Auditing management method and system based on interface calling

Abstract

The invention discloses an audit management method and system based on interface calling, and the method comprises the steps: a client generates audit collection information based on an audit instruction sent by a user, the audit collection information comprises a request link identifier, request interface information and a user identity identifier, and the audit instruction and the request link identifier have an association relationship; the client sends auditing collection information to the server in an asynchronous sending mode, the server calls an auditing interface and returns an auditing result to the client, and the server generates log data based on the auditing collection information and the auditing result and stores the log data in a log database. The deployment flexibility and reusability of the auditing management system are improved through the auditing JAR packet, and log-level call tracking is realized by using the association relationship between the auditing instruction and the request link identifier. In addition, the data is transmitted in an asynchronous transmission mode, so that the influence of synchronous transmission on interface performance is avoided, and the reliability of data transmission is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of audit management, and in particular to an audit management method and system based on interface calling. Background Art

[0002] With the continuous development of information technology, the internet has become an indispensable tool in our daily lives and work. With the rapid expansion of internet services, microservices have become a widely adopted software service architecture. To ensure the security, traceability, and compliance of microservice systems, interface call auditing is often introduced into business systems to record and analyze user access behavior and system operation logs for security monitoring and post-event tracing.

[0003] When calling the audit function, the above-mentioned business system needs to record user operation logs. In particular, when users modify or delete important data, key data such as the operator's identity, operation object, and operation time should be tracked, and user information and source IP address should be recorded at the same time.

[0004] Existing solutions use annotations, AOP, or logging tools to write business logs to databases or log analysis systems. However, in scenarios with a large number of business systems, requiring each system to implement this solution can lead to increased performance overhead and intrusion into business code, making it difficult to scale. Furthermore, audit systems have large data volumes, and direct synchronous data transmission can potentially block business operations or cause data loss. Summary of the Invention

[0005] In view of the deficiencies in the prior art, the present invention provides an audit management method and system based on interface calling, which aims to realize automatic recording of audit data through interface calling and improve the reliability of audit data transmission.

[0006] The present invention discloses an audit management method based on interface call, which is applied to an audit management system based on interface call. The audit management system includes a client and a server. The client is installed with an audit JAR package. The audit management method includes:

[0007] The client generates audit collection information based on the audit instruction sent by the user. The audit collection information includes the request link identifier, the request interface information, and the user identity identifier. The request interface information includes the audit interface and interface request parameters corresponding to the audit instruction. The audit instruction is associated with the request link identifier.

[0008] The client sends the audit collection information to the server using asynchronous sending;

[0009] The server calls the audit interface and returns the audit results to the client;

[0010] The server generates log data based on audit collection information and audit results, and stores the log data in a log database, which is used for data query and visual analysis.

[0011] Preferably, the audit management method based on interface call further includes: the client determining whether the audit instruction is a high-risk instruction according to the audit interface, the high-risk instruction being used to instruct deletion or export of data;

[0012] If the audit instruction is a high-risk instruction, the client generates a risk warning message and sends the audit collection information to the server after the user confirms the risk warning message;

[0013] If the audit instruction is not a high-risk instruction, the client directly sends the audit collection information to the server.

[0014] Preferably, the audit management method based on interface call also includes: the client counts the number of risk instructions of high-risk instructions within a preset time; when the number of risk instructions is greater than a preset threshold, the client intercepts the audit collection information and generates an alarm prompt.

[0015] Preferably, before the client sends the audit collection information to the server in an asynchronous sending manner, the client further includes: preprocessing the audit collection information, and the preprocessing includes at least one of compression, encryption, desensitization and data signing.

[0016] Preferably, the server calls the audit interface, including: the server verifies the received pre-processed audit collection information and generates a verification result;

[0017] If the verification result is successful, the audit interface is called;

[0018] If the verification result is a verification failure, a failure prompt message is generated and sent to the client.

[0019] Preferably, the client sends the audit collection information to the server in an asynchronous sending manner, including: asynchronously sending the audit collection information to the message queue middleware and generating a sending result;

[0020] If the sending result is a sending failure, the audit collection information is stored in a cache queue to generate cache information;

[0021] When the sending result is successful, the control message queue middleware sends the audit collection information to the server.

[0022] Preferably, the audit management method based on interface call further includes: the client determines whether there is cache information in the cache queue;

[0023] If there is cache information in the cache queue, the cache information is resent to the message queue middleware.

[0024] Preferably, the audit management method based on interface call further includes: the client writes the audit collection information into a local log file, and the local log file is used to generate a multi-channel backup file.

[0025] Preferably, the audit management method based on interface call further comprises: the server classifying the log data based on the user identity;

[0026] The server performs a query on the log data based on the request link identifier.

[0027] The present invention also discloses an audit management system based on interface call, which is used to execute the above-mentioned audit management method. The audit management system includes: a client, which is configured to: install an audit JAR package; generate audit collection information based on an audit instruction sent by a user, the audit collection information including a request link identifier, request interface information and a user identity identifier, the request interface information including an audit interface and interface request parameters corresponding to the audit instruction, and the audit instruction and the request link identifier have an associated relationship; and send the audit collection information to a server using an asynchronous sending method;

[0028] The server is configured to: call the audit interface and return the audit results to the client; and generate log data based on the audit collection information and the audit results, and store the log data in a log database, which is used for data query and visual analysis.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. The present invention improves the deployment flexibility and reusability of the audit management system by installing the audit JAR package on the client. For specific high-risk operations (such as data deletion and export), user confirmation prompts are provided to reduce data loss due to user errors.

[0031] 2. This invention implements log-level call tracking by associating audit instructions with request link identifiers. Furthermore, it utilizes an asynchronous transmission mechanism to send audit collection information between the client and server, achieving peak load shaving and valley filling through message queue middleware, thus avoiding the impact of synchronous data transmission on interface performance.

[0032] 3. This invention ensures secure data transmission through encryption, compression, and signature mechanisms, improving data integrity and reliability. Furthermore, by introducing a local persistent cache on the client side, it enables temporary storage of audit information and re-issuance of failed audits, further enhancing system reliability and audit integrity. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flow chart of the audit management method based on interface call provided by the present invention;

[0034] Figure 2 A schematic diagram of the process of verifying high-risk instructions provided by the client of the present invention;

[0035] Figure 3 A schematic diagram of the process of asynchronously sending audit collection information by the client provided by the present invention;

[0036] Figure 4 This is a structural diagram of the audit management system based on interface call provided by the present invention. DETAILED DESCRIPTION

[0037] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0038] The present invention will be described in further detail below with reference to the accompanying drawings.

[0039] like Figure 1 As shown, an embodiment of the present invention provides an audit management method based on interface call, which is applied to an audit management system based on interface call. The audit management system includes a client and a server, and the client is installed with an audit JAR package.

[0040] By installing the audit JAR package on the client, you can implement all audit functions without modifying the business code, improving the deployment flexibility and reusability of the audit management system. The client interacts with the server by calling the provided API, enabling effective monitoring of business operations. This approach reduces the cost and workload of manual audits and improves the efficiency and accuracy of audit management.

[0041] The audit management method based on interface call provided by the embodiment of the present invention includes:

[0042] S1. The client generates audit collection information based on the audit instructions sent by the user.

[0043] In the embodiment of the present invention, the user sends an audit instruction through the client, for example, the audit instruction may be data query or data insertion, etc. The client generates audit collection information based on the audit instruction sent by the user.

[0044] Audit collection information includes the request link identifier, request interface information, and user identity. The request link identifier, denoted as the Trace ID, is a unique identifier used to represent a complete request link. For example, if the request link for an audit instruction is the front-end, gateway, user service, order service, and database, the request link identifier will be present throughout the entire request link.

[0045] The request interface information includes the audit interface and interface request parameters corresponding to the audit instruction. Through the audit interface and interface request parameters, the audit interface that needs to be called by the audit instruction and the parameters that need to be uploaded can be determined, thereby realizing the business function.

[0046] User identities are used to distinguish and identify different users, thereby associating different user permission levels based on user identities and determining the resources or operation scope that users can access.

[0047] In this embodiment of the present invention, the association between audit instructions and request link identifiers is utilized to track and locate problems using the request link identifier. For example, if a user's audit instruction receives a slow response, the request link identifier can be used to query the processing log of the interface request corresponding to the audit instruction, thereby locating the location of the anomaly.

[0048] In addition, the audit collection information may also include other information such as the request IP address and interface processing time. This application does not specifically limit the content of the audit collection information.

[0049] like Figure 2 As shown, in this embodiment of the present invention, the client determines whether an audit instruction is a high-risk instruction based on the audit interface. A high-risk instruction is used to instruct the deletion or export of data. If the audit instruction is a high-risk instruction, the client generates a risk warning message and, after the user confirms the risk warning message, sends the audit collection information to the server. If the audit instruction is not a high-risk instruction, the client directly sends the audit collection information to the server.

[0050] For example, a user sends a data deletion instruction that requires calling a deletion interface. The client determines that the audit instruction that requires calling the deletion interface is a high-risk instruction and generates a risk warning message to prevent the user from deleting data due to accidental operation. After the user confirms the risk warning message on the client, they can perform the subsequent deletion operation.

[0051] The present invention can reduce the probability of human error through secondary confirmation of high-risk instructions, ensure that high-risk instructions are completed with the user's knowledge, and form a complete traceable behavior chain.

[0052] In this embodiment of the present invention, the client counts high-risk instructions within a preset timeframe. When the number of risky instructions exceeds a preset threshold, the client intercepts audit information and generates an alert. This allows for pattern recognition and risk control of user behavior within a short timeframe, improving the audit management system's ability to monitor and respond to malicious requests and abuse of authority.

[0053] For example, when the audit management system detects that the same user has accessed a highly sensitive interface more than three times in a row within 5 minutes, an alarm event is automatically triggered and the administrator is notified.

[0054] In this embodiment of the present invention, to ensure reliable transmission of audit information during high concurrency or network anomalies, the client writes this information to a local log file, which is then used to generate multi-channel backup files. This allows the client to retain audit trails in the event of any single point of failure or attack, thereby meeting the information redundancy and storage security requirements of information security compliance.

[0055] S2. The client sends the audit collection information to the server using asynchronous sending.

[0056] like Figure 3 As shown, in the embodiment of the present invention, before sending the audit collection information to the server, the client also preprocesses the audit collection information, and the preprocessing includes at least one of compression, encryption, desensitization and data signing.

[0057] Compression of audit information reduces storage space usage and increases data transmission speed, thereby improving resource utilization. Encryption of audit information prevents data leakage and ensures data integrity, thereby safeguarding confidentiality and tamper resistance. For example, symmetric or asymmetric encryption can be performed on audit information.

[0058] Furthermore, by performing desensitization operations on audit collection information, sensitive information such as mobile phone numbers and bank card numbers can be protected. By performing data signing on audit collection information, the authenticity of the data source can be confirmed and the data cannot be tampered with.

[0059] In an embodiment of the present invention, when a client sends audit collection information to a server using asynchronous transmission, the client first asynchronously sends the audit collection information to the message queue middleware and generates a transmission result. If the transmission result indicates that the transmission failed, the audit collection information is stored in a cache queue to generate cache information. If the transmission result indicates that the transmission was successful, the message queue middleware is controlled to send the audit collection information to the server.

[0060] Furthermore, the client determines whether there is cache information in the cache queue, and if there is cache information in the cache queue, resends the cache information to the message queue middleware.

[0061] It's important to note that message queue middleware (Message Queue Middleware) is a key component for data transmission. Through asynchronous communication mechanisms, it decouples services, buffers traffic, and ensures reliable data transmission. Asynchronous transmission also breaks down strong dependencies between services. In the event of a system or network failure, data to be transmitted is stored in a cache queue and processed again after the failure is resolved. Furthermore, asynchronous transmission can handle sudden, high-concurrency requests, enabling data buffering and peak-load shifting, thereby improving system response efficiency and processing capabilities.

[0062] For example, when the client fails to asynchronously send audit collection information to the server, the audit collection information will be stored in a local persistent cache, such as a disk queue, and automatically resent after the network is restored, thereby reducing the loss of audit collection information under failure conditions and improving system reliability and audit integrity.

[0063] S3. The server calls the audit interface and returns the audit results to the client.

[0064] In the implementation of the present invention, the server verifies the pre-processed audit information and generates a verification result. If the verification result is successful, the audit interface is called; if the verification result is failed, a failure prompt is generated and sent to the client.

[0065] Because the information received by the server is pre-processed audit information, it will perform verification based on the specific pre-processing method. For example, it will verify the signature of the audit information to ensure the correct transmission of the audit information. If the verification fails, the server will send a failure message to the client to inform the user that the audit information was not sent correctly.

[0066] S4. The server generates log data based on the audit collection information and audit results, and stores the log data in the log database.

[0067] In the embodiment of the present invention, the log database is used for data query and visual analysis. The server classifies the log data based on the user identity and queries the log data based on the request link identifier.

[0068] For example, the client provides a graphical audit management interface that supports multi-dimensional search and visualization. Users can search log data based on user identity, audit interface, and time range. They can also track logs across the entire chain based on the request link identifier (Trace ID) and display cross-service call logs. Logs can also be displayed in a timeline view, intuitively showing the chronological order and call relationships. Logs can also be exported and downloaded.

[0069] In the embodiment of the present invention, the log database can isolate and store log data and restrict access based on user identities, and log data of different user identities are stored in logically or physically isolated areas.

[0070] For example, users can be divided into system administrators, tenant administrators, and tenants based on their identities. System administrators and tenant administrators have different access rights. Tenants can query, filter, and audit common log data through the query interface, but do not have access to advanced logs. This ensures data isolation and tenants' audit autonomy.

[0071] In an embodiment of the present invention, when a user views log data, the server also sends the log data to the message queue middleware based on asynchronous transmission and generates a sending result. If the sending result is a sending failure, the log data is stored in the cache queue to generate cache information; if the sending result is a sending success, the message queue middleware is controlled to send the log data to the client. The server determines whether there is cache information in the cache queue; if there is cache information in the cache queue, the cache information is resent to the message queue middleware. The effect of asynchronous transmission of log data is the same as that of asynchronous transmission of audit collection information, which will not be repeated here.

[0072] like Figure 4 As shown, an embodiment of the present invention further provides an audit management system based on interface call, including a client 401 and a server 402.

[0073] The client 401 is configured as follows: having an audit JAR package installed; generating audit collection information based on the audit instructions sent by the user, the audit collection information including the request link identifier, request interface information and user identity identifier, the request interface information including the audit interface and interface request parameters corresponding to the audit instruction, and the audit instruction having an associated relationship with the request link identifier; and sending the audit collection information to the server 402 using an asynchronous sending method.

[0074] The server 402 is configured to: call the audit interface and return the audit results to the client 401; and generate log data based on the audit collection information and the audit results, and store the log data in a log database, which is used for data query and visual analysis.

[0075] As can be seen from the above technical solution, the present invention discloses an audit management method and system based on interface calls. The audit management method includes: based on the audit instructions sent by the user, the client generates audit collection information, the audit collection information includes a request link identifier, request interface information, and a user identity identifier, the request interface information includes the audit interface and interface request parameters corresponding to the audit instruction, and the audit instruction and the request link identifier are associated. The client sends the audit collection information to the server using an asynchronous transmission method. The server calls the audit interface and returns the audit results to the client. The server generates log data based on the audit collection information and the audit results, and stores the log data in a log database, thereby enabling query and visual analysis of the data.

[0076] The present invention improves the deployment flexibility and reusability of the audit management system by installing the audit JAR package on the client. For specific high-risk operations (such as data deletion and export), user confirmation prompts are provided to reduce data loss due to user errors. Log-level call tracking is achieved by associating audit instructions with request link identifiers. In addition, the client sends audit collection information to the server audit data using asynchronous transmission, which can avoid the impact of synchronous data transmission on interface performance.

[0077] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. An audit management method based on interface call, characterized in that: Applied to an audit management system based on interface call, the audit management system includes a client and a server, the client is installed with an audit JAR package, and the audit management method includes: The client generates audit collection information based on the audit instruction sent by the user, the audit collection information including a request link identifier, request interface information, and a user identity identifier, the request interface information including an audit interface and interface request parameters corresponding to the audit instruction, and the audit instruction and the request link identifier are associated with each other; The client sends the audit collection information to the server in an asynchronous manner; The server calls the audit interface and returns the audit result to the client; The server generates log data based on the audit collection information and the audit results, and stores the log data in a log database, which is used for data query and visual analysis.

2. The audit management method according to claim 1, characterized in that: Also includes: The client determines, according to the audit interface, whether the audit instruction is a high-risk instruction, where the high-risk instruction is used to instruct deletion or export of data; If the audit instruction is the high-risk instruction, the client generates risk warning information, and after the user confirms the risk warning information, sends the audit collection information to the server; If the audit instruction is not the high-risk instruction, the client directly sends the audit collection information to the server.

3. The audit management method according to claim 2, characterized in that: Also includes: The client counts the number of risky instructions of the high-risk instructions within a preset time; When the number of risk instructions is greater than a preset threshold, the client intercepts the audit collection information and generates an alarm prompt.

4. The audit management method according to claim 1, characterized in that: Before the client sends the audit collection information to the server in an asynchronous manner, the client further includes: The audit collection information is preprocessed, and the preprocessing includes at least one of compression, encryption, desensitization and data signing.

5. The audit management method according to claim 4, characterized in that: The server calls the audit interface, including: The server verifies the pre-processed audit collection information and generates a verification result; If the verification result is successful, calling the audit interface; When the verification result is a verification failure, a failure prompt message is generated and sent to the client.

6. The audit management method according to claim 1, characterized in that: The client sends the audit collection information to the server in an asynchronous manner, including: Asynchronously sending the audit collection information to the message queue middleware and generating a sending result; If the sending result is a sending failure, the audit collection information is stored in a cache queue to generate cache information; When the sending result is successful, the message queue middleware is controlled to send the audit collection information to the server.

7. The audit management method according to claim 6, characterized in that: Also includes: The client determines whether the cache information exists in the cache queue; In the case that the cache information exists in the cache queue, the cache information is resent to the message queue middleware.

8. The audit management method according to claim 1, characterized in that: Also includes: The client writes the audit collection information into a local log file, and the local log file is used to generate a multi-channel backup file.

9. The audit management method according to claim 1, characterized in that: Also includes: The server classifies the log data based on the user identity; The server performs a query on the log data based on the request link identifier.

10. An audit management system based on interface call, used to execute the audit management method according to any one of claims 1 to 9, characterized in that: include: The client is configured to have the audit JAR package installed; Generating audit collection information based on an audit instruction sent by a user, the audit collection information including a request link identifier, request interface information, and a user identity identifier, the request interface information including an audit interface and interface request parameters corresponding to the audit instruction, the audit instruction being associated with the request link identifier; and sending the audit collection information to the server using asynchronous sending; The server is configured to: call the audit interface and return the audit results to the client; and generate log data based on the audit collection information and the audit results, and store the log data in a log database, which is used for data query and visual analysis.

Images