Service interface security calling method and device, equipment and storage medium

Abstract

The application provides a service interface security calling method and device, equipment and a storage medium, an encryption channel is established between a service provider and a service caller, and the security calling of a service interface is performed in the encryption channel, the service interface security calling method comprises the following steps: receiving a service interface calling request sent by a service caller; generating an identity authentication request for at least one identity attribute in a target digital identity according to the service interface calling request; sending the identity authentication request to the service caller and receiving an identity certificate sent by the service caller according to the identity authentication request; verifying the identity certificate, and returning a service interface calling result to the service caller according to a verification result. The application can guarantee the security of service interface access and effectively avoid attacks on the service interface.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a method for securely invoking a service interface, a device for securely invoking a service interface, an electronic device, and a non-transitory computer-readable storage medium. Background Technology

[0002] "Network services" refer to service-oriented, distributed software modules that run on a network. Network services are typically provided by numerous Application Programming Interfaces (APIs). To ensure the security of API access, commonly used service interfaces, i.e., the methods for calling APIs, usually require configuring usernames and passwords for authorized users. However, this method of ensuring API access security is relatively weak and vulnerable to attacks. Summary of the Invention

[0003] This invention provides a method, apparatus, device, and storage medium for secure service interface invocation, which addresses the shortcomings of low security in service interface access and vulnerability to attacks in the prior art, thereby ensuring the security of service interface access and effectively preventing service interfaces from being attacked.

[0004] In a first aspect, the present invention provides a secure service interface invocation method, applied to a service provider, wherein an encrypted channel is established between the service provider and the service invoker, and the secure invocation of the service interface is performed within the encrypted channel. The secure service interface invocation method includes:

[0005] Receive service interface call requests from service callers;

[0006] Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity;

[0007] Send the authentication request to the service caller and receive the identity verification issued by the service caller based on the authentication request;

[0008] The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result.

[0009] According to a service interface secure invocation method provided by the present invention, an authentication request for at least one identity attribute in a target digital identity is generated based on the service interface invocation request, including:

[0010] The authentication strategy is determined based on the service interface call request; the authentication strategy includes: at least one identity attribute in the target digital identity and the method of authenticating the at least one identity attribute;

[0011] The authentication request is generated according to the authentication policy;

[0012] Verifying the identity document includes:

[0013] The identity verification is performed according to the determined identity verification method to obtain the verification result.

[0014] According to a secure service interface invocation method provided by the present invention, the identity certificate is verified, and the result of the service interface invocation is returned to the service caller based on the verification result, including:

[0015] Determine if the identity document is valid;

[0016] If the identity verification is valid, based on at least one identity attribute of the target digital identity, and according to the service interface information carried in the service interface call request, the corresponding version of the service interface is called to provide services, and the result of the service interface call is obtained.

[0017] Return the result of the service interface call to the service caller;

[0018] If the identity verification is invalid, a message indicating that the service interface call failed will be returned to the service caller.

[0019] According to a service interface secure invocation method provided by the present invention, before generating an authentication request for at least one identity attribute in a target digital identity based on the service interface invocation request, the method further includes:

[0020] Determine whether the service interface information carried in the service interface call request in the authentication proposal is legitimate;

[0021] If the service interface information carried in the service interface call request is legitimate, an authentication request for at least one identity attribute in the target digital identity is generated based on the service interface call request.

[0022] If the service interface information carried in the service interface call request is invalid, a message indicating that the service interface call failed will be returned to the service caller.

[0023] Secondly, this invention provides a secure service interface invocation method, applied to a service caller, wherein an encrypted channel is established between the service caller and the service provider, and the secure invocation of the service interface is performed within the encrypted channel. The secure service interface invocation method includes:

[0024] Send a service interface call request to the service provider;

[0025] Receive an authentication request from the service provider for at least one identity attribute in the target digital identity, issued in accordance with the service interface call request;

[0026] Generate an identity certificate based on the identity verification request, and send the identity certificate to the service provider;

[0027] Receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0028] Thirdly, the present invention also provides a secure service interface invocation device, applied to a service provider, wherein an encrypted channel is established between the service provider and the service caller, and the secure invocation of the service interface is performed in the encrypted channel. The secure service interface invocation device includes:

[0029] The first communication module is used to receive service interface call requests sent by the service caller.

[0030] The first processing module is used to generate an authentication request for at least one identity attribute in the target digital identity based on the service interface call request.

[0031] The first communication module is further configured to send the authentication request to the service caller and receive the identity certificate generated by the service caller based on the authentication request;

[0032] The first processing module is also used to verify the identity certificate;

[0033] The first communication module is also used to return the result of the service interface call to the service caller based on the verification result.

[0034] Fourthly, the present invention also provides a secure service interface invocation device, applied to a service caller, wherein an encrypted channel is established between the service caller and the service provider, and the secure invocation of the service interface is performed in the encrypted channel. The secure service interface invocation device includes:

[0035] The second communication module is used to send a service interface call request to the service provider; and to receive an authentication request from the service provider for at least one identity attribute in the target digital identity based on the service interface call request.

[0036] The second processing module is used to generate an identity certificate based on the identity verification request;

[0037] The second communication module is also used to send the identity certificate to the service provider and receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0038] Fifthly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the secure service interface invocation method as described in any of the first aspects above, or to implement the steps of the secure service interface invocation method as described in any of the second aspects above.

[0039] In a sixth aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the service interface secure invocation method as described in any of the first aspects above, or implements the steps of the service interface secure invocation method as described in any of the second aspects above.

[0040] The service interface secure invocation method, apparatus, device, and storage medium provided by this invention establishes an encrypted channel between the service provider and the service caller, and performs secure invocation of the service interface within the encrypted channel. It receives a service interface invocation request from the service caller, generates an authentication request for at least one identity attribute of the target digital identity based on the service interface invocation request, sends the authentication request to the service caller, receives the identity certificate issued by the service caller based on the authentication request, verifies the identity certificate, and returns the service interface invocation result to the service caller based on the verification result. By utilizing at least one identity attribute of the digital identity held by the service caller, the service caller proves to the service provider that it possesses a digital identity issued by the issuing authority of the digital identity, thereby gaining the service caller's trust and enabling access to the corresponding service interface. This ensures the security of service interface access and effectively prevents service interfaces from being attacked. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating a secure service interface invocation method provided by the present invention;

[0043] Figure 2 This is a schematic diagram of the structure of a digital identity system provided by the present invention;

[0044] Figure 3 yes Figure 1 Flowcharts of some embodiments of the secure invocation methods for service interfaces provided in the document;

[0045] Figure 4 This is a flowchart illustrating another method for securely invoking service interfaces provided by the present invention;

[0046] Figure 5 This is a flowchart illustrating an application scenario of the secure service interface invocation method provided by the present invention;

[0047] Figure 6 This is a schematic diagram of the structure of a service interface secure invocation device provided by the present invention;

[0048] Figure 7 This is a schematic diagram of another service interface secure call device provided by the present invention;

[0049] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0051] The following is combined Figures 1-5 This invention describes a secure service interface invocation method.

[0052] Please see Figure 1 , Figure 1 This is a flowchart illustrating a secure service interface invocation method provided by the present invention. Figure 1The service interface secure invocation method shown is applied to the service provider and can be executed by the service interface secure invocation device. It establishes an encrypted channel between the service provider and the service caller. For example, the encrypted channel can be established through Secure Sockets Layer (SSL), Transport Layer Security (TLS), or Hypertext Transfer Protocol over Secure Socket Layer (HTTPS). This embodiment of the invention does not limit the type of protocol used to implement the encrypted channel. Through the encrypted channel, the service caller and the service provider can exchange public keys. The secure invocation of the service interface is performed within the encrypted channel. Figure 1 As shown, the secure invocation method of this service interface includes at least the following:

[0053] 101. Receive service interface call requests from service callers.

[0054] In this embodiment of the invention, the service caller's service interface call request to the service provider may carry information about the called service interface, such as the name of the service interface, the names and values ​​of the service interface parameters, etc. This embodiment of the invention does not limit the content of the service interface information carried in the service interface call request. The service provider can call the corresponding service interface to provide services based on the service interface information carried in the received service interface call request. Optionally, the service caller may integrate the service interface call request into an authentication proposal and send the integrated authentication proposal to the service provider. The service provider can receive the integrated authentication proposal and obtain the service interface call request from it.

[0055] 102. Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity.

[0056] In this embodiment of the invention, digital identity is a digitally encrypted form of identity verification, such as... Figure 2 As shown, digital identity has the following characteristics:

[0057] (1) Each digital identity has an issuer and a holder. The issuer is the giver of the digital identity and the source of the digital identity. The holder is the object described by the digital identity and the owner of the digital identity. The digital identity represents the issuer's specific trust in the holder.

[0058] (2) Each digital identity conforms to a certain digital identity specification, and each digital identity specification has a unique identifier. The identifier of the digital identity specification is obtained by the specification maker through registration with a trusted intermediary, and its ownership belongs to the specification maker.

[0059] (3) Each digital identity specification can contain multiple different data formats. Each digital identity must conform to a specific data format and therefore must belong to the data specification to which that data format belongs. The data format of a digital identity is used to describe the relevant information of the holder of the digital identity, such as name, security level, etc. One or more different data formats of digital identity can be used for different application scenarios. Each data format has a unique identifier. The identifier of each data format is obtained by the data specification developer through registration with a trusted intermediary. The content of each digital identity must reference the identifier of the data format used.

[0060] (4) Each digital identity has a corresponding data source; the data source is a tuple consisting of the issuer of the digital identity and the data format. Each data source has a unique identifier. The identifier of each data source is obtained by the issuer of the digital identity registering the data source with a trusted intermediary before generating the digital identity. The content of each digital identity must reference the identifier of the data source used.

[0061] (5) Trust intermediaries can be organizations that specialize in providing trust services, or they can be public infrastructure such as blockchain;

[0062] (6) After issuing a digital identity, the issuer can send the issued digital identity to the holder through various communication methods, and the holder can store the digital identity obtained from the issuer.

[0063] (7) A holder of a digital identity may hold multiple digital identities from multiple data sources at the same time, and each digital identity may serve a different purpose;

[0064] (8) Digital identity is used by the holder to prove to the verifier that they have the specific trust given by the issuer. The verifier can choose the holder of the digital identity to trust based on their trust in the issuer.

[0065] (9) The verifier and issuer of a digital identity can be the same party.

[0066] In this embodiment of the invention, the service caller is the holder of the digital identity. The service caller can obtain all the digital identities required to access the service interface before calling it. The service provider is the verifier of the digital identity, or it can be the issuer of the digital identity. Alternatively, the issuer of the digital identity can be a third party other than the service provider and the service caller. The service provider has the trust in the digital identity issued by the issuer of the digital identity to perform the service interface call.

[0067] In this embodiment of the invention, after receiving a service interface call request from a service caller, the service provider can obtain the context information of the service interface call based on the request, such as the name of the service interface, the name of the service caller, and the time of the service interface call. Based on the context information, the service provider generates an authentication request for at least one identity attribute of the target digital identity of the service caller. Optionally, the target digital identity may include one of the following: a digital identity conforming to a specific digital identity specification, a digital identity conforming to a specific data format, a digital identity from a specific issuer, and a digital identity from a specific data source; at least one identity attribute of the target digital identity can be determined based on the content of the target digital identity, such as name, address, etc. This embodiment of the invention does not limit the type of the target digital identity or the type of at least one identity attribute of the target digital identity.

[0068] Optionally, the generated authentication request may be an authentication request for one identity attribute in a target digital identity of the service caller; or it may be an authentication request for multiple identity attributes in a target digital identity of the service caller; or it may be an authentication request for multiple identity attributes in multiple target digital identities of the service caller; the embodiments of the present invention do not limit this.

[0069] In this embodiment of the invention, each time a service interface is invoked, the service provider may generate an authentication request for at least one identity attribute among different target digital identities of the service caller, based on the context information of the service interface invocation, such as different service interfaces, different service callers, and different service interface invocation times; or, it may generate authentication requests for different types and / or numbers of identity attributes among the same target digital identity of the service caller; this embodiment of the invention does not limit this.

[0070] 103. Send an authentication request to the service caller and receive the authentication credentials issued by the service caller based on the authentication request.

[0071] In this embodiment of the invention, after the service provider generates an authentication request for at least one identity attribute of the target digital identity of the service caller, it can send the generated authentication request to the service caller. After receiving the authentication request for at least one identity attribute of the target digital identity sent by the service provider according to the service interface call request, the service caller can query the target digital identity in the digital identity stored in the local database according to the authentication request. After querying the target digital identity, it obtains at least one corresponding identity attribute of the target digital identity and generates an identity certificate based on the obtained at least one identity attribute according to the authentication request. After generating the identity certificate, the service caller sends the generated identity certificate to the service provider, and the service provider receives the identity certificate sent by the service caller according to the authentication request.

[0072] If the service caller finds multiple target digital identities matching the authentication request in the local database based on an authentication request for at least one of the identity attributes of the target digital identity, the service caller can automatically select one or more target digital identities to generate an identity certificate according to predefined rules; or it can also be done through interactive manual intervention to select one or more target digital identities to generate an identity certificate; the embodiments of the present invention do not limit this.

[0073] For example, at least one identity attribute obtained can be an identity attribute encrypted with the private key of the issuer of the target digital identity. The service caller can encrypt the identity attribute encrypted with the private key of the issuer using the private key of the service caller according to the authentication request, thereby obtaining an identity certificate. This identity certificate is an identity attribute encrypted with both the private key of the service caller and the private key of the issuer of the target digital identity.

[0074] 104. Verify the identity certificate and return the result of the service interface call to the service caller based on the verification result.

[0075] In this embodiment of the invention, after receiving the identity certificate generated by the service caller based on the authentication request, the service provider can verify the received identity certificate. For example, when the identity certificate can be an identity attribute encrypted with both the service caller's private key and the private key of the issuer of the target digital identity, the service provider can decrypt the encrypted identity attribute using the service caller's public key and the issuer's public key to obtain the corresponding identity attribute, thereby verifying the identity certificate. After obtaining the verification result of the identity certificate, the service provider can determine whether to call the corresponding service interface to provide services to the service caller. If the service provider calls the corresponding service interface to provide services to the service caller, it returns the result of the service interface call to the service caller.

[0076] The secure service interface invocation method provided by this invention establishes an encrypted channel between the service provider and the service caller, and performs secure invocation of the service interface within the encrypted channel. It receives a service interface invocation request from the service caller, generates an authentication request for at least one identity attribute of the target digital identity based on the request, sends the authentication request to the service caller, receives the identity certificate issued by the service caller based on the authentication request, verifies the identity certificate, and returns the result of the service interface invocation to the service caller based on the verification result. By utilizing at least one identity attribute of the digital identity held by the service caller, the service caller proves to the service provider that it possesses a digital identity issued by the issuing authority of the digital identity, thereby gaining the service caller's trust and enabling access to the corresponding service interface. This method ensures the security of service interface access and effectively prevents attacks on the service interface.

[0077] Please see Figure 3 , Figure 3 yes Figure 1 Flowcharts of some embodiments of the secure invocation method for the service interface provided in the document are shown below. Figure 3 As shown, the secure invocation method of this service interface includes at least the following:

[0078] 301, Accept authentication proposal from service caller.

[0079] In this embodiment of the invention, the service caller sends an authentication proposal that integrates the service interface call request to the service provider. The service provider receives the authentication proposal that integrates the service interface call request. In addition to the service interface call request, the authentication proposal that integrates the service interface call request may also include identity attributes that the service caller voluntarily discloses, such as the name of the service caller. This embodiment of the invention does not limit the type of identity attributes that the service caller voluntarily discloses in the authentication proposal. Based on the identity attributes contained in the authentication proposal, the identity attributes for generating the authentication request can be determined. That is, when generating the authentication request, identity attributes that are not disclosed in the authentication proposal can be selected to generate the authentication request.

[0080] 302, determine whether the service interface information carried in the service interface call request in the authentication proposal is valid.

[0081] If the service interface information carried in the service interface call request is valid, execute 303; if the service interface information carried in the service interface call request is invalid, execute 308.

[0082] In this embodiment of the invention, after receiving an authentication proposal that integrates a service interface call request, the service provider can parse out the service interface information carried in the service interface call request, such as the name of the service interface, the name and value of the service interface parameters, and perform a legality check on the parsed service interface information to determine whether the service interface information carried in the service interface call request in the authentication proposal is legal. For example, it can check whether the service interface exists, whether the parameters of the service interface conform to the legal value range, and obtain the check result.

[0083] 303, Based on the authentication proposal, generate an authentication request for at least one identity attribute in the target digital identity.

[0084] In this embodiment of the invention, the service provider performs a validity check on the service interface information. The check result can include success and failure. If the service interface information carried in the service interface call request is valid, the validity check result is success, indicating that the service interface information meets basic validity requirements, such as the service interface existing or the parameters of the service interface conforming to a valid value range. Then, based on the authentication proposal, an authentication request is generated for at least one identity attribute in the target digital identity. If the service interface information carried in the service interface call request is invalid, the validity check result is failure, indicating that the service interface information does not meet basic validity requirements, such as the service interface not existing or the parameters of the service interface not conforming to a valid value range. Then, a service interface call failure message is returned to the service caller. Optionally, the service interface call failure message can include the reason for the service interface call failure, such as the interface not existing or incorrect parameters.

[0085] In some optional examples, when generating an authentication request for at least one identity attribute in the target digital identity based on the authentication proposal, the authentication strategy can be determined based on the service interface call request. The authentication strategy may include at least one identity attribute in the target digital identity and a method of authenticating the at least one identity attribute. The method of authenticating the at least one identity attribute may include at least one of direct identity information authentication, also known as data authentication, and zero-knowledge proof. Then, the authentication request is generated based on the authentication strategy.

[0086] In this embodiment of the invention, the service provider may determine different authentication strategies each time the service interface is invoked, based on different service interfaces, different service callers, different service interface invocation times, etc. At least one of the target digital identity, the type and / or number of identity attributes of the target digital identity, and the method of identity verification included in different authentication strategies may be different, and this embodiment of the invention does not limit this.

[0087] Optionally, at least one identity attribute of the target digital identity in the authentication strategy can be selected from the following digital identities held by the service caller: a digital identity conforming to a specific digital identity specification, which does not limit the specific data format and issuer; a digital identity conforming to a specific data format, where the digital identity specification and data format are fixed and the data source is not limited, i.e., the issuer; a digital identity from a specific issuer, where the issuer of the digital identity is fixed and the digital identity specification and data format are not limited; or a digital identity from a specific data source, where the issuer, digital identity data specification, and data format are all fixed.

[0088] 304 indicates that an authentication request is sent to the service caller, and the service caller sends its authentication credentials in accordance with the authentication request.

[0089] In some optional examples, when the authentication request is generated by an authentication policy, after receiving the authentication request from the service provider, the service caller can query the target digital identity in the local database according to the authentication request, obtain at least one identity attribute from the target digital identity, and generate an identity certificate based on the identity verification method specified in the authentication request for the at least one identity attribute. Optionally, if the service caller encounters a problem in the process of querying or generating the identity certificate, the service caller will return an error message to the service provider. Optionally, the service provider can set a response time limit for the authentication request; if the service caller's process of generating the identity certificate exceeds the response time limit, the service provider determines that the authentication has failed.

[0090] 305. Determine if the identity document is valid.

[0091] If the identity document is valid, proceed to step 306; if the identity document is invalid, proceed to step 308.

[0092] In some optional examples, when the authentication request is generated by an authentication policy, the service provider, upon receiving the authentication credentials from the service caller, can verify the credentials according to the authentication policy's defined method to determine their validity. For instance, when the authentication method is data verification, the authentication credentials returned by the service caller proving they possess a digital identity that meets the service provider's requirements can be values ​​derived from at least one corresponding identity attribute. These values ​​can be obtained by encrypting the identity attributes using the service caller's private key and the private key of the target digital identity's issuer. The service provider can then decrypt the encrypted identity attributes using the service caller's public key and the digital identity's issuer's public key to verify the authentication credentials. For example, when the identity verification method is zero-knowledge proof, the identity verification returned by the service caller proving that it holds a digital identity that meets the service provider's requirements can be based on a zero-knowledge proof request constructed by the service provider, addressing the relationship between the value of at least one identity attribute and a preset value range (e.g., greater than or less than). The value of at least one identity attribute can be obtained by encrypting the identity attribute using the service caller's private key and the private key of the issuer of the target digital identity. The service provider can verify the identity verification by comparing the value of at least one identity attribute returned by the service caller with the preset value range. This allows the service caller to gain the service provider's trust without disclosing specific identity information, thus balancing the privacy of the service caller and the security of the service interface.

[0093] 306. Based on the target digital identity, according to the service interface information carried in the service interface call request, call the corresponding version of the service interface to provide services and obtain the result of the service interface call.

[0094] In this embodiment of the invention, when a service provider calls a service interface to provide services based on the service interface information carried in the service interface call request, it can call different versions of the service interface to provide services based on the different identity attributes of the target digital identity that generated the authentication request.

[0095] 307 returns the result of the service interface call to the service caller.

[0096] In this embodiment of the invention, the service provider verifies the identity certificate, and the verification result can include verification success or verification failure. If the identity certificate is valid, the verification result is verification success, indicating that the service caller holds a digital identity that meets the service provider's requirements. The service provider trusts the service provider to execute the service interface call, allowing the service provider to call the corresponding service interface to provide services based on the service interface information carried in the service interface call request, and returns the result of the service interface call to the service caller. Optionally, the service provider can append the result of the service interface call to the authentication confirmation message and return it to the service caller simultaneously.

[0097] 308 returns a message to the service caller indicating that the service interface call failed.

[0098] If the identity verification is invalid, the verification result will be "verification failed," indicating that the service caller does not possess a digital identity that meets the service provider's requirements. The service provider lacks the trust required to execute the service interface call and is not permitted to invoke the corresponding service interface to provide services based on the service interface information carried in the service interface call request. The service provider will then return a service interface call failure message to the service caller. Optionally, the service interface call failure message may include the reason for the failure, such as authentication failure.

[0099] Please see Figure 4 , Figure 4 This is a flowchart illustrating another method for securely invoking service interfaces provided by the present invention. Figure 4 The illustrated secure service interface invocation method is applied to the service caller and can be executed by a secure service interface invocation device. It establishes an encrypted channel between the service caller and the service provider, for example, through protocols such as SSL, TLS, or HTTPS. This embodiment of the invention does not limit the type of protocol used to implement the encrypted channel. Through the encrypted channel, the service caller and the service provider can exchange public keys. Secure invocation of the service interface is performed within the encrypted channel. Figure 4 As shown, the secure invocation method of this service interface includes at least the following:

[0100] 401 indicates that a service interface call request has been sent to the service provider.

[0101] 402, Receives an authentication request from the service provider for at least one identity attribute of the target digital identity, issued in accordance with the service interface call request.

[0102] 403: Generate identity verification based on the authentication request and send the identity verification to the service provider.

[0103] 404 indicates the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0104] In this embodiment of the invention, the descriptions of 401, 402, 403, and 404 can be found in [reference needed]. Figure 1 The explanations regarding 101, 102, 103, and 104 in the original text will not be repeated here.

[0105] Please see Figure 5 , Figure 5 This is a flowchart illustrating an application scenario of the secure service interface invocation method provided by the present invention, such as... Figure 5 As shown, the specific process of securely calling the service interface method is as follows:

[0106] The service caller sends an authentication proposal to the service provider. The authentication proposal includes the name of the service interface, the names and values ​​of the service interface parameters, and the identity attributes that the service caller voluntarily discloses.

[0107] Upon receiving an authentication proposal, the service provider parses the service interface name, parameter names, and values ​​contained in the service interface call request and performs a validity check. If the validity check fails, the service provider returns a service interface call failure message to the service caller.

[0108] If the validity check passes, the service provider returns an authentication request to the service caller. The authentication request can be based on one or more identity attributes of the target digital identity, performing data verification or generating zero-knowledge proofs.

[0109] Upon receiving an authentication request, the service caller queries the target digital identity from the digital identity stored locally, generates an identity certificate based on the authentication request, and returns the generated authentication request to the service provider.

[0110] After receiving the identity certificate, the service provider verifies it. Once the identity certificate is confirmed to be valid, the service provider executes the corresponding service interface function.

[0111] After the service provider completes the execution of the service interface function, it will append the execution result to the verification confirmation message and return it to the service caller.

[0112] The boundary point positioning device provided by the present invention is described below. The boundary point positioning device described below and the boundary point positioning method described above can be referred to in correspondence.

[0113] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a service interface secure invocation device provided by the present invention. Figure 6The service interface secure invocation device shown is applied to the service provider and can be used to execute... Figure 1 The method for securely invoking service interfaces establishes an encrypted channel between the service provider and the service caller. For example, this encrypted channel can be established using protocols such as SSL, TLS, or HTTPS. This embodiment of the invention does not limit the type of protocol used to implement the encrypted channel. Through the encrypted channel, the service caller and the service provider can exchange public keys. Secure invocation of the service interface is performed within the encrypted channel. Figure 6 As shown, the secure invocation device for the service interface includes at least:

[0114] The first communication module 610 is used to receive service interface call requests sent by the service caller.

[0115] The first processing module 620 is used to generate an authentication request for at least one identity attribute in the target digital identity based on the service interface call request.

[0116] The first communication module 610 is also used to send an authentication request to the service caller and receive the identity certificate generated by the service caller based on the authentication request.

[0117] The first processing module 620 is also used to verify identity documents.

[0118] The first communication module 610 is also used to return the result of the service interface call to the service caller based on the verification result.

[0119] Optionally, the first processing module 620 is used to determine an authentication strategy based on the service interface call request; the authentication strategy includes: at least one identity attribute in the target digital identity and a method for authenticating the at least one identity attribute; generate an authentication request based on the authentication strategy; and verify the identity authentication based on the determined method to obtain a verification result.

[0120] Optionally, the first processing module 620 is used to determine whether the identity certificate is valid; if the identity certificate is valid, based on the at least one identity attribute, according to the service interface information carried in the service interface call request, the corresponding version of the service interface is called to provide services, and the result of the service interface call is obtained.

[0121] The first communication module 610 is used to return the result of the service interface call to the service caller; if the identity certificate is invalid, it returns a message that the service interface call failed to the service caller.

[0122] Optionally, the first processing module 620 is further configured to determine whether the service interface information carried in the service interface call request in the authentication proposal is legitimate; if the service interface information carried in the service interface call request is legitimate, an authentication request for at least one identity attribute in the target digital identity is generated based on the service interface call request.

[0123] The first communication module 610 is also used to return a service interface call failure message to the service caller if the service interface call information carried in the service interface call request is not valid.

[0124] Please see Figure 7 , Figure 7 This is a schematic diagram of another service interface secure invocation device provided by the present invention. Figure 7 The service interface secure invocation device shown is applied to the service provider and can be used to execute... Figure 4 The method for securely invoking service interfaces establishes an encrypted channel between the service provider and the service caller. For example, this encrypted channel can be established using protocols such as SSL, TLS, or HTTPS. This embodiment of the invention does not limit the type of protocol used to implement the encrypted channel. Through the encrypted channel, the service caller and the service provider can exchange public keys. Secure invocation of the service interface is performed within the encrypted channel. Figure 7 As shown, the secure invocation device for the service interface includes at least:

[0125] The second communication module 710 is used to send a service interface call request to the service provider and receive an authentication request from the service provider for at least one identity attribute in the target digital identity based on the service interface call request.

[0126] The second processing module 720 is used to generate identity verification based on the identity verification request.

[0127] The second communication module 710 is also used to send identity verification to the service provider and receive the result of the service interface call returned by the service provider based on the verification result of the identity verification.

[0128] Optionally, the second processing module 720 is further configured to query the target digital identity in the local database according to the authentication request, and obtain at least one identity attribute from the target digital identity; and generate an identity certificate for the at least one identity attribute according to the identity certificate method specified in the authentication request.

[0129] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a secure service interface invocation method. When this secure service interface invocation method is applied to a service provider, an encrypted channel is established between the service provider and the service caller. The secure invocation of the service interface is performed within this encrypted channel. The secure service interface invocation method includes:

[0130] Receive service interface call requests from service callers;

[0131] Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity;

[0132] Send the authentication request to the service caller and receive the identity verification issued by the service caller based on the authentication request;

[0133] The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result;

[0134] When this secure service interface invocation method is applied to the service caller, an encrypted channel is established between the service caller and the service provider. The secure invocation of the service interface is performed within this encrypted channel. This secure service interface invocation method includes:

[0135] Send a service interface call request to the service provider;

[0136] Receive an authentication request from the service provider for at least one identity attribute in the target digital identity, issued in accordance with the service interface call request;

[0137] Generate an identity certificate based on the identity verification request, and send the identity certificate to the service provider;

[0138] Receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0139] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0140] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute the service interface secure invocation method provided by the above methods, wherein when the service interface secure invocation method is applied to a service provider, an encrypted channel is established between the service provider and the service caller, and the secure invocation of the service interface is performed in the encrypted channel, the service interface secure invocation method comprising:

[0141] Receive service interface call requests from service callers;

[0142] Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity;

[0143] Send the authentication request to the service caller and receive the identity verification issued by the service caller based on the authentication request;

[0144] The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result;

[0145] When this secure service interface invocation method is applied to the service caller, an encrypted channel is established between the service caller and the service provider. The secure invocation of the service interface is performed within this encrypted channel. This secure service interface invocation method includes:

[0146] Send a service interface call request to the service provider;

[0147] Receive an authentication request from the service provider for at least one identity attribute in the target digital identity, issued in accordance with the service interface call request;

[0148] Generate an identity certificate based on the identity verification request, and send the identity certificate to the service provider;

[0149] Receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0150] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a secure service interface invocation method provided by the methods described above. When the secure service interface invocation method is applied to a service provider, an encrypted channel is established between the service provider and the service caller. The secure invocation of the service interface is performed within the encrypted channel. The secure service interface invocation method includes:

[0151] Receive service interface call requests from service callers;

[0152] Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity;

[0153] Send the authentication request to the service caller and receive the identity verification issued by the service caller based on the authentication request;

[0154] The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result;

[0155] When this secure service interface invocation method is applied to the service caller, an encrypted channel is established between the service caller and the service provider. The secure invocation of the service interface is performed within this encrypted channel. This secure service interface invocation method includes:

[0156] Send a service interface call request to the service provider;

[0157] Receive an authentication request from the service provider for at least one identity attribute in the target digital identity, issued in accordance with the service interface call request;

[0158] Generate an identity certificate based on the identity verification request, and send the identity certificate to the service provider;

[0159] Receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

[0160] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0161] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for securely invoking a service interface, characterized in that, This method, applied to service providers, establishes an encrypted channel between the service provider and the service caller. Secure calls to the service interface are performed within this encrypted channel. The secure service interface call method includes: Receive authentication proposals from service callers; the service interface call request is integrated into the authentication proposal; the service interface call request carries the information of the service interface to be called; Obtain the service interface call request from the authentication proposal, obtain the service interface call context information based on the service interface call request, and generate an authentication request for at least one identity attribute in the target digital identity based on the service interface call context information; the service interface call context information includes the name of the service interface, the name of the service caller, and the time of the service interface call. Send the authentication request to the service caller and receive the identity verification issued by the service caller based on the authentication request; The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result.

2. The service interface secure invocation method according to claim 1, characterized in that, Based on the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity, including: The authentication strategy is determined based on the service interface call request; the authentication strategy includes: at least one identity attribute in the target digital identity and the method of authenticating the at least one identity attribute; The authentication request is generated according to the authentication policy; Verifying the identity document includes: The identity verification is performed according to the determined identity verification method to obtain the verification result.

3. The method for securely invoking a service interface according to claim 1 or 2, characterized in that, The identity verification is performed, and the result of the service interface call is returned to the service caller based on the verification result, including: Determine if the identity document is valid; If the identity verification is valid, based on at least one identity attribute of the target digital identity, and according to the service interface information carried in the service interface call request, the corresponding version of the service interface is called to provide services, and the result of the service interface call is obtained. Return the result of the service interface call to the service caller; If the identity verification is invalid, a message indicating that the service interface call failed will be returned to the service caller.

4. The method for securely invoking a service interface according to claim 3, characterized in that, Before generating an authentication request for at least one identity attribute in the target digital identity based on the service interface call request, the method further includes: Determine whether the service interface information carried in the service interface call request in the authentication proposal is legitimate; If the service interface information carried in the service interface call request is legitimate, an authentication request for at least one identity attribute in the target digital identity is generated based on the service interface call request. If the service interface information carried in the service interface call request is invalid, a message indicating that the service interface call failed will be returned to the service caller.

5. A method for securely invoking a service interface, characterized in that, This method, applied to the service caller, establishes an encrypted channel between the service caller and the service provider. Secure calls to the service interface are performed within this encrypted channel. The secure service interface call method includes: Send an authentication proposal to the service provider; the service interface call request is integrated into the authentication proposal; the service interface call request carries the information of the service interface to be called; The system receives an authentication request from the service provider for at least one identity attribute of the target digital identity, issued based on the service interface call request. The authentication request is generated by the service provider obtaining the service interface call request from an authentication proposal, acquiring the service interface call context information based on the service interface call request, and generating an authentication request for at least one identity attribute of the target digital identity based on the service interface call context information. The service interface call context information includes the name of the service interface, the name of the service caller, and the time of the service interface call. Generate an identity certificate based on the identity verification request, and send the identity certificate to the service provider; Receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

6. The service interface secure invocation method according to claim 5, characterized in that, Generate identity verification based on the authentication request, including: Based on the authentication request, query the target digital identity in the local database and obtain at least one identity attribute from the target digital identity; For the at least one identity attribute, the identity verification is generated according to the identity verification method specified in the identity verification request.

7. A service interface secure invocation device, characterized in that, Applied to service providers, an encrypted channel is established between the service provider and the service caller, and secure invocation of the service interface is performed within this encrypted channel. The secure invocation device for the service interface includes: The first communication module is used to receive authentication proposals from service callers; the service interface call request is integrated into the authentication proposal; the service interface call request carries the information of the service interface to be called. The first processing module is configured to obtain the service interface call request from the authentication proposal, obtain the service interface call context information based on the service interface call request, and generate an authentication request for at least one identity attribute in the target digital identity based on the service interface call context information; the service interface call context information includes the name of the service interface, the name of the service caller, and the time of the service interface call. The first communication module is further configured to send the authentication request to the service caller and receive the identity certificate generated by the service caller based on the authentication request; The first processing module is also used to verify the identity certificate; The first communication module is also used to return the result of the service interface call to the service caller based on the verification result.

8. A service interface secure invocation device, characterized in that, Applied to the service caller, an encrypted channel is established between the service caller and the service provider, and secure calls to the service interface are performed within this encrypted channel. The secure service interface call device includes: The second communication module is used to send an authentication proposal to the service provider, wherein a service interface call request is integrated into the authentication proposal; the service interface call request carries information about the service interface to be called; and receives an authentication request from the service provider based on the service interface call request for at least one identity attribute of the target digital identity; the authentication request is generated by the service provider obtaining the service interface call request from the authentication proposal, obtaining the service interface call context information based on the service interface call request, and generating an authentication request for at least one identity attribute of the target digital identity based on the service interface call context information; the service interface call context information includes the name of the service interface, the name of the service caller, and the time of the service interface call; The second processing module is used to generate an identity certificate based on the identity verification request; The second communication module is also used to send the identity certificate to the service provider and receive the result of the service interface call returned by the service provider based on the verification result of the identity certificate.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the service interface secure invocation method as described in any one of claims 1 to 4, or implements the steps of the service interface secure invocation method as described in claim 5 or 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the service interface secure invocation method as described in any one of claims 1 to 4, or implements the steps of the service interface secure invocation method as described in claim 5 or 6.

Images