API data security management method, device, equipment and computer storage medium

Abstract

The present application relates to an API data security management method, apparatus, device, and computer storage medium. The system includes: mirroring target traffic data to obtain mirrored traffic data, parsing data packets in the mirrored traffic data, analyzing each data packet, and when a problematic data packet is determined to exist, reassembling the original data packet content of the problematic data packet, and replaying the reassembled data packet to detect whether the API vulnerability of the problematic data packet has been repaired. The embodiments of the present application do not require the user to manually construct a reassembled data packet, and automatically monitor whether the problematic data packet has been repaired, thereby reducing the user's technical level requirements, improving the user experience, and better ensuring data security.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an API data security management method, apparatus, device, and computer storage medium. Background Art

[0002] The vulnerability of API (Application Programming Interface) data has always been an issue that requires continuous attention, because it directly affects data security.

[0003] In related technologies, when users detect and repair API data vulnerability issues, they generally use some penetration testing tools to manually simulate data packets and check API data vulnerability issues. They also need to detect whether the problem has been corrected based on whether the system will report the same API data vulnerability issue in the future. This requires a high level of technical skills from customers, and users need to manually build penetration packages, which results in a poor user experience. In addition, due to the uncertainty of API access time, users cannot know in time whether the API data vulnerability has been corrected, and problem feedback is not timely, which affects data security. Summary of the Invention

[0004] In order to solve or partially solve the problems existing in the related technologies, the present application provides an API data security management method, device, equipment and computer storage medium, which can automatically discover API data vulnerability problems and automatically detect whether the problem has been corrected. There is no need for users to manually build penetration packages, thereby improving the user experience and ensuring data security.

[0005] A first aspect of the present application provides an API data security management method, characterized in that the method includes:

[0006] Mirroring the target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through the API interface;

[0007] Parsing the data packets in the mirrored traffic data to obtain the original data packet content of the data packets;

[0008] Analyzing the original data packet content of each data packet, and when determining that a problematic data packet exists in the mirrored traffic data, saving the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability;

[0009] The original data packet content of the problematic data packet is reassembled, and the reassembled data packet is replayed to detect whether the API vulnerability of the problematic data packet is repaired.

[0010] As a possible implementation manner of the present application, in this implementation manner, mirroring the target traffic data to obtain mirrored traffic data includes:

[0011] Mirror all target traffic data to obtain mirrored traffic data; or

[0012] Mirror the target traffic data transmitted through the preset port to obtain mirrored traffic data.

[0013] As a possible implementation manner of the present application, in this implementation manner, the original data packet content of the data packet includes the source IP, destination IP, source port, destination port, request header, request BODY, response data packet content, and identification field of the data packet, and the analyzing of the original data packet content of each of the data packets, and when determining that a problem data packet exists in the mirrored traffic data, saving the original data content of the problem data packet, includes:

[0014] Comparing the identification field in each of the data packets with the standard identification field, and determining that the data packet is a problem data packet when it is determined that the identification field in any data packet is missing compared to the standard identification field;

[0015] Based on the missing identification field of the problem data packet compared to the standard identification field, the API vulnerability type of the problem data packet is determined, and the IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field and the API vulnerability type of the problem data packet are saved.

[0016] As a possible implementation manner of the present application, in this implementation manner, reorganizing the original data packet content of the problematic data packet and replaying the reorganized data packet includes:

[0017] Obtain the replay IP, reassemble the replay IP with the destination IP, source port, destination port, request header, request BODY, and identification field of the problem data packet to obtain a reassembled intermediate data packet, and combine the reassembled intermediate data packet with the corresponding data packet content returned by the target IP to generate a reassembled data packet, wherein the replay IP refers to the IP of the device used to replay the reassembled data packet.

[0018] As a possible implementation manner of the present application, in this implementation manner, replaying the reassembled data packet includes:

[0019] Sending the reassembled intermediate data packet from the replay IP to the destination IP, receiving the response data packet content returned by the destination IP, and combining the reassembled intermediate data packet with the response data packet content returned by the destination IP to generate a reassembled data packet;

[0020] The reassembled data packet is parsed to obtain original data packet content of the reassembled data packet, and whether the reassembled data packet has an API vulnerability problem is determined based on the original data packet content of the reassembled data packet.

[0021] As a possible implementation of the present application, in this implementation, detecting whether the API vulnerability problem of the problematic data packet is repaired includes:

[0022] Parsing the reassembled data packet to obtain an identification field in the reassembled data packet;

[0023] The identification field in the reassembled data packet is compared with the standard identification field. When the identification field in the reassembled data packet is not missing compared with the standard identification field, it indicates that the API vulnerability problem of the problematic data packet has been fixed.

[0024] As a possible implementation manner of the present application, in this implementation manner, after determining the API vulnerability type of the problematic data packet, the method further includes:

[0025] issuing a warning message based on the API vulnerability type of the problematic data packet, wherein the warning message includes the identity information of the problematic data packet and the API vulnerability type information of the problematic data packet;

[0026] After detecting whether the API vulnerability of the problematic data packet is repaired, the method includes:

[0027] Based on the detection result, data packet review result information is issued, wherein the review result information includes information that the API vulnerability has been resolved or information that the API vulnerability problem has not been resolved.

[0028] A second aspect of the present application provides a data security management device, characterized in that the device includes:

[0029] A data mirroring module, configured to mirror target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through an API interface;

[0030] A data packet parsing module, configured to parse the data packets in the mirrored traffic data to obtain the original data packet contents of the data packets;

[0031] a data packet analysis module, configured to analyze the original data packet content of each data packet, and when determining that a problematic data packet exists in the mirrored traffic data, save the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability;

[0032] The data packet replay module is used to reorganize the original data packet content of the problem data packet and replay the reorganized data packet to detect whether the API vulnerability of the problem data packet is repaired.

[0033] A third aspect of the present application provides an electronic device, including:

[0034] processor; and

[0035] The memory stores executable codes thereon, and when the executable codes are executed by the processor, the processor is caused to execute the method described above.

[0036] A fourth aspect of the present application provides a computer-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor is caused to execute the method described above.

[0037] The embodiment of the present application mirrors the traffic data transmitted through the API interface to obtain mirrored traffic data, parses and detects the data packets in the mirrored traffic data, and when a problem data packet with API vulnerability is found, retains the problem data packet, and after the user fixes the problem of the problem data packet, reassembles and replays the problem data packet to verify whether the problem of the problem data packet has been fixed. The user does not need to manually construct the reassembled data packet, and automatically monitors whether the problem data packet has been fixed, thereby reducing the user's technical level requirements, improving user experience, and better ensuring data security.

[0038] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and other objects, features and advantages of the present application will become more apparent by describing in more detail exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0040] Figure 1 This is a flowchart of an API data security management method shown in an embodiment of the present application;

[0041] Figure 2 This is a schematic diagram of traffic data mirroring shown in an embodiment of the present application;

[0042] Figure 3 This is a flow chart of a data packet parsing method shown in an embodiment of the present application;

[0043] Figure 4 This is a schematic diagram of an implementation scenario shown in an embodiment of the present application;

[0044] Figure 5 This is a flow chart of a data packet replay method shown in an embodiment of the present application;

[0045] Figure 6 This is a schematic diagram of a data packet replay shown in an embodiment of the present application.

[0046] Figure 7 This is a flow chart of a question review method shown in an embodiment of the present application;

[0047] Figure 8 This is a flow chart of a method for detecting login logs shown in an embodiment of the present application;

[0048] Figure 9 This is a schematic diagram of the structure of an API data security management device shown in an embodiment of the present application;

[0049] Figure 10 It is a structural diagram of an electronic device shown in an embodiment of the present application.

[0050] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale. DETAILED DESCRIPTION

[0051] The following describes embodiments of the present application in more detail with reference to the accompanying drawings. Although the accompanying drawings illustrate embodiments of the present application, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0052] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0053] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0054] In related technologies, when users detect and repair API data vulnerability issues, they generally use some penetration testing tools to manually simulate data packets and check for API data vulnerability issues. Furthermore, they need to check whether the problem has been corrected based on whether the system will report the same API data vulnerability issue in the future. This requires a high level of technical expertise from the customer, and users need to manually build penetration packages, resulting in a poor user experience. API vulnerability issues refer to issues with certain APIs that affect system security, such as unauthorized access, parameter traversal, or sensitive applications or APIs. Furthermore, due to the uncertainty of API access time, users cannot promptly determine whether the API data vulnerability has been corrected, resulting in delayed feedback on issues and impacting data security.

[0055] To address the above issues, the present application provides an API data security management method, apparatus, device, and computer storage medium that can automatically discover API data vulnerability issues and automatically detect whether the issues have been corrected, eliminating the need for users to manually build penetration packages, thereby improving user experience while ensuring data security.

[0056] The technical solutions of the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0057] Figure 1 It is a flow chart of the API data security management method shown in an embodiment of the present application.

[0058] See also Figure 1 The API data security management method provided in the embodiment of the present application includes:

[0059] Step S101 : Mirroring target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through an API interface.

[0060] In the embodiments of this application, Figure 2As shown, the target traffic data refers to the traffic data transmitted through the API interface. As a possible implementation method, the traffic data in the API server can be mirrored. The API server is an interface server. The data transmitted through the API interface will be uploaded to the API server. When mirroring the traffic data in the API server, an agent (artificial intelligence) can be used to mirror the real-time traffic data in the API server.

[0061] As a possible implementation of the present application, when mirroring the target traffic data to obtain mirrored traffic data, the following two methods may be included:

[0062] Mirror all target traffic data to obtain mirrored traffic data; or

[0063] Mirror the target traffic data transmitted through the preset port to obtain mirrored traffic data.

[0064] In the embodiments of the present application, when mirroring the target traffic data, there are multiple mirroring modes. Optionally, all traffic data in the target traffic data can be mirrored, or only part of the traffic data in the target traffic data can be mirrored. The specific mirroring mode to be used can be selected based on the actual situation.

[0065] As a possible implementation method of the present application, for the convenience of explanation, taking a specific embodiment as an example, when mirroring the traffic data in the target traffic data, the traffic data that needs to be mirrored can be selected according to the interface type. For example, when there is no special indication of which one or several types of interface traffic data need to be mirrored or not, you can choose to mirror all the traffic data in the target traffic data; when specifying which ports' traffic data need to be mirrored, you can choose to mirror only the traffic data of that type of port. For example, if you specify that only the traffic data of the HTTP port needs to be mirrored, then only the traffic data of the HTTP port needs to be mirrored. In particular, you can specify port 80, port 8080, etc.; or, you can choose not to mirror the traffic data of these ports, but only mirror the traffic data of other ports. These can be set according to actual conditions. This application does not impose any restrictions on this.

[0066] The embodiments of the present application can effectively reduce workload and improve work efficiency by selectively mirroring traffic data.

[0067] Step S102: Parse the data packets in the mirrored traffic data to obtain the original data packet contents of the data packets.

[0068] In an embodiment of the present application, the mirrored traffic data contains at least one data packet, which may be an access data packet, a request data packet, etc. After obtaining the data packets in the mirrored traffic data, the data packets are parsed to obtain the original data packet content of each data packet. In an embodiment of the present application, for each data packet, the original data packet content contained therein may be different, such as but not limited to the source IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field, etc. of the data packet. Among them, the source IP refers to the IP of the user terminal sending the data packet, the destination IP refers to the IP of the user terminal or server receiving the data packet, the source port and the destination port are the port for sending the data packet and the port for receiving the data packet, respectively. The request header and request BODY are the specific content in the data packet, the response data packet content refers to the content returned by the server after receiving the request in the data packet, and the identification field is a characteristic field used to detect whether the data packet has a vulnerability problem.

[0069] Step S103 , analyzing the original data packet content of each data packet, and when determining that there is a problematic data packet in the mirrored traffic data, saving the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability.

[0070] In an embodiment of the present application, as described in the aforementioned embodiment, after parsing the data packet, the original data packet content of each data packet is obtained, wherein the original data packet content includes an identification field of the data packet, and analyzing the original data packet content of each data packet refers to analyzing the identification field in each data packet. When it is determined that a vulnerability problem exists in a data packet, the data packet is saved, wherein the vulnerability problem includes but is not limited to "unauthorized access", "parameter traversal", "unauthorized login" and other issues.

[0071] As a possible implementation of the present application, for ease of explanation, taking a specific embodiment as an example, within a period of time, the mirrored traffic data includes three data packets, data packet a, data packet b, and data packet c. The data analysis module parses these three data packets and identifies the identification fields in the data packets. When there is a problem data packet among the three data packets, the problem data packet is retained; for example, if data packet a has unauthorized access, data packet a is retained and can be stored in the database. For data packets without problems, it can be chosen not to save them, saving database storage space. Of course, in the embodiments of the present application, the number of data packets in the mirrored traffic data is not unique and can be determined based on actual conditions. Whether each data packet has a problem is also determined based on actual conditions. This application does not impose any restrictions on this.

[0072] Step S104 : reorganize the original data packet content of the problematic data packet, and replay the reorganized data packet to detect whether the API vulnerability of the problematic data packet is repaired.

[0073] In an embodiment of the present application, reorganizing the original data packet content of the problem data packet refers to repackaging the original data packet content of the problem data packet to construct a reorganized data packet, wherein, because the data packet reorganization is performed in the data security brain, the source IP in the original problem data packet can be replaced with the IP of the data security brain, thereby constructing a reorganized data packet, and then the reorganized data packet is sent to the server where the destination IP is located through the data security brain to complete the replay of the data packet. In an embodiment of the present application, the data security brain is a functional module for protecting data security, which is mainly used for analyzing, reorganizing, and replaying data, and is an integrated server system. By replaying the reorganized data packet through the data security brain, it can be detected whether the API vulnerability problem in the problem data packet has been resolved.

[0074] The embodiment of the present application mirrors the traffic data transmitted through the API interface to obtain mirrored traffic data, parses and detects the data packets in the mirrored traffic data, and when a problem data packet with API vulnerability is found, retains the problem data packet, and after the user fixes the problem of the problem data packet, reassembles and replays the problem data packet to verify whether the problem of the problem data packet has been fixed. The user does not need to manually construct the reassembled data packet, and automatically monitors whether the problem data packet has been fixed, thereby reducing the user's technical level requirements, improving user experience, and better ensuring data security.

[0075] As a possible implementation manner of the present application, in this implementation manner, the original data packet content of the data packet includes the source IP, destination IP, source port, destination port, request header, request BODY, response data packet content, and identification field of the data packet, such as Figure 3 As shown, the analyzing the original data packet content of each data packet, and when determining that there is a problem data packet in the mirrored traffic data, saving the original data content of the problem data packet, includes:

[0076] Step S301 : comparing the identification field in each data packet with the standard identification field. When it is determined that the identification field in any data packet is missing compared to the standard identification field, the data packet is determined to be a problem data packet.

[0077] In an embodiment of the present application, after extracting the identification field of the data packet in the mirrored traffic data, it is determined whether the data packet has a vulnerability problem based on the extracted identification field. Optionally, the identification field of the extracted data packet can be compared with the standard identification field. When one or some identification fields are missing in the data packet, it is determined that the data packet has a vulnerability problem, and the type of the problem is confirmed based on the specific missing identification field.

[0078] As a possible implementation method of the present application, for the convenience of explanation, taking a specific embodiment as an example, after extracting the identification field of the data packet, such as the data packet in the mirrored traffic data of the HTTP port, when there is no token identification field in a data packet, it indicates that the data packet is unauthorized access, and it can be determined that the data packet has a vulnerability problem, and its corresponding vulnerability problem is unauthorized access. In the embodiment of the present application, depending on the specific port, the vulnerability problem is also different, and the corresponding identification field is also different. This application does not limit this.

[0079] Step S302: Determine the API vulnerability type of the problem data packet based on the missing identification field of the problem data packet compared to the standard identification field, and save the IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field, and API vulnerability type of the problem data packet.

[0080] In the embodiment of the present application, as described in the above embodiment, after determining the missing identification field in the problem data packet, the API vulnerability type of the problem data packet is determined based on the missing identification field, and the IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field and the API vulnerability type of the problem data packet are saved, such as Figure 4 The figure shows a possible implementation scenario, in which the vulnerability problem of the problem data packet is displayed on the human-computer interaction interface, and a human-computer interaction button is provided in the human-computer interaction interface. The user clicks the button to perform corresponding operations, such as problem review, viewing, processing, and deletion of vulnerability problems. The embodiment of the present application saves the original data packet content of the problem data packet and the API vulnerability type of the problem data packet, which facilitates the subsequent repair of the API vulnerability in the problem data packet and checks whether the vulnerability is successfully repaired.

[0081] As a possible implementation of the present application, in this implementation, if Figure 5 As shown, the reorganization of the original data packet content of the problem data packet includes:

[0082] Obtain the replay IP, reassemble the replay IP with the destination IP, source port, destination port, request header, request BODY, and identification field of the problem data packet to obtain a reassembled intermediate data packet, and combine the reassembled intermediate data packet with the corresponding data packet content returned by the target IP to generate a reassembled data packet, wherein the replay IP refers to the IP of the device used to replay the reassembled data packet.

[0083] In the embodiment of the present application, the replay IP refers to the IP of the device used to replay the reassembled data packet. As described in the above embodiment, the replay IP can be the IP where the data security brain is located. The reassembled intermediate data packet refers to the data packet obtained by reassembling the replay IP, destination IP, source port, destination port, request header, request BODY, and identification field. The reassembled intermediate data packet is sent to the server, and after obtaining the response data packet content returned by the server, the response data packet content is merged into the reassembled intermediate data packet to obtain a reassembled data packet. As a possible implementation method of the present application, when the original data packet content is reassembled, the storage format of each content in the original data packet content can be converted according to actual needs to ensure that the original data packet content can be stored in a preset format. Among them, the specific storage format can be set according to demand, and this application does not impose any restrictions on this.

[0084] As a possible implementation of the present application, in this implementation, if Figure 5 As shown, the replaying of the reassembled data packet includes:

[0085] Step S501, sending the reassembled intermediate data packet from the replay IP to the destination IP, receiving the response data packet content returned by the destination IP, combining the reassembled intermediate data packet with the response data packet content returned by the destination IP to generate a reassembled data packet.

[0086] In the embodiment of the present application, when replaying a data packet, the reassembled intermediate data packet is sent from the replay IP to the destination IP, and the response data packet content returned by the destination IP is received, and the reassembled intermediate data packet is combined with the response data packet content returned by the destination IP to generate a reassembled data packet. For the convenience of explanation, a specific embodiment is taken as an example. Figure 6As shown, there is a problem with the access data packet x sent from the client 601 to the API server. The traffic data containing the data packet x is mirrored to the data security brain 604 through the data mirroring module, and a communication connection, such as a TCP connection, is established between the data security brain 604 and the API server. Then, based on the recorded original data packet content of the problem data packet x, a new data packet y is constructed. The only difference between the new data packet y and the problem data packet x is that data packet y is an access data packet sent to the API server through the data analysis module of the data security brain 604, that is, the reconstructed problem data packet is sent to the API server by the data analysis module. Therefore, the source IP in data packet y is the IP of the data security brain, and the destination IP, source port, destination port, request header, request BODY, and identification field are the same as those in data packet x. After receiving the response data packet content returned by the server, a reconstructed data packet is constructed to verify whether the API vulnerability problem of the data packet has been fixed. Because the verification process is performed in the mirrored traffic data, it will not affect the information transmission of the real traffic data.

[0087] Step S502: Parse the reassembled data packet to obtain the original data packet content of the reassembled data packet, and determine whether the reassembled data packet has an API vulnerability problem based on the original data packet content of the reassembled data packet.

[0088] In an embodiment of the present application, the replay of the reassembled data packet also includes detecting whether there is an API vulnerability problem in the reassembled data packet. The reassembled data packet needs to be parsed to obtain the original data packet content of the reassembled data packet, and then based on the original data packet content of the reassembled data packet, it is determined whether there is an API vulnerability problem in the reassembled data packet. The technical solutions for how to parse the reassembled data packet to obtain the original data packet content of the reassembled data packet and how to determine whether there is an API vulnerability problem in the reassembled data packet based on the original data packet content of the reassembled data packet are the same as the operations on the problem data packet in the aforementioned embodiment, and will not be repeated here.

[0089] The embodiment of the present application reorganizes the problem data packets, verifies the reorganized problem data packets, and verifies them in the mirrored traffic data, thereby ensuring the stable transmission of the real traffic and automatically reviewing the data packet problems.

[0090] As a possible implementation of the present application, in this implementation, if Figure 7 As shown, the step of detecting whether the API vulnerability problem of the problematic data packet is repaired includes:

[0091] Step S701: Parse the reassembled data packet to obtain an identification field in the reassembled data packet.

[0092] In the embodiment of the present application, after obtaining the reassembled data packet, the reassembled data packet is parsed based on the method in the aforementioned embodiment to obtain the identification field in the reassembled data packet, which will not be repeated here.

[0093] Step S702: Compare the identification field in the reassembled data packet with the standard identification field. When the identification field in the reassembled data packet is not missing compared to the standard identification field, it indicates that the API vulnerability problem of the problematic data packet has been fixed.

[0094] In an embodiment of the present application, based on the method in the aforementioned embodiment, the identification field in the reassembled data packet is checked. When the identification field in the reassembled data packet is not missing compared to the standard identification field, it indicates that the API vulnerability problem of the problem data packet has been fixed.

[0095] The embodiment of the present application can automatically and timely detect whether the API vulnerability problem in the problematic data packet has been resolved by reviewing the problem of the reassembled data packet.

[0096] As a possible implementation of the present application, in this implementation, if Figure 8 As shown, the original data packet content of the data packet also includes a login log corresponding to the data packet, and the replaying of the reassembled data packet includes:

[0097] Step S801: When a data packet review request from a user is received, a login log of the reassembled data packet is detected.

[0098] In an embodiment of the present application, when a problematic data packet has a login process, when the original data packet content of the problematic data packet is saved, the login log of the problematic data packet is also saved.

[0099] In an embodiment of the present application, when an API vulnerability problem is discovered in a problematic data packet, after the technician completes the repair of the API vulnerability problem, the technician or user can make a data packet review request, and based on the data packet review request, detect the login log in the reassembled data packet.

[0100] Step S802: When it is detected that the login log of the problematic data packet is normal, the reassembled data packet is replayed.

[0101] In an embodiment of the present application, when it is detected that the login log of the problematic data packet is normal, the reassembled data packet is replayed. The specific replay process has been described in the aforementioned embodiment and will not be repeated here.

[0102] The embodiment of the present application saves the login process of the problem data packet and verifies whether the login process is normal before reorganizing the problem data packet. Only when the login process is normal will the problem data packet be reorganized to ensure the normal review of the problem data packet.

[0103] As a possible implementation manner of the present application, in this implementation manner, after determining the API vulnerability type of the problematic data packet, the method further includes:

[0104] issuing a warning message based on the API vulnerability type of the problematic data packet, wherein the warning message includes the identity information of the problematic data packet and the API vulnerability type information of the problematic data packet;

[0105] After detecting whether the API vulnerability of the problematic data packet is repaired, the method includes:

[0106] Based on the detection result, data packet review result information is issued, wherein the review result information includes information that the API vulnerability has been resolved or information that the API vulnerability problem has not been resolved.

[0107] In an embodiment of the present application, an alarm module is provided. The alarm module is a functional module for issuing an alarm warning for the alarm content in the data security management system. The alarm module can be a display, a sound player or other devices, or a functional component in the human-computer interaction module. When the data analysis module finds a problem data packet, the alarm module issues a warning to the user that a problem data packet has been found. The warning information includes the identity information of the problem data packet and the API vulnerability type information of the problem data packet. After completing the review of the data packet, the review result of the data packet is displayed to the user, such as whether the data packet problem has been fixed, or the data packet problem has not been fixed, or a new data packet has been found. This application does not impose any restrictions on this.

[0108] The embodiment of the present application mirrors the traffic data transmitted through the API interface to obtain mirrored traffic data, parses and detects the data packets in the mirrored traffic data, and when a problem data packet with API vulnerability is found, retains the problem data packet, and after the user fixes the problem of the problem data packet, reassembles and replays the problem data packet to verify whether the problem of the problem data packet has been fixed. The user does not need to manually construct the reassembled data packet, and automatically monitors whether the problem data packet has been fixed, thereby reducing the user's technical level requirements, improving user experience, and better ensuring data security.

[0109] As an embodiment of the present application, an API data security management device is provided, such as Figure 9 As shown, the device 90 includes a data mirroring module 910, a data packet parsing module 920, a data packet analysis module 930, and a data packet replay module 940, wherein:

[0110] The data mirroring module 910 is configured to mirror the target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through the API interface;

[0111] The data packet parsing module 920 is used to parse the data packets in the mirrored traffic data to obtain the original data packet content of the data packets;

[0112] a data packet analysis module 930 configured to analyze the original data packet content of each data packet and, when determining that a problematic data packet exists in the mirrored traffic data, save the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability;

[0113] The data packet replay module 940 is configured to reassemble the original data packet content of the problematic data packet and replay the reassembled data packet to detect whether the API vulnerability of the problematic data packet is repaired.

[0114] As a possible implementation of the present application, in this implementation, when mirroring the target traffic data to obtain mirrored traffic data, the data mirroring module 910 is configured to:

[0115] Mirror all target traffic data to obtain mirrored traffic data; or

[0116] Mirror the target traffic data transmitted through the preset port to obtain mirrored traffic data.

[0117] As a possible implementation manner of the present application, in this implementation manner, the original data packet content of the data packet includes the source IP, destination IP, source port, destination port, request header, request body, response data packet content, and identification field of the data packet. The data packet analysis module 930 analyzes the original data packet content of each data packet, and when determining that there is a problem data packet in the mirrored traffic data, saves the original data content of the problem data packet, and is used to:

[0118] Comparing the identification field in each of the data packets with the standard identification field, and determining that the data packet is a problem data packet when it is determined that the identification field in any data packet is missing compared to the standard identification field;

[0119] Based on the missing identification field of the problem data packet compared to the standard identification field, the API vulnerability type of the problem data packet is determined, and the IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field and the API vulnerability type of the problem data packet are saved.

[0120] As a possible implementation of the present application, in this implementation, the data packet replay module 940 reorganizes the original data packet content of the problematic data packet to:

[0121] Obtain the replay IP, reassemble the replay IP with the destination IP, source port, destination port, request header, request BODY, and identification field of the problem data packet to obtain a reassembled intermediate data packet, and combine the reassembled intermediate data packet with the corresponding data packet content returned by the target IP to generate a reassembled data packet, wherein the replay IP refers to the IP of the device used to replay the reassembled data packet.

[0122] As a possible implementation of the present application, in this implementation, the data packet replay module 940, when replaying the reassembled data packet, is configured to:

[0123] Sending the reassembled intermediate data packet from the replay IP to the destination IP, receiving the response data packet content returned by the destination IP, and combining the reassembled intermediate data packet with the response data packet content returned by the destination IP to generate a reassembled data packet;

[0124] The reassembled data packet is parsed to obtain the original data packet content of the reassembled data packet, and based on the original data packet content of the reassembled data packet, it is determined whether the reassembled data packet has an API vulnerability issue. As a possible embodiment of the present application, in this embodiment, when detecting whether the API vulnerability issue of the problematic data packet has been repaired, the data packet replay module 840 is configured to:

[0125] Parsing the reassembled data packet to obtain an identification field in the reassembled data packet;

[0126] The identification field in the reassembled data packet is compared with the standard identification field. When the identification field in the reassembled data packet is not missing compared with the standard identification field, it indicates that the API vulnerability problem of the problematic data packet has been fixed.

[0127] As a possible implementation of the present application, in this implementation, the original data packet content of the data packet also includes a login log corresponding to the data packet. When replaying the reassembled data packet, the data packet replay module 940 is configured to:

[0128] When receiving a data packet review request from a user, detecting a login log of the reassembled data packet;

[0129] When it is detected that the login log of the problematic data packet is normal, the reassembled data packet is replayed.

[0130] As a possible implementation of the present application, in this implementation, the device is further used for:

[0131] issuing a warning message based on the API vulnerability type of the problematic data packet, wherein the warning message includes the identity information of the problematic data packet and the API vulnerability type information of the problematic data packet;

[0132] After detecting whether the API vulnerability of the problematic data packet is repaired, the method includes:

[0133] Based on the detection result, data packet review result information is issued, wherein the review result information includes information that the API vulnerability has been resolved or information that the API vulnerability problem has not been resolved.

[0134] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated again here.

[0135] The embodiment of the present application mirrors the traffic data transmitted through the API interface to obtain mirrored traffic data, parses and detects the data packets in the mirrored traffic data, and when a problem data packet with API vulnerability is found, retains the problem data packet, and after the user fixes the problem of the problem data packet, reassembles and replays the problem data packet to verify whether the problem of the problem data packet has been fixed. The user does not need to manually construct the reassembled data packet, and automatically monitors whether the problem data packet has been fixed, thereby reducing the user's technical level requirements, improving user experience, and better ensuring data security.

[0136] Reference below Figure 10 The structure of an electronic device 100 suitable for implementing the embodiments of the present disclosure is shown. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 10 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0137] The electronic device includes: a memory and a processor, wherein the processor here may be referred to as the processing device 1001 described below, and the memory may include at least one of the read-only memory (ROM) 1002, the random access memory (RAM) 1003, and the storage device 1008 described below, as shown below:

[0138] like Figure 10As shown, electronic device 1000 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1008 into a random access memory (RAM) 1003. Various programs and data required for the operation of electronic device 1000 are also stored in RAM 1003. Processing device 1001, ROM 1002, and RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to bus 1004.

[0139] Typically, the following devices may be connected to the I / O interface 1005: an input device 1006 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1008 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device 1000 to communicate with other devices wirelessly or by wire to exchange data. Figure 6 The electronic device 1000 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0140] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1008, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0141] It should be noted that the computer-readable medium described above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable storage media may include, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wire, optical cable, RF (radio frequency), or any suitable combination thereof.

[0142] In some embodiments, the client and server can communicate using any currently known or later developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or later developed network.

[0143] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0144] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: mirrors the target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through the API interface; parses the data packets in the mirrored traffic data to obtain the original data packet content of the data packets; analyzes the original data packet content of each of the data packets, and when it is determined that there is a problem data packet in the mirrored traffic data, saves the original data packet content of the problem data packet, wherein the problem data packet refers to a data packet with an API vulnerability; reassembles the original data packet content of the problem data packet, and replays the reassembled data packet to detect whether the API vulnerability of the problem data packet is repaired.

[0145] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0146] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0147] The modules or units involved in the embodiments described in this disclosure may be implemented in software or hardware, wherein the name of a module or unit does not, in some cases, limit the unit itself.

[0148] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0149] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0150] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the present disclosure is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the scope of the above disclosure. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0151] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0152] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for API data security management, characterized in that: The method comprises: Mirroring the target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through the API interface; Parsing the data packets in the mirrored traffic data to obtain the original data packet content of the data packet; the original data packet content of the data packet includes an identification field; Comparing the identification field in each of the data packets with the standard identification field, and when it is determined that the identification field in any data packet is missing compared to the standard identification field, determining that the data packet is a problematic data packet, and saving the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability; Reassembling the original data packet content of the problematic data packet and replaying the reassembled data packet to detect whether the API vulnerability issue of the problematic data packet has been fixed, including: when the identification field in the reassembled data packet is not missing compared to the standard identification field, it indicates that the API vulnerability issue of the problematic data packet has been fixed; Based on the detection result, data packet review result information is issued, which includes: if the detection result indicates that the API vulnerability problem of the problematic data packet has been fixed, then API vulnerability resolved information is issued.

2. The API data security management method according to claim 1, characterized in that: Mirroring the target traffic data to obtain mirrored traffic data includes: Mirror all target traffic data to obtain mirrored traffic data; or Mirror the target traffic data transmitted through the preset port to obtain mirrored traffic data.

3. The API data security management method according to claim 1, characterized in that: The original data packet content of the data packet also includes the source IP, destination IP, source port, destination port, request header, request BODY, and response data packet content of the data packet; The step of saving the original data content of the problematic data packet includes: Based on the missing identification field of the problem data packet compared to the standard identification field, the API vulnerability type of the problem data packet is determined, and the IP, destination IP, source port, destination port, request header, request BODY, response data packet content, identification field and the API vulnerability type of the problem data packet are saved.

4. The API data security management method according to claim 3, characterized in that: The reorganizing the original data packet content of the problematic data packet includes: Obtain the replay IP, reassemble the replay IP with the destination IP, source port, destination port, request header, request BODY, and identification field of the problem data packet to obtain a reassembled intermediate data packet, and combine the reassembled intermediate data packet with the corresponding data packet content returned by the target IP to generate a reassembled data packet, wherein the replay IP refers to the IP of the device used to replay the reassembled data packet.

5. The API data security management method according to claim 4, characterized in that: The replaying of the reassembled data packet comprises: Sending the reassembled intermediate data packet from the replay IP to the destination IP, receiving the response data packet content returned by the destination IP, combining the reassembled intermediate data packet with the response data packet content returned by the destination IP to generate a reassembled data packet; The reassembled data packet is parsed to obtain original data packet content of the reassembled data packet, and whether the reassembled data packet has an API vulnerability problem is determined based on the original data packet content of the reassembled data packet.

6. The API data security management method according to claim 3, characterized in that: After determining the API vulnerability type of the problematic data packet, the method further includes: issuing a warning message based on the API vulnerability type of the problematic data packet, wherein the warning message includes the identity information of the problematic data packet and the API vulnerability type information of the problematic data packet; The sending of data packet review result information based on the detection result also includes: If the detection result indicates that the API vulnerability problem of the problematic data packet has not been fixed, then an API vulnerability problem unresolved message is issued.

7. An API data security management device, characterized in that: The device comprises: A data mirroring module, configured to mirror target traffic data to obtain mirrored traffic data, wherein the target traffic data is traffic data transmitted through an API interface; A data packet parsing module, configured to parse the data packets in the mirrored traffic data to obtain the original data packet content of the data packet; the original data packet content of the data packet includes an identification field; a data packet analysis module, configured to compare the identification field in each data packet with a standard identification field, and when determining that the identification field in any data packet is missing compared to the standard identification field, determine that the data packet is a problematic data packet, and save the original data content of the problematic data packet, wherein the problematic data packet is a data packet with an API vulnerability; a data packet replay module, configured to reconstruct the original data packet content of the problematic data packet and replay the reconstructed data packet to detect whether the API vulnerability problem of the problematic data packet has been fixed, wherein: when the identification field in the reconstructed data packet is not missing compared to the standard identification field, it indicates that the API vulnerability problem of the problematic data packet has been fixed; The device is further configured to: issue data packet review result information based on the detection result, wherein if the detection result indicates that the API vulnerability problem of the problematic data packet has been fixed, issue API vulnerability resolved information.

8. An electronic device, characterized in that: include: processor; as well as A memory having executable codes stored thereon, which, when executed by the processor, causes the processor to perform the method according to any one of claims 1 to 6. 9 . A computer-readable storage medium having executable codes stored thereon, wherein when the executable codes are executed by a processor of an electronic device, the processor is caused to execute the method according to claim 1 .

Images