated according to the second authentication configuration rule.
  • the first authentication configuration rule based on the above-mentioned authentication of the first request and the second authentication configuration rule based on the authentication of the second request are both generated based on the target authentication configuration entry, and the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.
  • the target authentication configuration entry is Authentication configuration entries related to the target microservice configured based on the global configuration framework decoupled from the microservice cluster.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供了一种服务鉴权方法、装置、设备、系统及存储介质，其中该方法包括：微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权。上述第一鉴权配置规则和第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。该方法能够使得微服务集群内部各微服务间的调用关系更清晰，保证与微服务集群的全局功能实现相符。

Description

一种服务鉴权方法、装置、设备、系统及存储介质
本公开要求于2020年07月28日提交中国专利局、申请号为202010736994.9、发明名称为“一种服务鉴权方法、装置、设备、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开涉及互联网技术领域，尤其涉及一种服务鉴权方法、装置、设备、系统及存储介质。
背景技术
在微服务网络架构中，服务鉴权作为一种常见的安全管控措施，在验证外界请求和验证微服务间调用权限的过程中均起到了极为重要的作用，通过服务鉴权可以验证外界请求是否能够访问微服务集群内部，以及验证调用请求方是否有权限访问目的微服务。
目前，微服务网络架构中常用的服务鉴权方法，是基于设置在微服务集群外部的鉴权网关和设置在微服务集群内部的开放授权(Open Authorization，OAuth2)认证服务实现的。
经本公开的发明人研究发现，相关技术的服务鉴权方法存在以下缺点：请求通过鉴权网关拿到token后，能否到达其想要访问的目的微服务完全取决于该各个微服务的业务编码，而各个微服务的业务编码彼此是互相独立的，在很多情况下，由微服务集群内部的各微服务的业务编码决定的调用关系往往非常杂乱，可能存在很多与微服务集群的全局功能实现不相符的调用关系。
发明内容
本公开实施例提供了一种服务鉴权方法、装置、系统、设备及存储介质，能够使得微服务集群内部各微服务间的调用关系更清晰，保证与微服务集群的全局功能实现相符。
有鉴于此，本公开实施例第一方面提供了一种服务鉴权方法，应用于微服务集群中处理目标微服务的服务器，所述方法包括：获取所述目标微服务调用目的微服务时使用的第一请求；根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
本公开实施例第二方面提供了一种服务鉴权方法，应用于微服务集群中处理目标微服务的服务器，所述方法包括：获取源微服务调用所述目标微服务时使用的第二请求；根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
本公开实施例第三方面提供了一种服务鉴权装置，所述装置应用于微服务集群中负责目标微服务的服务器，所述装置包括：请求获取单元，设置为获取所述目标微服务调用目的微服务时使用的第一请求；鉴权单元，设置为根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；发送处理单元，设置为若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
本公开实施例第四方面提供了一种服务鉴权装置，所述装置应用于微服务集群中负责目标微服务的服务器，所述装置包括：请求获取单元，设置为获取源微服务调用所述目标微服务时使用的第二请求；鉴权单元，设置为根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；接收处理单元，设置为若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
本公开实施例第五方面提供了一种服务器，所述服务器设置为处理微服务集群中的目标微服务，所述服务器包括代理模块和拦截模块；所述代理模块，设置为获取所述目标微服务调用目的微服务时使用的第一请求；根据第一鉴权配置规则对所述第一请求进行鉴权，所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求；所述拦截模块，设置为获取源微服务调用所述目标微服务时使用的第二请求；根据第二鉴权配置规则对所述第二请求进行鉴权，所述第二鉴权配置规则是基于所述目标鉴权配置条目生成的；若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
本公开实施例第六方面提供了一种服务鉴权系统，所述系统包括：配置中心和微服务集群中多个微服务各自对应的服务器；所述配置中心，设置为存储针对所述微服务集群配置的各鉴权配置条目；每个所述服务器，设置为执行上述第一方面或第二方面所述的服务鉴权方法。
本公开实施例第七方面提供了一种服务器，所述服务器包括：处理器以及存储器：所述存储器设置为存储计算机程序，并将所述计算机程序传输给所述处理器；所述处理器设置为根据所述计算机程序，执行第一方面或第二方面所述的服务鉴权方法。
本公开实施例第八方面提供了一种计算机可读存储介质，所述计算机可读存储介质设置为存储计算机程序，所述计算机程序设置为执行上述第一方面或第二方面所述的服务鉴权方法。
本公开实施例第九方面提供了一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行上述第一方面或第二方面所述的服务鉴权方法。
从以上技术方案可以看出，本公开实施例具有以下优点：本公开实施例提供了一种服务鉴权方法，在该方法中，微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，若鉴权通过，则发送该第一请求，反之，若鉴权未通过，则拦截发送该第一请求。此外，微服务集群中负责处理目标微服务的服务器，还可以在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权，若鉴权通过，则接收处理该第二请求，反之，若鉴权未通过，则拒绝接收该第二请求。
上述鉴权第一请求时依据的第一鉴权配置规则、以及鉴权第二请求时依据的第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
附图说明
图1为相关技术中服务鉴权方法的实现架构示意图；
图2为本公开提供的服务鉴权系统的工作原理示意图；
图3为本公开提供的用于配置鉴权配置规则的方法的流程示意图；
图4为本公开提供的目标权限划分维度的示意图；
图5为本公开提供的一种服务鉴权方法的流程示意图；
图6为本公开提供的另一种服务鉴权方法的流程示意图；
图7为本公开提供的三种鉴权类型的实现方式示意图；
图8为本公开提供的一种服务鉴权装置的结构示意图；
图9为本公开提供的另一种服务鉴权装置的结构示意图；
图10为本公开提供的一种服务器的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本公开实施例的方案，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本公开的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
相关技术中，微服务网络架构中常用的服务鉴权方法，是基于设置在微服务集群外部的鉴权网关和设置在微服务集群内部的开放授权(Open Authorization，OAuth2)认证服务实现的，其实现架构如图1所示。管理者可以预先在OAuth2认证服务中配置认证信息，完成认证信息的配置后，冷启动鉴权网关，以使鉴权网关在冷启动过程中读取OAuth2认证服务中配置的认证信息；在实际应用时，来自微服务集群外部的请求均会通过鉴权网关，鉴权网关可以基于此前读取的认证信息确定是否拦截所接收的请求，在确认所接收的请求为需要身份认证的请求时，调用OAuth2认证服务对该请求进行认证，并在鉴权通过后为该请求配置对应的token，允许该请求携带token访问微服务集群内部，拿到token的请求可以在微服务集群内部基于各微服务的业务编码进行路由。
然而，经本公开的发明人研究发现，上述服务鉴权方法存在以下缺点：请 求通过鉴权网关拿到token后，能否到达其想要访问的目的微服务完全取决于该各个微服务的业务编码，而各个微服务的业务编码彼此是互相独立的，在很多情况下，从业务编码的角度来看，可能既允许微服务A调用微服务B，又允许微服务B调用微服务A，但是从微服务集群的全局功能实现来看，可能只允许微服务A单向调用微服务B；可见，在微服务集群内部由各微服务的业务编码决定的调用关系往往非常杂乱，可能存在很多与微服务集群的全局功能实现不相符的调用关系。
目前主要由微服务集群中各微服务的业务编码来决定各微服务间的调用关系，如此将导致微服务集群的调用拓扑复杂度完全取决于微服务的业务编码，而基于微服务的业务编码确定的调用关系往往过于杂乱，并且可能存在大量与微服务集群的全局功能实现相悖的调用关系。
针对上述相关技术存在的问题，本公开实施例提供了一种服务鉴权方法，该方法能够有效地解决上述相关技术存在的问题，使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相一致。
在本公开实施例提供的服务鉴权方法中，微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，若鉴权通过，则发送该第一请求，反之，若鉴权未通过，则拦截发送该第一请求。此外，微服务集群中负责处理目标微服务的服务器，还可以在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权，若鉴权通过，则接收处理该第二请求，反之，若鉴权未通过，则拒绝接收该第二请求。
上述鉴权第一请求时依据的第一鉴权配置规则、以及鉴权第二请求时依据的第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。上述服务鉴权方法利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
需要说明的是，与微服务集群解耦的全局配置框架与微服务集群的整体功能实现相对应，其可以严格地限制微服务集群中各个微服务彼此之间的调用关系，使得各个微服务彼此之间的调用关系与微服务集群的实际功能业务实现完全对应。例如，假设从微服务集群的业务实现的角度来看，只允许微服务A单向调用微服务B，那么从与微服务集群解耦的全局配置框架配置的鉴权配置条目，会相应地规定只允许微服务A单向调用微服务B，而不允许微服务B 调用微服务A。换言之，从与微服务集群解耦的全局配置框架配置的鉴权配置条目，可以严格地与该微服务集群的整体功能实现相对应，不存在与微服务集群的实际业务实现不一致的微服务调用关系。
应理解，设置为执行上述服务鉴权方法的服务器可以为应用服务器或Web服务器，在实际部署时，该服务器可以为独立服务器，也可以为集群服务器。
为了便于理解本公开实施例提供的技术方案，下面先对本公开实施例提供的服务鉴权方法所适用的服务鉴权系统进行介绍。
参见图2，图2为本公开实施例提供的服务鉴权系统的工作原理示意图。如图2所示，该服务鉴权系统中包括：配置中心210、微服务集群中微服务A对应的服务器220和微服务B对应的服务器230；其中，服务器220和服务器230中均包括代理模块和拦截模块，代理模块设置为对服务器待发送的请求进行鉴权，拦截模块设置为对服务器待接收的请求进行鉴权。服务器220和服务器230可以通过网络与配置中心210进行信息交互，服务器220与服务器230之间也可以通过网络进行信息交互。
应理解，在实际应用中，微服务集群中可以包括更多的微服务，相应地，本公开实施例提供的服务鉴权系统中可以包括更多的微服务各自对应的服务器；此处为了便于描述，以图2所示的服务鉴权系统仅包括微服务A对应的服务器220和微服务B对应的服务器230作为示例，本公开实施例在此不对微服务集群中实际包括的服务器数量做任何限定。
配置中心210设置为存储针对该微服务集群配置的各鉴权配置条目。微服务集群的管理者可以将基于与微服务集群解耦的全局配置框架配置的各鉴权配置条目存储至配置中心210，进而，配置中心210可以通过网络将各鉴权配置条目下发给微服务集群中各微服务，即下发给微服务A对应的服务器220和微服务B对应的服务器230。此外，配置中心210还可以统一展示各鉴权配置条目，以使管理者获知微服务集群中各微服务间清晰的调用关系。
在实际应用中，服务器220和服务器230可以基于watch机制监控配置中心210，一旦监控到配置中心210中存储有新增的鉴权配置条目，服务器220和服务器230即可从配置中心210处及时地获取新增的鉴权配置条目，并在微服务运行的过程中将所获取的鉴权配置条目动态地加载到自身内存中。此外，配置中心210也可以在检测到自身存储有新增的鉴权配置条目时，通过远程过程调用(Remote Procedure Call，RPC)接口，将新增的鉴权配置条目及时地下发给服务器220和服务器230，以使服务器220和服务器230可以将新增的鉴权配置条目动态地加载到自身内存中。
服务器220和服务器230从配置中心210获取到鉴权配置条目后，可以基 于所获取的鉴权配置条目生成第一鉴权配置规则和第二鉴权配置规则，并基于第一鉴权配置规则和第二鉴权配置规则实现本公开实施例提供的服务鉴权方法，下面以服务器220执行该服务鉴权方法为例进行说明，应理解，服务器230的执行过程与服务器220的执行过程相同。
服务器220从配置中心210获取到鉴权配置条目后，即可从所获取的鉴权配置条目中筛选出与微服务A相关的目标鉴权配置条目，例如，服务器220可以根据微服务A对应的目标字段，从所获取的鉴权配置条目中选出与上述目标字段相匹配的鉴权配置条目作为目标鉴权配置条目。
然后，针对每条目标鉴权配置条目，基于目标权限划分维度进行相应地处理，得到每条目标鉴权配置条目对应的鉴权配置规则。
进而，针对每条目标鉴权配置条目，根据该条目标鉴权配置条目对应的鉴权类型，将该条目标鉴权配置条目对应的鉴权配置规则相应地注入服务器220中的代理模块和/或拦截模块，将设置为鉴权待发送的第一请求的第一鉴权配置规则注入代理模块，将设置为鉴权待接收的第二请求的第二鉴权配置规则注入拦截模块。例如，对于鉴权类型为请求前拦截的目标鉴权配置条目，可以将该目标鉴权配置条目对应的第一鉴权配置规则注入代理模块；对于鉴权类型为请求后拦截的目标鉴权配置条目，可以将该目标鉴权配置条目对应的第二鉴权配置规则注入拦截模块；对于鉴权类型为不拦截的目标鉴权配置条目，可以将该目标鉴权配置条目对应的鉴权配置规则同时注入代理模块和拦截模块。第一鉴权配置规则和第二鉴权配置规则注入完成后即刻生效。
在实际应用时，服务器220可以通过其中的代理模块和/或拦截模块，根据所注入的第一鉴权配置规则和/或第二鉴权配置规则，相应地对待发送的第一请求和/或待接收的第二请求进行鉴权。例如，代理模块可以根据其中注入的第一鉴权配置规则，对服务器220当前待发送的第一请求进行鉴权，若确定该第一请求通过鉴权，则发送该第一请求，若确定该第一请求没有通过鉴权，则可以拦截发送该第一请求；又例如，拦截模块可以根据其中注入的第二鉴权配置规则，对服务器220当前待接收的第二请求进行鉴权，若确定该第二请求通过鉴权，则接收处理该第二请求，若确定该第二请求没有通过鉴权，则可以拒绝接收该第二请求。
需要说明的是，上述配置中心210与微服务集群(即服务器220和服务器230)实质上属于解耦设计，在实际应用中，服务器220和服务器230不会关注配置中心210的具体配置情况，该配置中心210只需保证其可以向服务器220和服务器230下发格式规范的鉴权配置数据(如yaml数据、json数据等)即可，此处可以采用各种开源或自主研发的配置中心存储鉴权配置数据，本公 开实施例在此不对配置中心210做任何限定。
下面通过实施例对本公开提供的服务鉴权方法进行介绍。
首先，对鉴权配置规则的配置方法进行介绍。参见图3，图3为本公开实施例提供的用于配置鉴权配置规则(包括第一鉴权配置规则和第二鉴权配置规则)的方法流程示意图。该方法可以应用于微服务集群中各微服务各自对应的服务器，下面以该服务鉴权方法应用于微服务集群中处理目标微服务的服务器为例，对该服务鉴权方法进行介绍。如图3所示，该方法包括：
步骤301：获取目标鉴权配置条目；所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目。
服务器能够对请求进行鉴权的前提条件是，基于与目标微服务相关的目标鉴权配置条目生成鉴权时所需的鉴权配置规则。因此，服务器需要先获取与目标微服务相关的目标鉴权配置条目，正如上文所介绍的，本公开实施例构建了一个配置中心，该配置中心可以存储基于微服务集群的全局配置框架配置的各鉴权配置条目，相应地，服务器可以从该配置中心处获取与目标微服务相关的目标鉴权配套条目。
在初始阶段，确认配置中心已收集到当前基于与微服务集群解耦的全局配置框架配置的所有鉴权配置条目后，服务器可以从该配置中心获取其存储的所有鉴权配置条目，进而，从所获取的鉴权配置条目中选取与目标微服务相关的鉴权配置条目，作为目标鉴权配置条目。
配置中心可以响应鉴权配置条目下发指令，将其当前存储的所有鉴权配置条目分别下发给微服务集群中每个微服务对应的服务器；处理目标微服务的服务器接收到配置中心下发的鉴权配置条目后，可以根据目标微服务对应的目标字段，从所接收的各鉴权配置条目中选出与该目标字段相匹配的鉴权配置条目，作为目标鉴权配置条目。
此外，配置中心在确认其已收集到当前基于与微服务集群解耦的全局配置框架配置的所有鉴权配置条目后，可以相应地向微服务集群中每个微服务对应的服务器下发鉴权配置条目获取指令；处理目标微服务的服务器接收到该鉴权配置条目获取指令后，可以遍历配置中心以从中拉取其存储的所有鉴权配置条目，进而，该服务器可以根据目标微服务对应的目标字段，从所拉取的各鉴权配置条目中选出与该目标字段相匹配的鉴权配置条目，作为目标鉴权配置条目。
应理解，在实际应用中，服务器除了可以从配置中心处获取其存储的所有 鉴权配置条目，并从中选出目标鉴权配置条目外，服务器也可以直接从配置中心处获取其所需的目标鉴权配置条目。例如，配置中心可以预先确定其存储的各鉴权配置条目各自关联的微服务，进而，直接向每个微服务对应的服务器发送与该微服务相关的鉴权配置条目，或者在每个微服务对应的服务器从配置中心拉取鉴权配置条目时，直接为该服务器提供与该微服务相关的鉴权配置条目；本公开实施例在此不对初始阶段服务器获取目标鉴权配置条目的实现方式做任何限定。
在实际应用阶段，服务器可以对上述配置中心进行监控，当监控到该配置中心中存在新增的鉴权配置条目时，从该配置中心获取新增的鉴权配置条目；并从新增的鉴权配置条目中，选取与目标微服务相关的鉴权配置条目，作为目标鉴权配置条目。
服务器可以基于watch机制对配置中心进行监控，一旦监控到配置中心中存在新增的鉴权配置条目，则立刻从配置中心拉取新增的鉴权配置条目；在目标微服务运行的过程中，将所拉取的新增的鉴权配置条目动态地加载到内存中，在内存中根据目标微服务对应的目标字段，从新增的鉴权配置条目中选出与该目标字段相匹配的鉴权配置条目，作为目标鉴权配置条目。
此外，配置中心也可以对自身进行监控，一旦监控到存在新增的鉴权配置条目，可以通过RPC接口将新增的鉴权配置条目下发给微服务集群中每个微服务对应的服务器；处理目标微服务的服务器接收到新增的鉴权配置条目后，可以根据目标微服务对应的目标字段，从新增的鉴权配置条目中选出与该目标字段相匹配的鉴权配置条目，作为目标鉴权配置条目。
如此，在服务器实际应用阶段，即在服务器正常处理目标微服务的阶段，动态地获取新增的鉴权配置条目，可以有效地避免冷启动服务器带来的弊端。
应理解，在实际应用中，服务器除了可以从配置中心处获取全量新增的鉴权配置条目，并从中选出目标鉴权配置条目外，服务器也可以直接从配置中心处获取其所需的新增的鉴权配置条目。例如，配置中心可以针对新增的鉴权配置条目确定与其相关的微服务，进而，直接向该微服务对应的服务器发送该新增的鉴权配置条目，或者在微服务对应的服务器从配置中心拉取新增的鉴权配置条目时，直接为该服务器提供与该微服务相关的新增的鉴权配置条目；本公开实施例在此不对服务器实际应用阶段获取目标鉴权配置条目的实现方式做任何限定。
步骤302：基于目标权限划分维度，根据所述目标鉴权配置条目生成对应的鉴权配置规则(包括第一鉴权配置规则和第二鉴权配置规则)。
服务器获取到目标鉴权配置条目后，可以针对每条目标鉴权配置条目，基 于目标权限划分维度对该条目标鉴权配置条目进行处理，从而生成该条目标鉴权配置条目对应的鉴权配置规则。
需要说明的是，上述目标权限划分维度实质上是将鉴权配置条目转换为鉴权配置规则时所需依据的模板，基于该目标权限划分维度，可以将鉴权配置条目相应地转换为细粒度的鉴权配置规则，以满足细粒度服务鉴权管理的场景需求。
在一些实施例中，上述目标权限划分维度可以是根据鉴权模式、鉴权规则和匹配(Match)规则确定的，例如，目标权限划分维度可以等于鉴权模式*鉴权规则*匹配规则。其中，鉴权模式能够决定与所生成的鉴权配置规则相匹配的请求是否能够通过鉴权；鉴权规则能够决定对请求进行鉴权时所需使用的参考信息；匹配规则能够决定对请求进行鉴权时对上述参考信息的处理方式。
示例性的，如图4所示，上述鉴权模式可以包括黑名单(black list)或白名单(white list)。当鉴权模式为黑名单时，若某请求与所生成的鉴权配置规则相匹配，则表示该请求没有通过鉴权，反之，若某请求与所生成的鉴权配置规则不匹配，则表示该请求通过鉴权。当鉴权模式为白名单时，若某请求与所生成的鉴权配置规则相匹配，则表示该请求通过鉴权，反之，若某请求与所生成的鉴权配置规则不匹配，则表示该请求没有通过鉴权。
示例性的，如图4所示，上述鉴权规则中涉及的参考信息可以包括以下至少一种：资源标识符(url)、请求路径(path)、请求方式(method)、目的地址(ip)、请求名称(application-name)、请求类型(application-version)和请求服务名称(service-name)。基于所生成的鉴权配置规则对请求进行鉴权时，可以根据鉴权配置规则中涉及的鉴权规则，从请求中提取相应的参考信息进行鉴权。
示例性的，如图4所示，上述匹配规则中涉及的处理方式可以包括以下至少一种：基于前缀匹配、基于后缀匹配、全量匹配、基于包含的信息匹配和基于正则处理结果匹配。基于所生成的鉴权配置规则对请求进行鉴权时，可以根据匹配规则中涉及的处理方式，对所提取出的参考信息进行相应地处理，以根据处理结果确定请求鉴权结果。
需要说明的是，为了便于扩展目标权限划分维度，使得基于目标权限划分维度处理得到的鉴权配置规则具有更细粒度，服务器还可以包括权限划分维度扩展接口，该权限划分维度扩展接口可以设置为扩展上述鉴权类型、鉴权规则和匹配规则中的至少一种。
在一些实施方式中，服务器可以通过上述权限划分维度扩展接口接收维度扩展请求，该维度扩展请求的头部(header)可以携带所需扩展的因素对应的 标签(tag)，服务器对该维度扩展请求进行解析处理，进而根据解析处理结果相应地扩展目标权限划分维度中的鉴权类型、鉴权规则或匹配规则，如此对目标权限划分维度进行轻松地扩展和接入，使得服务器能够满足更细粒度的服务鉴权场景的需求。
步骤303：根据所述目标鉴权配置条目对应的鉴权类型，将所述鉴权配置规则注入所述代理模块和/或所述拦截模块。
服务器生成鉴权配置规则后，针对每条目标鉴权配置条目对应的鉴权配置规则，可以根据该目标鉴权配置条目对应的鉴权类型，确定该目标鉴权配置条目对应的鉴权配置规则为第一鉴权配置规则还是第二鉴权配置规则，将该第一鉴权配置规则相应地注入代理模块，将第二鉴权配置规则相应地注入拦截模块。
需要说明的是，通常情况下，鉴权配置条目所对应的鉴权类型主要包括：请求前拦截、请求后拦截和不拦截；鉴权配置条目可以采用开关的模式来表征其所对应的鉴权类型。
当目标鉴权配置条目对应的鉴权类型为请求前拦截时，服务器可以确定该目标鉴权配置条目对应的鉴权配置规则为第一鉴权配置规则，并将该第一鉴权配置规则注入服务器中的代理模块，以在服务器将请求发送出去之前，通过该代理模块对待发送的请求进行鉴权，决定是否继续发送该请求。如此，可以避免在微服务集群中传输无效请求，节约因传输无效请求占用的带宽和流量。
当目标鉴权配置条目对应的鉴权类型为请求后拦截时，服务器可以确定该目标鉴权配置条目对应的鉴权配置规则为第二鉴权配置规则，并将该第二鉴权配置规则注入服务器中的拦截模块，以在服务器对到来的请求进行处理之前，通过该拦截模块对待接收的请求进行鉴权，决定是否继续接收并处理该请求。
当目标鉴权配置条目对应的鉴权类型为不拦截时，服务器可以确定该目标鉴权配置条目对应的鉴权配置规则同时为第一鉴权配置规则和第二鉴权配置规则，将该目标鉴权配置条目对应的鉴权配置规则注入服务器中的代理模块和拦截模块。该场景可以应用作为测试环境Debug使用。
需要说明的是，相关技术中，通过微服务集群外部的鉴权网关的请求基本上都需要OAuth2认证服务对其进行身份认证，如此将导致OAuth2认证服务成为整个系统的瓶颈组件，导致单点故障拖垮整个系统的可能性增大。为了缓解该问题，本公开实施例提供的方法，在一实施方式中，支持由微服务自身进行身份验证，即当目标微服务为需要进行身份认证的服务时，服务器内部还可以相应地部署认证模块。当目标鉴权配置条目对应的鉴权类型为身份认证时，可以确定该目标鉴权配置条目对应的鉴权配置规则为第三鉴权配置规则，并将 该第三鉴权配置规则注入该认证模块，以在实际应用中，通过认证模块根据其中注入的第三鉴权配置规则，对待认证的请求进行身份认证。
示例性的，假设目标微服务为资金服务，资金服务通常都需要对访问请求进行身份认证，因此，服务器可以将OAuth2认证服务鉴权配置规则，注入该资金服务的认证模块中，以便在实际应用中，该认证模块可以根据其中的OAuth2认证服务鉴权配置规则，对访问请求进行身份认证。
如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
下面对服务器鉴权待发送的第一请求的方法进行介绍。参见图5，图5为本公开实施例提供的一种服务鉴权方法的流程示意图。该方法可以应用于微服务集群中各微服务各自对应的服务器，在一些实施方式中，例如应用于各服务器中的代理模块，通过该方法可以对服务器待发送的第一请求进行鉴权，以确定是否发送该第一请求。下面以该方法应用于微服务集群中处理目标微服务的服务器为例，对该服务鉴权方法进行介绍。如图5所示，该服务鉴权方法包括：
步骤501：获取所述目标微服务调用目的微服务时使用的第一请求。
服务器将第一鉴权配置规则注入代理模块后，第一鉴权配置规则即刻即可生效，在实际应用时，服务器可以直接通过代理模块，根据其中所注入的第一鉴权配置规则，相应地对待发送的第一请求进行鉴权。
步骤502：根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目。
步骤503：若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
对于目标微服务调用目的微服务(可以为微服务集群中任一其它的微服务)时使用的第一请求，服务器可以通过代理模块根据其中注入的第一鉴权配置规则对该第一请求进行鉴权，若鉴权通过，则正常发送该第一请求，若鉴权未通过，则拦截发送该第一请求。
代理模块可以对所有通过该服务器出口的请求，基于鉴权类型为请求前拦截的第一鉴权配置规则进行鉴权，若基于第一鉴权配置规则确定某待发送的第一请求没有通过鉴权，则代理模块需要拦截发送该第一请求，即不会继续向上 层网络栈发送该请求，如此降低无效请求在微服务集群中占用的带宽和流量，满足对于流量要求非常严格的应用场景的需求。反之，若基于第一鉴权配置规则确定某第一请求通过鉴权，则代理模块可以允许服务器将该第一请求发送给处理目的服务的服务器。
此外，服务器还可以通过代理模块根据其中注入的第一鉴权配置规则，确定不拦截服务器待发送的第三请求时，发送该第三请求。对于鉴权类型为不拦截的第一鉴权配置规则，服务器中的代理模块即使根据其中注入的第一鉴权配置规则匹配到某第三请求，也不对该第三请求进行拦截发送，对于待发送的第三请求仍继续发送。
为了便于理解本公开实施例中请求前拦截和不拦截这两种鉴权类型各自对应的实现方式，下面以微服务集群中包括微服务A和微服务B为例，结合图7对这两种鉴权类型各自对应的鉴权实现方式进行举例说明。
对于请求前拦截，实现的前提条件是微服务A的服务器解析到目标鉴权配置条目为禁止微服务A调用微服务B；在该场景下，微服务A的服务器将基于该目标鉴权配置条目生成的第一鉴权配置规则注入代理模块，所有通过微服务A出口的请求都会经过这条第一鉴权配置规则的计算，当根据该第一鉴权配置规则确定某请求鉴权未通过时，代理模块可以在准备发出该请求的地方拦截该请求，不会继续往上层网络栈发送该请求。
对于不拦截，虽然基于对应的目标鉴权配置条目生成的第一鉴权配置规则仍会被注入代理模块，但是代理模块即使根据该第一鉴权配置规则匹配到请求，也不会拦截该请求。
在上述服务鉴权方法中，微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，若鉴权通过，则发送该第一请求，反之，若鉴权未通过，则拦截发送该第一请求。上述鉴权第一请求时依据的第一鉴权配置规则是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
下面对服务器鉴权待接收的第二请求的方法进行介绍。参见图6，图6为本公开实施例提供的另一种服务鉴权方法的流程示意图。该方法可以应用于微服务集群中各微服务各自对应的服务器，在一些实施方式中，例如应用于各服 务器中的拦截模块，通过该方法可以对服务器待接收的第二请求进行鉴权，以确定是否接收处理该第二请求。下面以该方法应用于微服务集群中处理目标微服务的服务器为例，对该服务鉴权方法进行介绍。如图6所示，该服务鉴权方法包括：
步骤601：获取源微服务调用所述目标微服务时使用的第二请求。服务器将第二鉴权配置规则注入拦截模块后，第二鉴权配置规则即刻即可生效，在实际应用时，服务器可以直接通过拦截模块，根据其中所注入的第二鉴权配置规则，相应地对待接收的第二请求进行鉴权。
步骤602：根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目。
步骤603：若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
对于源微服务(可以为微服务集群中任一其它的微服务)调用目标微服务时使用的第二请求，服务器可以通过拦截模块根据其中注入的第二鉴权配置规则对该第二请求进行鉴权，若鉴权通过，则接收处理该第二请求，若鉴权未通过，则拒绝接收该第二请求。
拦截模块可以对服务器接收的所有第二请求，基于鉴权类型为请求后拦截的第二鉴权配置规则进行鉴权，若基于第二鉴权配置规则确定某第二请求没有通过鉴权，则拦截模块需要拒绝接收该第二请求，反之，若基于第二鉴权配置规则确定某第二请求通过鉴权，则拦截模块允许服务器继续接收该第二请求，对该第二请求进行后续处理。
在一实施方式中，拦截模块确定拒绝接收某第二请求后，可以向处理源服务的服务器发送拒绝接收响应，以通知处理源服务的服务器该请求已被拦截。
此外，服务器还可以通过拦截模块根据其中注入的第二鉴权配置规则，确定不拦截服务器待接收的第四请求时，接收该第四请求。对于鉴权类型为不拦截的第二鉴权配置规则，服务器中的拦截模块即使根据其中注入的第二鉴权配置规则匹配到某第四请求，也不对该第四请求进行拦截接收，对于待接收的请求仍继续接收。
为了便于理解本公开实施例中请求后拦截和不拦截这两种鉴权类型各自对应的实现方式，下面以微服务集群中包括微服务A和微服务B为例，结合图7对这两种鉴权类型各自对应的鉴权实现方式进行举例说明。
对于请求后拦截，实现的前提条件是微服务B的服务器解析到目标鉴权 配置条目为禁止微服务A调用微服务B；在该场景下，微服务B的服务器将基于该目标鉴权配置条目生成的第二鉴权配置规则注入拦截模块，此时，微服务A的服务器仍可以正常地向微服务B的服务器发送请求，但是所有通过微服务B入口的请求都会经过这条第二鉴权配置规则的计算，当根据该第二鉴权配置规则确定某请求鉴权未通过时，拦截模块可以拒绝接收该请求，并以404的http状态码作为响应。
对于不拦截，虽然基于对应的目标鉴权配置条目生成的第二鉴权配置规则仍会被注入拦截模块，但是拦截模块即使根据该第二鉴权配置规则匹配到请求，也不会拦截该请求。
在本公开实施例提供的服务鉴权方法中，微服务集群中负责处理目标微服务的服务器，还可以在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权，若鉴权通过，则接收处理该第二请求，反之，若鉴权未通过，则拒绝接收该第二请求。上述鉴权第二请求时依据的第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
本公开实施例还提供了一种服务鉴权装置，参见图8，图8为该服务鉴权装置800的结构示意图。该服务鉴权装置可以应用于微服务集群中负责目标微服务的服务器，该装置包括：
请求获取单元801，设置为获取所述目标微服务调用目的微服务时使用的第一请求；
鉴权单元802，设置为根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
发送处理单元803，设置为若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
在一实施方式中，在图8所示的服务鉴权装置的基础上，该装置还包括：
第一鉴权配置规则生成单元，设置为获取所述目标鉴权配置条目；基于目标权限划分维度，根据鉴权类型为请求前拦截或不拦截的所述目标鉴权配置条 目，生成所述第一鉴权配置规则。
本公开实施例还提供了一种服务鉴权装置，参见图9，图9为该服务鉴权装置900的结构示意图。该服务鉴权装置可以应用于微服务集群中负责目标微服务的服务器，该装置包括：
请求获取单元901，设置为获取源微服务调用所述目标微服务时使用的第二请求；
鉴权单元902，设置为根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
接收处理单元903，设置为若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
在一实施方式中，在图9所示的服务鉴权装置的基础上，该装置还包括：
第二鉴权配置规则生成单元，设置为获取所述目标鉴权配置条目；基于目标权限划分维度，根据鉴权类型为请求后拦截或不拦截的所述目标鉴权配置条目，生成所述第二鉴权配置规则。
在一实施方式中，在图8或图9所示的服务鉴权装置的基础上，所述第一鉴权配置规则生成单元或所述第二鉴权配置规则生成单元可以设置为：
从配置中心获取其存储的所有鉴权配置条目；所述配置中心设置为存储针对所述微服务集群配置的各鉴权配置条目；
从所获取的所述鉴权配置条目中，选取与所述目标微服务相关的鉴权配置条目，作为所述目标鉴权配置条目。
在一实施方式中，在图8或图9所示的服务鉴权装置的基础上，所述第一鉴权配置规则生成单元或所述第二鉴权配置规则生成单元具体设置为：
监控配置中心；所述配置中心设置为存储针对所述微服务集群配置的各鉴权配置条目；
当监控到所述配置中心中存在新增的鉴权配置条目时，从所述配置中心获取所述新增的鉴权配置条目；
从所述新增的鉴权配置条目中，选取与所述目标微服务相关的鉴权配置条目，作为所述目标鉴权配置条目。
在一实施方式中，所述目标权限划分维度是根据鉴权模式、鉴权规则和匹配规则确定的；所述鉴权模式设置为决定与所述鉴权配置规则匹配的请求是否通过鉴权；所述鉴权规则设置为决定对请求进行鉴权时使用的参考信息；所述匹配规则设置为决定对请求进行鉴权时对所述参考信息的处理方式。
在一实施方式中，所述鉴权模式包括：黑名单或白名单；
所述参考信息包括以下至少一种：资源定位符、请求路径、请求方式、目的地址、请求名称、请求类型、请求服务名称；
所述处理方式包括以下至少一种：基于前缀匹配、基于后缀匹配、全量匹配、基于包含的信息匹配、基于正则处理结果匹配。
在一实施方式中，所述服务器还包括权限划分维度扩展接口，所述权限划分维度扩展接口设置为扩展所述鉴权模式、所述鉴权规则和所述匹配规则中的至少一种。
在一实施方式中，在图8或图9所示的服务鉴权装置的基础上，当所述目标微服务为需要进行身份认证的服务时，所述装置还包括：
身份认证模块，设置为根据第三鉴权配置规则对待认证的请求进行身份认证；所述第三鉴权配置规则是基于鉴权类型为身份认证的目标鉴权配置条目生成的。
在本公开实施例提供的服务鉴权装置中，微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，若鉴权通过，则发送该第一请求，反之，若鉴权未通过，则拦截发送该第一请求。此外，微服务集群中负责处理目标微服务的服务器，还可以在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权，若鉴权通过，则接收处理该第二请求，反之，若鉴权未通过，则拒绝接收该第二请求。
上述鉴权第一请求时依据的第一鉴权配置规则、以及鉴权第二请求时依据的第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。
本公开实施例还提供了一种设置为服务鉴权的服务器，下面将从硬件实体化的角度对本公开实施例提供的服务器进行介绍。
参见图10，图10为本公开实施例提供的一种服务器1000的结构示意图。该服务器1000可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)1022(例如，一个或一个以上处理器)和存储器1032，一个或一个以上存储应用程序1042或数据1044 的存储介质1030(例如一个或一个以上海量存储设备)。其中，存储器1032和存储介质1030可以是短暂存储或持久存储。存储在存储介质1030的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对服务器中的一系列指令操作。在一实施方式中，中央处理器1022可以设置为与存储介质1030通信，在服务器1000上执行存储介质1030中的一系列指令操作。
服务器1000还可以包括一个或一个以上电源1026，一个或一个以上有线或无线网络接口1050，一个或一个以上输入输出接口1058，和/或，一个或一个以上操作系统1041，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等等。
上述实施例中由服务器所执行的步骤可以基于该图10所示的服务器结构。
其中，CPU 1022设置为执行如下步骤：
获取所述目标微服务调用目的微服务时使用的第一请求；
根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
或者，
获取源微服务调用所述目标微服务时使用的第二请求；
根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
在一实施方式中，CPU 1022还可以设置为执行本公开实施例提供的服务鉴权方法的任意一种实现方式的步骤。
本公开实施例还提供一种计算机可读存储介质，设置为存储计算机程序，该计算机程序设置为执行前述各个实施例所述的一种服务鉴权方法中的任意一种实施方式。
本公开实施例还提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行前述各个实施例所述的一种服务鉴权方法中的任意一种实施方式。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本公开所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开实施例的技术方案本质上或者说对相关技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(英文全称：Read-Only Memory，英文缩写：ROM)、随机存取存储器(英文全称：Random Access Memory，英文缩写：RAM)、磁碟或者光盘等各种可以存储计算机程序的介质。
以上所述，以上实施例仅用以说明本公开的技术方案，而非对其限制；尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本公开各实施例技术方案的精神和范围。
工业实用性
相关技术的服务鉴权方法存在以下缺点：请求通过鉴权网关拿到token后，能否到达其想要访问的目的微服务完全取决于该各个微服务的业务编码，而各个微服务的业务编码彼此是互相独立的，在很多情况下，由微服务集群内部的各微服务的业务编码决定的调用关系往往非常杂乱，可能存在很多与微服务集群的全局功能实现不相符的调用关系。
针对相关技术存在的上述技术缺陷，本公开实施例提供了一种服务鉴权方法、装置、设备、系统及存储介质，其中该方法包括：微服务集群中负责处理目标微服务的服务器，可以在获取到目标微服务调用目的微服务时使用的第一请求后，根据第一鉴权配置规则对第一请求进行鉴权，在获取到源微服务调用目标微服务时使用的第二请求后，根据第二鉴权配置规则对第二请求进行鉴权。上述鉴权第一请求时依据的第一鉴权配置规则、以及鉴权第二请求时依据的第二鉴权配置规则，均是基于目标鉴权配置条目生成的，该目标鉴权配置条目是基于与微服务集群解耦的全局配置框架配置的、且与目标微服务相关的鉴权配置条目。如此，利用基于与微服务集群解耦的全局配置框架配置的鉴权配置条目代替微服务的业务编码，确定微服务集群中微服务间的调用关系，可以使得微服务集群中各微服务间的调用关系更加清晰，并且确保与微服务集群的全局功能实现相符。

Claims (16)

  1. 一种服务鉴权方法，应用于微服务集群中处理目标微服务的服务器，所述方法包括：
    获取所述目标微服务调用目的微服务时使用的第一请求；
    根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
    若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
  2. 根据权利要求1所述的方法，其中，通过以下方式生成所述第一鉴权配置规则：
    获取所述目标鉴权配置条目；
    基于目标权限划分维度，根据鉴权类型为请求前拦截或不拦截的所述目标鉴权配置条目，生成所述第一鉴权配置规则。
  3. 一种服务鉴权方法，应用于微服务集群中处理目标微服务的服务器，所述方法包括：
    获取源微服务调用所述目标微服务时使用的第二请求；
    根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
    若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
  4. 根据权利要求3所述的方法，其中，通过以下方式生成所述第二鉴权配置规则：
    获取所述目标鉴权配置条目；
    基于目标权限划分维度，根据鉴权类型为请求后拦截或不拦截的所述目标鉴权配置条目，生成所述第二鉴权配置规则。
  5. 根据权利要求2或4所述的方法，其中，所述获取所述目标鉴权配置条目，包括：
    从配置中心获取其存储的所有鉴权配置条目；所述配置中心设置为存储针对所述微服务集群配置的各鉴权配置条目；
    从所获取的所述鉴权配置条目中，选取与所述目标微服务相关的鉴权配置条目，作为所述目标鉴权配置条目。
  6. 根据权利要求2或4所述的方法，其中，所述获取所述目标鉴权配置 条目，包括：
    监控配置中心；所述配置中心设置为存储针对所述微服务集群配置的各鉴权配置条目；
    当监控到所述配置中心中存在新增的鉴权配置条目时，从所述配置中心获取所述新增的鉴权配置条目；
    从所述新增的鉴权配置条目中，选取与所述目标微服务相关的鉴权配置条目，作为所述目标鉴权配置条目。
  7. 根据权利要求2或4所述的方法，其中，所述目标权限划分维度是根据鉴权模式、鉴权规则和匹配规则确定的；所述鉴权模式设置为决定与所述鉴权配置规则匹配的请求是否通过鉴权；所述鉴权规则设置为决定对请求进行鉴权时使用的参考信息；所述匹配规则设置为决定对请求进行鉴权时对所述参考信息的处理方式。
  8. 根据权利要求7所述的方法，其中，所述鉴权模式包括：黑名单或白名单；所述参考信息包括以下至少一种：资源定位符、请求路径、请求方式、目的地址、请求名称、请求类型、请求服务名称；
    所述处理方式包括以下至少一种：基于前缀匹配、基于后缀匹配、全量匹配、基于包含的信息匹配、基于正则处理结果匹配。
  9. 根据权利要求7所述的方法，其中，所述服务器还包括权限划分维度扩展接口，所述权限划分维度扩展接口设置为扩展所述鉴权模式、所述鉴权规则和所述匹配规则中的至少一种。
  10. 根据权利要求1-2中的任一项或3-9中的任一项所述的方法，其中，当所述目标微服务为需要进行身份认证的服务时，所述方法还包括：
    根据第三鉴权配置规则对待认证的请求进行身份认证；所述第三鉴权配置规则是基于鉴权类型为身份认证的目标鉴权配置条目生成的。
  11. 一种服务鉴权装置，所述装置应用于微服务集群中负责目标微服务的服务器，所述装置包括：
    请求获取单元，设置为获取所述目标微服务调用目的微服务时使用的第一请求；
    鉴权单元，设置为根据第一鉴权配置规则对所述第一请求进行鉴权；所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
    发送处理单元，设置为若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求。
  12. 一种服务鉴权装置，所述装置应用于微服务集群中负责目标微服务的服务器，所述装置包括：
    请求获取单元，设置为获取源微服务调用所述目标微服务时使用的第二请求；
    鉴权单元，设置为根据第二鉴权配置规则对所述第二请求进行鉴权；所述第二鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；
    接收处理单元，设置为若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
  13. 一种服务器，所述服务器设置为处理微服务集群中的目标微服务，所述服务器包括代理模块和拦截模块；
    所述代理模块，设置为获取所述目标微服务调用目的微服务时使用的第一请求；根据第一鉴权配置规则对所述第一请求进行鉴权，所述第一鉴权配置规则是基于目标鉴权配置条目生成的，所述目标鉴权配置条目是基于与所述微服务集群解耦的全局配置框架配置的、且与所述目标微服务相关的鉴权配置条目；若鉴权通过，则发送所述第一请求；若鉴权未通过，则拦截发送所述第一请求；
    所述拦截模块，设置为获取源微服务调用所述目标微服务时使用的第二请求；根据第二鉴权配置规则对所述第二请求进行鉴权，所述第二鉴权配置规则是基于所述目标鉴权配置条目生成的；若鉴权通过，则接收处理所述第二请求；若鉴权未通过，则拒绝接收所述第二请求。
  14. 一种服务鉴权系统，所述系统包括：配置中心和微服务集群中多个微服务各自对应的服务器；
    所述配置中心，设置为存储针对所述微服务集群配置的各鉴权配置条目；
    每个所述服务器，设置为执行权利要求1至10任一项所述的服务鉴权方法。
  15. 一种服务器，所述服务器包括：处理器以及存储器：
    所述存储器设置为存储计算机程序，并将所述计算机程序传输给所述处理器；所述处理器设置为根据所述计算机程序，执行权利要求1至10任一项所述的服务鉴权方法。
  16. 一种计算机可读存储介质，所述计算机可读存储介质设置为存储计算机程序，所述计算机程序设置为执行权利要求1至10任一项所述的服务鉴权方法。
PCT/CN2021/105174 2020-07-28 2021-07-08 一种服务鉴权方法、装置、设备、系统及存储介质 WO2022022253A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010736994.9 2020-07-28
CN202010736994.9A CN111835789B (zh) 2020-07-28 2020-07-28 一种服务鉴权方法、装置、设备、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2022022253A1 true WO2022022253A1 (zh) 2022-02-03

Family

ID=72925784

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/105174 WO2022022253A1 (zh) 2020-07-28 2021-07-08 一种服务鉴权方法、装置、设备、系统及存储介质

Country Status (2)

Country Link
CN (1) CN111835789B (zh)
WO (1) WO2022022253A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086047A (zh) * 2022-06-20 2022-09-20 未鲲(上海)科技服务有限公司 接口鉴权方法、装置、电子设备及存储介质
CN116389103A (zh) * 2023-03-30 2023-07-04 成都道客数字科技有限公司 一种基于角色权限的云原生微服务分布式鉴权方法和系统
CN117014226A (zh) * 2023-09-22 2023-11-07 云粒智慧科技有限公司 服务请求鉴权方法、装置、设备、系统和存储介质
CN117278323A (zh) * 2023-11-16 2023-12-22 荣耀终端有限公司 第三方信息的获取方法、电子设备及可读存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111835789B (zh) * 2020-07-28 2021-12-03 北京金山云网络技术有限公司 一种服务鉴权方法、装置、设备、系统及存储介质
CN113556357A (zh) * 2021-07-30 2021-10-26 平安普惠企业管理有限公司 基于注册中心的鉴权方法、装置、设备及存储介质
CN113938289B (zh) * 2021-08-31 2024-03-01 联通沃音乐文化有限公司 一种代理客户端预防拦截机制被滥用和攻击的系统和方法
CN114125039A (zh) * 2021-12-08 2022-03-01 阿里云计算有限公司 服务之间访问关系的发现与控制方法和装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108809956A (zh) * 2018-05-23 2018-11-13 广州虎牙信息科技有限公司 基于微服务的鉴权方法、访问请求转发方法和装置、系统
CN109683988A (zh) * 2018-12-25 2019-04-26 鼎信信息科技有限责任公司 微服务启动方法、装置、计算机设备和存储介质
US20190273746A1 (en) * 2018-03-02 2019-09-05 Syntegrity Networks Inc. Microservice architecture for identity and access management
CN110460595A (zh) * 2019-08-02 2019-11-15 阿里巴巴集团控股有限公司 一种鉴权与业务服务方法、装置以及设备
CN111259376A (zh) * 2020-01-17 2020-06-09 中国平安人寿保险股份有限公司 权限配置方法、装置、服务器及存储介质
CN111258781A (zh) * 2020-01-15 2020-06-09 中国平安人寿保险股份有限公司 微服务的调用鉴权方法、装置、设备及存储介质
CN111835789A (zh) * 2020-07-28 2020-10-27 北京金山云网络技术有限公司 一种服务鉴权方法、装置、设备、系统及存储介质

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190273746A1 (en) * 2018-03-02 2019-09-05 Syntegrity Networks Inc. Microservice architecture for identity and access management
CN108809956A (zh) * 2018-05-23 2018-11-13 广州虎牙信息科技有限公司 基于微服务的鉴权方法、访问请求转发方法和装置、系统
CN109683988A (zh) * 2018-12-25 2019-04-26 鼎信信息科技有限责任公司 微服务启动方法、装置、计算机设备和存储介质
CN110460595A (zh) * 2019-08-02 2019-11-15 阿里巴巴集团控股有限公司 一种鉴权与业务服务方法、装置以及设备
CN111258781A (zh) * 2020-01-15 2020-06-09 中国平安人寿保险股份有限公司 微服务的调用鉴权方法、装置、设备及存储介质
CN111259376A (zh) * 2020-01-17 2020-06-09 中国平安人寿保险股份有限公司 权限配置方法、装置、服务器及存储介质
CN111835789A (zh) * 2020-07-28 2020-10-27 北京金山云网络技术有限公司 一种服务鉴权方法、装置、设备、系统及存储介质

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086047A (zh) * 2022-06-20 2022-09-20 未鲲(上海)科技服务有限公司 接口鉴权方法、装置、电子设备及存储介质
CN115086047B (zh) * 2022-06-20 2024-05-03 广州聚智云智能科技有限公司 接口鉴权方法、装置、电子设备及存储介质
CN116389103A (zh) * 2023-03-30 2023-07-04 成都道客数字科技有限公司 一种基于角色权限的云原生微服务分布式鉴权方法和系统
CN116389103B (zh) * 2023-03-30 2024-01-26 成都道客数字科技有限公司 一种基于角色权限的云原生微服务分布式鉴权方法和系统
CN117014226A (zh) * 2023-09-22 2023-11-07 云粒智慧科技有限公司 服务请求鉴权方法、装置、设备、系统和存储介质
CN117014226B (zh) * 2023-09-22 2024-01-12 云粒智慧科技有限公司 服务请求鉴权方法、装置、设备、系统和存储介质
CN117278323A (zh) * 2023-11-16 2023-12-22 荣耀终端有限公司 第三方信息的获取方法、电子设备及可读存储介质
CN117278323B (zh) * 2023-11-16 2024-04-19 荣耀终端有限公司 第三方信息的获取方法、电子设备及可读存储介质

Also Published As

Publication number Publication date
CN111835789A (zh) 2020-10-27
CN111835789B (zh) 2021-12-03

Similar Documents

Publication Publication Date Title
WO2022022253A1 (zh) 一种服务鉴权方法、装置、设备、系统及存储介质
CN108650262B (zh) 一种基于微服务架构的云平台扩展方法及系统
WO2020057163A1 (zh) Mec平台部署方法及装置
US9130921B2 (en) System and method for bridging identities in a service oriented architectureprofiling
US8887296B2 (en) Method and system for object-based multi-level security in a service oriented architecture
WO2022095730A1 (zh) 业务通信方法、系统、装置及电子设备
US8966594B2 (en) Proxy authentication
US8452881B2 (en) System and method for bridging identities in a service oriented architecture
EP1641215B1 (en) System and method for bridging identities in a service oriented architecture
US8239520B2 (en) Network service operational status monitoring
JP4307448B2 (ja) 分散オブジェクトを単一表現として管理するシステムおよび方法
US7685633B2 (en) Providing consistent application aware firewall traversal
US7356601B1 (en) Method and apparatus for authorizing network device operations that are requested by applications
US8327430B2 (en) Firewall control via remote system information
US20160261607A1 (en) Techniques for identity-enabled interface deployment
US8613056B2 (en) Extensible authentication and authorization of identities in an application message on a network device
CN103404103A (zh) 将访问控制系统与业务管理系统相结合的系统和方法
US8161173B1 (en) Role passing and persistence mechanism for a container
EP3295652B1 (en) Methods, systems, and apparatuses of service provisioning for resource management in a constrained environment
US9548982B1 (en) Secure controlled access to authentication servers
EP3800564A1 (en) Secure communication method and system using network socket proxying
JP2000132473A (ja) ファイアウォール動的制御方式を用いたネットワークシステム
US20190349194A1 (en) Secure credential generation and validation
JP6185934B2 (ja) サーバー・アプリケーションと多数の認証プロバイダーとの統合
RU2422886C2 (ru) Обеспечение согласованного прохода брандмауэра, имеющего информацию о приложении

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21849395

Country of ref document: EP

Kind code of ref document: A1