Interface security control and verification method and device

Abstract

The present invention discloses an interface security control and verification method and device, which relates to the field of computer technology. A specific implementation of the method includes: when monitoring the client's call interface action, intercepting the call interface request sent by the client to the server, generating an encryption key-value pair based on the request parameters of the call interface request; performing symmetrical encryption processing on the encryption key-value pair to obtain an encryption token, sequentially splicing the encryption token, the request timestamp and specific parameters to generate detection agent information; adding the detection agent information to the request header of the call interface request, and transmitting the call interface request containing the detection agent information to the server for processing. This implementation method realizes interface security monitoring by agreeing on an encryption and decryption rule at the front and back ends, and setting the M-Agent field in the http / https request header for verification.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an interface security control and verification method and device. Background Art

[0002] With the development of e-commerce networks, online shopping has become more and more popular. E-commerce platforms usually distribute some beans, large coupons or red envelopes to attract user traffic. These benefits sometimes attract the covetousness of some people with ulterior motives. They imitate interface requests and call interfaces on a large scale in a short period of time to swipe these beans, coupons or red envelopes to make huge profits.

[0003] Currently, the main methods used to monitor interface security are limiting the maximum sending volume of a single IP, graphic verification codes, SMS verification codes, device fingerprint judgment, and tokens. However, in the process of implementing the present invention, the inventors found that the security of the existing methods is not high, and there are ready-made cracking solutions; the compatibility is not high, and it cannot be applied to mini-programs, PCs, and mobile terminals at the same time. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides an interface security control and verification method and device, which can at least solve the problems of low security, low compatibility and lack of universal applicability in the existing technology.

[0005] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for controlling interface security is provided, comprising:

[0006] When monitoring the client's call interface action, intercept the call interface request sent by the client to the server, and generate an encryption key-value pair according to the request parameters of the call interface request; wherein the request parameters include a request timestamp;

[0007] Performing symmetric encryption on the encryption key-value pair to obtain an encryption token, and sequentially concatenating the encryption token, the request timestamp, and specific parameters to generate detection agent information;

[0008] The detection agent information is added to the request header of the calling interface request, and the calling interface request containing the detection agent information is transmitted to the server for processing.

[0009] Optionally, the request parameters also include an interface name, a parameter string set, and a platform type;

[0010] Generating an encryption key-value pair according to the request parameters of the calling interface request includes:

[0011] Processing the request timestamp based on a preset encryption rule to obtain an encryption key name;

[0012] The interface name, the request timestamp, the parameter character string set and the platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain an encryption key value.

[0013] Optionally, processing the request timestamp based on a preset encryption rule to obtain an encryption key name includes:

[0014] The request timestamp is converted into a binary form, a preset number of binary numbers are intercepted, the intercepted binary numbers are inverted and converted into a decimal form to obtain an encryption key name.

[0015] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for verifying interface security is provided, comprising:

[0016] The server receives the call interface request transmitted by the client, and extracts the detection agent information and request parameters from the request header of the call interface request;

[0017] Generating a first encryption key-value pair according to the request parameters, and disassembling the detection agent information to obtain an encrypted token and decrypting it to obtain a second encryption key-value pair;

[0018] Compare the first encryption key-value pair and the second encryption key-value pair to see if they are the same. If the comparison results are the same, trigger the processing of the calling interface request and return the response result to the client; otherwise, return the token verification error information to the client.

[0019] Optionally, the request parameters include a first request timestamp, a first interface name, a first parameter string set, and a first platform type;

[0020] Generating a first encryption key-value pair according to the request parameter includes:

[0021] Processing the first request timestamp based on a preset encryption rule to obtain a first encryption key name;

[0022] The first interface name, the first request timestamp, the first parameter string set, and the first platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain a first encryption key value.

[0023] Optionally, the processing the first request timestamp based on a preset encryption rule to obtain a first encryption key name includes:

[0024] The first request timestamp is converted into a binary form, a preset number of binary numbers are intercepted, the intercepted binary numbers are inverted and converted into a decimal form, and a first encryption key name is obtained.

[0025] To achieve the above object, according to another aspect of an embodiment of the present invention, there is provided an interface security control device, comprising:

[0026] A monitoring module, configured to intercept an interface calling request sent by the client to the server upon detecting an interface calling action by the client, and generate an encrypted key-value pair based on request parameters of the interface calling request; wherein the request parameters include a request timestamp;

[0027] An encryption module, configured to perform symmetrical encryption processing on the encryption key-value pair to obtain an encryption token, and sequentially concatenate the encryption token, the request timestamp, and specific parameters to generate detection agent information;

[0028] The transmission module is used to add the detection agent information to the request header of the calling interface request, and transmit the calling interface request containing the detection agent information to the server for processing.

[0029] Optionally, the request parameters also include an interface name, a parameter string set, and a platform type;

[0030] The monitoring module is used to:

[0031] Processing the request timestamp based on a preset encryption rule to obtain an encryption key name;

[0032] The interface name, the request timestamp, the parameter character string set and the platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain an encryption key value.

[0033] Optionally, the monitoring module is configured to convert the request timestamp into a binary form, intercept a preset number of binary numbers, invert the intercepted binary numbers and convert them into a decimal form to obtain an encryption key name.

[0034] To achieve the above object, according to another aspect of an embodiment of the present invention, there is provided an interface security verification device, comprising:

[0035] The extraction module is used for receiving the calling interface request transmitted by the client at the server side and extracting the detection agent information and request parameters from the request header of the calling interface request;

[0036] a decryption module, configured to generate a first encryption key-value pair according to the request parameters, and to decrypt the detection agent information to obtain an encrypted token and obtain a second encryption key-value pair;

[0037] A processing module is used to compare whether the first encryption key-value pair and the second encryption key-value pair are the same. If the comparison results are the same, it triggers the processing of the calling interface request and returns the response result to the client; otherwise, it returns a token verification error message to the client.

[0038] Optionally, the request parameters include a first request timestamp, a first interface name, a first parameter string set, and a first platform type;

[0039] The decryption module is configured to: process the first request timestamp based on a preset encryption rule to obtain a first encryption key name;

[0040] The first interface name, the first request timestamp, the first parameter string set, and the first platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain a first encryption key value.

[0041] Optionally, the decryption module is configured to convert the first request timestamp into a binary form, intercept a preset number of binary numbers, invert the intercepted binary numbers and convert them into a decimal form to obtain a first encryption key name.

[0042] To achieve the above-mentioned purpose, according to another aspect of an embodiment of the present invention, an electronic device for interface security control and verification is provided.

[0043] The electronic device of an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-mentioned interface security control and verification methods.

[0044] To achieve the above objectives, according to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, any of the above-mentioned interface security control and verification methods is implemented.

[0045] According to the solution provided by the present invention, one embodiment of the above invention has the following advantages or beneficial effects: the front-end and back-end adopt certain rules to encrypt request parameters such as the timestamp in the interface call request to agree on an M-Agent field and put it in the http / https request header. After receiving it, the server determines whether the decrypted information is consistent with the information generated by the client based on the parameters, thereby realizing interface security monitoring.

[0046] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are provided for a better understanding of the present invention and are not intended to limit the present invention.

[0048] Figure 1 This is a schematic diagram of the main flow of an interface security control method according to an embodiment of the present invention;

[0049] Figure 2 This is a schematic diagram of the main process of an interface security verification method according to an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of the main modules of an interface security control device according to an embodiment of the present invention;

[0051] Figure 4 This is a schematic diagram of the main modules of an interface security verification device according to an embodiment of the present invention;

[0052] Figure 5 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

[0053] Figure 6 It is a schematic diagram of the structure of a computer system of a mobile device or server suitable for implementing the embodiments of the present invention. DETAILED DESCRIPTION

[0054] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0055] Currently, the main methods used to monitor interface security are limiting the maximum sending volume of a single IP address, graphic verification codes, SMS verification codes, device fingerprint judgment, and tokens. The following describes each method and its shortcomings:

[0056] 1. Limiting the maximum sending volume of a single IP can prevent the problem of multiple mobile phone numbers being swiped under a single IP, but it is not friendly to public IPs in large regional networks and can be easily bypassed by the gray industry.

[0057] 2. Graphic verification codes can be automatically recognized by machine learning and can be connected to a verification platform to verify whether the user is authentic, thereby achieving the purpose of interception. However, there are some third-party verification code verification platforms that can automatically identify the answer to the graphic verification code to bypass this interception, so the interception effect is not very strong.

[0058] 3. SMS verification codes also have code receiving platforms, and are easily bombarded by text messages by criminals, who maliciously charge a large amount of text message fees, causing huge financial losses to companies or individuals.

[0059] 4. Device fingerprinting generates a unique, unforgeable device ID for each device (mobile phone / PC). However, platforms in different ecosystems have different permissions for accessing user privacy data, making it difficult to generate a unique identification code and impossible to achieve cross-domain unification across web and app platforms. Another limitation of active device fingerprinting is that its strong reliance on client-side code makes the generated fingerprint less robust in anti-fraud scenarios.

[0060] 5. Token: For important API interfaces, a token value is generated for verification. The principle is that after the user logs in, he will provide the user authentication information (such as account and password) to the server. After the server completes the authentication, it returns a token to the client. When the user visits other interfaces of the site to obtain information again, he needs to bring this token. After receiving the request, the server verifies the token. If the token does not exist or expires, it means that the request is invalid and the service is rejected. However, this method requires the user to be logged in, and some interfaces, such as the case where the user's openid is used to assist in the app, are actually not logged in.

[0061] See also Figure 1 , which shows a main flow chart of an interface security control method provided by an embodiment of the present invention, including the following steps:

[0062] S101: When a client calls an interface, intercept the client's call interface request to the server, and generate an encryption key-value pair according to the request parameters of the call interface request; wherein the request parameters include a request timestamp;

[0063] S102: performing symmetric encryption processing on the encryption key-value pair to obtain an encryption token, and sequentially concatenating the encryption token, the request timestamp, and specific parameters to generate detection agent information;

[0064] S103: Add the detection agent information to the request header of the calling interface request, and transmit the calling interface request containing the detection agent information to the server for processing.

[0065] In the above embodiment, for step S101, when the client is detected to actively call a certain interface, the interface call request sent by the client to the server is intercepted and processed to achieve interface security encryption. Specifically:

[0066] 1. Generate an encryption key based on the request timestamp of the API call. Encryption rules: Convert the request timestamp to binary, extract a predetermined number of binary digits (e.g., extract 31 digits from the back or from the front), invert the extracted binary digits, and convert them to decimal to obtain the decimal encryption key. In practice, an encryption key can also be generated based on a random number generated by JavaScript or Java, and then using a specific encryption rule.

[0067] Since the subsequent symmetric encryption algorithms require the encryption key to be 16 bits, 24 bits, or 32 bits long, the minimum encryption key length here is 16 bits, with 1 added to the end if it is less than 16 bits.

[0068] The overall execution code is as follows:

[0069]

[0070]

[0071] 2. Extract the interface name, parameter string set, and platform type from the interface call request. Combined with the request timestamp, these are concatenated in sequence using the character "-" (this is just an example; other characters are also possible). Then, MD5 encrypt the extracted values to generate an encrypted value. Specifically, the encrypted value is in the form of encrypted value = MD5(interface name - request timestamp - parameter string set - platform type). It should be noted that there is no limit on the number of parameters in the encrypted value. For example, the request timestamp can be concatenated twice.

[0072] The parameters are described as follows:

[0073] ①Interface name: Interface request name, such as xxxxx: / / xxxxx.x.xx.xxx / xxxxxxx / xxxxxxxx. The xxxxxxxx after the last “ / ” is the interface request name;

[0074] ②Request time: The interface request timestamp is generated using JavaScript's built-in function new Date, using timestamp = new Date().getTime(). This timestamp represents the total number of seconds from 00:00:00 Greenwich Mean Time (08:00:00 Beijing Time) on January 1, 1970, to the present. It is a complete and verifiable record of the existence of a piece of data at a specific point in time.

[0075] ③ Parameter string set: All parameters for the GET and POST methods (GET parameters are those that follow the request URL, and POST parameters are those passed in the body). Parameters are concatenated in the format key1 = value1 & key2 = value2, and the concatenated strings are arranged in lexicographical order. For example, {"b":1,"a":2} is formatted as a = 2 & b = 1 for encryption.

[0076] ④ Platform Type: WeChat Mini Programs use wx, PCs use web, and H5 uses h5. This field can be modified by different platforms when calling the interface. For example, when running a mini program, the field uploads wx, PCs use web, and the same applies to h5. The platform to run on is pre-set during development, so it can be fixed directly in the code.

[0077] The overall execution code is as follows:

[0078] Sort params by key in a dictionary to form a string like key1=value1&key2=value2...

[0079]

[0080] For steps S102 and S103, after obtaining the encryption key-value pair, it is re-encrypted using a symmetric encryption algorithm, such as AES (Advanced Encryption Standard), DES (Data Encryption Standard), TripleDES, IDEA (Triple Data Encryption Algorithm), PBE (Public Beta Environment, password-based encryption), etc.

[0081] Use a symmetric encryption algorithm to re-encrypt the encryption key and encrypted value generated in the above two steps to obtain token = encrypt(value, key). AES encryption is preferred in this solution.

[0082] The specific encryption execution code is as follows:

[0083]

[0084]

[0085] M-Agent detects agent information, including channel / package name / platform type / system platform / system version / resolution / client unique identifier / request timestamp / token, such as "xxxxxx.xx.xxx / xxx.xx.xxxxxx / xx / xxxx / xxxxxxx / x / xxxxxxxxxx / xxxxxxxxxxxxxxxxxxxxxxxx", where:

[0086] ①xxxxxx.xx.xxx is the channel name, a fixed value;

[0087] ②xxx.xx.xxxxxx is the package name, a fixed value;

[0088] ③xx is the platform name, which represents the mini program here. If it is a PC terminal, it can be uploaded to the web. It is also a fixed value written during development;

[0089] ④xxxx is the system platform, Android for Android devices and iOS for Apple devices. This value is obtained based on the host model;

[0090] ⑤x.xx system version, obtained according to the host model;

[0091] ⑥xxxxxxx resolution, in px, the screen resolution of the host phone;

[0092] ⑦x uuid, here it is fixed to 0;

[0093] ⑧xxxxxxxx, the timestamp of the request, i.e. the time of the request. This time is the total number of seconds from 00:00:00 Greenwich Mean Time (08:00:00 Beijing Time) on January 1, 1970 to the present. Therefore, it is a unique value.

[0094] ⑨xxxxxxxxxxxxxxxxxxxxxxxxxxxx, token value (i.e. token, a string used for encryption and decryption) is the most important indicator of interface security implementation and the main field used for encryption and decryption.

[0095] Therefore, the three parameters (channel, package name, and platform name) are fixed values written into the code. The three parameters (system version, resolution, and client unique identifier) can be obtained in WeChat mini-programs through the wx.getSystemInfo API. In browsers, they can be obtained through navigator.userAgent. Therefore, information such as channel, package name, platform type, system platform, system version, resolution, and client unique identifier does not require interface validation and is only used for information reporting, so we will not explain them in detail.

[0096] The M-Agent information is placed in the request header, and a call interface request for adding the M-Agent information is obtained and sent to the server for processing.

[0097] In the method provided in the above embodiment, the front-end and back-end adopt certain rules to encrypt the request parameters such as the timestamp in the call interface request to agree on an M-Agent field and put it in the http / https request header. The M-agent information cannot be used after it is used once, which can effectively prevent fraud.

[0098] See also Figure 2 , shows a flow chart of an interface security verification method according to an embodiment of the present invention, including the following steps:

[0099] S201: The server receives an interface calling request transmitted by the client, and extracts detection agent information and request parameters from a request header of the interface calling request;

[0100] S202: Generate a first encryption key-value pair according to the request parameter, and decrypt the detection agent information to obtain an encryption token and decrypt it to obtain a second encryption key-value pair;

[0101] S203: Compare the first encryption key-value pair and the second encryption key-value pair to see if they are the same;

[0102] S204: If the comparison results are the same, triggering the processing of the calling interface request, and returning a response result to the client;

[0103] S205: Otherwise, return token verification error information to the client.

[0104] In the above implementation, for step S201, the server receives the interface calling request transmitted by the client, and the request header of the request contains M-Agent information and request parameters, such as the first request timestamp, the first interface name, the first parameter string set and the first platform type. All of this information can be extracted from the request.

[0105] In step S202, consistent with the client's method for generating key-value pairs, the encryption rule for generating the first encryption key is as follows: convert the first request timestamp into binary, extract a preset number of binary digits (31 digits from back to front or vice versa), invert the extracted binary digits, and convert them to decimal to obtain the decimal encryption key. In practice, the encryption key can also be generated based on a random number generated by JavaScript or Java, and then using a specific encryption rule. The length of the encryption key is consistent with the client's requirements.

[0106] The first request timestamp, first interface name, first parameter string set, and first platform type in the request parameters are concatenated in sequence using the character "-" (this is just an example; other characters are also possible) and encrypted with MD5 to generate an encrypted value. The specific format is MD5(first interface name - first request timestamp - first parameter string set - first platform type). It should be noted that there is no limit on the number of parameters in the encrypted value. For example, the first interface name can be concatenated twice, and the meaning and execution code of each parameter are consistent with those on the client.

[0107] The M-Agent information in the request header is disassembled to obtain the encrypted token, the first request timestamp, and the first specific parameter (such as channel / package name / platform type / system platform / system version / resolution / client unique identifier). The encrypted token is symmetrically decrypted using the decryption method corresponding to the client encryption method (such as AES) to obtain the second encryption key-value pair.

[0108] In addition, the M-Agent information also includes the first request timestamp, so the first encryption key can be directly generated based on the encryption rule for the first request timestamp in the M-Agent information.

[0109] For steps S203 to S205, the first key-value pair and the second key-value pair are compared. If the values are equal, the call interface request is processed and the response data is returned to the client. Otherwise, a "token verification error" is returned to the client.

[0110] The method provided in the above embodiment realizes interface security monitoring by agreeing on an encryption and decryption rule at the front and back ends, setting the M-Agent field in the http / https request header for verification, and judging whether the decrypted information is consistent with the information generated by the client based on the parameters.

[0111] The embodiment of the present invention provides a defense solution that sets encryption and decryption rules between the front-end and back-end, and sets the M-Agent field in the http / https request header for verification, so as to solve the problem of gray market forging users to maliciously call interfaces for profit. It also has the following beneficial effects:

[0112] 1) Verification can be performed before the server processes the call interface request, rather than remediation after the interface is called, as in the case of IP restriction;

[0113] 2) It can achieve cross-terminal unification of Web and App without involving the acquisition of underlying permissions on the mobile phone, and has strong versatility.

[0114] 3) No additional expenditure is required. For example, SMS verification codes require a certain amount of financial support, and M-agent information cannot be used after being used once, which can effectively prevent fraud.

[0115] See also Figure 3 , which shows a schematic diagram of the main modules of an interface security control device 300 provided by an embodiment of the present invention, including:

[0116] The monitoring module 301 is configured to intercept the interface calling request sent by the client to the server when monitoring the interface calling action of the client, and generate an encryption key-value pair according to the request parameters of the interface calling request; wherein the request parameters include the request timestamp;

[0117] An encryption module 302 is configured to perform symmetric encryption on the encryption key-value pair to obtain an encryption token, and sequentially concatenate the encryption token, the request timestamp, and specific parameters to generate detection agent information;

[0118] The transmission module 303 is configured to add the detection agent information to the request header of the calling interface request, and transmit the calling interface request including the detection agent information to the server for processing.

[0119] In the implementation device of the present invention, the request parameters also include an interface name, a parameter string set, and a platform type;

[0120] The monitoring module 301 is configured to: process the request timestamp based on a preset encryption rule to obtain an encryption key name;

[0121] The interface name, the request timestamp, the parameter character string set and the platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain an encryption key value.

[0122] In the embodiment of the present invention, the monitoring module 301 is used to:

[0123] The request timestamp is converted into a binary form, a preset number of binary numbers are intercepted, the intercepted binary numbers are inverted and converted into a decimal form to obtain an encryption key name.

[0124] See also Figure 4 , which shows a schematic diagram of the main modules of an interface security verification device 400 provided by an embodiment of the present invention, including:

[0125] Extraction module 401 is used for receiving the calling interface request transmitted by the client at the server end, and extracting the detection agent information and request parameters from the request header of the calling interface request;

[0126] A decryption module 402 is configured to generate a first encryption key-value pair according to the request parameters, and to decrypt the detection agent information to obtain an encrypted token and obtain a second encryption key-value pair;

[0127] Processing module 403 is used to compare whether the first encryption key-value pair and the second encryption key-value pair are the same. If the comparison results are the same, it triggers the processing of the calling interface request and returns the response result to the client; otherwise, it returns a token verification error message to the client.

[0128] In the implementation device of the present invention, the request parameters include a first request timestamp, a first interface name, a first parameter string set, and a first platform type;

[0129] The decryption module 402 is configured to process the first request timestamp based on a preset encryption rule to obtain a first encryption key name;

[0130] The first interface name, the first request timestamp, the first parameter string set, and the first platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain a first encryption key value.

[0131] In the implementation device of the present invention, the decryption module 402 is used to: convert the first request timestamp into binary form, intercept a preset number of binary numbers, invert the intercepted binary numbers and convert them into decimal form to obtain a first encryption key name.

[0132] In addition, the specific implementation content of the device in the embodiment of the present invention has been described in detail in the above method, so the repeated content will not be described again here.

[0133] Figure 5 An exemplary system architecture 500 is shown in which embodiments of the present invention may be applied.

[0134] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, and 503, a network 504, and a server 505 (only as an example). Network 504 is used to provide a medium for communication links between terminal devices 501, 502, and 503 and server 505. Network 504 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0135] Users can use terminal devices 501, 502, 503 to interact with server 505 via network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503.

[0136] The terminal devices 501 , 502 , and 503 may be various electronic devices having display screens and supporting web browsing, and the server 505 may be a server providing various services.

[0137] It should be noted that the method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the device is generally set in the server 505 .

[0138] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0139] Reference below Figure 6 , which shows a schematic structural diagram of a computer system 600 of a terminal device suitable for implementing an embodiment of the present invention. Figure 6 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0140] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage unit 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the system 600 are also stored in the RAM 603. The CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0141] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, and the like; an output section 607 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN card or a modem. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 610 as needed, so that computer programs read therefrom can be installed into the storage section 608 as needed.

[0142] In particular, according to the embodiments disclosed in the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from a removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are performed.

[0143] It should be noted that the computer-readable medium described in the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0145] The modules described in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be provided within a processor. For example, a processor may be described as including a monitoring module, an encryption module, and a transmission module. The names of these modules do not, in some cases, limit the modules themselves. For example, an encryption module may also be described as a "token encryption module."

[0146] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiments, or may exist independently without being incorporated into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the device, the device includes:

[0147] When monitoring the client's call interface action, intercept the call interface request sent by the client to the server, and generate an encryption key-value pair according to the request parameters of the call interface request; wherein the request parameters include a request timestamp;

[0148] Performing symmetric encryption on the encryption key-value pair to obtain an encryption token, and sequentially concatenating the encryption token, the request timestamp, and specific parameters to generate detection agent information;

[0149] The detection agent information is added to the request header of the calling interface request, and the calling interface request containing the detection agent information is transmitted to the server for processing.

[0150] The embodiment of the present invention provides a defense solution that sets encryption and decryption rules between the front-end and back-end, and sets the M-Agent field in the http / https request header for verification, so as to solve the problem of gray market forging users to maliciously call interfaces for profit. It also has the following beneficial effects:

[0151] 1) Verification can be performed before the server processes the call interface request, rather than remediation after the interface is called, as in the case of IP restriction;

[0152] 2) It can achieve cross-terminal unification of Web and App without involving the acquisition of underlying permissions on the mobile phone, and has strong versatility.

[0153] 3) No additional expenditure is required. For example, SMS verification codes require a certain amount of financial support, and M-agent information cannot be used after being used once, which can effectively prevent fraud.

[0154] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. An interface security control method, characterized in that: include: When a client's interface call action is detected, the client's interface call request sent to the server is intercepted, and an encryption key-value pair is generated based on the request parameters of the interface call request; wherein the request parameters include a request timestamp, an interface name, a parameter string set, and a platform type, and the encryption key value is generated based on the request parameters; the encryption key name is obtained by processing the request timestamp, and the processing process includes: converting the request timestamp into binary form, intercepting a preset number of binary numbers, inverting the intercepted binary numbers, and converting them into decimal form; Performing symmetric encryption on the encryption key-value pair to obtain an encryption token, and sequentially concatenating the encryption token, the request timestamp, and specific parameters to generate detection agent information; wherein the specific parameters include channel, package name, platform type, system platform, system version, resolution, and client unique identifier; The detection agent information is added to the request header of the calling interface request, and the calling interface request containing the detection agent information is transmitted to the server for processing; wherein, the server generates a first encryption key-value pair based on the request parameters in the calling interface request, and at the same time decrypts the encrypted token in the detection agent information to obtain a second encryption key-value pair, and compares the first encryption key-value pair and the second encryption key-value pair.

2. The method according to claim 1, characterized in that Generating an encryption key-value pair according to the request parameters of the calling interface request includes: Processing the request timestamp based on a preset encryption rule to obtain an encryption key name; The interface name, the request timestamp, the parameter character string set and the platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain an encryption key value.

3. An interface security verification method, characterized in that: include: The server receives a call interface request transmitted by the client, and extracts detection agent information and request parameters from a request header of the call interface request; wherein the call interface request is obtained by processing according to claim 1 or 2; the request parameters include a first request timestamp, a first interface name, a first parameter string set, and a first platform type; Generate a first encryption key-value pair based on the request parameters, and disassemble the detection agent information to obtain an encryption token and decrypt it to obtain a second encryption key-value pair; wherein the encryption key value in the first encryption key-value pair is generated based on the request parameters, and the encryption key name is obtained by processing the request timestamp, and the processing process includes: converting the first request timestamp into binary form, intercepting a preset number of binary numbers, inverting the intercepted binary numbers and converting them into decimal form; Compare the first encryption key-value pair and the second encryption key-value pair to see if they are the same. If the comparison results are the same, trigger the processing of the calling interface request and return the response result to the client; otherwise, return the token verification error information to the client.

4. The method according to claim 3, characterized in that Generating a first encryption key-value pair according to the request parameter includes: Processing the first request timestamp based on a preset encryption rule to obtain a first encryption key name; The first interface name, the first request timestamp, the first parameter string set, and the first platform type are sequentially concatenated, and the concatenated information is processed using an information digest algorithm to obtain a first encryption key value.

5. An interface security control device, characterized in that: include: A monitoring module is configured to, upon detecting a client's interface call action, intercept a client's interface call request sent to a server, and generate an encryption key-value pair based on request parameters of the interface call request; wherein the request parameters include a request timestamp, an interface name, a parameter string set, and a platform type, and the encryption key is generated based on the request parameters; the encryption key is obtained by processing the request timestamp, and the processing process includes: converting the request timestamp into binary form, intercepting a preset number of binary digits, inverting the intercepted binary digits, and converting them into decimal form; An encryption module, configured to perform symmetrical encryption on the encryption key-value pair to obtain an encryption token, and sequentially concatenate the encryption token, the request timestamp, and specific parameters to generate detection agent information; wherein the specific parameters include channel, package name, platform type, system platform, system version, resolution, and client unique identifier; A transmission module is used to add the detection agent information to the request header of the calling interface request, and transmit the calling interface request containing the detection agent information to the server for processing; wherein, the server generates a first encryption key-value pair based on the request parameters in the calling interface request, and at the same time decrypts the encrypted token in the detection agent information to obtain a second encryption key-value pair, and compares the first encryption key-value pair and the second encryption key-value pair.

6. An interface security verification device, characterized in that: include: An extraction module, configured to receive, at a server side, a call interface request transmitted by a client, and extract detection agent information and request parameters from a request header of the call interface request; wherein the call interface request is obtained by processing according to claim 5; and the request parameters include a first request timestamp, a first interface name, a first parameter string set, and a first platform type; a decryption module, configured to generate a first encryption key-value pair based on the request parameters, and to decrypt the detection agent information to obtain an encryption token and obtain a second encryption key-value pair; wherein the encryption key value in the first encryption key-value pair is generated based on the request parameters, and the encryption key name is obtained by processing the request timestamp, the processing process comprising: converting the first request timestamp into binary form, intercepting a preset number of binary digits, inverting the intercepted binary digits, and converting them into decimal form; A processing module is used to compare whether the first encryption key-value pair and the second encryption key-value pair are the same. If the comparison results are the same, it triggers the processing of the calling interface request and returns the response result to the client; otherwise, it returns a token verification error message to the client.

7. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

8. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images