Security authentication method, security authentication device and security authentication system for API calling

Abstract

The invention discloses a security authentication method, a security authentication device and a security authentication system for API calling. The method running on a server comprises the steps of after receiving an API request from a client, checking whether a token is valid or not if the API request carries the token; on the condition that the API request does not carry the token or the token is invalid, submitting the authentication information in the API request to a user center for identity verification; after the identity verification is passed at the user center, calculating to obtain a new token and sending the new token to the client; wherein the obtained new token is an encrypted random number obtained according to a pre-agreed parameter through an irreversible algorithm. According to the invention, on the premise that the security is ensured, the authentication efficiency of the client can be reduced. Meanwhile, the performance loss of the load server at the user center can be reduced.

Description

technical field [0001] The present application relates to technologies for safely calling APIs, in particular to a method, device, and system for safety authentication of API calls. Background technique [0002] At present, Internet software products are mainly divided into two categories in terms of product audiences, including mass Internet products for end consumers, such as Sina Weibo Web and Zhihu Web. The characteristic of this type of product is that the object of use of this type of product is human beings, and most of the media content provided is unstructured text (such as novels, blogs), pictures, audio and video, etc. Another type of product is aimed at computers, that is, the main form of service is an API (Application Programming Interface, Application Programming Interface) that provides a programming interface, which is convenient for programmers to use the API for secondary development. The characteristic of this type of product is that the service object i...

AI Technical Summary

Problems solved by technology

[0004] Due to the current authentication method for API-type products, each authentication needs to call the user center for authentication, so when unexpected factors such as network call jitter occur, it is very likely to cause intermittent instability in the server calling the user center, which will eventually affect To the user call unstable

For end-consumer products, because they rely on cookies to store Session IDs, there are security holes for forgery attacks, and when malicious users sniff network protocol packets and crack HTTP-related cookie or Session ID values, they can Can pretend to be a legitimate user to interact with the server

Images