An API application security protection method, device and server are disclosed

Abstract

The application provides an API application security protection method, device and server, which are opened to the outside. The application API is published by using a false name, so that a non-system personnel cannot determine which is the application API option. When an access instruction is acquired, a real API name corresponding to a target API name in the access instruction is acquired. An access user is authenticated based on a user identifier, a key and the real API name, so that the real API name of the application API cannot be acquired by the user. The API application security, unified business rule data sharing and system stability are realized, and the system and data security can be effectively ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to an API application security protection method, device and server for opening to the outside. BACKGROUND

[0002] Enterprise informatization construction plays a role in the subdivided field, solves the urgent needs of enterprises. It also gradually forms a chimney type system, and forms many data access barriers. The data assets of enterprises cannot be more conveniently and safely applied, and data cannot create greater value.

[0003] In order to avoid the repeated construction of data systems, the data resources of the built system need to be shared under the premise of ensuring the security and smooth operation of the system. Sharing generally adopts database access and publishing service. Among them, database access involves the control and management of a large number of databases, data tables and data content of multiple sources and heterogeneous systems, and a special data management team needs to be established to realize the authorization and control of external systems to the database, data table and data content of each system. The business logic sharing in the database cannot be realized, which is easy to cause the non-uniformity of business rules, and direct access to the database is easy to cause the influence on the system performance, and creating an intermediate library will also lead to the problems of large workload, inconsistent data and the like. The use of publishing service can solve the problem of non-uniformity of business rules, but the open service sharing leads to the security risk of the system and data. SUMMARY

[0004] Therefore, the embodiments of the present application provide an API application security protection method, device and server for opening to the outside, to ensure the security of the data of the open service system.

[0005] To achieve the above object, the embodiments of the present application provide the following technical solutions:

[0006] An API application security protection method for opening to the outside, comprising:

[0007] Obtaining a user access instruction, the access instruction at least comprising: a user identifier, a key, and a target API name;

[0008] Obtaining a real API name corresponding to the target API name;

[0009] Authenticating the access user based on the user identifier, the key and the real API name;

[0010] When the authentication is passed, obtaining an access connection matched with the real API name;

[0011] Establishing a connection between the user and the API application corresponding to the access connection.

[0012] Optionally, before the target API name corresponding to the real API name is obtained after the user access instruction is obtained in the API application security protection method, the method further comprises:

[0013] obtaining the target API name required to be accessed defined in the user access instruction;

[0014] determining whether the target API name is a false name;

[0015] when the target API name is a false name, the action of obtaining the target API name corresponding to the real API name is performed;

[0016] when the target API name is a real API name, the action of authenticating the access user based on the user identifier, the key, and the real API name is performed.

[0017] Optionally, before the user access instruction is obtained in the API application security protection method, the method further comprises:

[0018] when the user accesses the data management system loaded with the API application, obtaining the user IP address;

[0019] obtaining the target API name adapted to the user IP address and the real API name, and taking the target API name as the release name of the API application, wherein the target API name is inconsistent with the language type of the user IP address.

[0020] Optionally, before the target API name adapted to the user IP address and the real API name is obtained after the user IP address is obtained in the API application security protection method, the method further comprises:

[0021] determining whether the user IP address belongs to a preset trusted address range;

[0022] when the user IP address belongs to the preset trusted address range, directly taking the real API name of the API application as the release name of the API application.

[0023] Optionally, after the mapping relationship between the user and the data system corresponding to the access connection is established in the API application security protection method, the method further comprises:

[0024] when the user IP address does not belong to the preset trusted address range, determining whether the API application is in an allowed access time period, and when in the allowed access time period, limiting the access behavior of the user based on a preset flow limiting access rule.

[0025] An API application security protection device for opening to the outside world, comprising:

[0026] An access instruction acquisition unit is configured to acquire a user access instruction, the access instruction comprising at least a user identifier, a key, and a target API name;

[0027] An authentication unit is configured to acquire a real API name corresponding to the target API name, and authenticate the user based on the user identifier, the key, and the real API name;

[0028] A connection establishment unit is configured to acquire an access connection matched with the real API name when the authentication is passed, and establish a connection between the user and an API application corresponding to the access connection.

[0029] Optionally, in the API application security protection device for opening to the outside world, the authentication unit is further configured to:

[0030] acquire a target API name required to be accessed as defined in the user access instruction;

[0031] determine whether the target API name is a false name;

[0032] when the target API name is a false name, acquire a real API name corresponding to the target API name;

[0033] when the target API name is a real API name, authenticate the user based on the user identifier, the key, and the real API name.

[0034] Optionally, the API application security protection device for opening to the outside world further comprises:

[0035] A name publishing unit is configured to acquire a user IP address when it is detected that the user accesses a data management system loaded with the API application;

[0036] acquire a target API name adapted to the user IP address and a real API name, and take the target API name as a publishing name of the API application, wherein the target API name is inconsistent with a language type of the user IP address.

[0037] Optionally, in the API application security protection device for opening to the outside world, the name publishing unit is further configured to:

[0038] determine whether the user IP address belongs to a preset trusted address range;

[0039] When the user IP address belongs to a preset trusted address range, directly taking a real API name of the API application as a release name of the API application.

[0040] A server comprises:

[0041] comprising a memory and a processor;

[0042] The memory is configured to store a program.

[0043] The processor is configured to execute the program to implement each step of the method for protecting an externally open API application.

[0044] Based on the above technical solution, the above scheme provided by the embodiment of the application is published by using a false name for the application API, so that non-system personnel cannot determine which is the option of the application API. When an access instruction is obtained, a real API name corresponding to a target API name in the access instruction is obtained, and an access user is authenticated based on a user identifier, a key, and the real API name, so that the real name of the application API cannot be obtained by the user. The application API security, uniform business rule data sharing, and system stability and data security can be effectively guaranteed. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0046] Figure 1 The flowchart of the method for protecting an externally open API application disclosed by the embodiment of the application is shown.

[0047] Figure 2 The flowchart of the method for protecting an externally open API application disclosed by another embodiment of the application is shown.

[0048] Figure 3 The flowchart of the method for protecting an externally open API application disclosed by another embodiment of the application is shown.

[0049] Figure 4 The structural diagram of the device for protecting an externally open API application disclosed by the embodiment of the application is shown.

[0050] Figure 5 The structural diagram of the server disclosed by the embodiment of the application is shown. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0052] Provided is a method for protecting an API application open to the outside, by publishing an application API with business rules to the outside, by publishing the application API with a false name, so that non-system personnel cannot determine the real API name of the application API, and further verifying whether the access user has access rights through authentication, realizing safe API application, unified business rule data sharing, and effectively protecting system stability, system and data security.

[0053] Referring to Figure 1 The method for protecting an API application open to the outside disclosed in the embodiments of the present application can include:

[0054] Step S101: Obtain a user access instruction, the access instruction at least including a user identifier, a key, and a target API name.

[0055] The access instruction is an instruction generated by the user triggering the control corresponding to the API application, and the instruction at least includes a user identifier, a key, and a target API name. Here, the target API name is the publishing name of the control corresponding to the API application displayed on the user side, and in the present solution, the publishing name is a false name. The user cannot associate the false name with the corresponding API application, which can be a string of random codes, numbers, or other irregular strings, etc. The user identifier and the key are the user identifier and the key used by the user when applying for registration in the system.

[0056] Step S102: Obtain a real API name corresponding to the target API name.

[0057] The system applying the present method, after obtaining the user access instruction, obtains the real API name corresponding to the target API name based on a preset mapping relationship. At this time, the target API name in the access instruction can be replaced with the real API name.

[0058] Step S103: Authenticate the access user based on the user identifier, the key, and the real API name.

[0059] After the access instruction is modified, the user is authenticated based on the user identifier, the key, and the real API name in the modified access instruction, it is judged whether the user has the access right to the API application, when having the access right, step S104 is executed, otherwise, the user is fed back the prompt information of authentication failure.

[0060] Step S104: When the authentication is passed, the access connection matched by the real API name is acquired.

[0061] When the authentication is passed, the connection between the user and the API application system needs to be established, at this time, the access connection matched by the real API name needs to be acquired.

[0062] Step S105: The connection between the user and the API application corresponding to the access connection is established.

[0063] When the connection between the user and the API application is established, the user can access the API application, and the target data is acquired through the API application.

[0064] As can be seen from the above scheme, the application publishes the application API by using the false name, so that the non-system personnel cannot determine the real API name of the application API, when the access instruction is acquired, the real API name corresponding to the target API name in the access instruction is acquired, the user is authenticated based on the user identifier, the key, and the real API name, so that the real name of the application API cannot be acquired by the user, the security of the API application is realized, the data sharing of the unified business rule is realized, and the system stability, the system and data security are effectively guaranteed.

[0065] As can be seen from the technical scheme disclosed in the above embodiment, the application defines the publishing name of the API application published externally by packaging, defines the access address, port and other information of the API application and API service, and defines the naming of the API application published externally by packaging, avoids the exposure of the real API name, and relatively increases the safety factor of the system compared with the traditional information system directly publishing the real service name.

[0066] Moreover, the application subject is authorized, the access key of the application subject is generated, and the API application and API service accessible by the application subject are authorized. The application subject can only access the authorized API application and API service, and can access the API application to acquire related data after the key authentication is passed, which ensures that the acquired data includes the business rule, and unauthorized access is not allowed, which greatly improves the availability and security, and controls the access to ensure the stability of the application.

[0067] In the scheme, when the package definition software system publishes the API name for external other system to call, the function in the software system is published in the form of API to call to execute command to update data or obtain data, and the API is an Application Program Interface. In order to avoid exposing the real API name in the software system, which may cause security risk of information system, the real API name of each API in the software system which can be called by external other software system is mapped to the published target API name. The package definition maps the published target API name corresponding to each actual API name in the software system which can be called externally, and the target API name has no actual API attribute and does not need to define API attribute information other than the name. The mapping relationship between the target API name and the real API attribute can be established, and the real API name corresponding to the target API name can be determined from the real API attribute through the mapping relationship.

[0068] When the real API name and the API attribute of the system are defined, the real API name of the API application which is open to the outside, the URL address of the API request access, the port number, the corresponding target API name, the calling mode and the response type are defined. The calling mode is the calling mode provided by the API to the outside, including GET and POST. GET is used to obtain data, and POST is used to execute command to update data. The response type is the format of the data returned by the API when the external software system calls and accesses the API, including JSON, FILE, BINARY, HTML and TEXT.

[0069] When the system defines the API application which can be accessed by the external software system and is authorized, the name of the external software system needs to be defined. Here, the external software refers to the software which can access the system of the application of the method, and the attribute of the external software system is digitized, including the name of the external software system, the time range of the API application which can be accessed, the API access times per second, and a key, i.e. AccessKey / SecretKey, is generated and provided for each external software system. Only the external software system with the key can access the system of the application of the method. Then, the API name which can be called by the external software system is selected to realize the API access authorization. The target API name is used when the external authorization and the external software system call, and the target API name is a false name.

[0070] When the external software system calls the access API service, the external software system writes code to access the API application, accesses the real API name through the access address defined in the real API attribute mapped by the target API name, and passes the parameter of the filtered data to call the API application corresponding to the real API name, executes the software function of the API application to update the data, or obtains the data returned by the API application. The external software system calls the API application authorized to be allowed to access through an authorization key.

[0071] In another embodiment of the technical solution disclosed in the present application, in order to facilitate the company content personnel to access the API application, when the company intranet accesses the system applying the method, the target API name displayed to the user by the system can be the real API name of the API application, and when the extranet user accesses the system applying the method, the target API name displayed to the user by the system can be a false name of the API application, so as to ensure the security of the data. For this, see Figure 2 In the above method, after obtaining the user access instruction, before obtaining the real API name corresponding to the target API name, the method further comprises:

[0072] Step S201: obtaining the target API name required to be accessed defined in the user access instruction.

[0073] In this step, after obtaining the user access instruction, the target API name contained in the access instruction is obtained. The target API name is the published name of the API application facing the user.

[0074] Step S202: determining whether the target API name is a false name.

[0075] After the system applying the method extracts the target API name, the system can determine whether the target API name is a false name based on a preset API name list or other manners.

[0076] When the target API name is a false name, the action of obtaining the real API name corresponding to the target API name is performed. After obtaining the real API name, the real API attribute corresponding to the real API name can be obtained. Through the real API attribute, the URL address, port number, corresponding target API name, calling mode, response type and other related parameters of the API request access can be obtained. After the user authentication passes, the connection between the user and the API application corresponding to the access connection can be established based on these parameters.

[0077] When the target API name is a real API name, an action is performed: based on the user identification, key, real API name, an access user is authenticated, after the authentication passes, a real API attribute corresponding to the real API name can be acquired, through the real API attribute, a URL address, port number, corresponding target API name, calling mode, response type and other related parameters of an API request access can be acquired, based on these parameters, a connection between the user and an API application corresponding to the access connection can be established.

[0078] In another embodiment of the present application, the user is an intranet user or an extranet user by judging the IP address of the access user, when the user is an intranet user, the target API name published to the user is a real API name corresponding to the API application, when the user is an extranet user, the target API name published to the user is a false API name corresponding to the API application. Thus, in the above-mentioned solution, referring to Figure 3 , before the user access instruction is acquired, the following steps are further included:

[0079] Step S301: When a user accesses a data management system loaded with the API application, an IP address of the user is acquired.

[0080] Step S302: A target API name adapted to the user IP address and real API name is acquired.

[0081] At this time, the target API name is a false name, the target API name is used as a published name of the API application, further, in order to improve the security of data and improve the identification difficulty of the API application, the target API name is inconsistent with a language type corresponding to a home of the user IP address, for example, if the home of the user IP address is a European and American region, the language corresponding to the target API name is Japanese.

[0082] In the technical solution disclosed in the embodiment of the present application, some trusted address ranges can be set in advance, the trusted address ranges at least include an address range corresponding to an intranet IP, access users covered in the trusted address ranges are trusted users, the real API name can be published to the users. Thus, in the above-mentioned method, after the user IP address is acquired, before the target API name adapted to the user IP address and real API name is acquired, the following steps are further included: whether the user IP address belongs to a preset trusted address range is judged; when the user IP address belongs to the preset trusted address range, the real API name of the API application is directly used as the published name of the API application.

[0083] Further, when the access user is not a trusted user, the access period and access rules of the user can be limited to prevent the system from being attacked by external users. In the above scheme, after the mapping relationship between the user and the data system corresponding to the access connection is established, when the user IP address does not belong to the preset trusted address range, it is judged whether the API application is in the allowed access period, when it is in the allowed access period, the access behavior of the user is limited based on the preset flow limiting access rule, when the API application is not in the allowed access period, the user is prohibited from accessing the API application, and the user is fed back corresponding prompt information.

[0084] A specific example of applying the method is:

[0085] The real API name of the API application provided by the system for the external software system to obtain certain production day data is getDay, the calling address is www.system.com, the port number is 8080, the calling mode is GET, the response type is JSON, and the publishing name (target API name) of the API application is getDayReportData. The calling access mode of the user when accessing the API application is to write code to splice the API software system address + colon + port number + API calling address + question mark + key + API interface parameter name + equal sign + parameter value in the format of calling, and the spliced access address is http: / / www.system.com:8080 / getDayReportData?AccessKey=……&SecretKey=……&date=2022 / 06 / 04. The software system maps the accessed API application through the target API name getDayReportData, finds the real API name getDay, converts the API calling address (target API name getDayReportData) to the real API name, and when accessing the API application, the key in the address parameter of the access completely matches the provided key, and the software system considers that the user is authenticated and can continue to access the API application for the next operation. Through the API parameter date=2022 / 06 / 04, the production day data of the date 2022 / 06 / 04 can be obtained, the data obtained through the interface and the parameter is returned, and the data format is JSON. The external software system parses the JSON data file returned by the API to complete the operation of calling the API to obtain data.

[0086] In this embodiment, a device for protecting an externally open API application is disclosed. The specific working content of each unit in the device is described in the above method embodiment.

[0087] The following describes an externally open API application security protection device provided by an embodiment of the present application. The externally open API application security protection device described below can be referred to in correspondence with the externally open API application security protection device method described above.

[0088] Specifically, referring to Figure 4 , the externally open API application security protection device comprises:

[0089] An access instruction acquisition unit A, corresponding to step S101 in the method, is configured to acquire a user access instruction, the access instruction comprising at least a user identifier, a key, and a target API name;

[0090] An authentication unit B, corresponding to steps S102-S103 in the method, is configured to acquire a real API name corresponding to the target API name, and authenticate the access user based on the user identifier, the key, and the real API name;

[0091] A connection establishment unit C, corresponding to steps S104-S105 in the method, is configured to acquire an access connection matched with the real API name when the authentication is passed, and establish a connection between the user and an API application corresponding to the access connection.

[0092] Corresponding to the method, the authentication unit is further configured to, before acquiring the real API name corresponding to the target API name:

[0093] acquire a target API name required to be accessed as defined in the user access instruction;

[0094] determine whether the target API name is a false name;

[0095] when the target API name is a false name, perform an action of acquiring a real API name corresponding to the target API name;

[0096] when the target API name is a real API name, perform an action of authenticating the access user based on the user identifier, the key, and the real API name.

[0097] Optionally, the device further comprises:

[0098] A name publishing unit is configured to, when it is detected that a user accesses a data management system loaded with the API application, acquire a user IP address;

[0099] acquire a target API name adapted to the user IP address and the real API name, and take the target API name as a publishing name of the API application, wherein the target API name is inconsistent with a language type of the user IP address.

[0100] Optionally, in the API application security protection device open to the outside, the name issuing unit is further configured to:

[0101] determine whether the user IP address belongs to a preset trusted address range;

[0102] when the user IP address belongs to the preset trusted address range, directly taking the real API name of the API application as the published name of the API application.

[0103] Figure 5 The hardware structure of the server provided by the embodiment of the application is shown in FIG. 1. Figure 5 The server can include at least one processor 100, at least one communication interface 200, at least one memory 300, and at least one communication bus 400.

[0104] In the embodiment of the application, the number of the processor 100, the communication interface 200, the memory 300, and the communication bus 400 is at least one, and the processor 100, the communication interface 200, and the memory 300 complete mutual communication through the communication bus 400. Obviously, Figure 5 The communication connection shown in the processor 100, the communication interface 200, the memory 300, and the communication bus 400 is optional.

[0105] Optionally, the communication interface 200 can be an interface of a communication module, such as an interface of a GSM module.

[0106] The processor 100 can be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiment of the application.

[0107] The memory 300 can include a high-speed RAM memory, and can also include a non-volatile memory, such as at least one disk memory.

[0108] The processor 100 is specifically configured to:

[0109] obtain a user access instruction, the access instruction including at least a user identifier, a key, and a target API name;

[0110] obtain a real API name corresponding to the target API name;

[0111] authenticating the access user based on the user identifier, the key, and the real API name;

[0112] when the authentication is passed, obtaining an access connection matched with the real API name;

[0113] establishing a connection between the user and an API application corresponding to the access connection.

[0114] For the convenience of description, the above system is described in various modules in terms of functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware when the present application is implemented.

[0115] Each of the embodiments in the specification is described in a progressive manner, and the same and similar parts of each of the embodiments can be referred to each other. Each of the embodiments mainly describes the difference from other embodiments. In particular, for the system or system embodiments, since it is basically similar to the method embodiments, it is described more simply, and the relevant parts can be referred to the part of the method embodiments. The above-described system and system embodiments are only illustrative, and the units described as separate components can be or can not be physically separated, and the components displayed as units can be or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0116] The professional person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present text can be realized in electronic hardware, computer software or combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical scheme. The professional person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0117] The steps of the method or algorithm described in combination with the embodiments disclosed in the present text can be directly implemented in hardware, software module executed by a processor, or a combination of both. The software module can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0118] It is also to be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a component" can include a combination of two or more components, and the term "an element" can include comparable reference to a plurality of elements. Additionally, the term "or" as used herein means any one member of a logical disjunction (i.e., it is equivalent to "or" and "or else") and not a logical exclusion. Also, the terms "comprise," "comprising," "include," "including," and the like mean "including but not limited to." Furthermore, the terms "first," "second," "third," etc. are used merely as labels, and are not intended to impose numerical requirements on their objects.

[0119] The above description of disclosed embodiments provides examples, and is not intended to be limiting. Numerous modifications of the embodiments, as defined herein, will be apparent to those skilled in the art, and will be encompassed within the spirit or scope of the disclosure. Therefore, the scope of the present disclosure is not to be determined by such exemplary embodiments but, rather, is to be understood by reference to the appended claims.

Claims

1. An API application security protection method for opening to the outside, characterized by, Comprising: digitally defining an external software system requesting access to an API application, the digital definition including: an external software system name, a range of valid time periods in which the API application can be accessed, and a number of API access limits per second; generating a key for the external software system and authorizing target API names that it can access; obtaining a user IP address when a user accesses a data management system loaded with the API application; obtaining a target API name that matches the user IP address and a real API name, and taking the target API name as the release name of the API application, wherein the target API name is inconsistent with the language type of the user IP address; obtaining a user access instruction, the access instruction including at least: a user identifier, a key, and a target API name; obtaining a real API name corresponding to the target API name; authenticating the access user based on the user identifier, the key, and the real API name; when the authentication is passed, obtaining an access connection matched with the real API name; establishing a connection between the user and the API application corresponding to the access connection.

2. The method of claim 1, wherein the API application security protection method is opened to the outside. After obtaining the user access instruction, before obtaining the real API name corresponding to the target API name, further comprising: obtaining a target API name required for access defined in the user access instruction; determining whether the target API name is a false name; when the target API name is a false name, performing the action of obtaining a real API name corresponding to the target API name; when the target API name is a real API name, performing the action of authenticating the access user based on the user identifier, the key, and the real API name.

3. The method of claim 1, wherein the API application security protection method is opened to the outside. After obtaining the user IP address, before obtaining the target API name that matches the user IP address and the real API name, further comprising: determining whether the user IP address belongs to a preset trusted address range; when the user IP address belongs to the preset trusted address range, directly taking the real API name of the API application as the release name of the API application.

4. The method of claim 1, wherein the API application security protection method is opened to the outside. After establishing the mapping relationship between the user and the data system corresponding to the access connection, further comprising: when the user IP address does not belong to the preset trusted address range, determining whether the API application is in an allowed access time period, and when it is in the allowed access time period, limiting the user's access behavior based on a preset access limit rule.

5. An API application security protection device that is open to the outside, characterized by, Comprising: a name release unit configured to obtain a user IP address when a user accesses a data management system loaded with the API application; obtain a target API name that matches the user IP address and a real API name, and take the target API name as the release name of the API application, wherein the target API name is inconsistent with the language type of the user IP address; an access instruction obtaining unit configured to obtain a user access instruction, the access instruction including at least: a user identifier, a key, and a target API name; An authentication unit is configured to acquire a real API name corresponding to the target API name, and authenticate the access user based on the user identifier, the key, and the real API name. A connection establishment unit is configured to acquire an access connection matched with the real API name when the authentication is passed, and establish a connection between the user and an API application corresponding to the access connection. The device is further configured to digitally define an external software system requesting to access the API application, and the digital definition includes an external software system name, an effective time period range in which the external software system can access the API application, and an API access limit per second, generate a key for the external software system, and authorize the target API name accessible by the external software system.

6. The API application security device open to outside according to claim 5, characterized in that, Before acquiring the real API name corresponding to the target API name, the authentication unit is further configured to: acquire the target API name required to be accessed in the user access instruction; determine whether the target API name is a false name; when the target API name is a false name, acquire the real API name corresponding to the target API name; when the target API name is a real API name, authenticate the access user based on the user identifier, the key, and the real API name.

7. The API application security device open to outside according to claim 5, characterized in that, After acquiring the user IP address, before acquiring the target API name matched with the user IP address and the real API name, the name publishing unit is further configured to: determine whether the user IP address belongs to a preset trusted address range; when the user IP address belongs to the preset trusted address range, directly publish the real API name of the API application as the publishing name of the API application.

8. A server, characterized by comprises a memory and a processor; the memory is configured to store a program; the processor is configured to execute the program to implement the steps of the method for protecting an externally open API application according to any one of claims 1-4. ​

Images