Service flow compliance detection method, device, equipment, medium and product

Abstract

The invention provides a compliance detection method and device for service traffic, equipment, a medium and a product. The method comprises the following steps: acquiring first service traffic; wherein the first service flow is related to cross-regional data transmission based on a first API of a first service party; performing compliance detection on the first service flow based on the registered API set to obtain a compliance detection result; wherein the registration API set comprises at least one registered API and registration information of the at least one registered API; and processing the first service flow based on a set compliance processing rule according to a compliance detection result. In the method, by simulating a traditional cargo import and export process, the first registration and the second export of API data are realized, real-time detection is carried out on each service flow related to cross-regional data transmission, and the compliance of the cross-regional transmission of the API data is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a compliance detection method, device, electronic device, computer-readable storage medium, and computer program product for business traffic. Background Art

[0002] Enterprises with cross-regional businesses usually establish data centers or deploy businesses in different regions to run businesses in different regions. During the business operation process, business data needs to be transmitted between different regions.

[0003] Typically, cross-region data transmission can be achieved through an application programming interface (API). Specifically, the business party provides the API, and the caller transmits data by calling the API provided by the business party. Similarly, the business party can also return data to the caller in response to the API call request.

[0004] How to conduct compliance detection of business traffic in the above-mentioned scenario of cross-regional data transmission based on API has become an urgent problem to be solved. Summary of the invention

[0005] The present application provides a compliance detection method for business traffic. The method performs real-time detection on each business traffic involving cross-regional data transmission to ensure the compliance of cross-regional transmission of API data. The present application also provides a device, electronic device, computer-readable storage medium, and computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a compliance detection method for business traffic, the method comprising:

[0007] Obtaining first business traffic; wherein the first business traffic is related to cross-regional data transmission based on a first application programming interface API of a first business party;

[0008] Based on the registered API set, a compliance check is performed on the first service traffic to obtain a compliance check result; wherein the registered API set includes at least one registered API and registration information of the at least one registered API;

[0009] According to the compliance detection result, based on the set compliance processing rules, the first business traffic is processed.

[0010] In a second aspect, the present application provides a compliance detection device for service traffic, the device comprising:

[0011] An acquisition module, configured to acquire first service traffic; wherein the first service traffic is related to cross-regional data transmission based on a first application programming interface API of a first service party;

[0012] A detection module, configured to perform compliance detection on the first service traffic based on a registered API set to obtain a compliance detection result; wherein the registered API set includes at least one registered API and registration information of the at least one registered API;

[0013] A processing module is used to process the first business traffic according to the compliance detection result and based on the set compliance processing rules.

[0014] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the electronic device performs the compliance detection method for business traffic in the first aspect or any implementation of the first aspect.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct an electronic device to execute the compliance detection method for business traffic described in the above-mentioned first aspect or any implementation method of the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the compliance detection method for business traffic described in the first aspect or any one of the implementations of the first aspect.

[0017] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0018] It can be seen from the above technical solutions that this application has the following advantages:

[0019] The present application provides a compliance detection method for business traffic. The method first obtains a first business traffic, wherein the first business traffic is related to cross-regional data transmission based on a first API of a first business party. Then, based on a registered API set, a compliance detection is performed on the first business traffic to obtain a compliance detection result, wherein the registered API set includes at least one registered API and registration information of at least one registered API. According to the compliance detection result, the first business traffic is processed based on a set compliance processing rule.

[0020] In this method, a registered API set is pre-configured for APIs with cross-regional data transmission. When business traffic for cross-regional data transmission based on API is generated, the business traffic is matched with the registered APIs in the registered API set and the registration information of the registered APIs to determine whether there is a compliance risk in the business traffic, and then the business traffic is processed in combination with the compliance detection results and compliance processing rules. In this way, by simulating the traditional import and export process of goods, the "registration before export" of API data is realized, and real-time detection is performed on each business traffic involving cross-regional data transmission to ensure the compliance of API data cross-regional transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0022] Figure 1 A schematic diagram of the architecture of a compliance detection system for business traffic provided in an embodiment of the present application;

[0023] Figure 2 A flow chart of a compliance detection method for business traffic provided in an embodiment of the present application;

[0024] Figure 3A and Figure 3B A schematic diagram of a service flow provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of a compliance detection device for business traffic provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0028] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0029] Enterprises with cross-regional business can be understood as enterprises that conduct business in different regions. Usually, different regions have different data protection regulations. In order to meet the data protection regulations of each region, cross-regional enterprises can establish data centers in each region and then use local data centers to run their business.

[0030] Business parties deployed in different regions can provide application programming interfaces (APIs), and business data can be transmitted between different regions by calling APIs. The data transmitted across regions based on the APIs can also be called API data.

[0031] Considering the data compliance issues in the process of cross-regional data transmission, the industry has proposed a manual compliance assessment process. In specific implementation, when a business party (for example, a business party involved in cross-regional business) adds a new API related to cross-regional data transmission, it will actively initiate a compliance assessment process, fill in the API-related information through a compliance questionnaire, and the compliance personnel will conduct a compliance assessment on the API.

[0032] However, the above methods are less real-time and accurate. The compliance assessment process usually relies on the business party to take the initiative. If the business party does not propose a compliance assessment process, or if the business party does not update the compliance assessment information in a timely manner after the business changes, it may bring compliance risks to cross-regional data transmission for cross-regional enterprises. Moreover, from the perspective of cross-regional data transmission management, compliance personnel do not have reasonable means to conduct real-time detection of cross-regional data transmission.

[0033] In view of this, the present application provides a compliance detection method for business traffic, which method first obtains a first business traffic, wherein the first business traffic is related to cross-regional data transmission based on a first API of a first business party, and then, based on a registered API set, performs a compliance detection on the first business traffic to obtain a compliance detection result, wherein the registered API set includes at least one registered API and registration information of at least one registered API, and according to the compliance detection result, the first business traffic is processed based on the set compliance processing rules.

[0034] In this method, a registered API set is pre-configured for APIs with cross-regional data transmission. When business traffic for cross-regional data transmission based on API is generated, the business traffic is matched with the registered APIs in the registered API set and the registration information of the registered APIs to determine whether there is a compliance risk in the business traffic, and then the business traffic is processed in combination with the compliance detection results and compliance processing rules. In this way, by simulating the traditional import and export process of goods, the "registration before export" of API data is realized, and real-time detection is performed on each business traffic involving cross-regional data transmission to ensure the compliance of API data cross-regional transmission.

[0035] To facilitate understanding of the technical solution provided by the embodiments of the present application, the following will be described in conjunction with the accompanying drawings. Figure 1As shown is a schematic diagram of the architecture of a compliance detection system for business traffic, the compliance detection system 10 for business traffic includes a compliance proxy service 101, a compliance detection engine 102 and a cross-regional compliance platform 103, which are introduced separately below.

[0036] The compliance proxy service 101 is used to receive business traffic, send the business traffic to the compliance detection engine 102, and receive the compliance detection results returned by the compliance detection engine 102. In other words, the compliance proxy service 101 can be understood as a compliance gateway. Based on reverse proxy technology, the compliance proxy service 101 provides reverse proxy capabilities to the caller and the business party, and acts as an intermediary between the caller and the business party. The caller does not need to know the actual address of the business party, and the business party does not need to know the actual address of the caller. In this way, the compliance proxy service 101 can distribute call requests or responses to multiple servers according to the preset load balancing algorithm, balance the load pressure of the servers, and improve the system performance and reliability during cross-regional data transmission.

[0037] The compliance detection engine 102 is used to receive the business traffic sent by the compliance proxy service 101, perform compliance detection on the business traffic, and return the compliance detection results to the compliance proxy service 101. Specifically, the compliance detection engine 102 obtains the registration API set from the cross-regional compliance platform 103, performs compliance detection on the business traffic based on the registered APIs in the registration API set and the registration information of the registered APIs, and then obtains the compliance detection results. In this way, the compliance detection engine 102 returns the compliance detection results to the compliance proxy service 101, so that the compliance proxy service 101 can process the business traffic according to the compliance detection results and in combination with the compliance processing rules.

[0038] The cross-regional compliance platform 103 is used to maintain the set of registered APIs and compliance processing rules. In other words, the cross-regional compliance platform 103 can be understood as a platform that provides services to compliance personnel. Business parties can register APIs through the cross-regional compliance platform 103, and compliance personnel can review the business party's registered APIs through the cross-regional compliance platform 103. At the same time, compliance personnel can also configure compliance processing rules through the cross-regional compliance platform 103 to improve the flexibility of compliance testing.

[0039] based on Figure 1 The present application also provides a business flow compliance detection method, see Figure 2 The flowchart of a compliance detection method for business traffic is shown in FIG. 1 . The method can be applied to a compliance detection system 10 for business traffic. The method specifically includes:

[0040] S201: Obtain first service traffic.

[0041] The first business traffic may be understood as any business traffic that has compliance detection requirements. In an embodiment of the present application, the first business traffic may be related to cross-regional data transmission based on a first API of a first business party.

[0042] That is, the first service traffic involves cross-regional data transmission, and the sender and receiver of the first service traffic are located in different regions and use data centers in different regions. In addition, the first service traffic is generated based on the first API provided by the first service party, that is, one of the sender and receiver of the first service traffic is the first service party.

[0043] In some embodiments, the first business traffic may be a request traffic for calling a first API of a first business party. That is, in a call link in which a caller calls the first API, a request traffic is generated by a call request of the caller. In this case, the sender of the first business traffic is the caller, and the receiver of the first business traffic is the first business party.

[0044] like Figure 3A As shown, the caller calls the first API of the first business party, generates request traffic, and the request traffic is sent to the compliance proxy service 101. The compliance proxy service 101 sends the request traffic to the compliance detection engine 102 for compliance detection, and receives the compliance detection results returned by the compliance detection engine 102. When the request traffic is compliant, the request traffic is sent to the first business party, completing the process of the caller calling the first API.

[0045] The embodiments of the present application do not restrict the caller. For example, the caller may be an employee of a cross-regional enterprise, a user of a product provided by the first business party, or other services. Request traffic may be generated in various forms such as office network access, product function calls, or calls between services.

[0046] In other embodiments, the first business traffic may be a response traffic in response to a call request of the first API. That is, in a response link in which the first business party responds to an API call request, the response traffic is generated by the response of the first business party. In this case, the sender of the first business traffic is the first business party, and the receiver of the first business traffic is the caller.

[0047] like Figure 3B As shown, the first business party generates response traffic in response to the API call request (i.e., request traffic), and the corresponding traffic is sent to the compliance proxy service 101. The compliance proxy service 101 sends the response traffic to the compliance detection engine 102 for compliance detection, and receives the compliance detection results returned by the compliance detection engine 102. When the response traffic is compliant, the response traffic is sent to the caller, completing the process of the first business party responding to the API call request.

[0048] S202: Based on the registered API set, a compliance check is performed on the first service traffic to obtain a compliance check result.

[0049] In an embodiment of the present application, the registered API set may include at least one registered API and registration information of at least one registered API. In other words, the registered API set stores registration information of APIs that have been pre-declared and passed compliance testing. In this way, by the "pre-declaration" method, before actually using the API, the APIs involving cross-regional data transmission provided by different business parties are registered to form an "API whitelist".

[0050] In some embodiments, the registration information may include at least one of the following: an interface path, an interface field list, and an interface field type.

[0051] Among them, the interface path can be understood as a uniform resource locator (URL) used to identify API resources, and the caller can call the API through the interface path. The interface field list can be understood as the parameters and data structures contained in the request traffic and response traffic of the API, that is, the interface field list defines how the API receives input data and how to return data. Under normal circumstances, the caller should generate request traffic according to the request parameters defined in the interface field list, and the business party should generate response traffic according to the response parameters defined in the interface field list. The interface field type can be understood as the parameter type of each parameter in the interface field list. For example, the request parameters include parameters A and B, the interface field type of parameter A is a string type, the interface field type of parameter B is a number type, the response parameters include parameters C and D, the interface field type of parameter C is a floating point type, and the interface field type of interface D is an integer type.

[0052] By pre-forming the registered APIs into a registered API set, for all business flows that use APIs for cross-regional data transmission, the business flows are matched with the registered API set to perform real-time compliance detection. In specific implementation, the first API is matched with the registered APIs in the registered API set, and the first business flow is matched with the registration information of the first API in the registered API set to obtain the compliance detection result.

[0053] That is to say, in an embodiment of the present application, matching the first business traffic with the registered API set can be divided into two matching processes: in the first matching process, the first API related to the first business traffic is matched with the registered APIs in the registered API set to determine whether the first API has been registered, that is, to determine whether the first business party has declared the first API in advance.

[0054] If, through the first matching process, it is determined that the first API has been registered, the second matching process is executed. In the second matching process, the first business traffic is matched with the registration information of the first API in the registered API set to determine whether the specific information of the first business traffic is consistent with the registration information of the first API, that is, to determine whether there is unregistered information of the first API in the first business traffic.

[0055] In this way, through two matching processes, for API data (i.e. business traffic), on the one hand, it is detected whether the API is safe and compliant, and on the other hand, it is detected whether the specific data is the same as the registration information. If the API is not pre-registered or the registration information of the API changes due to business changes, it can be identified in the matching process, thereby enhancing the timeliness and comprehensiveness of compliance detection.

[0056] In some possible implementations, in response to the first API hitting a registered API set, the fields in the first business traffic matching the interface field list in the registration information of the first API, and the field types in the first business traffic matching the interface field types in the registration information of the first API, a compliance detection result characterizing the compliance of the first business traffic is obtained.

[0057] Among them, the first API hits the registered API set, which can be understood as the registration information of the first API is stored in the registered API set. The fields in the first business traffic match the interface field list in the registration information of the first API, which can be understood as the parameters contained in the first business traffic are the same as the parameters defined in the registration information of the first API. For example, when the first business traffic is request traffic, the request parameters contained in the request traffic are the same as the request parameters defined in the registration information of the first API. When the first business traffic is response traffic, the response parameters contained in the response traffic are the same as the response parameters defined in the registration information of the first API. The field type in the first business traffic matches the interface field type in the registration information of the first API, which can be understood as the parameter type of the parameters contained in the first business traffic is the same as the parameter type defined in the registration information of the first API. For example, when the first business traffic is request traffic, the parameter type of the request parameter in the request traffic is the same as the parameter type of the request parameter defined in the registration information of the first API. When the first business traffic is response traffic, the parameter type of the response parameter in the response traffic is the same as the parameter type of the response parameter defined in the registration information of the first API.

[0058] In other words, only when the first API is pre-registered and the information of the first service flow is consistent with the registration information of the first API, can the first service flow be determined to be compliant. Otherwise, it indicates that the first API is not pre-registered, and the first service flow based on the first API is not compliant, or it indicates that there is information in the first service flow that does not match the registration information of the first API, the first API may have changed, but the registration information has not been updated in time, the first service flow does not match the registration information, and the first service flow is not compliant.

[0059] In this way, by matching at the API level and matching at the business traffic information level, the actual API data is compared with the declared API data registered by the business party to see if they are consistent, thus achieving real-time verification of cross-regional data transmission through the API.

[0060] S203: Process the first service traffic according to the compliance detection result and based on the set compliance processing rules.

[0061] The compliance processing rule can be understood as a rule for processing business traffic. In the embodiment of the present application, the compliance processing rule is pre-set, and the first business traffic is processed in combination with the compliance detection result and the pre-set compliance processing rule.

[0062] Specifically, in response to the compliance detection result indicating that the first business traffic is compliant, the first business traffic is sent to the recipient of the first business traffic; otherwise, based on the set compliance processing rules, one of the following operations is performed: rejecting the first business traffic, desensitizing non-matching information in the first business traffic, sending the desensitized first business traffic to the recipient of the first business traffic, generating an alarm message, and sending the first business traffic to the recipient of the first business traffic.

[0063] Among them, the mismatch information may include information about the mismatch between the first business traffic and the registration information of the first API in the registered API set, and the alarm information can be used to issue an alarm for non-compliant cross-regional data transmission events.

[0064] That is to say, when the first service traffic is compliant, the first service traffic is directly forwarded to the recipient. For example, when the first service traffic is request traffic, the first service traffic is forwarded to the first service party, and when the first service traffic is response traffic, the first service traffic is forwarded to the caller.

[0065] When the first service traffic is not compliant, the embodiment of the present application supports a variety of different processing for the first service traffic. In some embodiments, the first service traffic is directly rejected, that is, the first service traffic is intercepted and not forwarded to the recipient of the first service traffic, so that the service traffic that fails the compliance detection is blocked from the root for cross-region transmission.

[0066] In other embodiments, desensitization is performed on the non-matching information. In other words, data desensitization is performed on the information that has not been pre-declared in the first business traffic, for example, the non-matching information is converted into characters that do not represent the actual meaning (such as "*"). In this way, it is ensured that the business traffic for cross-regional data transmission based on the API does not contain information that has not passed the compliance test, and unknown risks caused by information that has not been pre-declared in the business traffic are prevented.

[0067] In some other embodiments, an alarm is issued for the first business traffic that fails to pass the compliance detection and the occurrence of non-compliant cross-regional data transmission events, and relevant personnel (such as compliance personnel) are informed of information related to the non-compliant first business traffic, but no additional processing is performed on the first business traffic, and the first business traffic is still forwarded to the recipient of the first business traffic. In this way, a relatively loose compliance processing rule of "only observe but not intercept" is provided, and the compliance detection situation is notified to the compliance personnel without affecting the normal business operation of the first business party, so that the compliance personnel can perform subsequent processing.

[0068] In the embodiments of the present application, by providing a rich variety of compliance processing rules, it can be flexibly configured in combination with the actual needs of the business, thereby improving the applicability and flexibility of compliance detection and meeting diverse needs.

[0069] In this method, a registered API set is pre-configured for APIs with cross-regional data transmission. When business traffic for cross-regional data transmission based on API is generated, the business traffic is matched with the registered APIs in the registered API set and the registration information of the registered APIs to determine whether there is a compliance risk in the business traffic, and then the business traffic is processed in combination with the compliance detection results and compliance processing rules. In this way, by simulating the traditional import and export process of goods, the "registration before export" of API data is realized, and real-time detection is performed on each business traffic involving cross-regional data transmission to ensure the compliance of API data cross-regional transmission.

[0070] The above article introduces the process of compliance detection of business traffic provided by the embodiment of the present application. Figure 1 As shown in the compliance detection system 10 for business traffic, the cross-regional compliance platform 103 can also be used by business parties to register APIs and compliance personnel to configure compliance processing rules, which are explained below.

[0071] In some embodiments, the business party registers an API through the cross-region compliance platform 103. Specifically, a registration request for a second API from a second business party is received, and in response to the registration request passing the review, the second API is added to the registered API set.

[0072] The second business party can be understood as any business party that has an API registration requirement, and the second API can be understood as an API to be registered. For example, the second business party can be a business party that adds a new second API, or a business party that needs to modify the registration information of a registered second API. The registration request may include the registration information of the second API. In other words, the second business party declares the registration information of the second API through the cross-regional compliance platform 103, such as the interface path, interface field list, interface field type, etc. of the second API, to register the API.

[0073] In response to the second business party's registration request for the second API, the registration information of the second API is reviewed. If the registration request passes the review, that is, the registration information of the second API is compliant, the second API is added to the registered API set. In this way, the registration information of the second API is stored in the registered API set, and the second API is a registered compliant API.

[0074] In some possible implementations, the process of reviewing the registration information of the second API may be automatically performed, for example, by configuring a review algorithm or using a review model to review the registration information of the second API and automatically generating a review result of passing or failing the review.

[0075] In other possible implementations, considering that it is particularly important to review the registration information of the second API, and that the registration information of the APIs provided by different business parties may vary greatly, the automatic review method has a low accuracy rate. It is also possible to generate a compliance work order, receive feedback operations on the compliance work order, and in response to the feedback operation indicating that the registration request has passed the review, add the second API to the registered API set.

[0076] Among them, the compliance work order is used to review the registration request. That is to say, for the registration request of the second business party, a corresponding compliance work order is automatically generated for compliance personnel to conduct compliance review. The compliance personnel can review the registration information of the second API in the compliance work order, trigger the feedback operation of passing or failing the review, and complete the compliance review.

[0077] Furthermore, the compliance personnel can also configure the compliance processing rules in the cross-regional compliance platform 103. In specific implementation, a configuration operation for the compliance processing rules is received, wherein the configuration operation includes one of the following: a configuration operation for the compliance processing rules for the third API, a configuration operation for the compliance processing rules for the API set of the third business party, and a configuration operation for the compliance processing rules for the API set belonging to the first region.

[0078] That is to say, the embodiments of the present application support the configuration of compliance processing rules according to different granularities. In some embodiments, the compliance processing rules for the third API are configured separately, that is, the configuration granularity of the compliance processing rules can reach the API level, and each different API can be configured with different compliance processing rules, thereby improving the flexibility and pertinence of compliance detection. In other embodiments, a unified configuration is performed for multiple APIs provided by the same business party (i.e., the third business party), that is, in combination with the business characteristics of the business party, the same compliance processing rules are configured for multiple APIs provided by the same business party, and the compliance processing rule configuration at the business level is realized, thereby enhancing the degree of association between compliance processing and business. In some other embodiments, a unified configuration is performed for multiple APIs in the same area (i.e., the first area), that is, in combination with the provisions of different areas for cross-regional data transmission, the same compliance processing rules are configured for multiple APIs in the same area, for example, for areas with stricter cross-regional data transmission, a compliance processing rule of "rejecting business traffic" is configured for multiple APIs in the area, and for areas with looser cross-regional data transmission, a compliance processing rule of "generating alarm information and sending business traffic to the recipient" is configured for multiple APIs in the area. In this way, compliance processing rules can be configured at the regional level, enhancing the correlation between compliance processing and regions.

[0079] Combination of the above Figure 1 Figure 3 provides a detailed introduction to the compliance detection method for business traffic provided in the embodiment of the present application. The following will introduce the apparatus and device provided in the embodiment of the present application in conjunction with the accompanying drawings.

[0080] See also Figure 4 The schematic diagram of the structure of the compliance detection device for business traffic shown in FIG. 40 includes:

[0081] An acquisition module 401 is used to acquire a first service flow; wherein the first service flow is related to cross-region data transmission based on a first application programming interface API of a first service party;

[0082] A detection module 402 is used to perform compliance detection on the first service traffic based on a registered API set to obtain a compliance detection result; wherein the registered API set includes at least one registered API and registration information of the at least one registered API;

[0083] The processing module 403 is used to process the first business traffic according to the compliance detection result and based on the set compliance processing rules.

[0084] In some possible implementations, the first service flow includes:

[0085] the request traffic for calling the first API of the first service party; or,

[0086] The response traffic in response to the call request of the first API.

[0087] In some possible implementations, the detection module 402 is specifically configured to:

[0088] The first API is matched with the registered APIs in the registered API set, and the first business traffic is matched with the registration information of the first API in the registered API set to obtain a compliance detection result.

[0089] In some possible implementations, the registration information includes at least one of the following: an interface path, an interface field list, and an interface field type.

[0090] In some possible implementations, the registration information includes an interface field list and an interface field type, and the detection module 402 is specifically used to:

[0091] In response to the first API hitting the registered API set, the fields in the first business traffic matching the interface field list in the registration information of the first API, and the field types in the first business traffic matching the interface field types in the registration information of the first API, a compliance detection result characterizing the compliance of the first business traffic is obtained.

[0092] In some possible implementations, the processing module 403 is specifically configured to:

[0093] In response to the compliance detection result indicating that the first service traffic is compliant, sending the first service traffic to a receiver of the first service traffic;

[0094] Otherwise, based on the set compliance processing rules, perform one of the following operations: reject the first service flow; perform desensitization processing on the unmatched information in the first service flow, and send the desensitized first service flow to the recipient of the first service flow; and generate an alarm message, and send the first service flow to the recipient of the first service flow;

[0095] The mismatch information includes information about the mismatch between the first service traffic and the registration information of the first API in the registered API set, and the alarm information is used to issue an alarm for non-compliant cross-regional data transmission events.

[0096] In some possible implementations, the apparatus 40 further includes a review module, and the review module is configured to:

[0097] receiving a registration request for a second API from a second service provider; wherein the registration request includes registration information of the second API;

[0098] In response to the registration request passing the review, the second API is added to the registered API set.

[0099] In some possible implementations, the review module is specifically used to:

[0100] generating a compliance work order, wherein the compliance work order is used to review the registration request;

[0101] receiving feedback actions for the compliance work order;

[0102] In response to the feedback operation indicating that the registration request passes the review, the second API is added to the registration API set.

[0103] In some possible implementations, the apparatus 40 further includes a configuration module, and the configuration module is configured to:

[0104] A configuration operation for compliance processing rules is received, wherein the configuration operation includes one of the following: a configuration operation for compliance processing rules for a third API, a configuration operation for compliance processing rules for an API set of a third business party, and a configuration operation for compliance processing rules for an API set belonging to the first area.

[0105] The compliance detection device 40 for traffic flow according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the compliance detection device 40 for traffic flow are respectively to realize Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0106] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 4 The functions of the compliance detection device 40 for business traffic in the illustrated embodiment.

[0107] Figure 5 A schematic diagram of the structure of an electronic device 500 is provided. Figure 5 As shown, the electronic device 500 includes a bus 501, a processor 502, a communication interface 503 and a memory 504. The processor 502, the memory 504 and the communication interface 503 communicate with each other via the bus 501.

[0108] The bus 501 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0109] The processor 502 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0110] The communication interface 503 is used for communicating with the outside. For example, the communication interface 503 can be used for communicating with a terminal.

[0111] The memory 504 may include a volatile memory, such as a random access memory (RAM). The memory 504 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0112] The memory 504 stores executable codes, and the processor 502 executes the executable codes to perform the aforementioned compliance detection method for business traffic.

[0113] Specifically, in implementing Figure 4 In the case of the embodiment shown, and Figure 4 When each module or unit of the traffic compliance detection device 40 described in the embodiment is implemented by software, the execution Figure 4 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 504. The processor 502 executes the program code corresponding to each unit stored in the memory 504 to perform the aforementioned compliance detection method for service traffic.

[0114] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the compliance detection method for the business traffic of the compliance detection device 40 applied to the business traffic.

[0115] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0116] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0117] When the computer program product is executed by a computer, the computer executes any of the aforementioned methods for detecting compliance of business traffic. The computer program product may be a software installation package, and when any of the aforementioned methods for detecting compliance of business traffic is required, the computer program product may be downloaded and executed on a computer.

[0118] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0120] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0121] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0122] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0123] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0124] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0125] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0126] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A compliance detection method for business traffic, characterized in that: The method comprises: Obtaining first business traffic; wherein the first business traffic is related to cross-regional data transmission based on a first application programming interface API of a first business party; Based on the registered API set, a compliance check is performed on the first service traffic to obtain a compliance check result; wherein the registered API set includes at least one registered API and registration information of the at least one registered API; According to the compliance detection result, based on the set compliance processing rules, the first business traffic is processed.

2. The method according to claim 1, characterized in that The first service flow includes: the request traffic for calling the first API of the first service party; or, The response traffic in response to the call request of the first API.

3. The method according to claim 1, characterized in that The step of performing compliance detection on the first service traffic based on the registered API set to obtain a compliance detection result includes: The first API is matched with the registered APIs in the registered API set, and the first business traffic is matched with the registration information of the first API in the registered API set to obtain a compliance detection result.

4. The method according to claim 1, characterized in that: The registration information includes at least one of the following: an interface path, an interface field list, and an interface field type.

5. The method according to claim 1, characterized in that The registration information includes an interface field list and an interface field type. The compliance detection is performed on the first service traffic based on the registration API set to obtain a compliance detection result, including: In response to the first API hitting the registered API set, the fields in the first business traffic matching the interface field list in the registration information of the first API, and the field types in the first business traffic matching the interface field types in the registration information of the first API, a compliance detection result characterizing the compliance of the first business traffic is obtained.

6. The method according to claim 1, characterized in that The processing of the first service flow according to the compliance detection result and based on a set compliance processing rule includes: In response to the compliance detection result indicating that the first service traffic is compliant, sending the first service traffic to a receiver of the first service traffic; Otherwise, based on the set compliance processing rules, perform one of the following operations: reject the first service flow; perform desensitization processing on the unmatched information in the first service flow, and send the desensitized first service flow to the recipient of the first service flow; and generate an alarm message, and send the first service flow to the recipient of the first service flow; The mismatch information includes information about the mismatch between the first service traffic and the registration information of the first API in the registered API set, and the alarm information is used to issue an alarm for non-compliant cross-regional data transmission events.

7. The method according to claim 1, characterized in that The method further comprises: receiving a registration request for a second API from a second service provider; wherein the registration request includes registration information of the second API; In response to the registration request passing the review, the second API is added to the registered API set.

8. The method according to claim 7, characterized in that In response to the registration request passing the review, adding the second API to the registered API set includes: generating a compliance work order, wherein the compliance work order is used to review the registration request; receiving feedback actions for the compliance work order; In response to the feedback operation indicating that the registration request passes the review, the second API is added to the registration API set.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: A configuration operation for compliance processing rules is received, wherein the configuration operation includes one of the following: a configuration operation for compliance processing rules for a third API, a configuration operation for compliance processing rules for an API set of a third business party, and a configuration operation for compliance processing rules for an API set belonging to the first area.

10. A compliance detection device for business traffic, characterized in that: The device comprises: An acquisition module, configured to acquire first service traffic; wherein the first service traffic is related to cross-regional data transmission based on a first application programming interface API of a first service party; A detection module, configured to perform compliance detection on the first service traffic based on a registered API set to obtain a compliance detection result; wherein the registered API set includes at least one registered API and registration information of the at least one registered API; A processing module is used to process the first business traffic according to the compliance detection result and based on the set compliance processing rules.

11. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method as claimed in any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 9.

Images