A method and device for protecting API privacy parameters

Abstract

The present application relates to a method, apparatus, computer device and computer-readable storage medium for protecting API privacy parameters, wherein the method for protecting API privacy parameters includes: a first call request generated by an API caller; extracting a first identifier and a first privacy parameter from the first call request; homomorphically encrypting the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext; encapsulating the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request; and sending the second call request to a server for verification. Through the present application, the security issues caused by plain text transmission in the prior art are solved, and the protection of API privacy parameters in a cloud environment is achieved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method, apparatus, computer device, and computer-readable storage medium for protecting API privacy parameters. Background Art

[0002] In Internet environments such as public clouds and open data services, due to the particularity of the business, it is necessary to publicly open the public API (Application Programming Interface) of some data or services to meet the needs of public service calls.

[0003] In the existing technology, general API security protection mainly focuses on interface authorization, security authentication and HTTPS encrypted communication. The interface caller applies for an authentication access ID from the service provider. The caller must bring the applied access ID for all operations that require the authorization module. After receiving the request, the server performs ID verification. After the verification is passed, the data is allowed to be called. In this type of authentication method, in order to ensure the calling performance of the API, the API request parameters are usually transmitted in plain text or in an encapsulated manner. Attackers can obtain these API request parameters by capturing network packets, and obtain sensitive and private content from them, thereby launching attacks in other places.

[0004] Currently, no effective solution has been proposed for the security issues caused by the use of plain text transmission in related technologies. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, computer device, and computer-readable storage medium for protecting API privacy parameters, so as to at least solve the security problem caused by using plain text transmission to ensure transmission performance in the related technology.

[0006] In a first aspect, an embodiment of the present application provides a method for protecting API privacy parameters, the method comprising:

[0007] A first call request generated by an API caller;

[0008] Extracting a first identifier and a first privacy parameter from the first call request;

[0009] Performing homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext;

[0010] Encapsulating the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request;

[0011] The second call request is sent to the server for verification.

[0012] In some embodiments, sending the second call request to the server for verification includes the following steps:

[0013] Obtaining the first identifier ciphertext according to the second call request;

[0014] After the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext, a first operation result ciphertext is obtained according to the second identifier ciphertext;

[0015] Calculate the first identifier ciphertext and the first privacy parameter ciphertext to generate a second operation result ciphertext;

[0016] After the first operation result ciphertext and the second operation result ciphertext are successfully compared, the second call request is executed.

[0017] In some embodiments, before the server receives the second call request, the method further includes:

[0018] Acquire a second privacy parameter according to a second identifier preset in the server;

[0019] Calculate the second identifier and the second privacy parameter to obtain the first calculation result;

[0020] Performing homomorphic encryption on the second identifier, the second privacy parameter, and the first operation result, respectively, to obtain a second identifier ciphertext, a second privacy parameter ciphertext, and a first operation result ciphertext;

[0021] The second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext are stored in the server.

[0022] In some of these embodiments, the homomorphic encryption is additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption, or divisive homomorphic encryption.

[0023] In a second aspect, an embodiment of the present application provides a device for protecting API privacy parameters, the device comprising a generation module, an extraction module, an encryption module, a packaging module and a verification module;

[0024] The generating module is used for generating a first calling request by an API caller;

[0025] The extraction module is used to extract the first identifier and the first privacy parameter from the first call request;

[0026] The encryption module is used to perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext;

[0027] The encapsulation module is used to encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request;

[0028] The verification module sends the second call request to the server for verification.

[0029] In some of the embodiments, the verification module includes a first acquisition unit, a second acquisition unit, a first calculation unit, and an execution unit;

[0030] The first acquiring unit is used to acquire the first identifier ciphertext according to the second calling request;

[0031] The second acquisition unit is configured to obtain a first operation result ciphertext according to the second identifier ciphertext after the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext;

[0032] The calculation unit calculates the first identifier ciphertext and the first privacy parameter ciphertext to generate a second calculation result ciphertext;

[0033] The execution unit is used to execute the second call request after the first operation result ciphertext and the second operation result ciphertext are successfully compared.

[0034] In some of the embodiments, the verification device further includes a third acquisition unit, a second calculation unit, an encryption unit, and a storage unit;

[0035] The third acquisition unit is used to acquire a second privacy parameter according to a second identifier preset in the server;

[0036] The second calculation unit is used to calculate the second identifier and the second privacy parameter to obtain the first operation result; the encryption unit is used to perform homomorphic encryption on the second identifier, the second privacy parameter and the first operation result respectively to obtain the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext;

[0037] The storage unit stores the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext in the server.

[0038] In some of the embodiments, the homomorphic encryption in the encryption module and the encryption unit is additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption.

[0039] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for protecting API privacy parameters as described in the first aspect above is implemented.

[0040] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for protecting API privacy parameters as described in the first aspect above.

[0041] Compared with the related art, the embodiments of the present application provide a method, apparatus, computer device and computer-readable storage medium for protecting API privacy parameters. By extracting the first identifier and the first privacy parameter in the first call request generated by the API caller, homomorphically encrypting the first identifier and the first privacy parameter, and then reassembling the second call request with the first identifier ciphertext and the first privacy parameter ciphertext, the second call request assembled by the ciphertext is sent to the server for verification, thereby solving the security problems caused by the use of plain text transmission in the related art and realizing the protection of API privacy parameters in a cloud environment.

[0042] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 is a flow chart of a method for protecting API privacy parameters according to an embodiment of the present application;

[0045] Figure 2 is a flow chart of a method for protecting API privacy parameters according to another embodiment of the present application;

[0046] Figure 3 is a structural diagram of a method for protecting API privacy parameters according to an embodiment of the present application;

[0047] Figure 4 is a structural diagram of a method for protecting API privacy parameters according to another embodiment of the present application;

[0048] Figure 5 It is a structural diagram of a computer device according to a method for protecting API privacy parameters in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0050] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0051] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0052] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0053] In Internet environments such as public clouds or public data services, due to the particularity of the business, some public APIs of data or services need to be publicly opened to meet the needs of public service calls. This application is applicable to cloud environments where cloud tenants use homomorphic encryption to protect API request parameters when calling the above public APIs. At the same time, the homomorphic encryption feature that does not require decryption and can directly participate in the operation is used to ensure the response efficiency of the API.

[0054] This embodiment provides a method for protecting API privacy parameters, which can be used to protect API privacy parameters. Figure 1 is a flow chart of a method for protecting API privacy parameters according to an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0055] Step S101, a first call request is generated by an API caller. The API caller is a cloud tenant in a cloud environment. When the cloud tenant wants to call a public API in a cloud host, a call request, i.e., a first call request, is generated. The first call request is essentially a URL (Uniform Resource Locator).

[0056] Step S102: extracting a first identifier and a first privacy parameter from the first call request. The first identifier refers to a unique identifier of the cloud tenant, which may be a tenant ID. The first privacy parameter may be a host ID, a service process ID, and a verification password in the cloud environment.

[0057] Step S103: Perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0058] Step S104: encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request. The second call request is essentially also a URL. Compared with the first call request, the second call request is composed of ciphertext.

[0059] Step S105, sending the second call request to the server for verification. After sending the second call request to the server, the server will verify the second call request. Only after the verification is passed, the request can continue to be executed.

[0060] In the above steps S101 to S105, in a cloud environment, the first identifier and the first privacy parameter in the first call request generated by the API caller are extracted, the first identifier and the first privacy parameter are homomorphically encrypted, and then the first identifier ciphertext and the first privacy parameter ciphertext are reassembled into a second call request, and the second call request assembled by the ciphertext is sent to the server for verification, thereby solving the security problems caused by the use of plain text transmission in related technologies and realizing the protection of API privacy parameters in a cloud environment.

[0061] This embodiment provides a method for protecting API privacy parameters. Figure 2 is a flow chart of a method for protecting API privacy parameters according to another embodiment of the present application. Figure 2 As shown, the method includes:

[0062] Step S101, receiving a first call request generated by an API caller. The API caller is a cloud tenant in a cloud environment. When the cloud tenant wants to call a public API in a cloud host, a call request, i.e., a first call request, is generated. The first call request is essentially a URL (Uniform Resource Locator).

[0063] Step S102: extracting a first identifier and a first privacy parameter from the first call request. The first identifier refers to a unique identifier of the cloud tenant, which may be a tenant ID. The first privacy parameter may be a host ID, a service process ID, and a verification password in the cloud environment.

[0064] Step S103: Perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0065] Step S104: encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request. The second call request is essentially also a URL. Compared with the first call request, the second call request is composed of ciphertext.

[0066] Step S1051, according to the second call request, obtain the first identifier ciphertext. After receiving the second call request, the server extracts the first identifier ciphertext from the second call request.

[0067] Step S1052, after the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext, the first operation result ciphertext is obtained according to the second identifier ciphertext. The first identifier is essentially the identifier of the cloud tenant, and the second identifier is the identifier of the host rented by the cloud tenant in this cloud environment. When the cloud tenant purchases the cloud service, the first identifier is bound to the second identifier. The relationship between the first identifier plaintext and the second identifier plaintext is stored in the server, and the relationship between the first identifier ciphertext and the second identifier ciphertext is also stored. Therefore, the comparison relationship here is to confirm whether the relationship between the cloud tenant and the cloud host is correct. If it is correct, the first operation result ciphertext can be obtained. If it is not correct, there is no need to further operate, saving the performance of the server.

[0068] Step S1053, the first identifier ciphertext and the first privacy parameter ciphertext are calculated to generate a second operation result ciphertext. The calculation used here can be additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption, and due to the characteristics of homomorphic encryption, the first identifier ciphertext and the first privacy parameter ciphertext can be calculated without decryption.

[0069] Step S1054: After the first operation result ciphertext and the second operation result ciphertext are successfully compared, the second call request is executed. The comparison operation refers to comparing the first operation result ciphertext with the second operation result ciphertext to see if they are the same. If they are the same, the verification is completed and the server continues to execute the second request.

[0070] Through the above steps S101 to S1054, the first identifier and the first privacy parameter in the first call request generated by the API caller are extracted, the first identifier and the first privacy parameter are homomorphically encrypted, and then the first identifier ciphertext and the first privacy parameter ciphertext are reassembled into a second call request, and then the second call request assembled from the ciphertext is sent to the server, and the server verifies the second call request in the ciphertext state without decryption, which solves the security problem caused by the use of plaintext transmission in order to ensure the API call performance in the related technology, and realizes the protection of API privacy parameters in the cloud environment under the premise of ensuring API response efficiency.

[0071] Furthermore, in an optional embodiment, before the above step S105, it is also necessary to complete:

[0072] Step S301, according to the second identifier preset in the server, obtain the second privacy parameter. The second identifier is essentially a unique identifier of a host in a cloud environment, and the identifier can be a host ID. After obtaining the host ID, the second privacy parameter, such as the service process ID and the verification password, can be obtained.

[0073] Step S302, the second identifier and the second privacy parameter are calculated to obtain the first operation result. The calculation used here can be additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption, and due to the characteristics of homomorphic encryption, the first identifier ciphertext and the first privacy parameter ciphertext can be calculated without decryption, but the calculation method used here must be the same as the calculation method used in the above step S1053.

[0074] Step S303: Perform homomorphic encryption on the second identifier, the second privacy parameter, and the first operation result, respectively, to obtain a second identifier ciphertext, a second privacy parameter ciphertext, and a first operation result ciphertext.

[0075] Step S304: Store the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext in the server. The encryption result of the above step S303 is stored in the server for subsequent verification of the request sent by the API caller.

[0076] Furthermore, in an optional embodiment, the homomorphic encryption includes but is not limited to: addition homomorphic encryption, multiplication homomorphic encryption, subtraction homomorphic encryption or division homomorphic encryption, but only one form of homomorphic encryption can be selected in the method. If two different homomorphic encryption methods are used before and after in the method, the verification result will be inaccurate.

[0077] Based on the same inventive concept, the present application also provides a device for protecting API privacy parameters, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the terms "module", "unit", "sub-unit", etc. can implement a combination of software and / or hardware for predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0078] This embodiment provides a device for protecting API privacy parameters, which can be used to protect API privacy parameters. Figure 3 is a structural diagram of a method for protecting API privacy parameters according to an embodiment of the present application, such as Figure 3 As shown, the device includes: a generating module 31, an extracting module 32, an encrypting module 33, a packaging module 34 and a verifying module 35.

[0079] The generating module 31 is used for generating a first calling request by an API caller.

[0080] The extraction module 32 is used to extract the first identifier and the first privacy parameter from the first call request.

[0081] The encryption module 33 is used to perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0082] The encapsulation module 34 is used to encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request.

[0083] The verification module 35 sends the second call request to the server for verification.

[0084] This embodiment provides a device for protecting API privacy parameters, which can be used to protect API privacy parameters. Figure 4 is a structural diagram of a method for protecting API privacy parameters according to another embodiment of the present application, such as Figure 4 As shown, the device includes: a generation module 31, an extraction module 32, an encryption module 33, an encapsulation module 34 and a verification module 35, and the verification device 35 includes a first acquisition unit 351, a second acquisition unit 352, a first calculation unit 353 and an execution unit 354.

[0085] The generating module 31 is used for generating a first calling request by an API caller.

[0086] The extraction module 32 is used to extract the first identifier and the first privacy parameter from the first call request.

[0087] The encryption module 33 is used to perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0088] The encapsulation module 34 is used to encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request.

[0089] The first acquisition unit 351 is used to acquire the first identifier ciphertext according to the second calling request.

[0090] The second acquisition unit 352 is configured to obtain a first operation result ciphertext according to the second identifier ciphertext after the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext;

[0091] The calculation unit 353 calculates the first identifier ciphertext and the first privacy parameter ciphertext to generate a second operation result ciphertext.

[0092] The execution unit 354 is used to execute the second call request after the first operation result ciphertext and the second operation result ciphertext are successfully compared.

[0093] Furthermore, the verification device 35 also includes a third acquisition unit, a second calculation unit, an encryption unit and a storage unit.

[0094] The third acquisition unit is used to acquire the second privacy parameter according to the second identifier preset in the server.

[0095] The second calculation unit calculates the second identifier and the second privacy parameter to obtain the first operation result. The encryption unit is used to perform homomorphic encryption on the second identifier, the second privacy parameter and the first operation result respectively to obtain the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext.

[0096] The storage unit stores the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext in the server.

[0097] Furthermore, the homomorphic encryption in the encryption module and the encryption unit includes but is not limited to: adding homomorphic encryption, multiplying homomorphic encryption, subtracting homomorphic encryption or dividing homomorphic encryption, but only one form of homomorphic encryption can be selected in the device.

[0098] In one embodiment, a computer device is provided. Figure 5 is a schematic diagram of the structure of a computer device according to a method for protecting API privacy parameters in an embodiment of the present invention. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store blockchain transaction query data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the processor executes the computer program, a method for protecting API privacy parameters is implemented, comprising the following steps:

[0099] S1, the first call request generated by the API caller.

[0100] S2. Extract a first identifier and a first privacy parameter from the first call request.

[0101] S3. Perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0102] S4: Encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request.

[0103] S5: Send the second call request to the server for verification.

[0104] As an implementable method, before step S5, the following steps need to be completed:

[0105] Obtaining the first identifier ciphertext according to the second call request;

[0106] After the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext, a first operation result ciphertext is obtained according to the second identifier ciphertext;

[0107] Calculate the first identifier ciphertext and the first privacy parameter ciphertext to generate a second operation result ciphertext;

[0108] After the first operation result ciphertext and the second operation result ciphertext are successfully compared, the second call request is executed.

[0109] As an implementable method, before step S5, the following steps need to be completed:

[0110] Acquire a second privacy parameter according to a second identifier preset in the server;

[0111] Calculate the second identifier and the second privacy parameter to obtain the first calculation result;

[0112] Performing homomorphic encryption on the second identifier, the second privacy parameter, and the first operation result, respectively, to obtain a second identifier ciphertext, a second privacy parameter ciphertext, and a first operation result ciphertext;

[0113] The second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext are stored in the server.

[0114] As a feasible implementation method, the homomorphic encryption includes but is not limited to: additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption, but only one form of homomorphic encryption can be selected in the described method.

[0115] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, a method for protecting API privacy parameters is implemented, including the following steps:

[0116] S1, the first call request generated by the API caller.

[0117] S2. Extract a first identifier and a first privacy parameter from the first call request.

[0118] S3. Perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext.

[0119] S4: Encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request.

[0120] S5: Send the second call request to the server for verification.

[0121] As an implementable method, before step S5, the following steps need to be completed:

[0122] Obtaining the first identifier ciphertext according to the second call request;

[0123] After the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext, a first operation result ciphertext is obtained according to the second identifier ciphertext;

[0124] Calculate the first identifier ciphertext and the first privacy parameter ciphertext to generate a second operation result ciphertext;

[0125] After the first operation result ciphertext and the second operation result ciphertext are successfully compared, the second call request is executed.

[0126] As an implementable method, before step S5, the following steps need to be completed:

[0127] Acquire a second privacy parameter according to a second identifier preset in the server;

[0128] Calculate the second identifier and the second privacy parameter to obtain the first calculation result;

[0129] Performing homomorphic encryption on the second identifier, the second privacy parameter, and the first operation result, respectively, to obtain a second identifier ciphertext, a second privacy parameter ciphertext, and a first operation result ciphertext;

[0130] The second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext are stored in the server.

[0131] As a feasible implementation method, the homomorphic encryption includes but is not limited to: additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption, but only one form of homomorphic encryption can be selected in the described method.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for protecting API privacy parameters, characterized in that: The method comprises: A first call request generated by an API caller; Extracting a first identifier and a first privacy parameter from the first call request; Performing homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext; Encapsulating the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request; Sending the second call request to the server for verification includes the following steps: Obtaining the first identifier ciphertext according to the second call request; After the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext, a first operation result ciphertext is obtained according to the second identifier ciphertext; Calculate the first identifier ciphertext and the first privacy parameter ciphertext to generate a second operation result ciphertext; After the first operation result ciphertext and the second operation result ciphertext are successfully compared, executing the second call request; Before the server receives the second call request, the method further includes: Acquire a second privacy parameter according to a second identifier preset in the server; Calculate the second identifier and the second privacy parameter to obtain the first calculation result; Performing homomorphic encryption on the second identifier, the second privacy parameter, and the first operation result, respectively, to obtain a second identifier ciphertext, a second privacy parameter ciphertext, and a first operation result ciphertext; The second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext are stored in the server.

2. The method according to claim 1, characterized in that The homomorphic encryption is additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption.

3. A device for protecting API privacy parameters, characterized in that: The device includes a generation module, an extraction module, an encryption module, a packaging module and a verification module; The generating module is used for generating a first calling request by an API caller; The extraction module is used to extract the first identifier and the first privacy parameter from the first call request; The encryption module is used to perform homomorphic encryption on the first identifier and the first privacy parameter to obtain a first identifier ciphertext and a first privacy parameter ciphertext; The encapsulation module is used to encapsulate the first identifier ciphertext and the first privacy parameter ciphertext to obtain a second call request; The verification module sends the second call request to the server for verification.

4. The device according to claim 3, characterized in that The verification module includes a first acquisition unit, a second acquisition unit, a first calculation unit and an execution unit; The first acquiring unit is used to acquire the first identifier ciphertext according to the second calling request; The second acquisition unit is configured to obtain a first operation result ciphertext according to the second identifier ciphertext after the first identifier ciphertext is successfully compared with the pre-generated second identifier ciphertext; The calculation unit calculates the first identifier ciphertext and the first privacy parameter ciphertext to generate a second calculation result ciphertext; The execution unit is used to execute the second call request after the first operation result ciphertext and the second operation result ciphertext are successfully compared.

5. The device according to claim 4, characterized in that The verification module also includes a third acquisition unit, a second calculation unit, an encryption unit and a storage unit; The third acquisition unit is used to acquire a second privacy parameter according to a second identifier preset in the server; The second calculation unit calculates the second identifier and the second privacy parameter to obtain the first calculation result; The encryption unit is used to perform homomorphic encryption on the second identifier, the second privacy parameter and the first operation result respectively to obtain a second identifier ciphertext, a second privacy parameter ciphertext and a first operation result ciphertext; The storage unit stores the second identifier ciphertext, the second privacy parameter ciphertext and the first operation result ciphertext in the server.

6. The device according to claim 5, characterized in that The homomorphic encryption in the encryption module and the encryption unit is additive homomorphic encryption, multiplicative homomorphic encryption, subtractive homomorphic encryption or divisive homomorphic encryption.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, a method for protecting API privacy parameters as described in any one of claims 1 to 2 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a method for protecting API privacy parameters as described in any one of claims 1 to 2 is implemented.

Images