An interface call authorization method, device, equipment and storage medium

Abstract

The application discloses an interface calling authorization method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: according to the authorization instruction of a service owner to a target application on a client, sending corresponding authorization related information to the target application; receiving an interface calling request containing a signature sent by the target application; the signature is generated based on the authorization related information; the interface calling request is verified, and it is judged whether to perform a corresponding interface calling operation according to the verification result. The application level authorization is realized by using the authorization related information, the purpose of more refined management can be achieved, the management and control of the service owner on the permission are strengthened, meanwhile, the risk of user account password exposure can be reduced, and as long as the authorization is performed once, the use experience of the service user is not affected.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an interface call authorization method, apparatus, device, and storage medium. Background Technology

[0002] Currently, most web applications that call web interfaces (Web APIs) for authorization are based on the OAuth 2.0 single sign-on method. When a user sends a request to the client, the client application guides the user to the authorization server for authentication. Authentication requires the client ID and a callback URL. If the authentication is successful, the authorization server will send an authorization code to the client application. The client application then uses the authorization code, client ID, and client password to exchange for a token from the authorization server. After the authorization server verifies that everything is correct, it sends the token to the client application. The client application then uses this token to make subsequent API calls.

[0003] However, this approach is designed for individual users. Once an individual authorizes the service, they immediately access the authorized application's services, exposing all their personal permissions. Furthermore, in real-world enterprise multi-tenant service scenarios, especially multi-tenant SaaS (Software-as-a-Service) services, the service owner (authorizer) and the user are often not the same person. The authorization and usage processes are not seamless, and the permissions held and used are not equal. This can lead to users needing to repeatedly wait for authorization from the service owner before they can continue using the authorized application's services. On the other hand, granting users access to the service owner's account and password raises data security management issues and contradicts the original intent of using the OAuth 2.0 protocol. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide an interface call authorization method, apparatus, device, and medium that enables fine-grained management of application permissions and reduces the risk of user account password exposure. The specific solution is as follows:

[0005] Firstly, this application discloses an interface call authorization method, applied to an authorization server, comprising:

[0006] Based on the authorization instruction received from the service owner for the target application on the client, send the corresponding authorization-related information to the target application;

[0007] Receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information.

[0008] The interface call request is verified, and the corresponding interface call operation is determined based on the verification result.

[0009] Optionally, the authorization-related information includes the API interface verification serial number and the API interface key.

[0010] Optionally, receiving the interface call request containing a signature sent by the target application includes:

[0011] Receive an API call request containing a signature sent by the target application; the signature is generated by encrypting the API interface verification sequence number using the API interface key based on a hash algorithm.

[0012] Optionally, sending the corresponding authorization-related information to the target application includes:

[0013] Send the corresponding authorization-related information to the authorization information receiving address corresponding to the target application; the authorization information receiving address is an address pre-configured by the target application for receiving authorization-related information.

[0014] Optionally, the step of verifying the signature of the interface call request and determining whether to execute the corresponding interface call operation based on the signature verification result includes:

[0015] By verifying the signature in the interface call request, it can be determined whether the target application has the permission for the target interface corresponding to the interface call request.

[0016] If it is available, then the operation of calling the target interface for the target application will be performed;

[0017] If the target application does not possess the target interface, the operation of calling the target interface for the target application will not be performed.

[0018] Optionally, the interface call authorization method further includes:

[0019] Obtain the permission modification instructions for the target application from the service owner;

[0020] Update the permission configuration for the target application according to the permission modification instruction.

[0021] Optionally, updating the permission configuration for the target application according to the permission modification instruction includes:

[0022] If the permission modification instruction is a permission disabling instruction, then the permission configuration for the target application is updated according to the permission disabling instruction, so that when an interface call request containing a signature is received from the target application, the corresponding interface call operation is not executed.

[0023] Secondly, this application discloses an interface call authorization device, applied to an authorization server, comprising:

[0024] The information sending module is used to send corresponding authorization-related information to the target application based on the authorization instruction received from the service owner for the target application on the client.

[0025] The request receiving module is used to receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information.

[0026] The interface call module is used to verify the signature of the interface call request and determine whether to execute the corresponding interface call operation based on the signature verification result.

[0027] Thirdly, this application discloses an electronic device, including:

[0028] Memory, used to store computer programs;

[0029] A processor is used to execute the computer program to implement the aforementioned interface call authorization method.

[0030] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned interface call authorization method.

[0031] Fifthly, this application discloses a computer program product that, when run on a computer, can implement the aforementioned interface call authorization method.

[0032] In this application, based on the authorization instruction received from the service owner for the target application on the client, corresponding authorization-related information is sent to the target application; an interface call request containing a signature is received from the target application; the signature is generated based on the authorization-related information; the interface call request is verified, and the corresponding interface call operation is executed based on the verification result. It is evident that by sending authorization-related information that characterizes the permission level to the target application, so that the target application sends an interface call request containing authorization-related information when requesting an interface call, the authorization server can determine whether the target application has the relevant permissions based on the information in the interface call request, and then execute the corresponding interface call operation based on the determination result. Therefore, for enterprise multi-tenant service usage scenarios, separating the service data authorization and service data usage processes, and using authorization-related information to achieve application-level authorization, achieves more refined management, strengthens the service owner's control over permissions, reduces the risk of user account password exposure, and requires only one authorization without affecting the user experience. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 A flowchart of an interface call authorization method provided in this application;

[0035] Figure 2 This application provides a specific sequence diagram for interface call authorization.

[0036] Figure 3 This application provides a specific authorization disabling sequence diagram;

[0037] Figure 4 This application provides a specific framework diagram of an interface call authorization system;

[0038] Figure 5 A schematic diagram of an interface call authorization device provided in this application;

[0039] Figure 6 This application provides a structural diagram of an electronic device. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] In existing technologies, web application authorization for calling web interfaces is mostly based on the OAuth 2.0 single sign-on method. When a user initiates a request to the client, the client application guides the user to the authorization server for authentication. Upon successful authentication, the authorization server sends an authorization code to the client application, which then exchanges it for a token. After verification, the authorization server sends the token to the client application, which subsequently uses this token for interface calls. However, this method exposes all personal user permissions in individual user scenarios. Furthermore, in real-world enterprise multi-tenant service scenarios, service users may need to repeatedly wait for authorization from the service owner before continuing to use the authorized application's services. Giving users access to the service owner's account and password raises data security management issues. To overcome these technical problems, this application proposes an interface call authorization method that enables fine-grained management of application permissions and reduces the risk of exposing user account passwords.

[0042] This application discloses an interface call authorization method, applied to an authorization server, see [link to relevant documentation]. Figure 1 As shown, the method may include the following steps:

[0043] Step S11: Based on the authorization instruction received from the service owner for the target application on the client, send the corresponding authorization-related information to the target application.

[0044] In this embodiment, the authorization server, upon receiving the authorization instruction from the service owner for the target application on the client, sends corresponding authorization-related information to the target application. This authorization-related information characterizes the permission level of the target application; that is, based on the service owner's authorization of the target application, matching authorization-related information is sent to the target application. The authorization server is the provider of the enterprise SaaS service and is the party whose business interface is called. The service owner is the administrator of the enterprise SaaS service and has the right to perform all operations on the enterprise SaaS service. The service user is the operating user within the enterprise SaaS service, possessing operational permissions for the business within the enterprise SaaS service, but not permissions to operate the service itself (such as deleting the service).

[0045] For example Figure 2As shown in this embodiment, the authorization-related information may include an API interface verification serial number and an API interface key. The API interface verification serial number (AppKey) is the authorization ID for the target application, authorized by the service owner to the target application as the identity ID for calling the API from a specific tenant, used for authentication. The target application can be an ISV application (Independent Software Vendor). The API interface key (AppSecret) is the authorization secret for the ISV application, authorized by the service owner to the specific tenant for calling the API, used for authentication. Therefore, by using AppKey and AppSecret to authorize application-level access for specific tenants of SaaS services, users can authorize different product services to different ISV applications, achieving more refined management and greatly strengthening the service owner's control over permissions. Moreover, authorization is only required once, and subsequent use does not affect the user experience. Furthermore, the use of AppKey and AppSecret significantly reduces the use of user account passwords, lowers the risk of exposure, and protects the security and privacy of user information.

[0046] In this embodiment, sending the corresponding authorization-related information to the target application may include: sending the corresponding authorization-related information to the authorization information receiving address corresponding to the target application; the authorization information receiving address is an address pre-configured by the target application for receiving authorization-related information. That is, the authenticated target application is required to configure an authorization information receiving address in advance, and this address is dedicated to receiving authorization-related information sent by the authorization server. This design is specifically for enterprise multi-tenant service use scenarios, separating the service data authorization process from the service data usage process. After the service owner authorizes the application based on the OAuth 2.0 protocol, the authorization-related information such as AppKey and AppSecret is pushed to the application's pre-configured receiving address.

[0047] Step S12: Receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information.

[0048] In this embodiment, the authorization server receives an interface call request containing a signature from the target application; the signature is generated based on the authorization-related information. That is, the target application saves the authorization-related information after receiving it, and when it needs to call the interface, it generates a signature based on the saved authorization-related information, and then sends an interface call request containing the signature for the target interface to the authorization server.

[0049] In this embodiment, receiving the interface call request containing a signature sent by the target application may include: receiving the interface call request containing a signature sent by the target application; the signature is generated by encrypting the API interface verification sequence number using the API interface key based on a hash algorithm. The hash algorithm can be SHA256, a very secure hash algorithm that uses a hash value length of 256 bits. That is, when an authorized ISV application initiates a business request, the ISV needs to encrypt the AppKey using the AppSecret based on the SHA256 algorithm to obtain a signature, which the client application then carries in the interface call.

[0050] Step S13: Verify the signature of the interface call request, and determine whether to execute the corresponding interface call operation based on the signature verification result.

[0051] In this embodiment, after receiving an API call request from a client application, the authorization server verifies the signature in the request and then determines whether to execute the corresponding API call operation based on the verification result. That is, upon receiving the request, the authorization server authenticates the authorization corresponding to the signature and determines whether the call is valid.

[0052] In this embodiment, the step of verifying the signature of the interface call request and determining whether to execute the corresponding interface call operation based on the signature verification result includes: verifying the signature in the interface call request to determine whether the target application has permission for the target interface corresponding to the interface call request; if it does, then the operation of calling the target interface for the target application is executed; if it does not, then the operation of calling the target interface for the target application is not executed. That is, if it is determined after authentication that the target application has permission to call the target interface, then the operation of calling the target interface for the target application is executed; if it is determined after authentication that the target application does not have permission to call the target interface, then the operation of calling the target interface for the target application is not executed.

[0053] In this embodiment, the interface call authorization method further includes:

[0054] S21: Obtain the permission modification instruction of the service owner for the target application;

[0055] S22: Update the permission configuration for the target application according to the permission modification instruction.

[0056] In this embodiment, after the initial authorization, the client can still manage permissions such as modification, enabling, and disabling. That is, using this authorization method in this embodiment not only allows for uninterrupted requesting of interface services with only a single authorization, but the client can also revoke the authorization themselves, increasing controllability.

[0057] In this embodiment, updating the permission configuration of the target application according to the permission modification instruction includes: if the permission modification instruction is a permission disabling instruction, then updating the permission configuration of the target application according to the permission disabling instruction, so that when an interface call request containing a signature is received from the target application, the corresponding interface call operation is not executed.

[0058] For example Figure 3 As shown, when the permission modification instruction is a permission disabling instruction, the authorization server updates the permission configuration for the target application according to the permission disabling instruction. After the update, when the server receives an interface call request containing a signature from the target application, it determines that the target application does not have interface call permissions, and therefore does not perform the corresponding interface call operation.

[0059] As can be seen from the above, in this embodiment, based on the authorization instruction received from the service owner for the target application on the client, corresponding authorization-related information is sent to the target application; the authorization-related information can represent the permission level of the target application; an interface call request containing a signature is received from the target application; the signature is generated based on the authorization-related information; the interface call request is verified, and the corresponding interface call operation is determined based on the verification result. It is evident that by sending authorization-related information that represents the permission level to the target application, so that the target application sends an interface call request containing authorization-related information when requesting an interface call, the authorization server can determine whether the target application has the relevant permissions based on the information in the interface call request, and then execute the corresponding interface call operation based on the determination result. Therefore, for enterprise multi-tenant service usage scenarios, separating the service data authorization and service data usage processes, and using authorization-related information to achieve application-level authorization, achieves more refined management, strengthens the service owner's control over permissions, reduces the risk of user account password exposure, and only requires one authorization, without affecting the user experience of subsequent service users.

[0060] The system framework used in the interface call authorization scheme of this application can be found in [link to relevant documentation]. Figure 4As shown, this can specifically include: an authorization server and a number of user terminals that have established communication connections with the authorization server. The server executes the interface call authorization steps, including sending corresponding authorization-related information to the target application based on the authorization instruction received from the service owner for the target application on the client; the authorization-related information can characterize the permission level of the target application; receiving an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information; verifying the interface call request, and determining whether to execute the corresponding interface call operation based on the verification result. By sending authorization-related information that characterizes the permission level to the target application, so that the target application sends an interface call request containing authorization-related information when requesting an interface call, the authorization server can determine whether the target application has the relevant permissions based on the information in the interface call request, and then execute the corresponding interface call operation based on the determination result. Therefore, this design, tailored to enterprise multi-tenant service usage scenarios, separates the service data authorization and service data usage processes, using authorization-related information to achieve application-level authorization, achieving more refined management, strengthening the service owner's control over permissions, reducing the risk of user account password exposure, and requiring only one authorization without affecting the user experience.

[0061] Accordingly, this application also discloses an interface call authorization device, see [link to relevant documentation]. Figure 5 As shown, the device includes:

[0062] The information sending module 11 is used to send corresponding authorization-related information to the target application according to the authorization instruction received from the service owner for the target application on the client.

[0063] The request receiving module 12 is used to receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information.

[0064] The interface call module 13 is used to verify the signature of the interface call request and determine whether to execute the corresponding interface call operation based on the signature verification result.

[0065] As can be seen from the above, in this embodiment, based on the authorization instruction received from the service owner for the target application on the client, the corresponding authorization-related information is sent to the target application; an interface call request containing a signature is received from the target application; the signature is generated based on the authorization-related information; the interface call request is verified, and the corresponding interface call operation is determined based on the verification result. It is evident that by sending authorization-related information that characterizes the permission level to the target application, so that the target application sends an interface call request containing authorization-related information when requesting an interface call, the authorization server can determine whether the target application has the relevant permissions based on the information in the interface call request, and then execute the corresponding interface call operation based on the determination result. Therefore, this design, tailored to enterprise multi-tenant service usage scenarios, separates the two processes of service data authorization and service data usage, using authorization-related information to achieve application-level authorization, achieving more refined management, strengthening the service owner's control over permissions, reducing the risk of user account password exposure, and ensuring that authorization is only required once, without affecting the user experience.

[0066] In some specific embodiments, the authorization-related information includes the API interface verification serial number and the API interface key.

[0067] In some specific embodiments, the request receiving module 12 may specifically include:

[0068] An interface call request receiving unit is used to receive an interface call request containing a signature sent by the target application; the signature is generated by encrypting the API interface verification sequence number using the API interface key based on a hash algorithm.

[0069] In some specific embodiments, the information sending module 11 may specifically include:

[0070] An authorization-related information sending unit is used to send corresponding authorization-related information to the authorization-related information receiving address corresponding to the target application; the authorization-related information receiving address is an address pre-configured by the target application for receiving authorization-related information.

[0071] In some specific embodiments, the interface calling module 13 may specifically include:

[0072] The signature verification unit is used to verify the signature in the interface call request to determine whether the target application has the permission for the target interface corresponding to the interface call request.

[0073] An execution unit is configured to, if it has permission to access the target interface corresponding to the interface call request, execute an operation to call the target interface for the target application.

[0074] The non-execution unit is configured to not perform the operation of calling the target interface for the target application if it does not have permission to call the target interface corresponding to the interface call request.

[0075] In some specific embodiments, the interface call authorization device may specifically include:

[0076] The permission modification instruction acquisition unit is used to acquire the permission modification instruction of the service owner for the target application;

[0077] The permission update unit is used to update the permission configuration for the target application according to the permission modification instruction.

[0078] In some specific embodiments, the permission update unit may specifically include:

[0079] The disabling unit is configured to update the permission configuration of the target application according to the permission disabling instruction if the permission modification instruction is a permission disabling instruction, so that when an interface call request containing a signature is received from the target application, the corresponding interface call operation is not executed.

[0080] Furthermore, this application also discloses an electronic device, see [link to relevant documentation]. Figure 6 As shown, the content in the figure should not be considered as any limitation on the scope of use of this application.

[0081] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the interface call authorization method disclosed in any of the foregoing embodiments.

[0082] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0083] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon include operating system 221, computer program 222 and data 223 including authorization instructions, etc., and the storage method can be temporary storage or permanent storage.

[0084] The operating system 221 manages and controls the various hardware devices on the electronic device 20 and the computer program 222 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the interface call authorization methods executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0085] Furthermore, this application also discloses a computer storage medium storing computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, they implement the interface call authorization method steps disclosed in any of the foregoing embodiments.

[0086] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0087] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0088] Furthermore, this application also discloses a computer program product that, when run on a computer, can implement the interface call authorization method steps disclosed in any of the foregoing embodiments.

[0089] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0090] The foregoing has provided a detailed description of an interface call authorization method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An interface call authorization method, characterized in that, Applied to authorization servers, including: Based on the authorization instruction received from the service owner for the target application on the client, the corresponding authorization-related information is sent to the target application; the authorization server is a SaaS service provider, and the service owner is a SaaS service administrator; Receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information. The interface call request is verified, and the corresponding interface call operation is determined based on the verification result. Sending the corresponding authorization-related information to the target application includes: Send the corresponding authorization-related information to the authorization information receiving address corresponding to the target application; the authorization information receiving address is a pre-configured address of the target application specifically for receiving authorization-related information; The interface call authorization method further includes: Obtain the permission modification instructions for the target application from the service owner; Update the permission configuration for the target application according to the permission modification instruction; The step of updating the permission configuration for the target application according to the permission modification instruction includes: If the permission modification instruction is a permission disabling instruction, then the permission configuration for the target application is updated according to the permission disabling instruction, so that when an interface call request containing a signature is received from the target application, the corresponding interface call operation is not executed.

2. The interface call authorization method according to claim 1, characterized in that, The authorization-related information includes the API interface verification serial number and the API interface key.

3. The interface call authorization method according to claim 2, characterized in that, Receiving the signed interface call request sent by the target application includes: Receive an API call request containing a signature sent by the target application; the signature is generated by encrypting the API interface verification sequence number using the API interface key based on a hash algorithm.

4. The interface call authorization method according to claim 1, characterized in that, The step of verifying the signature of the interface call request and determining whether to execute the corresponding interface call operation based on the signature verification result includes: By verifying the signature in the interface call request, it can be determined whether the target application has the permission for the target interface corresponding to the interface call request. If it is available, then the operation of calling the target interface for the target application will be performed; If the target application does not possess the target interface, the operation of calling the target interface for the target application will not be performed.

5. An interface call authorization device, characterized in that, Applied to authorization servers, including: The information sending module is used to send corresponding authorization-related information to the target application based on the authorization instruction received from the service owner for the target application on the client; the authorization server is a SaaS service provider, and the service owner is a SaaS service administrator; The request receiving module is used to receive an interface call request containing a signature sent by the target application; the signature is generated based on the authorization-related information. The interface call module is used to verify the signature of the interface call request and determine whether to execute the corresponding interface call operation based on the signature verification result. The information sending module is used to send corresponding authorization-related information to the authorization information receiving address corresponding to the target application; the authorization information receiving address is a pre-configured address of the target application specifically for receiving authorization-related information. The interface call authorization device is further configured to obtain the permission modification instruction of the service owner for the target application; and update the permission configuration of the target application according to the permission modification instruction. The interface call authorization device is further configured to update the permission configuration of the target application according to the permission disabling instruction if the permission modification instruction is a permission disabling instruction, so that when an interface call request containing a signature is received from the target application, the corresponding interface call operation is not executed.

6. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the interface call authorization method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the interface call authorization method as described in any one of claims 1 to 4.

Images