Control methods and devices that call application programming interfaces, storage media, electronic devices

Abstract

This invention provides a method, apparatus, storage medium, and electronic device for controlling the invocation of application programming interfaces (APIs). The method includes: determining the license information of a target application, wherein the license information includes invocation information of the target application invoking the target API; determining the constraint information of the target application invoking the target API using the license information; and controlling the application's invocation of the target API based on the constraint information. This invention solves the problem of controlling API invocation in related technologies, achieving effective filtering and interception of API permissions.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and more specifically, to a control method and apparatus for calling application programming interfaces, a storage medium, and an electronic device. Background Technology

[0002] A typical program consists of two main software modules: first, the program's core business software, primarily developed by the program's developers; and second, the Software Development Kit (SDK). The SDK contains a great deal of content, the most crucial of which is the implementation of the functional application programming interfaces (APIs) upon which the business software depends, such as binary dynamic libraries.

[0003] The same operating system (OS) and SDK support the operation of multiple business applications. Different business applications may have different functions and require different permissions from the OS and SDK APIs. For example, business1 (business 1) only needs to access the operating system's multimedia information, requiring only simple media permissions. business2 (business 2), however, needs to install its own driver on the OS, requiring much more extensive permissions.

[0004] Therefore, for the security and stability of the operating system, API access control is needed for calls from different software within the same OS SDK. However, current API access control is too simplistic, relying entirely on matching API numbers in certificates. Summary of the Invention

[0005] This invention provides a control method and apparatus for calling application programming interfaces (APIs), a storage medium, and an electronic device, to at least solve the problem of calling application programming interfaces in related technologies.

[0006] According to an embodiment of the present invention, a control method for invoking an application programming interface is provided, comprising:

[0007] Determine the license information of the target application, wherein the license information includes the call information of the target application calling the target application interface;

[0008] The above-mentioned licensing information is used to determine the constraint information for the target application to call the target application interface.

[0009] Based on the aforementioned constraint information, control the calls made by the aforementioned application to the aforementioned target application interface.

[0010] According to another embodiment of the present invention, a control device for invoking an application programming interface is provided, comprising:

[0011] The first determining module is used to determine the license information of the target application, wherein the license information includes the call information of the target application calling the target application interface;

[0012] The second determining module is used to determine the constraint information for the target application calling the target application interface using the aforementioned licensing information;

[0013] The first control module is used to control the application's calls to the target application interface based on the aforementioned constraint information.

[0014] In one exemplary embodiment, the first determining module described above includes:

[0015] The first publishing unit is used to publish certificate management services;

[0016] The first receiving unit is configured to receive the application information of the application through the certificate management service, wherein the application information is used to apply for the license information.

[0017] The first response unit is used to respond to the above application information and publish the above license information to the above target application;

[0018] The aforementioned licensing information includes at least one of the following: the identification information of the target application, the verification information used to verify the legitimacy of the target application, the level information of the target application calling the target application interface, the domain to which the target application calls the target application interface, and the domain to which the target application interface belongs includes the scope of application and business type of the target application interface.

[0019] In one exemplary embodiment, the above-described apparatus further includes:

[0020] The third determining module is used to determine the business type of the aforementioned target application;

[0021] The first invocation module is used to determine the level information of the target application calling the target application interface based on the business type of the target application.

[0022] In one exemplary embodiment, the above-described apparatus further includes:

[0023] The fourth determination module is used to determine whether the target application needs to access a high-risk application programming interface (API), wherein the development level of the high-risk API is greater than a preset threshold.

[0024] The fifth determination module is used to determine the domain to which the target application interface belongs, based on whether the target application needs to access the high-risk application interface.

[0025] In one exemplary embodiment, the second determining module described above includes:

[0026] The first determining unit is used to determine the level information of the target application interface included in the above-mentioned license information, and the domain to which the target application interface belongs.

[0027] The second determining unit is used to determine the constraint information based on the level information of the target application interface, the domain to which the target application interface belongs, and the attribute information of the target application interface.

[0028] In one exemplary embodiment, the above-described apparatus further includes:

[0029] The building module is used to determine the constraint information of the target application calling the target application interface using the above-mentioned license information, and then build the constraint information into the preset operating system.

[0030] The deployment module is used to deploy the aforementioned preset information to the target device through the aforementioned preset operating system.

[0031] In one exemplary embodiment, the first control module includes:

[0032] The third determining unit is used to determine the application identification information of the target application, wherein the application identification information is used to represent the development information of the target application;

[0033] The first search unit is used to search for the target certificate information corresponding to the above application identification information;

[0034] The second search unit is used to search for the level information of the target application interface and the domain to which the application interface belongs from the above constraint information.

[0035] The first control unit is used to control the application's invocation of the target application interface based on the target application interface's level information, the domain to which the target application interface belongs, and the target certificate information.

[0036] In one exemplary embodiment, the first control unit includes:

[0037] The first comparison subunit is used to compare the level information of the target application interface with the preset level information corresponding to the target certificate information.

[0038] The second comparison subunit is used to compare the domain to which the target application interface belongs with the preset domain corresponding to the target certificate information.

[0039] The first control subunit is configured to control the application to call the target application interface when the level information of the target application interface is a subset of the preset level information corresponding to the target certificate information, and the domain to which the target application interface belongs is a subset of the preset domain corresponding to the target certificate information.

[0040] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0041] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0042] This invention determines the license information of a target application, including call information of the target application calling a target application programming interface (API). It then uses this license information to determine constraint information for the target application calling the API. Based on this constraint information, it controls the application's calls to the API. In this process, software developers apply for license information for the target application according to the business type; if the business type remains unchanged, the license information can remain the same. When the permissions of the API change, these changes are clearly defined during the development of the software development kit (SDK), and interception occurs during API calls. Furthermore, for cases where different software developments call the same API, control and interception can be achieved through certificate development levels. Therefore, this invention solves the problem of API calls in related technologies, effectively filtering and intercepting API permissions. Attached Figure Description

[0043] Figure 1 This is a hardware structure block diagram of a mobile terminal for a control method of calling an application programming interface according to an embodiment of the present invention.

[0044] Figure 2 This is a flowchart of a control method for invoking an application programming interface according to an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram illustrating the operation of a single software according to an embodiment of the present invention;

[0046] Figure 4This is a schematic diagram illustrating the operation of multiple software programs according to an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram illustrating the development and deployment based on the SDK API according to an embodiment of the present invention;

[0048] Figure 6 This is a schematic diagram of the license issuance process according to an embodiment of the present invention;

[0049] Figure 7 This is a schematic diagram illustrating the definition of developer levels and API domains according to an embodiment of the present invention;

[0050] Figure 8 This is a flowchart illustrating the release process of the SDK API according to an embodiment of the present invention;

[0051] Figure 9 This is a flowchart of the compilation and construction process according to an embodiment of the present invention;

[0052] Figure 10 This is a schematic diagram of constraint information according to an embodiment of the present invention;

[0053] Figure 11 This is a flowchart of the permission verification process for API calls according to an embodiment of the present invention;

[0054] Figure 12 This is a flowchart of an API call according to an embodiment of the present invention;

[0055] Figure 13 This is a structural block diagram of a control device for calling an application programming interface according to an embodiment of the present invention. Detailed Implementation

[0056] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0057] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0058] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a control method that calls an application programming interface according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0059] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the control method for calling the application programming interface in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0060] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0061] This embodiment provides a control method for calling application programming interfaces (APIs). Figure 2 This is a flowchart of a control method for calling an application programming interface according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0062] Step S202: Determine the license information of the target application, wherein the license information includes the call information of the target application calling the target application interface;

[0063] In this embodiment, the target application includes, but is not limited to, the core business software of the program, developed by the program's developers. License information includes licenses for calling application programming interfaces (APIs).

[0064] Step S204: Use the license information to determine the constraint information for the target application to call the target application interface;

[0065] Step S206: Control the application's calls to the target application interface based on constraint information.

[0066] In this embodiment, the target application includes two software modules: (1) the business software of the target application, which is developed by the program developer. (2) the SDK, which contains a lot of content, the most important of which is the implementation of the functional APIs that the business software depends on, such as binary dynamic libraries.

[0067] This embodiment is applicable to the following scenarios:

[0068] Scenario 1: For example Figure 3 As shown, the user developed a business software module that relies on the libsdk module, which is released by the software runtime environment developer (operating system developer).

[0069] Scenario 2: For example Figure 4 As shown, in a scenario where the same OS and SDK support the operation of multiple business software applications, the different business software applications may have different functions and require different permissions from the OS and SDK APIs. For example, business1 only needs to obtain multimedia information from the operating system, in which case only simple media permissions are needed. business2 needs to install its own driver on the operating system OS, in which case more extensive permissions are required.

[0070] For scenario one: the business software and runtime_os have a one-to-one relationship. libsdk can be continuously customized to differentiate itself as the business software changes and iterates.

[0071] For scenario two: when an SDK within the same operating system calls different software, access control for API calls is required. For example... Figure 5 As shown, after user software is developed and deployed based on the SDK API, the operating system (OS+SDK) updates if the target application and certificate are not updated. The update includes: the certificate now allows access to high-risk APIs, which are defined as having serious risks in the (OS_SDK), and the OS expects users to no longer access these APIs. This embodiment blocks such previously allowed high-risk APIs.

[0072] The OS SDK has added high-risk APIs, such as API_4. These high-risk APIs are not included in the certificate and will be treated as ordinary APIs without access control, posing a system risk. This implementation blocks access to these newly added high-risk APIs.

[0073] The entities that perform the above steps can be terminals, servers, processors, etc., but are not limited to these.

[0074] Through the above steps, the license information of the target application is determined, including call information of the target application calling the target application programming interface (API). The license information is then used to determine constraint information for the target application calling the API. Based on the constraint information, the application's calls to the API are controlled. In this process, software developers apply for license information for the target application according to the business type. If the business type remains unchanged, the license information can remain unchanged. When the permissions of the API change, this is clearly defined during the construction of the software development kit (SDK), and interception is performed during the API call process. Furthermore, for cases where different software developments call the same API, control and interception can also be achieved through certificate development levels. Therefore, the problem of API calls in related technologies can be solved, achieving effective filtering and interception of API permissions.

[0075] In one exemplary embodiment, determining the license information of the target application includes:

[0076] S11, release certificate management service;

[0077] S12, Receive application information from the application through the certificate management service, wherein the application information is used to apply for license information;

[0078] S13, responding to the application information, publish the license information to the target application;

[0079] The license information includes at least one of the following: the identification information of the target application, the verification information used to verify the legitimacy of the target application, the level information of the target application calling the target application interface, the domain to which the target application calls the target application interface, and the domain to which the target application interface belongs includes the scope of application and business type of the target application interface.

[0080] In this embodiment, the licensing information includes, but is not limited to, license certificates in the target application. For example, issuing a license certificate for user software developed based on the SDK API. The license certificate issuance process is as follows: Figure 6As shown, OS (SDK) developers release certificate management services. Software developers apply to this certificate service for licenses for their software. A license includes four key elements:

[0081] (1) Developer's identification information ID, used to identify the uniqueness of the target application developer.

[0082] (2) The developer’s RSA public key, which is used to verify the legitimacy of the target application.

[0083] (3) Developer level: The developer level is used to indicate the API level that the target application can call.

[0084] (4) API fields, which represent the scope and types of APIs that the target application can call, can be composed of multiple fields. The larger the number of levels, the higher the level of APIs that can be called. A level of 0 indicates unlimited access (super user), allowing the application to call all APIs. API fields restrict the types of APIs that the target application can call. For example, only multimedia APIs can be called.

[0085] In one exemplary embodiment, the above method further includes:

[0086] S21, Determine the business type of the target application;

[0087] S22, determine the level information for the target application to call the target application interface based on the business type of the target application.

[0088] In this embodiment, the process of defining developer levels and API domains is as follows: Figure 7 As shown. The target application implements various business types, including multimedia services that only retrieve multimedia data such as video and audio streams. These require less advanced permissions and belong to lower-level APIs. Network services, on the other hand, require lower-level network permissions, necessitating more advanced permissions and higher-level APIs. Implementing only a specific business type means only calling the corresponding API type is possible.

[0089] In one exemplary embodiment, the above method further includes:

[0090] S31, determine whether the target application needs to access a high-risk application interface, wherein the development level of the high-risk application interface is greater than a preset threshold.

[0091] S32, determine the domain to which the target application interface belongs based on whether the target application needs to access high-risk application interfaces.

[0092] In this embodiment, the process of defining developer levels and API domains is as follows: Figure 7As shown. Does the target application need to access high-risk APIs? The OS maintains a high-risk API pool. If the target application needs to access high-risk APIs, its development level will be relatively high, but not higher than the highest level required to access high-risk APIs.

[0093] For example, high-risk APIs include:

[0094] Media Type API: EX_MEDIA_xxx(), Level 3;

[0095] Network type API: EX_NET_xxx(), Level 4;

[0096] Configuration type API: EX_CONFIG_xxx(), Level 5;

[0097] High-risk API type 1: EX_BUG_xxx1(), level 20;

[0098] High-risk API type 2: EX_BUG_xxx2(), level 22;

[0099] For example, if target application A needs to access a configuration type API and also needs to access a high-risk type API1, then the API domain is "CONFIG" and the development level is 20.

[0100] In one exemplary embodiment, determining the constraint information for a target application's invocation of a target application interface using license information includes:

[0101] S41, determine the level information of the target application interface included in the license information, and the domain to which the target application interface belongs;

[0102] S42, determine constraint information based on the target application interface's level information, the domain to which the target application interface belongs, and the target application interface's attribute information.

[0103] In this embodiment, the process of determining constraint information includes the release of the SDK API, which refers to the process by which OS (+SDK) developers release the SDK to user software developers (SDK users).

[0104] like Figure 8 As shown, during the compilation and build of the SDK source code, an API build configuration is required. This configuration identifies the domain to which the API being built belongs and its corresponding API level. The levels are segmented into business-oriented APIs and high-risk APIs. For example, the business-oriented API level range is 1-10000, and the high-risk API level range is 10001-20000. This ensures that the level of high-risk APIs is always higher than that of business-oriented APIs.

[0105] like Figure 9 As shown, after the build is complete, an API implementation library (SDK.SO) and an API constraint information (API limit) will be generated, in the following format: Figure 10 As shown.

[0106] In this embodiment, the constraint information includes: API information, API domain information, and API permission level.

[0107] In one exemplary embodiment, after determining the constraint information for the target application's invocation of the target application interface using the permission information, the method further includes:

[0108] S51, construct the constraint information into the preset operating system;

[0109] S52 deploys preset information to the target device through a preset operating system.

[0110] In this embodiment, when building the operating system (OS), the API limit is built into the OS as an API constraint center module, and then deployed to the device as the OS is updated and upgraded.

[0111] In one exemplary embodiment, controlling the application's calls to the target application interface based on constraint information includes:

[0112] S61, determine the application identification information of the target application, wherein the application identification information is used to represent the development information of the target application;

[0113] S62, Locate the target certificate information corresponding to the application identification information;

[0114] S63, find the level information of the target application interface and the domain to which the application interface belongs from the constraint information;

[0115] S64 controls how applications call the target application interface based on the target application interface's level information, the domain to which the target application interface belongs, and the target certificate information.

[0116] In this embodiment, the OS controls the application's calls to the target application's interface based on constraint information, including permission verification for API calls. This means that when the target application calls the API, the OS will verify the permissions of the API caller.

[0117] For example, such as Figure 11As shown, when the target application starts, the OS assigns a unique AppId within the OS domain to the target application. This AppId maps to and identifies the Owner (i.e., the developer) of the target application. All subsequent API calls will carry the AppId as an internal default parameter.

[0118] In one exemplary embodiment, controlling the application's invocation of the target application interface (API) based on the API's level information, the domain to which the API belongs, and the target certificate information includes:

[0119] S71, compare the level information of the target application interface with the preset level information corresponding to the target certificate information;

[0120] S72, compare the domain to which the target application interface belongs with the preset domain corresponding to the target certificate information;

[0121] S73, when the level information of the target application interface is a subset of the preset level information corresponding to the target certificate information, and the domain to which the target application interface belongs is a subset of the preset domain corresponding to the target certificate information, control the application to call the target application interface.

[0122] In this embodiment, as Figure 12 As shown, during the process of calling the target application interface, the OS will first look up the certificate to which the target application interface belongs, then query APIlimits for the domain and level of the API to be called locally, and then compare the API domain and level (here, let's assume it is A) found in APIlimits with the domain and development level defined in the certificate (here, let's assume it is B). Only if the domain in A is a subset of the domain in B, and the level in A is less than or equal to the level in B, will the call be allowed.

[0123] In summary, software developers can apply for licenses according to categories, ensuring the certificates remain unchanged as long as the software's business type remains the same. Permission changes caused by API iteration updates can be clearly defined during SDK construction and intercepted during API calls. Furthermore, controlling and intercepting calls to the same API by different software development projects can be achieved through certificate development levels.

[0124] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0125] This embodiment also provides a control device for calling an application programming interface (API), which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0126] Figure 13 This is a structural block diagram of a control device for calling an application programming interface according to an embodiment of the present invention, such as... Figure 13 As shown, the device includes:

[0127] The first determining module 1302 is used to determine the license information of the target application, wherein the license information includes the call information of the target application calling the target application interface;

[0128] The second determining module 1304 is used to determine the constraint information for the target application calling the target application interface using the above-mentioned license information;

[0129] The first control module 1306 is used to control the application program's calls to the target application interface based on the aforementioned constraint information.

[0130] In one exemplary embodiment, the first determining module described above includes:

[0131] The first publishing unit is used to publish certificate management services;

[0132] The first receiving unit is configured to receive the application information of the application through the certificate management service, wherein the application information is used to apply for the license information.

[0133] The first response unit is used to respond to the above application information and publish the above license information to the above target application;

[0134] The aforementioned licensing information includes at least one of the following: the identification information of the target application, the verification information used to verify the legitimacy of the target application, the level information of the target application calling the target application interface, the domain to which the target application calls the target application interface, and the domain to which the target application interface belongs includes the scope of application and business type of the target application interface.

[0135] In one exemplary embodiment, the above-described apparatus further includes:

[0136] The third determining module is used to determine the business type of the aforementioned target application;

[0137] The first invocation module is used to determine the level information of the target application calling the target application interface based on the business type of the target application.

[0138] In one exemplary embodiment, the above-described apparatus further includes:

[0139] The fourth determination module is used to determine whether the target application needs to access a high-risk application programming interface (API), wherein the development level of the high-risk API is greater than a preset threshold.

[0140] The fifth determination module is used to determine the domain to which the target application interface belongs, based on whether the target application needs to access the high-risk application interface.

[0141] In one exemplary embodiment, the second determining module described above includes:

[0142] The first determining unit is used to determine the level information of the target application interface included in the above-mentioned license information, and the domain to which the target application interface belongs.

[0143] The second determining unit is used to determine the constraint information based on the level information of the target application interface, the domain to which the target application interface belongs, and the attribute information of the target application interface.

[0144] In one exemplary embodiment, the above-described apparatus further includes:

[0145] The building module is used to determine the constraint information of the target application calling the target application interface using the above-mentioned license information, and then build the constraint information into the preset operating system.

[0146] The deployment module is used to deploy the aforementioned preset information to the target device through the aforementioned preset operating system.

[0147] In one exemplary embodiment, the first control module includes:

[0148] The third determining unit is used to determine the application identification information of the target application, wherein the application identification information is used to represent the development information of the target application;

[0149] The first search unit is used to search for the target certificate information corresponding to the above application identification information;

[0150] The second search unit is used to search for the level information of the target application interface and the domain to which the application interface belongs from the above constraint information.

[0151] The first control unit is used to control the application's invocation of the target application interface based on the target application interface's level information, the domain to which the target application interface belongs, and the target certificate information.

[0152] In one exemplary embodiment, the first control unit includes:

[0153] The first comparison subunit is used to compare the level information of the target application interface with the preset level information corresponding to the target certificate information.

[0154] The second comparison subunit is used to compare the domain to which the target application interface belongs with the preset domain corresponding to the target certificate information.

[0155] The first control subunit is configured to control the application to call the target application interface when the level information of the target application interface is a subset of the preset level information corresponding to the target certificate information, and the domain to which the target application interface belongs is a subset of the preset domain corresponding to the target certificate information.

[0156] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0157] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0158] In this embodiment, the computer-readable storage medium described above may be configured to store a computer program for performing the above steps.

[0159] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0160] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0161] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0162] In one exemplary embodiment, the processor described above may be configured to perform the above steps via a computer program.

[0163] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0164] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0165] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A control method for calling an application programming interface (API), characterized in that, include: Determine the license information of the target application, wherein the license information includes call information of the target application calling the target application interface; The permission information is used to determine the constraint information for the target application to call the target application interface; The constraints are used to control the application's calls to the target application interface. The method of determining the constraint information for the target application to call the target application interface using the permission information includes: determining the level information of the target application interface included in the permission information, and the domain to which the target application interface belongs; determining the constraint information based on the level information, the domain to which the target application interface belongs, and the attribute information of the target application interface, wherein the level information is segmented according to business application interface APIs and high-risk APIs, and the constraint information includes API information, API domain information, and API permission level; After determining the constraint information for the target application to call the target application interface using the permission information, the method further includes: building the constraint information into a preset operating system; and deploying the preset information to the target device through the preset operating system.

2. The method according to claim 1, characterized in that, Determine the target application's license information, including: Issuance of certificate management services; The application's request information is received through the certificate management service, wherein the request information is used to request the license information; In response to the application information, the license information is published to the target application; The license information includes at least one of the following: the identification information of the target application, the verification information used to verify the legitimacy of the target application, the level information of the target application calling the target application interface, the domain to which the target application calls the target application interface, and the domain to which the target application interface belongs includes the scope of application and business type of the target application interface.

3. The method according to claim 2, characterized in that, The method further includes: Determine the business type of the target application; The level information for the target application to call the target application interface is determined based on the business type of the target application.

4. The method according to claim 2, characterized in that, The method further includes: Determine whether the target application needs to access a high-risk application programming interface (API), wherein the development level of the high-risk API is greater than a preset threshold. Based on whether the target application needs to access high-risk application interfaces, determine the domain to which the target application interface belongs.

5. The method according to claim 1, characterized in that, Controlling the application's calls to the target application interface based on the constraint information includes: Determine the application identification information of the target application, wherein the application identification information is used to represent the development information of the target application; Locate the target certificate information corresponding to the application identifier information; Find the level information of the target application interface and the domain to which the application interface belongs from the constraint information; Based on the level information of the target application interface, the domain to which the target application interface belongs, and the target certificate information, the application's calls to the target application interface are controlled.

6. The method according to claim 5, characterized in that, Based on the target application interface's level information, the domain to which the target application interface belongs, and the target certificate information, controlling the application's calls to the target application interface includes: The level information of the target application interface is compared with the preset level information corresponding to the target certificate information; Compare the domain to which the target application interface belongs with the preset domain corresponding to the target certificate information; When the level information of the target application interface is a subset of the preset level information corresponding to the target certificate information, and the domain to which the target application interface belongs is a subset of the preset domain corresponding to the target certificate information, the application is controlled to call the target application interface.

7. A control device for calling an application programming interface (API), characterized in that, include: The first determining module is used to determine the license information of the target application, wherein the license information includes the call information of the target application calling the target application interface; The second determining module is used to determine the constraint information for the target application to call the target application interface using the permission information; The first control module is used to control the application's calls to the target application interface based on the constraint information; The second determining module is further configured to determine the level information of the target application interface included in the permission information, and the domain to which the target application interface belongs; and to determine the constraint information based on the level information, the domain to which the target application interface belongs, and the attribute information of the target application interface, wherein the level information is segmented according to business application interface (API) and high-risk API, and the constraint information includes API information, API domain information, and API permission level; The device further includes: a building module, used to determine the constraint information of the target application calling the target application interface using the license information, and then build the constraint information into a preset operating system; and a deployment module, used to deploy the preset information to the target device through the preset operating system.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 6.

Images