A non-modification proxy API method, device, equipment and storage medium

Abstract

The present invention discloses a non-modification proxy API method, which is applied to the computer field, including: obtaining an API call request and an iptables rule; if the API call request is not issued by a zero-trust API gateway, determining whether the application corresponding to the API call request is an authorized application; if the application is an authorized application, the API call request is logically processed according to the iptables rule and redirected to the zero-trust API gateway; if the application is an unauthorized application, the API interface request traffic of the API call request is discarded. This method selects the same IP address traffic as the application by setting the iptables rule, and can obtain the API request data packet and forward it to the zero-trust API gateway without modifying the API. In addition, this method also provides a non-modification proxy API device, equipment and storage medium, which also have the above beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a non-modification proxy API method, device, equipment and storage medium. Background Art

[0002] In the prior art, the API (Application Programming Interface) proxy method usually requires the proxy application API to be modified according to the IP (Internet Protocol) of the gateway, that is, the original interface is changed according to the IP address of the gateway, and too many APIs also make the proxy process very cumbersome. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a non-modification proxy API method, which solves the problem in the prior art that the proxy application API needs to be modified according to the IP of the gateway.

[0004] To solve the above technical problems, the present invention provides a non-modification proxy API method, comprising:

[0005] Obtaining an API call request and iptables rules, wherein the iptables rules are set according to a source IP, a destination IP, and a port;

[0006] If the API call request is not issued by a zero-trust API gateway, determining whether the application corresponding to the API call request is an authorized application;

[0007] If the application is an authorized application, the API call request is logically processed according to the iptables rules and redirected to the zero-trust API gateway;

[0008] If the application is an unauthorized application, the API interface request traffic of the API call request is discarded.

[0009] Optionally, performing logical processing on the API call request according to the iptables rule and redirecting it to the zero-trust API gateway includes:

[0010] Verify the server information of the API call request through the iptables rule;

[0011] After the verification is passed, apply for a token from the zero-trust authentication center;

[0012] After successfully applying for the token, the token is added to the API interface request flow as the first flow;

[0013] Forward the first traffic to the zero trust API gateway.

[0014] Optionally, if the API service request is not issued by a zero-trust API gateway, it includes:

[0015] Determine, based on the source IP of the API call request, that the API interface request traffic is not gateway traffic.

[0016] Optionally, verifying the server information of the API call request through iptables rules includes:

[0017] If the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center, the verification passes.

[0018] Optionally, the application for the token is successful, including:

[0019] If the authentication center service is normal, the network is normal, and the application is reserved by TAM, the application for the token is successful.

[0020] Optionally, after performing logical processing on the API service request according to the iptables rule and redirecting it to the zero-trust API gateway, the method further includes:

[0021] Apply for API access permission from the zero trust authentication center through the zero trust API gateway;

[0022] After the application for API access permission is approved, the request input is checked according to the access policy of the Zero Trust Policy Center;

[0023] After the request input parameter check passes, the zero-trust API gateway connects to the data tunnel of the API service to complete the data interaction.

[0024] The present invention also provides a non-modification proxy API device, comprising:

[0025] The acquisition module is used to obtain API call requests and iptables rules;

[0026] A judgment module, configured to judge whether the application corresponding to the API call request is an authorized application if the API call request is not issued by a zero-trust API gateway;

[0027] A processing module, configured to perform logical processing on the API call request and redirect it to the zero-trust API gateway according to the iptables rules if the application is an authorized application;

[0028] The discarding module is used to discard the API interface request traffic of the API call request if the application is an unauthorized application.

[0029] Optionally, also include:

[0030] An application module, used to apply for API access permission from the zero trust authentication center through the zero trust API gateway;

[0031] A detection module, used to check the request input according to the access policy of the zero trust policy center after the application for API access permission is approved;

[0032] The interaction module is used for connecting the zero-trust API gateway to the data tunnel of the API service to complete data interaction after the request input parameter check passes.

[0033] The present invention also provides a non-modification proxy API device, comprising:

[0034] Memory for storing computer programs;

[0035] A processor is used to implement the steps of the above-mentioned non-modification proxy API method when executing the computer program.

[0036] The present invention also provides a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned non-modification proxy API method are implemented.

[0037] It can be seen that the present invention obtains API call requests and iptables rules, wherein the iptables rules are set according to the source IP, destination IP and port; if the API call request is not issued by the zero-trust API gateway, it is determined whether the application corresponding to the API call request is an authorized application; if the application is an authorized application, the API call request is logically processed according to the iptables rules and redirected to the zero-trust API gateway; if the application is an unauthorized application, the API interface request traffic of the API call request is discarded. The present invention selects the same IP address traffic as the application by setting the iptables rules, and can obtain the API request data packet and forward it to the zero-trust API gateway without modifying the API.

[0038] In addition, the present invention also provides a non-modification proxy API device, equipment and storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flowchart of a non-modification proxy API method provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the structure of a non-modification proxy API device provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the structure of a non-modification proxy API device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Please refer to Figure 1 , Figure 1 A flowchart of a non-modification proxy API method provided by an embodiment of the present invention. The method may include:

[0045] S101: Obtain API call requests and iptables rules.

[0046] The execution subject of this embodiment is a server with an agent program. The agent program is downloaded on the server, and the attached private key is placed in the server file. When the agent program is started, the configuration file is decrypted, wherein the configuration file is a file configured in the zero-trust authentication center, which may include authorization, API access rights, access policies, application source IP, and API gateway. Iptables is an IP packet filtering system integrated with the Linux kernel. If a Linux (Linux is a free and open source UNIX-like operating system) system is connected to the Internet or a LAN (Local Area Network), a server, or a proxy server connecting a LAN and the Internet, the system is conducive to better control of IP packet filtering and firewall configuration on the Linux system. The iptables component is a tool, also known as user space, which makes it easy to insert, modify, and remove rules in the packet filter table.

[0047] The iptables rules are set according to the source IP, destination IP and port. Get the API call request initiated by the application server to the configured API server. For ease of understanding, an example can be given: for example, assuming that the access address of the application API is http: / / 10.50.1.82:12345, add the following rules to the server iptables: Set rules based on the real IP (10.50.1.82) and port (12345) of the proxy application API to discard non-proxy traffic; set rules based on the real IP (10.50.1.82) and port (12345) of the proxy application API to forward proxy application traffic. The specific rules are a) iptables-t nat-A custom chain name! -s gateway IP -d destination IP -p tcp -m tcp --dport destination port -j DNAT --to-destination virtual network card IP; b) iptables -t nat -I custom chain name -s local IP -d destination IP -pt tcp -m tcp --dport destination port -j DNAT --to-destination virtual IP address.

[0048] S102: Determine whether the API call request is issued by a zero-trust API gateway.

[0049] Determine whether the API gateway on the application server that initiates the API call request is a zero-trust gateway.

[0050] Furthermore, in order to improve the accuracy of the judgment, it is possible to determine whether the API interface request traffic is gateway traffic based on the source IP of the API call request.

[0051] S103: Determine whether the application corresponding to the API call request is an authorized application.

[0052] Determine whether the application that initiates the API call request is an authorized application, and configure the authorized application in the authentication center configuration file.

[0053] S104: Normal call.

[0054] Just call it normally without going through the proxy program.

[0055] S105: Perform logical processing on the API call request according to iptables rules and redirect it to the zero-trust API gateway.

[0056] The traffic of API call requests is intercepted to the virtual network card through iptables rules, and then written to the specified port through the virtual network card. The http and https requests of the specified port are listened to, the destination IP and request header of the data packet are modified, and sent to the zero-trust API gateway.

[0057] Furthermore, for the accuracy of traffic interception, the following may be included:

[0058] Verify the server information of the API call request through iptables rules;

[0059] After the verification is passed, apply for a token from the zero-trust authentication center;

[0060] After successfully applying for a token, add the token to the API interface request flow as the first flow;

[0061] Forward the first traffic to the Zero Trust API Gateway.

[0062] The server information of the API call request is verified through iptables rules. If the verification is passed, a token is applied to the zero-trust authentication center. The token is a temporary ID card for the application (expired in 12 hours by default); if the verification fails, the traffic of the API call request is discarded. After the token application is successful, the token is placed in the traffic and forwarded to the zero-trust API gateway.

[0063] Furthermore, for the accuracy of traffic interception, the server information of the API call request is verified through iptables rules, which may specifically include:

[0064] If the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center, the verification passes.

[0065] It can be understood that if the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center, the verification passes. If the destination IP and port of the API call request are not the server IP and server port configured by the zero-trust authentication center, the verification fails and the traffic of the API call request is discarded.

[0066] Furthermore, in order to ensure the accuracy of the token application, the above token application is successful, which may specifically include:

[0067] If the authentication center service is normal, the network is normal, and the application is reserved by TAM, the token application is successful.

[0068] The criteria for successful token application are that the authentication center service is normal, the network is normal, and the application is reserved by TAM. If all of these conditions are met, the token application is successful. If any one of them is not met, the token application fails and the traffic of the API call request is discarded.

[0069] Furthermore, in order to achieve encryption, desensitization and permission control, ensure the security of API services, reduce the exposure of backend services, and improve the overall security capabilities, after the API call request is logically processed and redirected to the zero-trust API gateway according to the iptables rules, it can also include:

[0070] Apply for API access rights from the Zero Trust Authentication Center through the Zero Trust API Gateway;

[0071] After the application for API access permission is approved, the request input is checked according to the access policy of the Zero Trust Policy Center;

[0072] After the request input parameter check passes, the zero-trust API gateway connects to the data tunnel of the API service to complete the data interaction.

[0073] The zero-trust authentication gateway applies for API access rights from the zero-trust authentication center, discards unfamiliar traffic, and ensures the security of the application itself. After the application for API access rights is approved, the request input is checked according to the access policy of the zero-trust policy center. The access policy includes access rights and data desensitization of request responses. Checking the request input is to check the token.

[0074] S106: discarding the API interface request traffic of the API call request.

[0075] If the API call request is not issued by the zero-trust API gateway and the application is an unauthorized application, the API interface request traffic of the API call request will be discarded.

[0076] An unmodified proxy API method is provided by the embodiment of the application of the present invention. The method obtains an API call request and iptables rules, wherein the iptables rules are set according to the source IP, destination IP and port; if the API call request is not issued by a zero-trust API gateway, it is determined whether the application corresponding to the API call request is an authorized application; if the application is an authorized application, the API call request is logically processed according to the iptables rules and redirected to the zero-trust API gateway; if the application is an unauthorized application, the API interface request traffic of the API call request is discarded. The method selects the same IP address traffic as the application by setting the iptables rules, that is, only the relevant rules need to be configured, and the API request data packet can be obtained and forwarded to the zero-trust API gateway without modifying the API, and there is no need to change the user's access habits. The server information of the API call request is verified by determining whether the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center. When the authentication center service is normal, the network is normal, and the application is reserved by TAM, the token application is successful, thereby improving accuracy; the zero-trust API gateway applies for API access rights from the zero-trust authentication center. Once approved, the request input is checked according to the access policy of the zero-trust policy center. Once approved, the zero-trust API gateway connects to the data tunnel of the API service and completes data interaction, thereby achieving encryption, desensitization and permission management to ensure the security of API services, while also reducing the exposure of back-end businesses and improving overall security capabilities.

[0077] A non-modification proxy API device provided in an embodiment of the present invention is introduced below. The non-modification proxy API device described below and the non-modification proxy API method described above can refer to each other.

[0078] Please refer to Figure 2 , Figure 2 A structural diagram of a non-modification proxy API device provided by an embodiment of the present invention may include:

[0079] The acquisition module 100 is used to acquire the API call request and the iptables rules;

[0080] A determination module 200 is used to determine whether the application corresponding to the API call request is an authorized application if the API call request is not issued by the zero-trust API gateway;

[0081] The processing module 300 is used to perform logical processing on the API call request and redirect it to the zero-trust API gateway according to the iptables rules if the application is an authorized application;

[0082] The discarding module 400 is used to discard the API interface request traffic of the API call request if the application is an unauthorized application.

[0083] Based on the above embodiment, the method may further include:

[0084] The application module is used to apply for API access rights from the zero-trust authentication center through the zero-trust API gateway;

[0085] The detection module is used to check the request input according to the access policy of the Zero Trust Policy Center after the application for API access permission is approved;

[0086] The interaction module is used to request that the zero-trust API gateway connect to the data tunnel of the API service after the input parameter check is passed to complete the data interaction.

[0087] Based on the above embodiment, the processing module 300 may include:

[0088] A verification unit is used to verify the server information of the API call request through iptables rules;

[0089] The application unit is used to apply for a token from the zero-trust authentication center after passing the verification;

[0090] The adding unit is used to add the token to the API interface request flow as the first flow after the token application is successful;

[0091] The forwarding unit is used to forward the first traffic to the zero-trust API gateway.

[0092] Based on the above embodiment, the determination module 200 may include:

[0093] The determination unit is used to determine, according to the source IP address of the API call request, that the API interface request traffic is not the gateway traffic.

[0094] Based on the above embodiment, the verification unit may include:

[0095] The verification subunit is used to verify that the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center.

[0096] Based on the above embodiment, the adding unit may include:

[0097] The application subunit is used to successfully apply for a token if the authentication center service is normal, the network is normal, and the application is reserved by the TAM.

[0098] It should be noted that the order of the modules and units in the above-mentioned non-modification proxy API device can be changed without affecting the logic.

[0099] An unmodified proxy API device is provided by the embodiment of the application of the present invention. The device is used to obtain API call requests and iptables rules through an acquisition module 100; a judgment module 200 is used to judge whether the application corresponding to the API call request is an authorized application if the API call request is not issued by a zero-trust API gateway; a processing module 300 is used to redirect the API call request to the zero-trust API gateway according to the iptables rules if the application is an authorized application; and a discarding module 400 is used to discard the API interface request traffic of the API call request if the application is an unauthorized application. The device selects the same IP address traffic as the application by setting iptables rules, that is, only the relevant rules need to be configured, and the API request data packet can be obtained and forwarded to the zero-trust API gateway without modifying the API, and there is no need to change the user's access habits. The inspection subunit is used to verify the server information of the API call request by determining whether the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center. The application subunit is used to successfully apply for the token when the authentication center service is normal, the network is normal, and the application is reserved by TAM, thereby improving accuracy. The zero-trust API gateway applies for API access rights from the zero-trust authentication center. After passing, the request input is checked according to the access policy of the zero-trust policy center. After passing, the zero-trust API gateway connects to the data tunnel of the API service and completes data interaction, thereby achieving encryption, desensitization and permission management to ensure the security of API services. At the same time, it also reduces the exposure of back-end businesses and improves overall security capabilities.

[0100] A non-modification proxy API device provided in an embodiment of the present invention is introduced below. The transformation proxy API device described below and the non-modification proxy API method described above can refer to each other.

[0101] Please refer to Figure 3 , Figure 3 A structural diagram of a non-modification proxy API device provided in an embodiment of the present invention may include:

[0102] A memory 10, used for storing computer programs;

[0103] The processor 20 is used to execute a computer program to implement the above-mentioned non-modification proxy API method.

[0104] The memory 10 , the processor 20 , and the communication interface 31 all communicate with each other via the communication bus 32 .

[0105] In the embodiment of the present invention, the memory 10 is used to store one or more programs, and the program may include program code, and the program code includes computer operation instructions. In the embodiment of the present application, the memory 10 may store programs for implementing the following functions:

[0106] Get API call requests and iptables rules, where iptables rules are set based on source IP, destination IP, and port;

[0107] If the API call request is not issued by the zero-trust API gateway, determine whether the application corresponding to the API call request is an authorized application;

[0108] If the application is an authorized application, the API call request is logically processed according to the iptables rules and redirected to the zero-trust API gateway;

[0109] If the application is an unauthorized application, the API interface request traffic of the API call request will be discarded.

[0110] In a possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0111] In addition, the memory 10 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include an NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset thereof, or an extended set thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0112] The processor 20 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, a microprocessor or any conventional processor, etc. The processor 20 may call a program stored in the memory 10 .

[0113] The communication interface 31 may be an interface of a communication module, and is used to connect to other devices or systems.

[0114] Of course, it should be noted that Figure 3 The structure shown does not constitute a limitation on a non-modification proxy API device in the embodiment of the present application. In actual applications, a non-modification proxy API device may include Figure 3More or fewer components than shown, or combinations of certain components.

[0115] The storage medium provided in an embodiment of the present invention is introduced below. The storage medium described below and the non-modification proxy API method described above can be referenced to each other.

[0116] The present invention also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned non-modification proxy API method are implemented.

[0117] The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0118] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0119] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0120] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0121] The above is a detailed introduction to the non-modification proxy API method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A non-modification proxy API method, characterized in that: include: Obtaining an API call request and iptables rules, wherein the iptables rules are set according to a source IP, a destination IP, and a port; If the API call request is not issued by a zero-trust API gateway, determining whether the application corresponding to the API call request is an authorized application; If the application is an authorized application, the API call request is logically processed according to the iptables rules and redirected to the zero-trust API gateway; If the application is an unauthorized application, the API interface request traffic of the API call request is discarded; The step of logically processing the API call request according to the iptables rule and redirecting it to the zero-trust API gateway includes: Verify the server information of the API call request through the iptables rule; After verification, apply for a token from the zero-trust authentication center; After successfully applying for the token, the token is added to the API interface request flow as the first flow; Forward the first traffic to the zero trust API gateway.

2. The non-modification proxy API method according to claim 1, characterized in that: If the API service request is not issued by the zero-trust API gateway, it includes: Determine, based on the source IP of the API call request, that the API interface request traffic is not gateway traffic.

3. The non-modification proxy API method according to claim 1, characterized in that: The verifying the server information of the API call request through iptables rules includes: If the destination IP and port of the API call request are the server IP and server port configured by the zero-trust authentication center, the verification passes.

4. The non-modification proxy API method according to claim 1, characterized in that: The application for the token is successful, including: If the authentication center service is normal, the network is normal, and the application is reserved by TAM, the application for the token is successful.

5. The non-modification proxy API method according to any one of claims 1 to 4, characterized in that: After the API service request is logically processed and redirected to the zero-trust API gateway according to the iptables rule, the method further includes: Apply for API access permission from the zero trust authentication center through the zero trust API gateway; After the application for API access permission is approved, the request input is checked according to the access policy of the Zero Trust Policy Center; After the request input parameter check passes, the zero-trust API gateway connects to the data tunnel of the API service to complete the data interaction.

6. A non-modification proxy API device, characterized in that: include: The acquisition module is used to obtain API call requests and iptables rules; A judgment module, configured to judge whether the application corresponding to the API call request is an authorized application if the API call request is not issued by a zero-trust API gateway; A processing module, configured to perform logical processing on the API call request and redirect it to the zero-trust API gateway according to the iptables rules if the application is an authorized application; A discarding module, configured to discard the API interface request traffic of the API call request if the application is an unauthorized application; The processing module comprises: A verification unit is used to verify the server information of the API call request through iptables rules; The application unit is used to apply for a token from the zero-trust authentication center after passing the verification; The adding unit is used to add the token to the API interface request flow as the first flow after the token application is successful; The forwarding unit is used to forward the first traffic to the zero-trust API gateway.

7. The non-modification proxy API device according to claim 6, characterized in that: Also includes: An application module is used to apply for API access rights from a zero-trust authentication center through the zero-trust API gateway; A detection module, used to check the request input according to the access policy configured by the zero trust policy center after the application is approved; The interaction module is used for connecting the zero-trust API gateway to the data tunnel of the API service to complete data interaction after the inspection is passed.

8. A non-modification proxy API device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the non-modification proxy API method as described in any one of claims 1 to 5 when executing the computer program.

9. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the non-modification proxy API method according to any one of claims 1 to 5.

Images