Implementation method and device of programmable API security gateway

Abstract

This invention discloses a method and apparatus for implementing a programmable API security gateway. The method includes: identifying API interface characteristics and automatically programming policy templates for the API interfaces based on these characteristics; detecting security events of the API interfaces and automatically programming security policy templates for the API interfaces based on these security events; and monitoring the operational status of the API interfaces and automatically adjusting the flow control and security policies associated with the API interfaces. This method and apparatus improve the maintenance efficiency of API interfaces and reduce operational costs.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and apparatus for implementing a programmable API security gateway. Background Technology

[0002] APIs (Application Programming Interfaces) serve as bridges for interaction between programs, playing a crucial role in data transmission. With the development of cloud-native technologies, containerization, orchestration, microservices, and service mesh technologies have made business architecture management more flexible. Simultaneously, this has led to a significant increase in the number of API interfaces for interaction between various services / modules. To reduce coupling between services and improve management flexibility, more and more basic service capabilities are being migrated to API gateways for unified processing.

[0003] API gateways host tens of thousands of API interfaces. Due to differences in business types, it's impossible to implement the same strategies (routing, traffic control, and detection strategies, etc.) for all API interfaces, nor is it feasible to configure different strategies for each interface individually. Furthermore, the rapid development of internet services leads to frequent iterations of API interfaces. These changes inevitably necessitate changes in implementation strategies, posing significant challenges to operations and development personnel. Summary of the Invention

[0004] To address the above issues, this invention provides a method and apparatus for implementing a programmable API security gateway. This method identifies API interface characteristics and automatically programs policy templates for API interfaces based on these characteristics; detects security events of API interfaces and automatically programs security policy templates for API interfaces based on these events; and monitors the operational status of API interfaces and automatically adjusts the flow control and security policies associated with the API interfaces.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] In one embodiment of the present invention, a method for implementing a programmable API security gateway is proposed, the method comprising:

[0007] Identify API interface characteristics and automatically arrange API interface policy templates based on these characteristics; policy templates include flow control policy templates and security policy templates.

[0008] Detect security events at API interfaces and automatically compile security policy templates for those API interfaces based on those security events.

[0009] Monitor the running status of API interfaces and automatically adjust the flow control and security policies associated with the API interfaces.

[0010] Furthermore, the API interface identification system analyzes the traffic passing through the API gateway to determine the characteristics of the API interfaces; when multiple API interfaces have similar characteristics, these API interfaces are automatically grouped, and each group is associated with a policy template.

[0011] Furthermore, the API control system automatically selects a policy template based on the characteristics of the API interface and the characteristics of the API gateway to which the API interface belongs. If the existing policy template does not meet the requirements of the API interface characteristics, the API control system automatically selects the policy execution rules and constructs a new policy template based on the API interface characteristics and the system characteristics of the API gateway to which the API interface belongs. Alternatively, a policy template can be manually created or an existing policy template can be modified based on the API interface characteristics.

[0012] Furthermore, the API control system instantiates the policy template to generate a policy based on the API interface characteristics, and sends the mapping relationship between the API interface characteristics and the policy to the API gateway. The API control system determines the input and output parameter values ​​of the policy execution rules based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs.

[0013] Furthermore, when client traffic passes through the API gateway, the API gateway performs feature matching based on the mapping relationship between API interface characteristics and policies, and performs traffic control or security processing on the client traffic passing through the API gateway according to the execution rules of the matched policies.

[0014] Furthermore, the API interface features are automatically associated with a strategy template, which is used to determine the input and output parameters of the strategy's execution rules and the execution order; when a strategy template does not exist, a new strategy template is automatically generated.

[0015] Furthermore, the strategy template is divided into system default template and custom template; the strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

[0016] Furthermore, the security detection system performs security detection on client traffic passing through the API gateway to identify attacks and generate security events. After receiving the security event information through the API control system, it automatically compiles security policy templates based on the site, API gateway, and API interface to which the security event belongs, combined with the characteristics of the security event. The API control system generates security policies based on the compiled security policy templates and sends them to the security execution unit for security implementation or security handling.

[0017] Furthermore, the security policy template includes multiple execution steps, and the execution unit for these steps includes the API gateway. The API control system dynamically adjusts and terminates the relationship between the API interface and the security policy template based on the API interface's operating status and subsequent security event information.

[0018] Furthermore, the API control system monitors the running status of the API interface, the service status associated with the API interface, and the status of the API gateway to which the API interface belongs. Based on the running status of the API interface, the system dynamically adjusts the input and output parameter values ​​of the policy execution rules.

[0019] In one embodiment of the present invention, an implementation device for a programmable API security gateway is also proposed. The device includes an API gateway, an API control system, a traffic acquisition system, and a detection system. The API control system interacts with the traffic acquisition system, the detection system, and the API gateway. The detection system includes an API interface identification system and a security detection system.

[0020] The traffic acquisition system is used to collect and preprocess client traffic passing through the API gateway, and then send the processed traffic data to the API interface identification system.

[0021] The API interface identification system is used to analyze processed traffic data and determine API interface characteristics.

[0022] The security detection system is used to perform security checks on the processed traffic data, identify attacks, and generate security events for the API interface.

[0023] The API control system is used to automatically orchestrate policy templates for API interfaces based on API interface characteristics; automatically orchestrate security policy templates for API interfaces based on API interface security events; monitor the running status of API interfaces, and automatically adjust the flow control and security policies associated with API interfaces.

[0024] An API gateway is used to perform feature matching on client traffic passing through it based on the mapping relationship between API interface characteristics and policies, and to perform traffic control or security measures on the client traffic passing through it according to the execution rules in the matched policies.

[0025] Furthermore, when multiple API interfaces have similar characteristics, these API interfaces are automatically grouped, and each group is associated with a strategy template.

[0026] Furthermore, the API control system is specifically used for:

[0027] Automatically select a strategy template based on the characteristics of the API interface and the API gateway to which the API interface belongs;

[0028] If the existing policy template does not meet the requirements of the API interface characteristics, the policy execution rules will be automatically selected and a new policy template will be built based on the API interface characteristics and the system characteristics of the API gateway to which the API interface belongs.

[0029] Manually create policy templates or modify existing policy templates based on API interface characteristics.

[0030] Furthermore, the API control system is specifically used for:

[0031] Based on the API interface characteristics, the policy template is instantiated to generate a policy, and the mapping relationship between the API interface characteristics and the policy is sent to the API gateway.

[0032] Based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs, determine the input and output parameter values ​​of the policy execution rules.

[0033] Furthermore, the API interface features are automatically associated with a strategy template, which is used to determine the input and output parameters of the strategy's execution rules and the execution order; when a strategy template does not exist, a new strategy template is automatically generated.

[0034] Furthermore, the strategy template is divided into system default template and custom template; the strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

[0035] Furthermore, the API control system is specifically used for:

[0036] Upon receiving security incident information, security policy templates are automatically compiled based on the site, API gateway, and API interface to which the security incident belongs, combined with the characteristics of the security incident.

[0037] Security policies are generated based on the compiled security policy template and sent to the security execution unit for security implementation or security handling.

[0038] Furthermore, the security policy template contains multiple execution steps, and the execution unit for these execution steps includes the API gateway.

[0039] Furthermore, the API control system is specifically used for:

[0040] Based on the API interface's operational status and subsequent security event information, dynamically adjust and disconnect the relationship between the API interface and the security policy template.

[0041] Furthermore, the API control system is specifically used for:

[0042] Monitor the running status of the API interface, the status of the services associated with the API interface, and the status of the API gateway to which the API interface belongs. Based on the running status of the API interface, dynamically adjust the input and output parameter values ​​of the policy execution rules.

[0043] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned programmable API security gateway.

[0044] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that executes an implementation of a programmable API security gateway.

[0045] Beneficial effects:

[0046] This invention improves API interface maintenance efficiency and reduces operational costs by identifying API interface characteristics, automatically compiling API interface policy templates based on these characteristics, detecting API interface security events, automatically compiling API interface security policy templates based on these events, and monitoring the API interface's operational status to automatically adjust the associated flow control and security policies. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the implementation method of the programmable API security gateway of the present invention;

[0048] Figure 2 This is a schematic diagram of system interaction according to an embodiment of the present invention;

[0049] Figure 3 This is a schematic diagram of the implementation device structure of the programmable API security gateway of the present invention;

[0050] Figure 4 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation

[0051] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of the disclosure to those skilled in the art.

[0052] Those skilled in the art will recognize that embodiments of the present invention can be implemented as an apparatus, device, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0053] According to an embodiment of the present invention, a method and apparatus for implementing a programmable API security gateway are proposed, which identifies API interface characteristics and automatically programs policy templates for API interfaces based on the API interface characteristics; detects security events of API interfaces and automatically programs security policy templates for API interfaces based on the security events of API interfaces; monitors the operating status of API interfaces and automatically adjusts the flow control policies and security policies associated with API interfaces.

[0054] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0055] Figure 1 This is a schematic diagram illustrating the implementation method of the programmable API security gateway of this invention. For example... Figure 1 As shown, the method includes:

[0056] S1: Identify API interface characteristics and automatically arrange API interface policy templates based on these characteristics; policy templates include flow control policy templates and security policy templates.

[0057] The API interface identification system analyzes traffic passing through the API gateway to determine API interface characteristics, including interface type, interface level, business type, sensitive data type, and data volume.

[0058] In practice, when multiple API interfaces have similar characteristics, these API interfaces can be automatically grouped, and each group can be associated with a strategy template.

[0059] In practice, the API interface identification system can assign different tags to API interfaces based on their characteristics, and then map the API interfaces to different policy templates based on the tags.

[0060] In practice, API interfaces may not be associated with policy templates. Policy templates can be global, meaning that all traffic passing through the API gateway needs to execute the global policy. Policy templates can also be associated with a site, in which case all API interfaces under that site must execute the policy.

[0061] In practice, the API control system automatically associates policy templates based on the characteristics of the API interface and the system characteristics of the API gateway to which the API belongs. If the existing policy template does not meet the requirements of the API interface characteristics, the API control system can automatically select execution rules and build a new policy template based on the API interface characteristics and the system characteristics of the API gateway to which the API belongs (different API gateways have different execution capabilities and their execution rules are also different). Administrators can also manually create policy templates or modify existing policy templates based on the API interface characteristics.

[0062] Each execution rule exists as a plugin in the API gateway and is loaded into the API gateway's memory when an execution rule is enabled. The API gateway executes each rule in the order specified in the flow control policy.

[0063] The strategy template is divided into system default template and custom template. The strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

[0064] The API control system instantiates policy templates, generates policies, and distributes them to the API gateway. It also distributes a mapping table between API interfaces and policies to the API gateway. The API control system determines the input and output parameter values ​​of the policy execution rules based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs. The system characteristics of the service associated with the API interface include the system parameters of the server hosting the service (CPU, memory, number of nodes, and concurrency, etc.), and the system characteristics of the API gateway to which the API interface belongs include the system parameters and capacity of the API gateway.

[0065] Specifically, each execution rule is a Lua script whose input parameters, output parameters, thresholds, and processing rules are all exposed, and the final parameter values ​​are determined by the API control system. The policy template, on the other hand, connects multiple Lua scripts through logical relationships through orchestration. In the forwarding plane, the API interface is associated with the policy, and the Lua script corresponding to the policy is finally executed. According to the execution rules, traffic rate limiting and security measures are taken for the API interface. For example, a login interface limits the number of login attempts per IP address within a fixed time window, while employing a whitelist strategy, allowing only requests from IPs that match the whitelist to pass. Two rules are created: an IP whitelist rule and an IP frequency limit rule. These two rules are then programmed into a policy template. The execution order is: the IP whitelist rule is executed first, followed by the IP frequency limit rule only if the whitelist rule is successful. This policy template is then associated with the login interface. The IP whitelist rule exposes IP whitelist parameters and handles requests with either allow or discard rules. Users only need to enter the IP addresses that can be allowed. The IP frequency limit rule exposes the time window and IP address, handling requests with either alarms or packet dropping rules. When programming the template, a whitelist code of 200 is specified for allowance, and a code of 403 for packet dropping. When the code is 200, the IP frequency limit rule continues to execute.

[0066] When the API gateway receives traffic, it identifies the keywords of the API interface according to the API interface identification rules, and looks up the mapping relationship table between the API interface and the policy. If a policy is matched, the corresponding Lua code of the policy is executed to perform traffic control and security handling.

[0067] S2: Detect security events of API interfaces and automatically orchestrate security policy templates based on the security events of API interfaces;

[0068] The security detection system performs security checks on client traffic passing through the API gateway, detects attacks, and identifies security events based on attack and traffic information. After receiving security event information, the API control system automatically compiles security policy templates based on the site, API gateway, and API interface to which the security event belongs, combined with the security event characteristics. If a security event, based on its attack characteristics (attack type, severity, attack source, and attack frequency, etc.), may affect multiple API interfaces or the entire service, security implementation needs to be carried out at the service level, across multiple API gateways, or within API interface groups. The security policy template includes multiple execution steps, with execution units including the API gateway. The API control system can request other security execution units (i.e., other security devices) to perform security implementation or security measures based on the compiled security policy template. The API control system generates security policies based on the security policy template and sends them to each security execution unit.

[0069] The API control system monitors the operational status of API interfaces and, based on subsequent security event information, dynamically adjusts and terminates the relationship between API interfaces and security policy templates.

[0070] S3: Monitors the running status of API interfaces and automatically adjusts the flow control and security policies associated with the API interfaces.

[0071] The API control system monitors the operational status and service status of API interfaces, as well as the status of the API gateway. Based on the operational status of the API interfaces, it dynamically adjusts the input and output parameters of the policy execution rules. In practice, when API interface characteristics change, the policy template can be adjusted.

[0072] API operational status includes the total number of requests to the API interface and the number of requests from a specific client, as well as API interface version changes, parameter changes, outbound data changes, and outbound data volume changes.

[0073] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0074] To provide a clearer explanation of the implementation of the programmable API security gateway described above, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation of the present invention.

[0075] Example:

[0076] S1: Identify API interface characteristics and automatically arrange API interface policy templates based on these characteristics; policy templates include flow control policy templates and security policy templates.

[0077] like Figure 2 As shown, in this embodiment, the traffic acquisition system collects and preprocesses the traffic data, then sends the processed traffic data to the detection system. The detection system includes an API interface identification system and a security detection system. This embodiment is merely an implementation example; the API control system, traffic acquisition system, and detection system are functional modules of the entire system.

[0078] The API control system interacts with the traffic acquisition system, detection system, and API gateway, and is responsible for overall configuration management, monitoring, and decision-making.

[0079] The API interface identification system analyzes traffic passing through the API gateway to determine the characteristics of the API interface. These characteristics include interface type, protocol type, interface level, business type, sensitive data type, and data volume.

[0080] Specifically, the interface types include registration interface, login interface, logout interface, and payment interface.

[0081] Protocol types include HTTP, HTTPS, WebSocket, and gRPC.

[0082] Sensitive data includes personal information (ID card and bank card numbers) and network data (IP address, MAC address and device fingerprint), as well as various business data (order number and bill number), etc.

[0083] In practice, when multiple API interfaces have similar characteristics, these API interfaces can be automatically grouped, and each group can be associated with a strategy template. For example, API interfaces with the same interface level, or API interfaces for a specific business function, can be grouped using multiple dimensions.

[0084] In practice, the API control system automatically associates policy templates based on the characteristics of the API interface and the system characteristics of the API gateway to which the API interface belongs. If the existing policy template does not meet the requirements of the API interface characteristics, the API control system can automatically select execution rules and build a new policy template based on the characteristics of the API interface and the system characteristics of the API gateway to which the API interface belongs.

[0085] The API control system distributes the mapping relationship between API interface characteristics and policies to the API gateway. The API gateway performs feature matching on the client traffic passing through it, and performs traffic control or security processing on the client traffic passing through the API gateway according to the execution rules of the matched policies.

[0086] Specifically, different API gateways have different execution capabilities and execution rules. All rules must be enabled and associated with the service or API interface before they can take effect.

[0087] Taking the login interface as an example, the API control system automatically orchestrates policy templates, selects request restriction rules, login frequency restriction rules, and exception code judgment rules, etc. The API gateway will limit the login frequency and number of connections of a certain IP address, as well as the login frequency of all users and the number of connections of a certain service according to these rules. When a certain threshold is exceeded, rate limiting or blocking can be implemented.

[0088] Administrators can also manually create policy templates or modify existing policy templates based on API interface characteristics. Policy templates automatically created by the system must be reviewed by the administrator.

[0089] Each execution rule exists as a plugin in the API gateway. When an execution rule is enabled, it is loaded into the API gateway's memory. Each execution rule consists of multiple execution rule instances. The API gateway executes each rule according to the execution order in the flow control policy. The execution rules in the flow control policy are logically related to each other.

[0090] When client traffic passes through the API gateway, the corresponding flow control policy is automatically matched according to the characteristics of the API interface, and the client traffic passing through the API gateway is subject to flow control or security processing according to the policy execution rules.

[0091] If client traffic passing through the API gateway exceeds the rate limiting threshold or is blacklisted during the execution of flow control policies, the client traffic passing through the API gateway will be dropped, and the processing of client traffic passing through the API gateway will end at this point.

[0092] The execution rules here can be connection limit, request limit, service circuit breaking, or data masking rules, etc.

[0093] The strategy template is divided into system default template and custom template. The strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

[0094] The API control system instantiates policy templates, generates policies, and distributes them to the API gateway. Based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs, the API control system determines the input and output parameter values ​​of the policy execution rules. The system characteristics of the service associated with the API interface include the system parameters of the server hosting the service (CPU, memory, number of nodes, and concurrency, etc.), and the system characteristics of the API gateway to which the API interface belongs include the system parameters and capacity of the API gateway.

[0095] Specifically, a relatively lenient strategy template can be implemented in the initial state.

[0096] S2: Detect security events of API interfaces and automatically orchestrate security policy templates based on the security events of API interfaces;

[0097] The security detection system performs security checks on client traffic passing through the API gateway, detects attacks, and determines security events based on attack and traffic information. These security events include the event name, attack type, attack purpose, attack source, associated API gateway and site information, API interface information, attack time, priority, and attack frequency.

[0098] After receiving security event information, the API control system automatically generates security policy templates based on the site, API gateway, and API interface to which the security event belongs, combined with the characteristics of the security event; custom security policy templates can also be created. The security execution unit in security implementation is determined by the system based on the security capability devices in the network.

[0099] Security incidents, depending on their attack characteristics, may affect multiple API interfaces or the entire service, necessitating security implementation at the service level, across multiple API gateways, or within API interface groups. Security policy templates consist of multiple execution steps, with the API gateway serving as the execution unit for these steps. The API control system can request other security execution units to perform security implementation or handling based on the orchestrated security policy template. The API control system generates a security policy based on the security policy template and sends it to each security execution unit.

[0100] S3: Monitors the running status of API interfaces and automatically adjusts the flow control and security policies associated with the API interfaces.

[0101] In practice, the API control system monitors the operational status of API interfaces by collecting the operation logs of the API gateway.

[0102] The API control system monitors the running status, service status, and API gateway status of API interfaces, and dynamically adjusts the input and output parameters of the policy execution rules based on the running status of the API interfaces.

[0103] The API control system monitors the operational status of API interfaces and subsequent security event information, and dynamically adjusts and terminates the relationship between API interfaces and security policy templates.

[0104] API operational status includes the number of API requests, status code statistics, and traffic statistics. It also includes API version changes, parameter changes, outbound data changes, and outbound data volume changes. Additionally, it includes statistics based on client address, region, user agent (UA), and client device type.

[0105] In practice, when API interface characteristics change, the strategy template can be adjusted. For example, if monitoring reveals that the number of API requests changes in a 24-hour cycle, the input and output parameters of the strategy execution rules can be adjusted according to the periodic traffic changes.

[0106] In practice, the API interface identification system compares the version changes of the API interface. When the parameters or outbound data of the API interface change, it automatically notifies the API control system of the change characteristics of the API interface. The API control system determines whether the existing flow control strategy meets the requirements based on the new characteristics of the API interface. If it does not meet the requirements, the current flow control strategy is adjusted. This can be done by adding, deleting, or modifying execution rules, or simply modifying the input and output parameter values ​​of the execution rules.

[0107] Based on the same inventive concept, this invention also proposes an implementation apparatus for a programmable API security gateway. The implementation of this apparatus can refer to the implementation of the methods described above, and repeated details will not be repeated. The term "module" as used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0108] Figure 3 This is a schematic diagram of the implementation device structure of the programmable API security gateway of the present invention. Figure 3 As shown, the device includes an API gateway 101, an API control system 102, a traffic acquisition system 103, and a detection system 104. The API control system 102 interacts with the traffic acquisition system 103, the detection system 104, and the API gateway 101. The detection system 104 includes an API interface identification system 105 and a security detection system 106.

[0109] Traffic acquisition system 103 is used to collect and preprocess client traffic passing through API gateway 101, and send the processed traffic data to API interface identification system 105.

[0110] API Interface Recognition System 105 is used to analyze processed traffic data and determine API interface characteristics.

[0111] When multiple API interfaces have similar characteristics, these API interfaces are automatically grouped, and each group is associated with a strategy template.

[0112] The security detection system 106 is used to perform security detection on the processed traffic data, identify attacks, and generate security events for the API interface.

[0113] API control system 102 is used to automatically arrange policy templates for API interfaces based on API interface characteristics; automatically arrange security policy templates for API interfaces based on API interface security events; monitor the running status of API interfaces and automatically adjust the flow control policies and security policies associated with API interfaces.

[0114] Automatically select a strategy template based on the characteristics of the API interface and the API gateway to which the API interface belongs;

[0115] If the existing policy template does not meet the requirements of the API interface characteristics, the policy execution rules will be automatically selected and a new policy template will be built based on the API interface characteristics and the system characteristics of the API gateway to which the API interface belongs.

[0116] Manually create policy templates or modify existing policy templates based on API interface characteristics.

[0117] Based on the API interface characteristics, the policy template is instantiated to generate a policy, and the mapping relationship between the API interface characteristics and the policy is sent to the API gateway.

[0118] Based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs, determine the input and output parameter values ​​of the policy execution rules.

[0119] The API interface features automatic association with a strategy template, which is used to determine the input and output parameters of the strategy's execution rules and the execution order; when a strategy template does not exist, a new strategy template is automatically generated.

[0120] The strategy template is divided into system default template and custom template. The strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

[0121] Upon receiving security incident information, security policy templates are automatically compiled based on the site, API gateway, and API interface to which the security incident belongs, combined with the characteristics of the security incident.

[0122] Security policies are generated based on the compiled security policy template and sent to the security execution unit for security implementation or security handling.

[0123] The security policy template contains multiple execution steps, and the execution unit for these steps includes API gateways, etc.

[0124] Based on the API interface's operational status and subsequent security event information, dynamically adjust and disconnect the relationship between the API interface and the security policy template.

[0125] Monitor the running status of the API interface, the status of the services associated with the API interface, and the status of the API gateway to which the API interface belongs. Based on the running status of the API interface, dynamically adjust the input and output parameter values ​​of the policy execution rules.

[0126] API Gateway 101 is used to perform feature matching on client traffic passing through it based on the mapping relationship between API interface characteristics and policies, and to perform traffic control or security processing on client traffic passing through it according to the execution rules in the matched policies.

[0127] It should be noted that although several modules of the implementation apparatus for a programmable API security gateway have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in a single module. Conversely, the features and functions of a single module described above can be further divided and embodied by multiple modules.

[0128] Based on the aforementioned inventive concept, such as Figure 4 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it implements the aforementioned programmable API security gateway.

[0129] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that executes the aforementioned programmable API security gateway implementation.

[0130] The present invention proposes a programmable API security gateway implementation method and apparatus, which improves the maintenance efficiency of API interfaces and reduces operation and maintenance costs.

[0131] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0132] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.

Claims

1. An implementation method of an orchestratable API security gateway, characterized in that, The method includes: The API interface identification system identifies API interface characteristics and automatically orchestrates policy templates for these characteristics. It analyzes traffic passing through the API gateway to determine API interface characteristics. When multiple API interfaces have similar characteristics, they are automatically grouped, and each group is associated with a policy template. The system tags API interfaces based on their characteristics and maps them to different policy templates. API interface characteristics are automatically associated with policy templates, which determine the input and output parameters and execution order of the policy's execution rules. If a policy template is missing, a new one is automatically generated. Each execution rule is a Lua script whose input parameters, output parameters, thresholds, and processing rules are all exposed, and the final parameter values ​​are determined by the API control system. Policy templates, on the other hand, orchestrate multiple Lua scripts through logical relationships. At the forwarding plane, the API gateway associates API interfaces with policies, ultimately executing the Lua script corresponding to the policy. Based on the execution rules, traffic rate limiting and security measures are applied to the API interface. When the API gateway receives traffic, it identifies the keywords of the API interface according to the API interface identification rules and looks up the mapping table between API interfaces and policies. If a policy is matched, the corresponding Lua code is executed to perform traffic control and security measures. The API control system detects security events of the API interface and automatically arranges security policy templates for the API interface based on these security events. The API control system monitors the operational status of the API interface and automatically adjusts the flow control and security policies associated with the API interface.

2. The method for implementing a programmable API security gateway according to claim 1, characterized in that, The API control system automatically selects a policy template based on the characteristics of the API interface and the API gateway to which the API interface belongs. If the existing policy template does not meet the requirements of the API interface characteristics, the API control system automatically selects the policy execution rules and builds a new policy template based on the API interface characteristics and the system characteristics of the API gateway to which the API interface belongs. Alternatively, a policy template can be manually created or an existing policy template can be modified based on the API interface characteristics.

3. The method for implementing a programmable API security gateway according to claim 2, characterized in that, The API control system instantiates policy templates based on API interface characteristics to generate policies, and distributes the mapping relationship between API interface characteristics and policies to the API gateway. The API control system determines the input and output parameter values ​​of the policy execution rules based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs.

4. The method for implementing a programmable API security gateway according to claim 3, characterized in that, When client traffic passes through the API gateway, the API gateway performs feature matching based on the mapping relationship between API interface characteristics and policies, and performs traffic control or security measures on the client traffic passing through the API gateway according to the execution rules of the matched policies.

5. The method for implementing a programmable API security gateway according to claim 1, characterized in that, The strategy template is divided into a system default template and a custom template. The strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

6. The method for implementing a programmable API security gateway according to claim 1, characterized in that, The security detection system performs security checks on client traffic passing through the API gateway to identify attacks and generate security events. After receiving security incident information through the API control system, the system automatically compiles security policy templates based on the site, API gateway, and API interface to which the security incident belongs, combined with the characteristics of the security incident. The API control system then generates security policies based on the compiled security policy templates and sends them to the security execution unit for security implementation or handling.

7. The method for implementing a programmable API security gateway according to claim 6, characterized in that, The security policy template includes multiple execution steps, and the execution unit for these steps includes the API gateway. The API control system dynamically adjusts and terminates the relationship between the API interface and the security policy template based on the API interface's operating status and subsequent security event information.

8. The method for implementing a programmable API security gateway according to claim 1, characterized in that, The API control system monitors the running status of API interfaces, the service status associated with API interfaces, and the status of the API gateway to which the API interface belongs. Based on the running status of the API interfaces, the system dynamically adjusts the input and output parameter values ​​of the policy execution rules.

9. An implementation apparatus for a programmable API security gateway, characterized in that, The device includes an API gateway, an API control system, a traffic acquisition system, and a detection system. The API control system interacts with the traffic acquisition system, the detection system, and the API gateway. The detection system includes an API interface identification system and a security detection system. The traffic acquisition system is used to collect and preprocess client traffic passing through the API gateway, and then send the processed traffic data to the API interface identification system. The API interface identification system is used to analyze processed traffic data and determine API interface characteristics. When multiple API interfaces have similar characteristics, these API interfaces are automatically grouped, and each group is associated with a strategy template; Based on API interface characteristics, API interfaces are tagged differently, and these tags map the API interfaces to different policy templates. API interface characteristics are automatically associated with policy templates, which determine the input and output parameters and execution order of the policy's execution rules. When a policy template does not exist, a new one is automatically generated through orchestration. Each execution rule is a Lua script whose input parameters, output parameters, thresholds, and processing rules are all exposed, with the final parameter values ​​determined by the API control system. Policy templates are created by orchestrating multiple Lua scripts through logical relationships. At the forwarding plane, API interfaces are associated with policies, and the corresponding Lua script is ultimately executed. Based on the execution rules, traffic rate limiting and security measures are applied to the API interface. The security detection system is used to perform security checks on the processed traffic data, identify attacks, and generate security events for the API interface. The API control system is used to automatically orchestrate API policy templates based on API interface characteristics and to automatically orchestrate API security policy templates based on API interface security events. Monitor the running status of API interfaces and automatically adjust the flow control and security policies associated with the API interfaces; An API gateway is used to perform feature matching on client traffic passing through it based on the mapping relationship between API interface characteristics and policies. Then, it performs traffic control or security processing on the client traffic passing through it by executing the rules in the matched policies. When traffic is received, the gateway identifies the keywords of the API interface according to the API interface identification rules and looks up the mapping relationship table between the API interface and the policy. If a policy is matched, the gateway executes the corresponding Lua code to perform traffic control and security processing on the traffic.

10. The apparatus for implementing a programmable API security gateway according to claim 9, characterized in that, The API control system is specifically used for: Automatically select a strategy template based on the characteristics of the API interface and the API gateway to which the API interface belongs; If the existing policy template does not meet the requirements of the API interface characteristics, the policy execution rules will be automatically selected and a new policy template will be built based on the API interface characteristics and the system characteristics of the API gateway to which the API interface belongs. Manually create policy templates or modify existing policy templates based on API interface characteristics.

11. The implementation apparatus for the programmable API security gateway according to claim 10, characterized in that, The API control system is specifically used for: Based on the API interface characteristics, the policy template is instantiated to generate a policy, and the mapping relationship between the API interface characteristics and the policy is sent to the API gateway. Based on the system characteristics of the service associated with the API interface and the system characteristics of the API gateway to which the API interface belongs, determine the input and output parameter values ​​of the policy execution rules.

12. The apparatus for implementing a programmable API security gateway according to claim 9, characterized in that, The strategy template is divided into a system default template and a custom template. The strategy template contains multiple execution rules and specifies the parameter types of the input and output parameters of each execution rule, the execution order of the execution rules, and the parameter passing and execution logic between the execution rules.

13. The apparatus for implementing a programmable API security gateway according to claim 9, characterized in that, The API control system is specifically used for: Upon receiving security incident information, security policy templates are automatically compiled based on the site, API gateway, and API interface to which the security incident belongs, combined with the characteristics of the security incident. Security policies are generated based on the compiled security policy template and sent to the security execution unit for security implementation or security handling.

14. The implementation apparatus for the programmable API security gateway according to claim 13, characterized in that, The security policy template contains multiple execution steps, and the execution unit for these execution steps includes the API gateway.

15. The apparatus for implementing a programmable API security gateway according to claim 9, characterized in that, The API control system is specifically used for: Based on the API interface's operational status and subsequent security event information, dynamically adjust and disconnect the relationship between the API interface and the security policy template.

16. The apparatus for implementing a programmable API security gateway according to claim 9, characterized in that, The API control system is specifically used for: Monitor the running status of the API interface, the status of the services associated with the API interface, and the status of the API gateway to which the API interface belongs. Based on the running status of the API interface, dynamically adjust the input and output parameter values ​​of the policy execution rules.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-8.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-8.

Images