API interface authentication method and system

Abstract

The invention discloses an API interface authentication method and system. The method comprises the following steps: receiving an HTTP request initiated by an API interface caller client, determining the identity of the client, and generating a public request parameter and a signature value; the HTTP request is provided with the public request parameter and the signature value pre-generated by the API interface caller client; comparing the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, determining whether a signature unique random number SignNonce exists; if not, determining whether a request timestamp Timestamp exceeds a set time range from the current time; if not, responding to the request, caching all signature unique random numbers SignNonce, and setting a cache period; recording an API interface call log, identifying the caller identity according to the public request parameter and an encryption protocol, ensuring call security, and preventing network attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of API interface authentication, and in particular to an API interface authentication method and system. Background Art

[0002] The statements in this section merely mention background art related to the present invention and do not necessarily constitute prior art.

[0003] WEB programs are transmitted using the HTTP protocol, which is a stateless protocol and has no memory for transaction processing. The lack of state means that if the subsequent request processing requires the previous information, it must be retransmitted, which may increase the amount of data transmitted for each connection. The traditional authentication method is that the client requests the login interface, and the server determines who is requesting the login based on the information of the login interface, and then generates a token indicating the identity of the requester, which is cached on the server, namely the Session. At the same time, the server needs to notify the client to remember the ID of this token. When the client makes subsequent requests, it carries this token, and the server can know who is requesting.

[0004] Obviously, this technology relies on the server's session extreme value. In a distributed system, since there may be multiple servers and the sessions are independent of each other, it cannot be used. In addition, if the token is obtained by other parties, it will leave unsafe risks. Summary of the invention

[0005] In order to solve the deficiencies of the prior art, the present invention provides an API interface authentication method and system; the identity of the caller can be identified based on public request parameters and encryption protocols, the call security can be ensured, and network attacks can be prevented.

[0006] In a first aspect, the present invention provides an API interface authentication method;

[0007] An API interface authentication method, applied to a server, comprising:

[0008] Receive an HTTP request initiated by an API interface caller client, determine the identity of the API interface caller client, and generate public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0009] Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to the next step; if the comparison result is different, reject the request;

[0010] Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to the next step;

[0011] Determine whether the timestamp of the request is beyond the set time range from the current time; if yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log.

[0012] In a second aspect, the present invention provides a server;

[0013] A server configured to:

[0014] Receive an HTTP request initiated by an API interface caller client, determine the identity of the API interface caller client, and generate public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0015] Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to the next step; if the comparison result is different, reject the request;

[0016] Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to the next step;

[0017] Determine whether the timestamp of the request is beyond the set time range from the current time; if yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log.

[0018] In a third aspect, the present invention provides an API interface authentication system;

[0019] An API interface authentication system, comprising: a server and an API interface caller client;

[0020] The API interface caller client initiates an HTTP request to the server; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0021] The server receives the HTTP request initiated by the API interface caller client, determines the identity of the API interface caller client, and generates public request parameters and signature values;

[0022] The server compares the signature value generated by the server with the signature value transmitted by the client. If the comparison results are the same, it determines whether the unique random number SignNonce exists. If the comparison results are different, the request is rejected.

[0023] The server determines whether the unique random number SignNonce exists. If yes, the request is rejected. If no, the server determines whether the timestamp of the request is beyond the set time range from the current time.

[0024] The server determines whether the timestamp of the request is beyond the set time range from the current time; if so, the request is rejected; if not, the request is responded to, all signature unique random numbers SignNonce are cached, and the cache period is set; the API interface call log is recorded.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The present invention can solve the authentication and authorization problems of interface calls.

[0027] 2. The authentication method of the present invention can avoid the login operation of traditional Token authentication.

[0028] 3. The authentication method of the present invention can ensure that the identity of the caller is not stolen.

[0029] 4. The authentication method of the present invention can resist network attacks.

[0030] 5. The supervision method of the present invention can quickly assist the caller to locate the problem in a timely manner.

[0031] 6. The monitoring method of the present invention can timely discover the leakage of AccessSecret.

[0032] Advantages of additional aspects of the present invention will be partially given in the following description or learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0034] Figure 1 This is a schematic diagram of the internal structure of HTTP in the first embodiment;

[0035] Figure 2 is a system architecture diagram of the third embodiment;

[0036] Figure 3 This is a flow chart of the method of the first embodiment. DETAILED DESCRIPTION

[0037] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0038] It should be noted that the terms used herein are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that the terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0039] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0040] In this embodiment, all data is obtained in compliance with laws and regulations and based on the user's consent, and is used legally.

[0041] Terminology explanation:

[0042] API interface: API (Application Programming Interface) is a set of predefined interfaces (such as functions, HTTP interfaces) used to provide a set of programs that applications and developers can access based on certain software or hardware without having to access the source code or understand the details of the internal working mechanism.

[0043] Request line, request body:

[0044] The HTTP request format is as follows, including: request line, request header, request body, Figure 1 The request data is the request body.

[0045] UUID: UUID is the abbreviation of Universally Unique Identifier. Its purpose is to allow all elements in a distributed system to have unique identification information. In this way, everyone can create a UUID that does not conflict with others.

[0046] RFC3986: RFC3986 is a URL encoding principle, which aims to use safe characters (printable characters with no special purpose or special meaning) to represent unsafe characters; at the same time, characters that affect URL understanding (such as =: and other characters) and Chinese characters that appear in request parameters are all included in the encoding.

[0047] HTTP (HyperText Transfer Protocol) request: refers to the request message from the client to the server. The first line of the message includes: the request method for the resource, the resource identifier, and the protocol used.

[0048] API (Application Program Interface) interface: It is a calling interface left by the operating system to the application program. The application program makes the operating system execute the application program's commands by calling the operating system's API.

[0049] Embodiment 1

[0050] This embodiment provides an API interface authentication method;

[0051] like Figure 3 As shown, an API interface authentication method is applied to a server, including:

[0052] S101: receiving an HTTP request initiated by an API interface caller client, determining the identity of the API interface caller client, and generating public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0053] S102: Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to S103; if the comparison result is different, reject the request;

[0054] S103: Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to S104;

[0055] S104: Determine whether the timestamp of the request is beyond the set time range from the current time; if yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log.

[0056] Furthermore, the method S101 receives an HTTP request initiated by an API interface caller client; and also includes:

[0057] A paired access key number "AccessID" and access key "AccessSecret" are issued to each authorized API interface caller client; the "AccessID" received by each API interface caller client is different from the "AccessID" received by other API interface caller clients; the "AccessSecret" received by each API interface caller client is different from the "AccessSecret" received by other API interface caller clients.

[0058] Furthermore, the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; specifically including:

[0059] The API interface caller client receives and stores the "AccessID" and "AccessSecret" issued by the server;

[0060] The API interface caller client retrieves the "AccessID" and "AccessSecret" issued by the server;

[0061] The API interface caller client generates public request parameters and signature values ​​according to the public request parameter string generation method and signature method.

[0062] Furthermore, the S101: receiving an HTTP request initiated by an API interface caller client, determining the identity of the API interface caller client, and generating public request parameters and signature values; specifically includes:

[0063] Receive HTTP requests initiated by API interface caller clients;

[0064] Determine the caller's identity based on the plain text parameter "AccessID" in the public request parameters;

[0065] According to the caller's identity, obtain the corresponding "AccessSecret";

[0066] Use "AccessID" and "AccessSecret" to generate public request parameters and signature values ​​according to the public request parameter string generation method and signature method.

[0067] Furthermore, the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; the position setting of the public request parameters in the HTTP request includes one of the following situations:

[0068] For HTTP requests without a request body, the common request parameters are concatenated after the request parameters of the request line of the HTTP request;

[0069] For HTTP requests with a request body, concatenate the common request parameters onto the request line;

[0070] For HTTP requests that already have request parameters, the common request parameters are concatenated after the existing request parameters.

[0071] For example, for HTTP requests without a request body (such as a GET request), the common request parameters are concatenated after the request parameters on the request line; for HTTP requests with a request body (such as a POST request), the common request parameters are concatenated on the request line and do not affect the content of the request body. If the request has request parameters, they are concatenated after the request parameters.

[0072] POST request example:

[0073] POST / openapi / v1 / user? Public request parameter string HTTP / 1.1

[0074] Host:localhost

[0075] User-Agent:Mozilla / 5.0(windows NT 6.1;Win64;x64;rv:60.o)Gecko / 20100101Firefox / 60.0

[0076] Accept:text / html,application / xhtml+xml,application / xml; q=0.9,* / *; q=0.8

[0077] Accept-Language:zh-CN,zh; q=0.8,zh-Tw; q=0.7,zh-HK; q=0.5,en-US; q=0.3,en; q=0.2

[0078] Accept-Encoding:gzip,defiate

[0079] Referer:http: / / localhost / login.html

[0080] Connection: keep alive

[0081] Upgrade-Insecure-Requests:1

[0082] username=zhangsan&publisher=Wiley

[0083] Example of a GET request:

[0084] GET / openapi / v1 / user?id=xxxxxx&public request parameter string HTTP / 1.1

[0085] Host:localhost

[0086] User-Agent:Mozilla / 5.0(windows NT 6.1;Win64;x64;rv:60.o)Gecko / 20100101Firefox / 60.0

[0087] Accept:text / html,application / xhtml+xml,application / xml; q=0.9,* / *; q=0.8

[0088] Accept-Language:zh-CN,zh; q=0.8,zh-Tw; q=0.7,zh-HK; q=0.5,en-US; q=0.3,en; q=0.2

[0089] Accept-Encoding:gzip,defiate

[0090] Referer:http: / / localhost / login.html

[0091] Connection: keep alive

[0092] Upgrade-Insecure-Requests:1

[0093] Furthermore, the public request parameters and signature values ​​are generated according to the public request parameter string generation method and signature method; wherein the public request parameter generation step includes:

[0094] S1011: Set public request parameters, including: access key ID, signature value, signature method, signature algorithm version, signature unique random number and request timestamp;

[0095] S1012: Sort the other public request parameters except the signature value in alphabetical order;

[0096] S1013: Encode the sorted common request parameters and their values;

[0097] S1014: Connect the encoded common request parameters and the values ​​of the common request parameters to obtain a request parameter pair; concatenate the request parameter pair to obtain a concatenated string;

[0098] S1015: Encrypt the concatenated character string, and encode the encryption result to obtain a signature value;

[0099] S1016: Add the signature value to the end of the concatenated string to obtain the final public request parameter.

[0100] Table 1 List of common request parameters

[0101]

[0102] Exemplarily, the S1012: sorting other public request parameters except the signature value in alphabetical order; specifically includes:

[0103] Sort the public request parameters. Sort in alphabetical order. The sorting parameters are the public request parameters, excluding the Sign parameter in the public request parameters, a total of 5. The signature unique random number SignNonce must be UUID to ensure that the request is not repeated. The effect after sorting is as follows:

[0104] AccessID=320299f45851

[0105] SignMethod = HMAC-SHA1

[0106] SignNonce=223778d6-10de-4de9-b5a0-a740b8142797

[0107] SignVersion=1.0

[0108] Timestamp=2021-04-15T12:00:00Z

[0109] Furthermore, the step S1013: encoding the sorted common request parameters and the values ​​of the common request parameters refers to:

[0110] The sorted common request parameters and their values ​​are encoded using the UTF-8 character set in accordance with the RFC3986 encoding specification.

[0111] Furthermore, the step S1014: connecting the encoded common request parameters and the values ​​of the common request parameters to obtain a request parameter pair; and concatenating the request parameter pair to obtain a concatenated string; specifically includes:

[0112] For the encoded common request parameters and the values ​​of the common request parameters, the equal sign "=" is used to connect them to obtain a request parameter pair; the ampersand "&" is used to splice the request parameter pair to obtain a spliced ​​string; during the splicing process, the splicing order is ensured to be consistent with the sorting order in S1012.

[0113] Exemplarily, an equal sign (=) is used to connect the encoded request parameter and parameter value, and an ampersand (&) is used to connect the encoded request parameter pair.

[0114] Effect after splicing:

[0115] AccessID=320299f45851&SignatureMethod=HMAC-SHA1&SignatureNonce=223778d6-10de-4de9-b5a0-a740b8142797&SignatureVersion=1.0&Timestamp=2021-04-15T12%3A00%3A00Z

[0116] Furthermore, the S1015: encrypting the concatenated character string and encoding the encryption result to obtain a signature value; specifically includes:

[0117] The concatenated string is encrypted using the encryption algorithm specified by the signature method, and the encrypted result is encoded using the Base64 encoding method.

[0118] For example, the string is encrypted using the encryption algorithm specified by SignMethod and then Base64 encoded. The encryption key is the concatenation of AccessSecret & AccessID.

[0119] If AccessID = 320299f45851, and

[0120] AccessSecret=b6264e36-6f4d-4bf5-98f4-b4ac2248321d,

[0121] The encryption key is b6264e36-6f4d-4bf5-98f4-b4ac2248321d&320299f45851.

[0122] The calculated signature value (Sign) is:

[0123] MTk2ODNhMWMwZDQ5MTg5MzJjZGJlZTBhMTZkZTk5MWI2OGZmZWIzNQ==

[0124] Exemplarily, the step S1016: splicing the signature value to the end of the spliced ​​string to obtain the final public request parameter specifically includes:

[0125] Use the equal sign (=) to connect the request parameters and parameter values ​​before encoding, and use the ampersand (&) to connect the request parameter pairs before encoding. Note that the request parameters are all public request parameters, among which the parameter value of Sign is the signature value. Generate a public request parameter string as follows:

[0126] AccessID=320299f45851&SignMethod=HMAC-SHA1&SignNonce=223778d6-10de-4de9-b5a0-a740b8142797&SignVersi on=1.0&Timestamp=2021-04-15T12:00:00Z&Sign=MTk2ODNhMWMwZDQ5MTg5MzJjZGJlZTBhMTZkZTk5MWI2OGZmZWIzNQ==

[0127] Furthermore, the step S101: receiving an HTTP request initiated by an API interface caller client and determining the identity of the API interface caller client specifically includes:

[0128] The server receives the HTTP request, determines the identity of the API caller client based on the access key ID (AccessID) in the request line of the HTTP request, and obtains the corresponding AccessSecret.

[0129] Exemplarily, S104: determining whether the requested timestamp is beyond a set time range from the current time; specifically including:

[0130] The server checks whether the Timestamp is more than ±1 day away from the current time. If not, the request is rejected to prevent network attacks.

[0131] The server needs to cache all SignNonce, and the cache period is 1 day.

[0132] Since SignNonce requires each request to be different, the generated Sign is also different. Therefore, it can prevent impersonation after the request is intercepted.

[0133] Furthermore, the cache time of the SignNonce should not be shorter than the verification time of the Timestamp.

[0134] Furthermore, the API interface call log includes: access key ID, API interface caller client identity, call request time, call interface name, HTTP status code, HTTP request line, HTTP request body, HTTP response body, requestId, success, signature unique random number SignNonce and / or error code, etc. Record API interface call logs to timely discover security risks and cooperate with the caller to troubleshoot problems.

[0135] Statistics are made on multiple dimensions such as "calling interface name", "SignNonce", "HTTP status code", "error code" and so on for different callers, so as to timely identify the security risks of "AccessSecret" leakage.

[0136] Furthermore, the server is provided with an identity authentication module, which randomly generates an "AccessID" and "AccessSecret" pair and provides it to the authorized API caller. Different callers have different "AccessID" and "AccessSecret". The identity authentication module needs to record the "AccessID", "AccessSecret" and the provided caller identity information. The AccessID is used to identify the user identity, and the "AccessSecret" needs to be kept secret by the caller and is used to encrypt the request text;

[0137] Table 2 API interface corresponding specifications

[0138]

[0139]

[0140] Embodiment 2

[0141] This embodiment provides a server;

[0142] A server configured to:

[0143] Receive an HTTP request initiated by an API interface caller client, determine the identity of the API interface caller client, and generate public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0144] Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to the next step; if the comparison result is different, reject the request;

[0145] Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to the next step;

[0146] Determine whether the timestamp of the request is beyond the set time range from the current time; if yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log.

[0147] The technical implementation details of each step in the second embodiment are consistent with those in the first embodiment and will not be repeated here.

[0148] Embodiment 3

[0149] This embodiment provides an API interface authentication system;

[0150] like Figure 2 As shown, an API interface authentication system includes: a server and an API interface caller client;

[0151] The API interface caller client initiates an HTTP request to the server; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client;

[0152] The server receives the HTTP request initiated by the API interface caller client, determines the identity of the API interface caller client, and generates public request parameters and signature values;

[0153] The server compares the signature value generated by the server with the signature value transmitted by the client. If the comparison results are the same, it determines whether the unique random number SignNonce exists. If the comparison results are different, the request is rejected.

[0154] The server determines whether the unique random number SignNonce exists. If yes, the request is rejected. If no, the server determines whether the timestamp of the request is beyond the set time range from the current time.

[0155] The server determines whether the timestamp of the request is beyond the set time range from the current time; if so, the request is rejected; if not, the request is responded to, all signature unique random numbers SignNonce are cached, and the cache period is set; the API interface call log is recorded.

[0156] The technical implementation details of each step in the third embodiment are consistent with those in the first embodiment and will not be repeated here.

[0157] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An API interface authentication method, characterized in that: Applicable to servers, including: Receive an HTTP request initiated by an API interface caller client, determine the identity of the API interface caller client, and generate public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to the next step; if the comparison result is different, reject the request; Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to the next step; Determine whether the timestamp of the request is beyond the set time range from the current time; if yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log; The receiving of the HTTP request initiated by the API interface caller client, determining the identity of the API interface caller client, and generating public request parameters and signature values ​​specifically includes: Receive HTTP requests initiated by API interface caller clients; Determine the caller's identity based on the plain text parameter "AccessID" in the public request parameters; According to the caller's identity, obtain the corresponding "AccessSecret"; Use "AccessID" and "AccessSecret" to generate public request parameters and signature values ​​according to the public request parameter string generation method and signature method; The receiving of the HTTP request initiated by the API interface caller client also includes: Issue the paired access key number "AccessID" and access key "AccessSecret" to each authorized API interface caller client; AccessID is used to identify the user identity, and "AccessSecret" needs to be kept secret by the caller and is used to encrypt the request text; The public request parameter string generation method and the signature method are used to generate the public request parameter and the signature value; wherein the public request parameter generation step includes: Set public request parameters, including: access key ID, signature value, signature method, signature algorithm version, signature unique random number and request timestamp; Sort the public request parameters except the signature value in alphabetical order; Encoding the sorted common request parameters and the values ​​of the common request parameters; The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are concatenated to obtain a concatenated string; Encrypt the concatenated string, and then encode the encrypted result to obtain the signature value; Add the signature value to the end of the concatenated string to get the final public request parameter. The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are spliced ​​to obtain a spliced ​​string; specifically including: The encoded common request parameters and the values ​​of the common request parameters are connected by an equal sign "=" to obtain a request parameter pair; and the request parameter pair is concatenated by an ampersand "&" to obtain a concatenated string; The concatenated character string is encrypted, and the encrypted result is encoded to obtain a signature value; specifically, the following steps are performed: The concatenated string is encrypted using the encryption algorithm specified by the signature method, and the encrypted result is encoded using the Base64 encoding method; the encryption key is AccessSecret concatenation & AccessID concatenation; Add the signature value to the end of the concatenated string to get the final public request parameters, including: Use the equal sign = to connect the request parameter and parameter value before encoding, and use the ampersand & to connect the request parameter pair before encoding. Note that the request parameters are all public request parameters, among which the parameter value of Sign is the signature value; The HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; the location setting of the public request parameters in the HTTP request includes one of the following situations: For HTTP requests without a request body, the common request parameters are concatenated after the request parameters of the request line of the HTTP request; For HTTP requests with a request body, concatenate the common request parameters onto the request line; For HTTP requests with existing request parameters, concatenate the common request parameters after the existing request parameters; The API interface call log includes: access key ID, API interface caller client identity, call request time, call interface name, HTTP status code, HTTP request line, HTTP request body, HTTP response body, requestId, success, signature unique random number SignNonce and / or error code; statistics are made on multiple dimensions of different callers.

2. The API interface authentication method according to claim 1, characterized in that: The receiving of the HTTP request initiated by the API interface caller client also includes: The "AccessID" received by each API interface caller client is different from the "AccessID" received by other API interface caller clients; the "AccessSecret" received by each API interface caller client is different from the "AccessSecret" received by other API interface caller clients.

3. The API interface authentication method according to claim 1, characterized in that: The HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; specifically including: The API interface caller client receives and stores the "AccessID" and "AccessSecret" issued by the server; The API interface caller client retrieves the "AccessID" and "AccessSecret" issued by the server; The API interface caller client generates public request parameters and signature values ​​according to the public request parameter string generation method and signature method.

4. The API interface authentication method according to claim 1, characterized in that: Encoding the sorted common request parameters and their values; refers to: The sorted common request parameters and their values ​​are encoded using the UTF-8 character set in accordance with the RFC3986 encoding specification.

5. A server, characterized in that: It is configured as: Receive an HTTP request initiated by an API interface caller client, determine the identity of the API interface caller client, and generate public request parameters and signature values; the HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; Compare the signature value generated by the server with the signature value transmitted by the client; if the comparison result is the same, proceed to the next step; if the comparison result is different, reject the request; Determine whether the unique random number SignNonce exists; if yes, reject the request; if no, proceed to the next step; Determine whether the requested timestamp is beyond the set time range from the current time; If yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log; The receiving API interface caller client initiated HTTP request, determining the API interface caller client identity, generating public request parameters and signature value; Specifically include: Receive HTTP requests initiated by API interface caller clients; Determine the caller's identity based on the plain text parameter "AccessID" in the public request parameters; According to the caller's identity, obtain the corresponding "AccessSecret"; Use "AccessID" and "AccessSecret" to generate public request parameters and signature values ​​according to the public request parameter string generation method and signature method; The receiving of the HTTP request initiated by the API interface caller client also includes: Issue the paired access key number "AccessID" and access key "AccessSecret" to each authorized API interface caller client; AccessID is used to identify the user identity, and "AccessSecret" needs to be kept secret by the caller and is used to encrypt the request text; The public request parameter string generation method and the signature method are used to generate the public request parameter and the signature value; wherein the public request parameter generation step includes: Set public request parameters, including: access key ID, signature value, signature method, signature algorithm version, signature unique random number and request timestamp; Sort the public request parameters except the signature value in alphabetical order; Encoding the sorted common request parameters and the values ​​of the common request parameters; The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are concatenated to obtain a concatenated string; Encrypt the concatenated string, and then encode the encrypted result to obtain the signature value; Add the signature value to the end of the concatenated string to get the final public request parameter. The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are spliced ​​to obtain a spliced ​​string; specifically including: The encoded common request parameters and the values ​​of the common request parameters are connected by an equal sign "=" to obtain a request parameter pair; and the request parameter pair is concatenated by an ampersand "&" to obtain a concatenated string; The concatenated character string is encrypted, and the encrypted result is encoded to obtain a signature value; specifically, the following steps are performed: The concatenated string is encrypted using the encryption algorithm specified by the signature method, and the encrypted result is encoded using the Base64 encoding method; the encryption key is AccessSecret concatenation & AccessID concatenation; Add the signature value to the end of the concatenated string to get the final public request parameters, including: Use the equal sign = to connect the request parameter and parameter value before encoding, and use the ampersand & to connect the request parameter pair before encoding. Note that the request parameters are all public request parameters, among which the parameter value of Sign is the signature value; The HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; the location setting of the public request parameters in the HTTP request includes one of the following situations: For HTTP requests without a request body, the common request parameters are concatenated after the request parameters of the request line of the HTTP request; For HTTP requests with a request body, concatenate the common request parameters onto the request line; For HTTP requests with existing request parameters, concatenate the common request parameters after the existing request parameters; The API interface call log includes: access key ID, API interface caller client identity, call request time, call interface name, HTTP status code, HTTP request line, HTTP request body, HTTP response body, requestId, success, signature unique random number SignNonce and / or error code; statistics are made on multiple dimensions of different callers.

6. An API interface authentication system, characterized in that: include: Server and API interface caller client; The API interface caller client initiates an HTTP request to the server; The HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; The server receives the HTTP request initiated by the API interface caller client, determines the identity of the API interface caller client, and generates public request parameters and signature values; The server compares the signature value generated by the server with the signature value transmitted by the client. If the comparison results are the same, it determines whether the unique random number SignNonce exists. If the comparison results are different, the request is rejected. The server determines whether the unique random number SignNonce exists. If yes, the request is rejected. If no, the server determines whether the timestamp of the request is beyond the set time range from the current time. The server determines whether the requested timestamp is beyond the set time range from the current time; If yes, reject the request; if no, respond to the request, cache all signature unique random numbers SignNonce, and set the cache period; record the API interface call log; The receiving API interface caller client initiated HTTP request, determining the API interface caller client identity, generating public request parameters and signature value; Specifically include: Receive HTTP requests initiated by API interface caller clients; Determine the caller's identity based on the plain text parameter "AccessID" in the public request parameters; According to the caller's identity, obtain the corresponding "AccessSecret"; Use "AccessID" and "AccessSecret" to generate public request parameters and signature values ​​according to the public request parameter string generation method and signature method; The receiving of the HTTP request initiated by the API interface caller client also includes: Issue the paired access key number "AccessID" and access key "AccessSecret" to each authorized API interface caller client; AccessID is used to identify the user identity, and "AccessSecret" needs to be kept secret by the caller and is used to encrypt the request text; The public request parameter string generation method and the signature method are used to generate the public request parameter and the signature value; wherein the public request parameter generation step includes: Set public request parameters, including: access key ID, signature value, signature method, signature algorithm version, signature unique random number and request timestamp; Sort the public request parameters except the signature value in alphabetical order; Encoding the sorted common request parameters and the values ​​of the common request parameters; The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are concatenated to obtain a concatenated string; Encrypt the concatenated string, and then encode the encrypted result to obtain the signature value; Add the signature value to the end of the concatenated string to get the final public request parameter. The encoded common request parameters and the values ​​of the common request parameters are connected to obtain a request parameter pair; the request parameter pairs are spliced ​​to obtain a spliced ​​string; specifically including: The encoded common request parameters and the values ​​of the common request parameters are connected by an equal sign "=" to obtain a request parameter pair; and the request parameter pair is concatenated by an ampersand "&" to obtain a concatenated string; The concatenated character string is encrypted, and the encrypted result is encoded to obtain a signature value; specifically, the following steps are performed: The concatenated string is encrypted using the encryption algorithm specified by the signature method, and the encrypted result is encoded using the Base64 encoding method; the encryption key is AccessSecret concatenation & AccessID concatenation; Add the signature value to the end of the concatenated string to get the final public request parameters, including: Use the equal sign = to connect the request parameter and parameter value before encoding, and use the ampersand & to connect the request parameter pair before encoding. Note that the request parameters are all public request parameters, among which the parameter value of Sign is the signature value; The HTTP request is provided with public request parameters and signature values ​​pre-generated by the API interface caller client; the location setting of the public request parameters in the HTTP request includes one of the following situations: For HTTP requests without a request body, the common request parameters are concatenated after the request parameters of the request line of the HTTP request; For HTTP requests with a request body, concatenate the common request parameters onto the request line; For HTTP requests with existing request parameters, concatenate the common request parameters after the existing request parameters; The API interface call log includes: access key ID, API interface caller client identity, call request time, call interface name, HTTP status code, HTTP request line, HTTP request body, HTTP response body, requestId, success, signature unique random number SignNonce and / or error code; statistics are made on multiple dimensions of different callers.

Images