A system, method, apparatus, and medium for secure exchange of data for RESTFUL interface calls

Abstract

The application discloses a data security exchange system and method for RESTFUL interface calling, a device and a medium, and mainly relates to the technical field of data security, and aims to solve the problem that the existing scheme lacks encryption between a RESTFUL interface calling client and a RESTFUL interface calling proxy server and between a RESTFUL interface calling proxy client and a real RESTFUL interface calling server, and has a security risk. The application comprises the following steps: using a session key and a symmetric encryption algorithm to encrypt an interface calling request of a RESTFUL interface calling client; using a RESTFUL interface calling proxy server to receive the encrypted interface calling request and decrypt the encrypted interface calling request into a request file; using a RESTFUL interface calling server to decrypt the interface calling request and return an encrypted interface calling response; and using a RESTFUL interface calling proxy client to receive the encrypted interface calling response and decrypt the encrypted interface calling response into a response file.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security exchange, in particular to a data security exchange system and method for RESTFUL interface calling, equipment and a medium. BACKGROUND

[0002] With the informationization construction of enterprises, institutions and public services, the demand for cross-network data security exchange is becoming more and more intense, and the types of data security exchange are becoming more and more extensive. Interface calling cross-network data security exchange is gradually flourishing, especially RESTFUL interface calling cross-network data security exchange, that is, a set of RESTFUL interface calling data security exchange system is deployed between the RESTFUL interface calling client and the RESTFUL interface calling server to realize RESTFUL interface calling cross-network data security exchange.

[0003] Objective defects of the prior art: the RESTFUL interface calling proxy server and the import single guide and the export single guide can transmit data through private protocol for encryption, and the RESTFUL interface calling proxy client and the import single guide and the export single guide can also transmit data through private protocol for encryption, which ensures the security of data transmission within the RESTFUL interface calling data security exchange system, but there is no encryption method for data transmission between the RESTFUL interface calling client and the RESTFUL interface calling proxy server, and between the RESTFUL interface calling proxy client and the real RESTFUL interface calling server, so the security of data transmission between them cannot be guaranteed. SUMMARY

[0004] The application provides a data security exchange system, method, equipment and medium for RESTFUL interface calling to solve the problem that there is no encryption between the RESTFUL interface calling client and the RESTFUL interface calling proxy server, and between the RESTFUL interface calling proxy client and the real RESTFUL interface calling server, which exists a security risk.

[0005] In a first aspect, the application provides a data security exchange system for RESTFUL interface calling, which comprises:

[0006] An authentication link, an interface calling request transmission link and an interface calling response link.

[0007] The authentication link comprises:

[0008] The RESTFUL interface calling client and the RESTFUL interface calling agent server exist HTTPS two-way authentication; the RESTFUL interface calling server and the RESTFUL interface calling agent client exist HTTPS two-way authentication; wherein, the HTTPS two-way authentication contains session key confirmation and symmetric encryption algorithm confirmation;

[0009] The interface calling request transmission link comprises:

[0010] The RESTFUL interface calling client initiates the interface calling request and encrypts the interface calling request by using the session key and the symmetric encryption algorithm; the RESTFUL interface calling agent server connected with the RESTFUL interface calling client is used for receiving the encrypted interface calling request and decrypting the encrypted interface calling request into a request file; the import single guide connected with the RESTFUL interface calling agent server is used for receiving the request file; the RESTFUL interface calling agent client connected with the import single guide is used for receiving the request file and encrypting the interface calling request by using the session key and the symmetric encryption algorithm; and the RESTFUL interface calling server connected with the RESTFUL interface calling agent client is used for receiving the encrypted interface calling request.

[0011] The interface calling response transmission link comprises:

[0012] The RESTFUL interface calling server decrypts the interface calling request and returns the encrypted interface calling response; the RESTFUL interface calling agent client receives the encrypted interface calling response and decrypts the encrypted interface calling response into a response file; the export single guide connected with the RESTFUL interface calling agent client is used for receiving the response file; the RESTFUL interface calling agent server connected with the export single guide is used for receiving the response file and encrypting the response file into an interface calling response; and the RESTFUL interface calling client decrypts the encrypted interface calling response transmitted by the RESTFUL interface calling agent server.

[0013] In a second aspect, the application provides a data security exchange method of RESTFUL interface calling, based on a data security exchange system of RESTFUL interface calling, and the method comprises:

[0014] The RESTFUL interface calling client and the RESTFUL interface calling agent server, and the RESTFUL interface calling server and the RESTFUL interface calling agent client are established by using HTTPS two-way authentication; wherein, the HTTPS two-way authentication contains session key and symmetric encryption algorithm;

[0015] When the RESTFUL interface calling client initiates an interface calling request to the RESTFUL interface calling proxy server, the interface calling request is encrypted by using the session key and the symmetric encryption algorithm;

[0016] The RESTFUL interface calling proxy server decrypts the received encrypted interface calling request by using the session key and the symmetric encryption algorithm, converts the decrypted interface calling request into a request file, and sends the request file to the RESTFUL interface calling proxy client through the import single guide;

[0017] The RESTFUL interface calling proxy client converts the request file into an interface calling request, and encrypts the interface calling request by using the session key and the symmetric encryption algorithm;

[0018] The RESTFUL interface calling server decrypts the encrypted interface calling request by using the session key and the symmetric encryption algorithm, and further generates a corresponding interface calling response and encrypts the interface calling response;

[0019] The RESTFUL interface calling proxy client decrypts the encrypted interface calling response, converts the interface calling response into a response file, and sends the response file to the RESTFUL interface calling proxy server through the export single guide;

[0020] The RESTFUL interface calling proxy server converts the response file into an interface calling response, and encrypts the interface calling response;

[0021] The RESTFUL interface calling client decrypts the encrypted interface calling response to obtain the interface calling response.

[0022] In an implementation manner of the present application, two-way authentication of HTTPS between the RESTFUL interface calling client and the RESTFUL interface calling proxy server is established, and specifically includes the following steps:

[0023] The RESTFUL interface calling client initiates a TCP three-way handshake to the 443 port of the RESTFUL interface calling proxy server to establish a TCP connection;

[0024] The RESTFUL interface calling client sends a supported TLS protocol version, a random number generated by the RESTFUL interface calling client, and a supported symmetric encryption algorithm list to the RESTFUL interface calling proxy server;

[0025] The RESTFUL interface calling proxy server sends a selected TLS protocol version, a random number generated by the RESTFUL interface calling proxy server, and a selected symmetric encryption algorithm to the RESTFUL interface calling client;

[0026] The RESTFUL interface calling proxy server sends a digital certificate to the RESTFUL interface calling client; the digital certificate contains a public key, identity information of the RESTFUL interface calling proxy server, and is signed by a certificate authority;

[0027] The RESTFUL interface calling proxy server sends a ServerHelloDone to the RESTFUL interface calling client;

[0028] After receiving the ServerHelloDone, the RESTFUL interface calling client verifies the digital certificate of the RESTFUL interface calling proxy server;

[0029] When the digital certificate verification is successful, the RESTFUL interface calling client sends a digital certificate to the RESTFUL interface calling proxy server;

[0030] The RESTFUL interface calling client generates a pre-master key and encrypts it with the public key in the digital certificate sent by the RESTFUL interface calling proxy server and sends it to the RESTFUL interface calling proxy server;

[0031] The RESTFUL interface calling client sends signature data encrypted by the private key of the RESTFUL interface calling client to the RESTFUL interface calling proxy server;

[0032] The RESTFUL interface calling proxy server verifies the signature data using the public key in the digital certificate of the RESTFUL interface calling client;

[0033] When the signature data verification is successful, the RESTFUL interface calling client random number, the RESTFUL interface calling proxy server random number and the pre-master key are used as the session key, and the selected symmetric encryption algorithm is used as the encrypted symmetric encryption algorithm.

[0034] In an implementation of the present application, the digital certificate of the RESTFUL interface calling proxy server is verified, specifically including:

[0035] Certificate chain verification, revocation status check, domain name verification, and validity period check are performed.

[0036] When the verification fails, the verification failure information is returned to the RESTFUL interface calling proxy server.

[0037] In an implementation of the present application, before the RESTFUL interface calling client sends the signature data encrypted by the private key of the RESTFUL interface calling client to the RESTFUL interface calling proxy server, the method further includes:

[0038] The RESTFUL interface calling client calculates a hash value of all handshake messages before calling the client computer;

[0039] The RESTFUL interface calling client signs the hash value by using a private key of the client to obtain signature data.

[0040] In an implementation of the present application, two-way authentication between the RESTFUL interface calling service and the RESTFUL interface calling proxy client is established, and specifically includes the following steps:

[0041] The RESTFUL interface calling proxy client initiates a TCP three-way handshake to the 443 port of the RESTFUL interface calling service to establish a TCP connection;

[0042] The RESTFUL interface calling proxy client sends a supported TLS protocol version, a random number generated by the RESTFUL interface calling proxy client, and a supported symmetric encryption algorithm list to the RESTFUL interface calling service;

[0043] The RESTFUL interface calling service sends a selected TLS protocol version, a random number generated by the RESTFUL interface calling service, and a selected symmetric encryption algorithm to the RESTFUL interface calling proxy client;

[0044] The RESTFUL interface calling service sends a digital certificate to the RESTFUL interface calling proxy client, wherein the digital certificate contains a public key, identity information of the RESTFUL interface calling service, and is signed by a certificate authority;

[0045] The RESTFUL interface calling service sends a ServerHelloDone to the RESTFUL interface calling proxy client;

[0046] After receiving the ServerHelloDone, the RESTFUL interface calling proxy client verifies the digital certificate of the RESTFUL interface calling service;

[0047] When the digital certificate is verified successfully, the RESTFUL interface calling proxy client sends a digital certificate to the RESTFUL interface calling service;

[0048] The RESTFUL interface calling proxy client generates a pre-master key and encrypts the pre-master key by using the public key in the digital certificate sent by the RESTFUL interface calling service and sends the pre-master key to the RESTFUL interface calling service;

[0049] The RESTFUL interface calling proxy client sends signature data encrypted by a private key of the RESTFUL interface calling proxy client to the RESTFUL interface calling service;

[0050] The RESTFUL interface calling service end verifies the signature data by using the public key in the RESTFUL interface calling agent client digital certificate;

[0051] When the signature data verification is successful, the RESTFUL interface calling agent client random number, the RESTFUL interface calling service end random number and the pre-master key are used as a session key, and the selected symmetric encryption algorithm is used as the encrypted symmetric encryption algorithm.

[0052] In an implementation form of the present application, the interface calling request contains a URL, a method type, a request header and a request body.

[0053] In an implementation form of the present application, the single guide is sent to the RESTFUL interface calling agent client by importing, and specifically includes:

[0054] The import single guide detects the format and content of the request file and sends the qualified request file to the RESTFUL interface calling agent client;

[0055] When the detection is unqualified, an exception instruction is sent to the RESTFUL interface calling agent client.

[0056] In a third aspect, the present application provides a data security exchange device for RESTFUL interface calling, which comprises:

[0057] a processor;

[0058] and a memory having executable code stored thereon, when the executable code is executed, the processor executes the RESTFUL interface calling data security exchange method according to any one of the above.

[0059] In a fourth aspect, the present application provides a non-volatile computer storage medium having computer instructions stored thereon, when the computer instructions are executed, the RESTFUL interface calling data security exchange method according to any one of the above is implemented.

[0060] From the above technical solutions, the present application has the following advantages:

[0061] The RESTFUL interface calling request and the RESTFUL interface calling response are converted into files (non-protocol agent transparent mode), which is convenient for security check on the contents of the RESTFUL interface calling request and the RESTFUL interface calling response.

[0062] Adopt HTTPS two-way authentication, ensure the safety of the transmission of requests and responses between the RESTFUL interface calling client and the RESTFUL interface calling proxy server, and also ensure the safety of the transmission of requests and responses between the RESTFUL interface calling proxy client and the RESTFUL interface calling server, thereby ensuring the security of the whole link of the cross-network interface service calling.

[0063] Further specifically, by constructing the whole-link HTTPS two-way authentication and hierarchical encryption mechanism, three major core beneficial effects are achieved: first, identity trusted verification, the HTTPS two-way authentication is adopted between the client and the proxy server, and between the proxy client and the real server, the identity of the communication parties is strictly verified through the digital certificate, the risk of man-in-the-middle attack is completely eliminated, and the session key and the symmetric encryption algorithm are cooperatively confirmed, so that the encryption parameters of each session are dynamically generated, and the systematic risk caused by the cracking of the fixed key is avoided. Second, data transmission process encryption, the interface calling request and response are symmetrically encrypted by the session key in the transmission link (client-proxy server, proxy client-server). Third, modularized security isolation, the physical transfer of the request and response files is realized through the import / export single guide, which not only ensures the logical decoupling between the proxy server and the proxy client, but also cuts off the direct memory access path through file-level transmission, so that malicious code cannot be transmitted across nodes through continuous memory injection, and the modular design facilitates the centralized recording of audit logs, providing a complete evidence chain for subsequent tracing. In addition, the architecture realizes performance optimization through the standardized encryption process, the symmetric encryption algorithm has a processing efficiency close to plaintext transmission under the support of hardware acceleration, and the session key reuse mechanism avoids the frequent calculation overhead of asymmetric encryption, so that the security enhancement and system throughput are balanced. BRIEF DESCRIPTION OF DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the present application, the drawings required to be used in the description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0065] Figure 1 is a data security exchange system internal structure schematic diagram of a RESTFUL interface calling provided by an embodiment of the present application.

[0066] Figure 2 is a data security exchange method flow chart of a RESTFUL interface calling provided by an embodiment of the present application.

[0067] Figure 3 is a data security exchange device internal structure schematic diagram of a RESTFUL interface calling provided by an embodiment of the present application.

[0068] Main reference signs:

[0069] 1, RESTFUL interface call client; 2, RESTFUL interface call proxy server; 3, import single guide; 4, export single guide; 5, RESTFUL interface call proxy client; 6, RESTFUL interface call server. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0071] Those skilled in the art should understand that the embodiments described below are only preferred embodiments of the present disclosure, and do not represent that the present disclosure can only be implemented by the preferred embodiments. The preferred embodiments are only used to explain the technical principles of the present disclosure, and are not used to limit the protection scope of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by those skilled in the art without creative work still fall within the protection scope of the present disclosure.

[0072] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or further include elements inherent in such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device including the element.

[0073] The technical solutions proposed by the embodiments of the present application will be described in detail below with reference to the drawings.

[0074] The present application Figure 1 A data security exchange system for RESTFUL interface call provided by the embodiments of the present application. As shown in the figure, the system provided by the embodiments of the present application mainly includes: Figure 1 As shown in the figure, the system provided by the embodiments of the present application mainly includes:

[0075] RESTFUL interface calling client 1: located on the business system or for simple browser access, mainly used to send interface requests to RESTFUL interface calling proxy server 2 and receive interface response data returned from RESTFUL interface calling proxy server 2, and implement HTTPS two-way authentication between RESTFUL interface calling proxy server 2.

[0076] RESTFUL interface calling server 6: real business server, mainly used to receive interface requests sent by RESTFUL interface calling proxy client 5 and return interface response data to RESTFUL interface calling proxy client 5, and implement HTTPS two-way authentication between RESTFUL interface calling proxy client 5.

[0077] RESTFUL interface calling proxy server 2: provides proxy function of RESTFUL interface calling server, receives the request sent by RESTFUL interface calling client 1, writes the data in the request into a request file, the data in the request includes URL, method type, request header, request body, sends the request file to import single guide 3, and performs HTTPS two-way authentication on the accessed RESTFUL interface calling client 1. At the same time, receive the response file sent by export single guide 4, parse the response file into response body and return to RESTFUL interface calling client 1.

[0078] RESTFUL interface calling proxy client 5: provides proxy function of RESTFUL interface calling client, receives the interface calling request file transmitted by import single guide 3, parses the URL, method type, request header, and request body in the request file, reconstructs the interface calling request, initiates the request to the real RESTFUL interface calling server 6, and performs HTTPS two-way authentication on the real RESTFUL interface calling server 6. At the same time, receive the interface response data returned by the real RESTFUL interface calling server 6, write the interface response data into a response file, and send the response file to export single guide 4.

[0079] Import single guide 3: provides one-way non-feedback data transmission service, and file format and content detection capability. Receive the request file sent by RESTFUL interface calling proxy server 2, and send the legal request file to RESTFUL interface calling proxy client 5.

[0080] Export single guide 4: provides one-way non-feedback data transmission service, and file format and content detection capability. Receive the response file sent by RESTFUL interface calling proxy client 5, and send the legal response file to RESTFUL interface calling proxy server 2.

[0081] Based on the above description, the embodiment provides a data security exchange system of a RESTFUL interface call, which comprises:

[0082] An authentication link, an interface call request transmission link, and an interface call response link;

[0083] The authentication link comprises:

[0084] There is HTTPS two-way authentication between the RESTFUL interface call client 1 and the RESTFUL interface call proxy server 2, and there is HTTPS two-way authentication between the RESTFUL interface call server 6 and the RESTFUL interface call proxy client 5; the HTTPS two-way authentication comprises session key confirmation and symmetric encryption algorithm confirmation.

[0085] The interface call request transmission link comprises:

[0086] The RESTFUL interface call client 1 initiates an interface call request and encrypts the interface call request by using a session key and a symmetric encryption algorithm; the RESTFUL interface call proxy server 2, connected to the RESTFUL interface call client 1, receives the encrypted interface call request and decrypts the encrypted interface call request into a request file; the import single guide 3, connected to the RESTFUL interface call proxy server 2, receives the request file; the RESTFUL interface call proxy client 5, connected to the import single guide 3, receives the request file and encrypts the interface call request by using the session key and the symmetric encryption algorithm; and the RESTFUL interface call server 6, connected to the RESTFUL interface call proxy client 5, receives the encrypted interface call request.

[0087] The interface call response link comprises:

[0088] The RESTFUL interface call server 6 decrypts an interface call request to return an encrypted interface call response; the RESTFUL interface call proxy client 5 receives the encrypted interface call response and decrypts the encrypted interface call response into a response file; the export single guide 4, connected to the RESTFUL interface call proxy client 5, receives the response file; the RESTFUL interface call proxy server 2, connected to the export single guide 4, receives the response file and encrypts the response file into an interface call response; and the RESTFUL interface call client 1 decrypts the encrypted interface call response transmitted by the RESTFUL interface call proxy server 2.

[0089] Based on the above description, the operation flow of the embodiment can be specifically as shown in the following table: Figure 1

[0090] ​The HTTPS two-way authentication of the RESTFUL interface calling client 1 and the RESTFUL interface calling proxy server 2 is realized through step A), which can include session key and symmetric encryption algorithm and other operations; after the HTTPS two-way authentication is realized, the RESTFUL interface calling client 1 initiates an interface calling request to the RESTFUL interface calling proxy server 2 through step B) (satisfying the HTTPS two-way authentication protocol); the RESTFUL interface calling proxy server 2 reads the specific interface calling request data of the interface calling request of the HTTPS two-way authentication protocol, and through step C), the following operations are performed on the read specific interface calling request data: converting the interface calling request into a file, and inputting the converted file (request file) into the import single guide 3; step D) is entered to perform data checking and filtering on the request file through the import single guide 3; step E) is entered: the import single guide 3 transmits the interface calling request file to the RESTFUL interface calling proxy client 5; in order to realize the security of data transmission between the RESTFUL interface calling proxy client 5 and the RESTFUL interface calling server 6, step F) is entered to perform HTTPS two-way authentication of the RESTFUL interface calling proxy client 5 and the RESTFUL interface calling server 6 (which can include session key and symmetric encryption algorithm and other operations). Further, step G) is entered, in which the RESTFUL interface calling proxy client 5 converts the interface calling request file into a real interface calling request, and transmits the real interface calling request to the RESTFUL interface calling server 6 by using the session key and symmetric encryption algorithm and other operations contained in the HTTPS two-way authentication protocol.

[0091] After the RESTFUL interface calling server 6 extracts the real interface calling request data from the response interface calling request satisfying the HTTPS two-way authentication protocol, a response is performed to obtain an interface calling response, which is sent to the RESTFUL interface calling proxy client 5 through step H) satisfying the HTTPS two-way authentication protocol; the RESTFUL interface calling proxy client 5 extracts the specific interface calling response data from the interface calling response satisfying the HTTPS two-way authentication protocol, and through step I), the following operations are performed on the specific interface calling response data: converting the interface calling response into a file (interface calling response file), and transmitting it to the export single guide 4; step J) is entered, in which the export single guide 4 performs data checking and filtering on the interface calling response file; step K) is entered, in which the export single guide 4 transmits the interface calling response file to the RESTFUL interface calling proxy server 2; step L) is entered, in which the RESTFUL interface calling proxy server 2 converts the interface calling response file into a real interface calling response, and transmits the real interface calling response to the RESTFUL interface calling client 1 by using the HTTPS two-way authentication protocol.

[0092] In addition, the embodiment provides a data security exchange method for RESTFUL interface calling, as shown in the method provided by the embodiment of the application mainly comprises the following steps: Figure 2

[0093] Step 110, establishing HTTPS two-way authentication between the RESTFUL interface calling client and the RESTFUL interface calling proxy server and between the RESTFUL interface calling server and the RESTFUL interface calling proxy client.

[0094] The HTTPS two-way authentication includes a session key and a symmetric encryption algorithm.

[0095] In some embodiments, the process of the HTTPS two-way authentication can be (when the client is the RESTFUL interface calling client, the server is the RESTFUL interface calling proxy server; when the client is the RESTFUL interface calling proxy client, the server is the RESTFUL interface calling server):

[0096] Step 1: The client initiates TCP three-way handshake (SYN, SYN-ACK, ACK) to the 443 port of the server to establish a reliable TCP connection.

[0097] Step 2: The client sends ClientHello to the server, including the supported TLS protocol version, the random number generated by the client, and the supported cipher suite list.

[0098] Step 3: The server sends ServerHello to the client, including the selected TLS protocol version, the random number generated by the server, and the selected cipher suite.

[0099] Step 4: The server sends Certificate to the client, sending its digital certificate to the client, which includes the public key, identity information of the server, and is signed by a trusted certificate authority (CA).

[0100] Step 5: The server sends CertificateRequest to the client, requiring the client to provide a certificate, and the request specifies the CA list trusted by the server (i.e. which CA should issue the client certificate).

[0101] Step 6: The server sends ServerHelloDone to the client, indicating that the initial handshake message of the server has been sent.

[0102] Step 7: The client verifies the server certificate after receiving it, including certificate chain verification, revocation status check, domain name verification, and validity period check.

[0103] ​Step 8: Client sends Certificate to Server, sends client digital certificate to server, the certificate is signed by a trusted CA, usually the same private CA that both server and client trust.

[0104] Step 9: Client generates another random number (Pre-Master Secret), encrypts this Pre-Master Secret using Server's public key (obtained from Server's certificate), and sends it to Server.

[0105] Step 10: Client sends CertificateVerify to Server, proves that the client indeed possesses the private key corresponding to its certificate, the client will calculate the hash value of all previous handshake messages, and sign it with its own client private key, then send this signature, the server can use the client's public key to verify the signature, thus confirming the authenticity of the client's identity.

[0106] Step 11: Client and Server both have three elements: client Random (Client Random), Server Random (Server Random) and Pre-Master Secret (Pre-Master Secret), both parties use the same algorithm (negotiated key suite) to independently generate the same master key, and then derive the session key used for this session.

[0107] Step 12: Client and Server send ChangeCipherSpec to each other, notify each other that all subsequent messages will be encrypted and authenticated using the session key just negotiated, and then send Finished, the other party needs to correctly decrypt and verify the content to confirm that the key generation and handshake process has not been tampered with.

[0108] Step 13: TLS handshake is successfully completed, a secure encrypted channel is established, and client and server use symmetric encryption algorithm and session key to encrypt and decrypt all request and response data.

[0109] Step 120, when the RESTFUL interface calling client initiates an interface call request to the RESTFUL interface calling proxy server, the session key and symmetric encryption algorithm are used to encrypt the interface call request.

[0110] Step 130, the RESTFUL interface calling proxy server uses the session key and symmetric encryption algorithm to decrypt the received encrypted interface call request, converts the decrypted interface call request into a request file, and sends it to the RESTFUL interface calling proxy client through the import single.

[0111] It should be noted that the RESTFUL interface calling agent server writes the interface calling request to a request file and sends it to the import single guide, wherein the interface calling request comprises a URL, a method type, a request header, and a request body.

[0112] The import single guide performs format and content detection on the request file and sends the request file to the RESTFUL interface calling agent client (the import single guide performs format and content detection on the request file and sends the qualified request file to the RESTFUL interface calling agent client; when the detection is unqualified, an exception instruction is sent to the RESTFUL interface calling agent client).

[0113] In step 140, the RESTFUL interface calling agent client converts the request file into an interface calling request and performs encryption processing on the interface calling request by using a session key and a symmetric encryption algorithm.

[0114] In some embodiments, the RESTFUL interface calling agent client receives and encrypts the request file and reconstructs the interface calling request. The RESTFUL interface calling agent client sends the encrypted interface calling request to the RESTFUL interface calling server.

[0115] It should be noted that the process of performing encryption processing on the interface calling request by using a session key and a symmetric encryption algorithm is implemented by the prior art, and the present application does not limit it here.

[0116] In step 150, the RESTFUL interface calling server performs decryption processing on the encrypted interface calling request by using a session key and a symmetric encryption algorithm, and further generates a corresponding interface calling response and performs encryption processing on the interface calling response.

[0117] In step 160, the RESTFUL interface calling agent client decrypts the encrypted interface calling response and converts it into a response file; and the response file is sent to the RESTFUL interface calling agent server through the export single guide.

[0118] Specifically, the RESTFUL interface calling agent client writes the interface calling response to a response file and sends it to the export single guide; and the export single guide performs format and content detection on the response file and sends the response file to the RESTFUL interface calling agent server.

[0119] In step 170, the RESTFUL interface calling agent server converts the response file into an interface calling response and performs encryption processing on the interface calling response.

[0120] In step 180, the RESTFUL interface calling client decrypts the encrypted interface calling response to obtain the interface calling response.

[0121] Based on the foregoing description, it can be known that the embodiment adopts the conversion of the RESTFUL interface call request and the RESTFUL interface call response into files (non-protocol proxy transparent mode), so as to facilitate the security check on the content of the RESTFUL interface call request and the RESTFUL interface call response.

[0122] The HTTPS two-way authentication is adopted to ensure the security of the transmission of the request and the response between the RESTFUL interface call client and the RESTFUL interface call proxy server, and also ensure the security of the transmission of the request and the response between the RESTFUL interface call proxy client and the RESTFUL interface call server, thereby ensuring the security of the whole link of the cross-network interface service call.

[0123] Further specifically, by constructing the whole-link HTTPS two-way authentication and the hierarchical encryption mechanism, three major core beneficial effects are achieved: first, identity trusted verification, the HTTPS two-way authentication is adopted between the client and the proxy server, and between the proxy client and the real server, the identity of the communication parties is strictly verified through the digital certificate, the risk of the man-in-the-middle attack is completely eliminated, and the session key and the symmetric encryption algorithm are cooperatively confirmed, so that the encryption parameters of each session are dynamically generated, and the systematic risk caused by the cracking of the fixed key is avoided. Second, data transmission process encryption, the interface call request and the response are symmetrically encrypted by the session key in the transmission link (client-proxy server, proxy client-server). Third, modularized security isolation, the physical transfer of the request and the response files is realized through the import / export single guide, which not only ensures the logical decoupling between the proxy server and the proxy client, but also cuts off the direct memory access path through the file-level transmission, so that the malicious code cannot be transmitted across the nodes through the continuous memory injection method, and the modularized design facilitates the centralized recording of the audit log, and provides a complete evidence chain for the subsequent tracing. In addition, the architecture realizes the performance optimization through the standardized encryption process, the symmetric encryption algorithm has a processing efficiency close to the clear text transmission under the support of the hardware acceleration, and the session key reuse mechanism avoids the frequent calculation overhead of the asymmetric encryption, so that the security enhancement and the system throughput are balanced.

[0124] The above is the method embodiment in the application, based on the same inventive concept, the embodiment of the application also provides a data security exchange device for the RESTFUL interface call. As shown in the Figure 3 device includes a processor and a memory having executable code stored thereon, when the executable code is executed, the processor executes the data security exchange method for the RESTFUL interface call as described in one of the above embodiments.

[0125] Specifically, the server side establishes HTTPS two-way authentication between the RESTFUL interface calling client and the RESTFUL interface calling proxy server side, and between the RESTFUL interface calling server side and the RESTFUL interface calling proxy client side; the HTTPS two-way authentication includes a session key and a symmetric encryption algorithm; when the RESTFUL interface calling client initiates an interface calling request to the RESTFUL interface calling proxy server side, the interface calling request is encrypted by using the session key and the symmetric encryption algorithm; the RESTFUL interface calling proxy server side decrypts the received encrypted interface calling request by using the session key and the symmetric encryption algorithm, converts the decrypted interface calling request into a request file, and sends the request file to the RESTFUL interface calling proxy client side through an import single guide; the RESTFUL interface calling proxy client side converts the request file into an interface calling request, and encrypts the interface calling request by using the session key and the symmetric encryption algorithm; the RESTFUL interface calling server side decrypts the encrypted interface calling request by using the session key and the symmetric encryption algorithm, and then generates a corresponding interface calling response and encrypts the interface calling response; the RESTFUL interface calling proxy client side decrypts the encrypted interface calling response, and converts the interface calling response into a response file; the response file is sent to the RESTFUL interface calling proxy server side through an export single guide; the RESTFUL interface calling proxy server side converts the response file into an interface calling response, and encrypts the interface calling response; and the RESTFUL interface calling client decrypts the encrypted interface calling response to obtain the interface calling response.

[0126] Based on the foregoing description, it can be known that the embodiment converts the RESTFUL interface calling request and the RESTFUL interface calling response into files (non-protocol proxy transparent mode), so as to facilitate security check on the contents of the RESTFUL interface calling request and the RESTFUL interface calling response.

[0127] The HTTPS two-way authentication is adopted to ensure the security of the transmission of the request and the response between the RESTFUL interface calling client and the RESTFUL interface calling proxy server side, and to ensure the security of the transmission of the request and the response between the RESTFUL interface calling proxy client side and the RESTFUL interface calling server side, so as to ensure the security of the whole link of the cross-network interface service calling.

[0128] Further specifically, by constructing the full-link HTTPS two-way authentication and layered encryption mechanism, three major core benefits are achieved: first, identity trusted verification, the client and the proxy server, the proxy client and the real server are all adopted with HTTPS two-way authentication, through the digital certificate to strictly verify the identity of both parties of communication, completely eliminate the risk of man-in-the-middle attack, and the session key and symmetric encryption algorithm coordination mechanism ensures that the encryption parameters of each session are dynamically generated, avoiding the risk of systematic risk caused by fixed key cracking. Second, data transmission process encryption, interface call request and response in the transmission link (client-proxy server, proxy client-server) are all implemented with symmetric encryption by session key. Third, modular security isolation, through the import / export single guide to realize the physical transfer of request and response files, which not only ensures the logical decoupling between the proxy server and the proxy client, but also cuts off the direct memory access path through file-level transmission, so that malicious code cannot be spread across nodes through continuous memory injection method, and the modular design facilitates the centralized recording of audit logs, providing a complete evidence chain for subsequent tracing. In addition, the architecture realizes performance optimization through standardized encryption process, and the symmetric encryption algorithm has a processing efficiency close to plaintext transmission under the support of hardware acceleration, while the session key reuse mechanism avoids the frequent calculation overhead of asymmetric encryption, so that the security enhancement and system throughput are balanced.

[0129] In addition, the embodiment of the present application further provides a non-volatile computer storage medium, which stores executable instructions, and when the executable instructions are executed, the data security exchange method for the RESTFUL interface call is realized.

[0130] The above description of disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure data exchange system using RESTful interface calls, characterized in that, The system includes: Authentication link, API call request transmission link, API call response link; The authentication process includes: There is HTTPS mutual authentication between the RESTful API call client and the RESTful API call proxy server; there is HTTPS mutual authentication between the RESTful API call server and the RESTful API call proxy client; among which, HTTPS mutual authentication includes session key verification and symmetric encryption algorithm verification; The API call request transmission link includes: A RESTful API call client that initiates API call requests and encrypts them using a session key and a symmetric encryption algorithm; a RESTful API call proxy server connected to the RESTful API call client to receive encrypted API call requests and decrypt them into request files; an import client connected to the RESTful API call proxy server to receive request files; a RESTful API call proxy client connected to the import client to receive request files and encrypt API call requests using a session key and a symmetric encryption algorithm; and a RESTful API call server connected to the RESTful API call proxy client to receive encrypted API call requests. The API call response chain includes: The RESTful API call server is responsible for decrypting API call requests and returning encrypted API call responses; the RESTful API call proxy client receives encrypted API call responses and decrypts them into response files; the export client, connected to the RESTful API call proxy client, is used to receive the response files; the RESTful API call proxy server, connected to the export client, is used to receive response files and encrypt the response files into API call responses; and the RESTful API call client decrypts the encrypted API call responses transmitted by the RESTful API call proxy server.

2. A secure data exchange method for RESTful interface calls, based on the secure data exchange system for RESTful interface calls as described in claim 1, characterized in that, The method includes: Establish HTTPS mutual authentication between the RESTful API call client and the RESTful API call proxy server, and between the RESTful API call server and the RESTful API call proxy client; wherein, HTTPS mutual authentication includes session keys and symmetric encryption algorithms; When a RESTful API call client initiates an API call request to a RESTful API call proxy server, the API call request is encrypted using a session key and a symmetric encryption algorithm. The RESTful API call proxy server uses a session key and a symmetric encryption algorithm to decrypt the received encrypted API call request, converts the decrypted API call request into a request file, and sends it to the RESTful API call proxy client via import. The RESTful API call proxy client converts the request file into an API call request and encrypts the API call request using a session key and a symmetric encryption algorithm. The RESTful API call server uses a session key and a symmetric encryption algorithm to decrypt the encrypted API call request, and then generates the corresponding API call response, and encrypts the API call response. The RESTful API call proxy client decrypts the encrypted API call response and converts it into a response file; then, through export, it sends the response file to the RESTful API call proxy server. The RESTful API call proxy server converts the response file into the API call response and encrypts the API call response; The RESTful API call client decrypts the encrypted API call response to obtain the API call response.

3. The data security exchange method for RESTful interface calls according to claim 2, characterized in that, Establish HTTPS mutual authentication between the RESTful API call client and the RESTful API call proxy server, specifically including: The RESTful API call client initiates a TCP three-way handshake to port 443 of the RESTful API call proxy server to establish a TCP connection; The RESTful API call client sends the supported TLS protocol versions, the random number generated by the RESTful API call client, and the list of supported symmetric encryption algorithms to the RESTful API call proxy server. The RESTful API call proxy server sends the selected TLS protocol version, the random number generated by the RESTful API call proxy server, and the selected symmetric encryption algorithm to the RESTful API call client. The RESTful API call proxy server sends a digital certificate to the RESTful API call client; the digital certificate contains the RESTful API call proxy server's public key, identity information, and is signed by a certificate authority; The RESTful API call proxy server sends ServerHelloDone to the RESTful API call client; After receiving ServerHelloDone, the RESTful API call client verifies the digital certificate of the proxy server. Once the digital certificate is successfully verified, the RESTful API call client sends the digital certificate to the RESTful API call proxy server. The RESTful interface calls the client to generate a pre-master key, and then uses the RESTful interface calls the proxy server to send the public key in the digital certificate to the RESTful interface calls the proxy server in encrypted form. The RESTful API call client sends signed data encrypted with the RESTful API call client's private key to the RESTful API call proxy server; The proxy server uses the RESTful interface to call the public key in the client's digital certificate to verify the signature data. Once the signature data is successfully verified, the random number from the RESTful interface call client, the random number from the RESTful interface call proxy server, and the pre-master key are used as the session key, and the selected symmetric encryption algorithm is used as the encryption symmetric encryption algorithm.

4. The data security exchange method for RESTful interface calls according to claim 3, characterized in that, Verification of the digital certificate of the proxy server for RESTful API calls includes: Perform certificate chain verification, revocation status check, domain name verification, and validity period check; When verification fails, a verification failure message is returned to the RESTful interface call proxy server.

5. The method for secure data exchange via RESTful interface calls according to claim 3, characterized in that, Before the RESTful interface call client sends the signed data encrypted with the RESTful interface call client's private key to the RESTful interface call proxy server, the method further includes: The RESTful interface calls the client to calculate the hash values ​​of all previous handshake messages; Use the RESTful interface to call the client's private key to sign the hash value and obtain the signed data.

6. The data security exchange method for RESTful interface calls according to claim 2, characterized in that, Establish HTTPS mutual authentication between the RESTful API call server and the RESTful API call proxy client, specifically including: The RESTful API call proxy client initiates a TCP three-way handshake to port 443 of the RESTful API call server to establish a TCP connection; The RESTful API call proxy client sends the supported TLS protocol versions, the random number generated by the RESTful API call proxy client, and the list of supported symmetric encryption algorithms to the RESTful API call server. The RESTful API call server sends the selected TLS protocol version, the random number generated by the RESTful API call server, and the selected symmetric encryption algorithm to the RESTful API call proxy client. The RESTful API call server sends a digital certificate to the RESTful API call proxy client; the digital certificate contains the RESTful API call server's public key, identity information, and is signed by a certificate authority; The RESTful API call server sends ServerHelloDone to the RESTful API call proxy client; After receiving ServerHelloDone, the RESTful API call proxy client verifies the digital certificate of the RESTful API call server. Once the digital certificate is successfully verified, the RESTful API call proxy client sends the digital certificate to the RESTful API call server. The RESTful API call proxy client generates a pre-master key, and uses the public key in the digital certificate to encrypt and send it to the RESTful API call server. The RESTful API call proxy client sends signed data encrypted with the RESTful API call proxy client's private key to the RESTful API call server; The RESTful API call server uses the public key in the digital certificate of the proxy client to verify the signature data; Once the signature data is successfully verified, the random number generated by the RESTful interface call agent client, the random number generated by the RESTful interface call server, and the pre-master key are used as the session key, and the selected symmetric encryption algorithm is used as the encryption symmetric encryption algorithm.

7. The data secure exchange method for RESTful interface calls according to claim 2, characterized in that, An API call request includes a URL, method type, request headers, and request body.

8. The data security exchange method for RESTful interface calls according to claim 2, characterized in that, Importing a single import and sending it to the RESTful interface call proxy client specifically includes: The importer performs format and content checks on the request file and sends the qualified request file to the RESTful interface call proxy client. When the test fails, an exception command is sent to the RESTful interface call agent client.

9. A data security exchange device for RESTful interface calls, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a data secure exchange method for a RESTful interface call as described in any one of claims 2-8.

10. A non-volatile computer storage medium, characterized in that, It stores computer instructions that, when executed, implement a secure data exchange method for RESTful interface calls as described in any one of claims 2-8.

Images