Method and platform for realizing safe connection of third-party system

Abstract

The application relates to a method for realizing third-party safe docking, which is used for a docking platform, and the method comprises the following steps: obtaining registration information of a request party, establishing account information according to the registration information, encrypting the account information, and generating a key; configuring an interface of a target party according to the account information and the key; obtaining request information of the request party, and encrypting the request information; judging whether the account has the right to access the interface, and if yes, decrypting the request information according to the key; if the decryption is successful, recording information of the account, and processing a business by using the decrypted request information; encrypting a business result according to the key, and feeding back the business result to the request party. By the docking platform, complex configuration in an existing enterprise system is not needed every time, and the internal business system can be directly docked by simply allocating different accounts and keys to new request parties, so that the method is convenient and fast; data transmission of the docking platform is in an encrypted form, so that the safety of the transmission process is guaranteed.

Description

Technical Field

[0001] This invention relates to data security technology, and more particularly to a method and platform for achieving secure third-party integration. Background Technology

[0002] System interface integration is a common scenario for software systems. For enterprises, as business expands, interface integration is no longer limited to internal systems but also includes interactions with external systems. Because this involves inter-enterprise interaction, data transmission security requires particular attention. Larger enterprises typically establish dedicated enterprise service governance bus systems internally to manage inter-system calls.

[0003] While existing systems offer powerful functionality and support cross-system and cross-enterprise service governance, their configuration is cumbersome, with extensive documentation and multiple management platform configurations required. This is particularly true for financial service systems, which serve as the entry point for service sales and require interfaces with numerous third-party companies. Each new external company necessitates repeating the tedious configuration process within the business system. Furthermore, the lack of robust data encryption during transmission results in low security, impacting the speed of requirement iteration and hindering rapid market expansion for frontline staff. Summary of the Invention

[0004] The purpose of this invention is to propose a method and platform for achieving secure third-party integration, so as to solve the problems of cumbersome integration with third-party enterprise systems and the technical problems of weak encryption schemes during transmission.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a method for achieving secure third-party integration, applied to an integration platform between a requester and a target party, comprising:

[0006] Obtain the requester's registration information, create account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key;

[0007] Configure the target party's interface based on account information and encryption keys;

[0008] Obtain the request information from the requester, which includes account information and business information, and encrypt the business information using a preset encryption method;

[0009] Determine whether the account has permission to access the interface based on the account information. If it does, obtain the corresponding encryption key based on the account information to decrypt the business information.

[0010] If decryption is successful, the account information is recorded, which includes at least the account, the requested interface, and the request time.

[0011] After completing the recording, access the target party's interface and use the decrypted business information to perform business processing;

[0012] The business results are encrypted using an encryption key and then sent back to the requester.

[0013] Furthermore, the step of configuring the target party's interface based on account information and encryption keys includes:

[0014] Obtain the interface access information sent by the requester, the interface access information including the interface to be accessed and the interface access order, and encrypt the interface access information using a preset encryption method;

[0015] Determine whether the interface access information matches the account information. If they match, obtain the corresponding encryption key based on the account information to decrypt the interface access information.

[0016] Obtain the list of interfaces sent by the target party, select and arrange the access order of the interfaces in the list according to the interface access information, and establish the mapping relationship between the account in the account information and the interface to be accessed one by one.

[0017] Furthermore, the step of configuring the target party's interface based on account information and encryption keys further includes:

[0018] Establish a mapping table between all requesters and the interfaces to be accessed, store it in a Redis cache, and map the data in the mapping table to the corresponding binary data using a BitMap.

[0019] Furthermore, the method also sets an interface access timeout mechanism, including:

[0020] Set the timeout period for a single interface. If an access request exceeds the set time, the interface will be automatically re-accessed.

[0021] Set a total timeout for all interfaces. If the cumulative timeout for all interfaces exceeds the set timeout, the request is deemed to have timed out, and an access exception is returned directly to the requester.

[0022] Furthermore, the method also includes an interface access confirmation mechanism, comprising:

[0023] For each operation by the requester, an confirmation and cancellation operation is set up. If all interfaces are accessed successfully, the request is considered successful, the interface access is confirmed, and the interface access is performed. If one interface access fails, the successful interface access is rolled back, the interface access is cancelled, and the result is returned to the requester.

[0024] Furthermore, the method also sets up an interface access traffic control mechanism, which includes using a token algorithm to manage the traffic of interface access.

[0025] Furthermore, the method also includes:

[0026] Obtain the request information from the requesting party to establish a secure channel, the request information including the requesting party's digital certificate;

[0027] The request information is sent back to the target party, and the response information from the target party is received.

[0028] If the received feedback is "agree", a secure channel is established between the requester and the target, and a direct login key is set for the requester using a preset encryption method based on the secure channel;

[0029] The direct login key will be returned to the requester.

[0030] To address the aforementioned technical problems, embodiments of the present invention also provide a method for enabling secure interfacing with third-party systems, applied to an interfacing platform between a requester and a target, comprising:

[0031] Obtain the request information and private key from the requester. The request information includes account information and business information, and the private key is a symmetric key.

[0032] An asymmetric key is generated using an asymmetric encryption algorithm, wherein the asymmetric key includes a public key and a private key;

[0033] The public key is used to encrypt the private key to obtain a dual key. The private key is then used to encrypt the business information to obtain ciphertext information.

[0034] Based on the account information, determine whether the account has the right to access the interface. If it does, use the private key to decrypt the dual key and trigger the use of the decrypted special key to decrypt the ciphertext information to obtain the decrypted business information.

[0035] If decryption is successful, the account information is recorded. After recording, the target party's interface is accessed, and the decrypted business information is used for business processing.

[0036] The business results are encrypted and then sent back to the requester.

[0037] To address the aforementioned technical problems, embodiments of the present invention also provide a docking platform for secure third-party docking, comprising:

[0038] The account module is used to obtain the requester's registration information, create account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key;

[0039] The configuration module is used to configure the target party's interface based on account information and encryption keys;

[0040] The first communication module is used to obtain the request information from the requester, which includes account information and business information, and encrypts the business information using a preset encryption method.

[0041] The judgment module is used to determine whether the account has the right to access the interface based on the account information. If it does, it obtains the corresponding encryption key based on the account information to decrypt the business information.

[0042] The recording module is used to record the account information if the decryption is successful. The account information includes at least the account, the request interface, and the request time.

[0043] The business processing module is used to access the target party's interface after completing the recording, and to perform business processing using the decrypted business information;

[0044] The second communication module is used to encrypt the business results according to the encryption key and send them back to the requester.

[0045] To address the aforementioned technical problems, embodiments of the present invention also provide a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the method for achieving secure third-party interfacing as described above.

[0046] To address the aforementioned technical problems, this invention also provides a computer-readable storage medium, employing the following technical solution: the computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for achieving secure third-party interoperability as described above.

[0047] Compared with existing technologies, the embodiments of the present invention have the following main advantages: The method is applied to a docking platform between a requester and a target, including: obtaining the requester's registration information, establishing account information based on the registration information, encrypting the account information using a preset encryption method, and generating an encryption key; configuring the target's interface based on the account information and the encryption key; obtaining the requester's request information, which includes account information and business information, and encrypting the business information using a preset encryption method; determining whether the account has the right to access the interface based on the account information, and if so, obtaining the corresponding encryption key based on the account information to decrypt the business information; if decryption is successful, recording the account information, which includes at least the account, the request interface, and the request time; after recording, accessing the target's interface and using the decrypted business information for business processing; encrypting the business result using the encryption key and feeding it back to the requester. The present invention, through the docking platform, eliminates the need for complex configuration in existing enterprise systems each time; it simply assigns different accounts and keys to new requesters to directly dock with internal business systems, making it convenient and fast; all data transmission on the docking platform is encrypted, ensuring the security of the transmission process and preventing the risk of information leakage. Attached Figure Description

[0048] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0049] Figure 1 This is an exemplary system architecture diagram showing how the present invention can be applied to a docking platform;

[0050] Figure 2 This is a flowchart of an embodiment of the method for achieving secure third-party integration according to the present invention;

[0051] Figure 3 This is a flowchart of yet another embodiment of the method for achieving secure third-party integration according to the present invention;

[0052] Figure 4 This is a schematic diagram of the structure of an embodiment of the docking platform for achieving secure third-party docking according to the present invention;

[0053] Figure 5 This is a schematic diagram of the structure of an embodiment of a computer device according to the present invention. Detailed Implementation

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0055] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0056] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0057] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, and 103, an interface platform 104, and a server 105. The interface platform 104 is used to provide services such as permission verification, encryption / decryption, service orchestration, and interface rate limiting between the terminal devices 101, 102, and 103 and the server 105.

[0058] Users can use terminal devices 101, 102, and 103 to interact with server 105 through interface platform 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0059] Terminal devices 101, 102, and 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc.

[0060] Server 105 can be a server that provides various services, such as a backend server that supports the pages displayed on terminal devices 101, 102, and 103.

[0061] It should be noted that the method for achieving secure third-party integration provided in this embodiment of the invention is executed by the integration platform.

[0062] It should be understood that Figure 1 The number of terminal devices, interface platforms, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, interface platforms, and servers can be included.

[0063] Continue to refer to Figure 2 The diagram illustrates a flowchart of an embodiment of a method for achieving secure third-party integration according to the present invention. The method for achieving secure third-party integration includes the following steps:

[0064] Step S20: Obtain the requester's registration information, establish account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key;

[0065] Specifically, when a third-party enterprise joins the target enterprise's service system, the requesting party (the third-party enterprise) can send registration information to the integration platform using a terminal device. The integration platform then creates account information based on a fixed template, including the account name, password, and enterprise name. The account information is encrypted using a preset encryption method on the integration platform, including DES, AES, RSA, and IDEA algorithms, which the requesting party can choose as needed. The requesting party automatically generates a corresponding encryption key on the integration platform using a random number and alphanumeric salt, based on its selected encryption method. Furthermore, a unified input parameter format is defined for all third-party systems. This includes a request number for differentiation (e.g., channel code_timestamp), an integration account generated by the comparison platform, and business information—encrypted string data (originally a JSON string). The encryption key is pre-generated by the system and provided to the integrating party. In a preferred embodiment, for example, if the requester selects AES encryption, the system assigns an encryption string of "asfweteg225" and an assigned interface account of "testDemo", then the encrypted data of the business parameter data is: AES("actual business parameter", "asfweteg225").

[0066] Step S30: Configure the target party's interface based on account information and encryption key;

[0067] Specifically, this step involves configuring the target party's interfaces that the account has the right to access in the account information. This step also includes:

[0068] Step S31: Obtain the interface access information sent by the requester. The interface access information includes the interface to be accessed and the interface access order. The interface access information is encrypted using a preset encryption method.

[0069] Step S32: Determine whether the interface access information matches the account information. If they match, obtain the corresponding encryption key based on the account information to decrypt the interface access information.

[0070] Step S33: Obtain the list of interfaces sent by the target party, select and arrange the access order of the interfaces in the list according to the interface access information, and establish the mapping relationship between the account in the account information and the interface to be accessed one by one.

[0071] In a preferred embodiment, if the requester needs to update the interface to be accessed, it can reselect and rearrange the access order of the interfaces in the interface list according to the new interface access information, delete the previous mapping relationship, and re-establish the new mapping relationship.

[0072] Specifically, in real-world scenarios, different external systems (requesters) may access the target system's interfaces, and these requests may occur in different orders. For example, given business interfaces d, e, and f, requester A might need to call interfaces d, e, and f in that order, while requester B might need to call interfaces e, f, and d in that order. In this case, simply orchestrating the interface order on the integration platform for each requester is sufficient to meet their different needs. As another example, due to a business change, requester A might have called interfaces d, e, and f in that order, but later needs to change it to f, e, d. Again, orchestration on the integration platform is sufficient; no changes are required on the target system.

[0073] Step S40: Obtain the request information from the requester, which includes account information and business information, and encrypt the business information using a preset encryption method;

[0074] Specifically, when a requester generates a business need, the requester sends a request message to the interface platform. This request message includes account information and business information. The account information is used for authentication, and the business information may be the business parameters that need to be processed. Due to confidentiality requirements, the interface platform encrypts the business information using a preset encryption method to ensure the security of data transmission.

[0075] Step S50: Determine whether the account has the right to access the interface based on the account information. If it does, obtain the corresponding encryption key based on the account information to decrypt the business information.

[0076] Specifically, since the platform stores the account information of registered requesters, it can determine whether an account has the right to access the interface by checking the account information. Furthermore, based on the mapping relationship established between the account and the interface, this configuration is used to determine whether the interface called by the account has a mapping relationship. If a relationship exists, it is determined that the input parameter account has the right to access the interface; otherwise, it is determined that the account does not have the right and the request is returned directly.

[0077] Furthermore, if authorized, the system will automatically decrypt the business information using the encryption key obtained from the platform. If decryption fails, it indicates that the keys of both parties do not match, and an error will be returned directly to the requesting party.

[0078] Step S60: If decryption is successful, record the account information, which includes at least the account, the request interface, and the request time.

[0079] Specifically, if decryption is successful, the information of the calling account is recorded, including the account used for input parameters, the requested interface, parameter details, and the request time. This ensures that each call has a detailed record on the platform, facilitating the traceability of every operation by each account. Furthermore, by distinguishing between accounts and keys and encrypting the parameter transmission process, the security of the interface call is guaranteed. In some embodiments, "interface access" refers to the same concept as "interface call."

[0080] Step S70: After completing the recording, access the target party's interface and use the decrypted business information to perform business processing.

[0081] Specifically, after the recording is completed, the decrypted business information is used to directly call the relevant internal business interface for business processing based on the address of the interface to be accessed.

[0082] Step S80: Encrypt the business result using the encryption key and send it back to the requester.

[0083] Specifically, after the requesting party completes the business processing, it returns relevant information to the integration platform. The integration platform encrypts the business result according to the previously generated encryption key, and then returns the encrypted business result to the requesting party.

[0084] Based on the above method, when multiple requesting systems come to connect, as long as the business interface process is kept universal, different accounts and keys are configured for the relevant systems, and different interface permissions are assigned to the accounts, the front-line business can be directly supported. The configuration can usually be completed within a few minutes without the need for repeated development.

[0085] In one embodiment, after step S30, the method further includes:

[0086] Step S301: Establish a mapping table between all requesters and the interfaces to be accessed, store it in the Redis cache, and map the data in the mapping table to the corresponding binary data using a BitMap.

[0087] Specifically, a mapping table is established between the requesting account and the interface to be accessed, and stored in a Redis cache for easy modification or deletion later. For further security, the data in the mapping table is mapped to corresponding binary data using a Bitmap.

[0088] In practice, given the varying performance and service characteristics of different interfaces during interface orchestration, the platform provides mechanisms to ensure the stability of interface calls. Specifically:

[0089] In one embodiment, for the method of achieving secure integration with third parties, in order to ensure stability and timeliness, the method also sets an interface access timeliness mechanism, including: setting a timeout period for a single interface; when the access request exceeds the set time, the interface will be automatically re-accessed; setting a total timeout period for all interfaces; when the cumulative time of all interfaces exceeds the set time, the request is determined to have timed out, and an access exception is directly returned to the requester.

[0090] In one embodiment, the method for achieving secure integration with a third party further includes an interface access confirmation mechanism, comprising: setting a confirmation and cancellation operation for each operation of the requester; wherein, if all interfaces are accessed successfully, the request is considered successful, interface access confirmation is performed, and interface access is performed; if one interface access fails, the successful interface access is rolled back, interface access is cancelled, and returned to the requester.

[0091] Specifically, since a single request may involve multiple interfaces, it's possible that some interfaces will consistently fail while others succeed. To address this scenario, it's necessary to roll back the successfully requested interfaces. The platform uses a compensated transaction (TCC) mechanism to implement this. The core idea is to register a corresponding confirmation and cancellation operation for each operation: Try, Commit, and Cancel. Try primarily attempts to call all the corresponding interfaces. If an interface succeeds, its call status is changed to Try successful; otherwise, it's changed to Try fail. When all interfaces are in the Try successful state, a Commit operation is performed, and the request is successful. If any interface is in the Try fail state, all successful interfaces are Canceled, the request fails, and a response is returned to the requester.

[0092] In one embodiment, the method for achieving secure third-party integration further includes an interface access traffic control mechanism, which includes using a token algorithm to manage interface access traffic.

[0093] Specifically, in response to potential traffic surges, the platform also provides a rate limiting mechanism to ensure system availability, primarily using a token algorithm for traffic control.

[0094] In one embodiment, the method for achieving secure third-party integration further includes:

[0095] Step S901: Obtain the request information from the requesting party to establish a secure channel, wherein the request information includes the requesting party's digital certificate;

[0096] Step S902: Send the request information back to the target party and receive the feedback information from the target party;

[0097] Step S903: If the received feedback is "agree", a secure channel is established between the requester and the target, and a direct login key is set for the requester using a preset encryption method based on the secure channel;

[0098] Step S904: The direct login key is sent back to the requester.

[0099] Please refer to Figure 3 The present invention also provides an embodiment of a method for achieving secure third-party integration, wherein, with interface configuration already completed, the method includes:

[0100] Step S200: Obtain the request information and private key from the requester. The request information includes account information and business information. The private key is a symmetric key.

[0101] Specifically, the private key can be an AES key.

[0102] Step S300: Generate an asymmetric key using an asymmetric encryption algorithm, wherein the asymmetric key includes a public key and a private key;

[0103] Specifically, the asymmetric key is the encryption key in step S20, and the asymmetric key generated by the asymmetric encryption algorithm can be an RSA key.

[0104] Step S400: Encrypt the private key with the public key to obtain a dual key; encrypt the business information with the private key to obtain ciphertext data.

[0105] Specifically, this step can further improve security.

[0106] Step S500: Determine whether the account has the right to access the interface based on the account information. If it does, use the private key to decrypt the dual key and trigger the use of the decrypted special key to decrypt the ciphertext data to obtain the decrypted business information.

[0107] Step S600: If decryption is successful, record the account information. After recording, access the target party's interface and use the decrypted business information for business processing.

[0108] Step S700: Encrypt the business result and send it back to the requester.

[0109] Specifically, encryption can use the requester's private key or private key, but the public key is provided to the requester in advance.

[0110] The main advantages of this invention are as follows: This integration platform eliminates the need for complex configuration within the enterprise business system each time. Simply assigning different accounts and keys to each new requester allows for direct integration, making it convenient and fast. For scenarios involving different requesters' interface call sequences and numbers, the platform can dynamically orchestrate different call sequences and numbers for different requesters, providing a unified interface for all requesters. When business changes occur, no further development is required; only dynamic configuration of the interface sequence and type is needed. Furthermore, configuring account access interfaces ensures the security of interface calls and prevents unauthorized access. The platform also records each requester's call, achieving traceability and enabling timely and accurate retrieval of operation records when needed. Moreover, all input and output parameters are encrypted, ensuring secure transmission and preventing information leakage. Furthermore, the reasonable granular design of business interfaces eliminates the need for repetitive development in most scenarios, significantly reducing development workload and providing timely and effective support for frontline business personnel's business expansion.

[0111] It should be emphasized that, to further ensure the privacy and security of the above-mentioned methods for achieving secure third-party connections, these methods can also be stored in a blockchain node.

[0112] The blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0113] The embodiments of this invention can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0114] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0115] Further reference Figure 4 As a response to the above Figure 2 In addition to the implementation of the method shown, this invention also provides an embodiment of a docking platform for achieving secure third-party docking. This system embodiment is similar to... Figure 2 The method embodiments shown correspond to those described.

[0116] like Figure 4 As shown, the interface platform 100 for implementing third-party secure integration in this embodiment includes: an account module 2, a configuration module 3, a first communication module 4, a judgment module 5, a recording module 6, a business processing module 7, and a second communication module 8. Wherein:

[0117] Account module 2 is used to obtain the requester's registration information, create account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key;

[0118] Configuration module 3 is used to configure the target party's interface based on account information and encryption keys;

[0119] The first communication module 4 is used to obtain the request information from the requester, which includes account information and business information, and encrypts the business information using a preset encryption method.

[0120] Module 5 is used to determine whether the account has the right to access the interface based on the account information. If it does, it obtains the corresponding encryption key based on the account information to decrypt the business information.

[0121] Recording module 6 is used to record the account information if decryption is successful. The account information includes at least the account, the request interface, and the request time.

[0122] Business processing module 7 is used to access the target party's interface after completing the record and to perform business processing using the decrypted business information;

[0123] The second communication module 8 is used to encrypt the business results according to the encryption key and send them back to the requester.

[0124] The main advantages of this invention are as follows: This integration platform eliminates the need for complex configuration within the enterprise business system each time. Simply assigning different accounts and keys to each new requester allows for direct integration, making it convenient and fast. For scenarios involving different requesters' interface call sequences and numbers, the platform can dynamically orchestrate different call sequences and numbers for different requesters, providing a unified interface for all requesters. When business changes occur, no further development is required; only dynamic configuration of the interface sequence and type is needed. Furthermore, configuring account access interfaces ensures the security of interface calls and prevents unauthorized access. The platform also records each requester's call, achieving traceability and enabling timely and accurate retrieval of operation records when needed. Moreover, all input and output parameters are encrypted, ensuring secure transmission and preventing information leakage. Furthermore, the reasonable granular design of business interfaces eliminates the need for repetitive development in most scenarios, significantly reducing development workload and providing timely and effective support for frontline business personnel's business expansion.

[0125] In some optional implementations of this embodiment, the configuration module 3 includes:

[0126] The acquisition unit 310 is used to acquire interface access information sent by the requester. The interface access information includes the interface to be accessed and the interface access order. The interface access information is encrypted using a preset encryption method.

[0127] The judgment unit 320 is used to determine whether the interface access information matches the account information. If they match, the corresponding encryption key is obtained based on the account information to decrypt the interface access information.

[0128] The mapping unit 330 is used to obtain the list of interfaces sent by the target party, select and arrange the access order of the interfaces in the list according to the interface access information, and establish the mapping relationship between the account in the account information and the interface to be accessed one by one.

[0129] In some optional implementations of this embodiment, the configuration module 3 further includes:

[0130] Data unit 340 is used to establish a mapping table between all requesters and the interfaces to be accessed, and store it in the Redis cache. The data in the mapping table is mapped to the corresponding binary data through a BitMap.

[0131] In some optional implementations of this embodiment, the interface platform 100 for implementing third-party secure interface also has an interface access timeliness mechanism, including:

[0132] Set the timeout period for a single interface. If an access request exceeds the set time, the interface will be automatically re-accessed.

[0133] Set a total timeout for all interfaces. If the cumulative timeout for all interfaces exceeds the set timeout, the request is deemed to have timed out, and an access exception is returned directly to the requester.

[0134] In some optional implementations of this embodiment, the interface platform 100 for implementing third-party secure interface connection also has an interface access confirmation mechanism, including: setting a confirmation and cancellation operation for each operation of the requester; wherein, if all interfaces are accessed successfully, the request is considered successful, interface access confirmation is performed, and interface access is performed; if one interface access fails, the successful interface access is rolled back, interface access is cancelled, and returned to the requester.

[0135] In some optional implementations of this embodiment, the interface platform 100 for implementing secure third-party interface connection also has an interface access traffic control mechanism, which includes using a token algorithm to manage interface access traffic.

[0136] In some optional implementations of this embodiment, the interface platform 100 for implementing secure third-party interface further includes a secure channel module 9, which further includes:

[0137] Digital unit 910 is used to obtain request information from the requesting party to establish a secure channel, the request information including the requesting party's digital certificate;

[0138] Establishment unit 920 is used to send request information back to the target party and receive feedback information from the target party; if the received feedback information is in agreement, a secure channel is established between the requester and the target party, and a direct login key is set for the requester using a preset encryption method based on the secure channel;

[0139] The direct login unit 930 is used to send the direct login key back to the requester.

[0140] To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 5 , Figure 5 This is a basic structural block diagram of the computer device in this embodiment.

[0141] The computer device 9 includes a memory 91, a processor 92, and a network interface 93 that are interconnected via a system bus. It should be noted that... Figure 5Only a computer device 9 with components 91-93 is shown in the illustration; however, it should be understood that implementation of all shown components is not required, and more or fewer components may be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0142] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0143] The memory 91 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 91 may be an internal storage unit of the computer device 9, such as the hard disk or memory of the computer device 9. In other embodiments, the memory 91 may also be an external storage device of the computer device 9, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 9. Of course, the memory 91 may include both the internal storage unit and its external storage device of the computer device 9. In this embodiment, the memory 91 is typically used to store the operating system and various application software installed on the computer device 9, such as computer-readable instructions for implementing secure third-party interfaces. In addition, the memory 91 can also be used to temporarily store various types of data that have been output or will be output.

[0144] In some embodiments, the processor 92 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 92 is typically used to control the overall operation of the computer device 9. In this embodiment, the processor 92 is used to execute computer-readable instructions stored in the memory 91 or to process data, for example, to execute computer-readable instructions for implementing the method of secure third-party interfacing.

[0145] The network interface 93 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 9 and other electronic devices.

[0146] The present invention also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the method for implementing third-party secure interfacing as described above.

[0147] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0148] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A method for achieving secure integration with a third-party system, characterized in that, A platform for connecting requesters and target parties, including: Obtain the requester's registration information, create account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key; Configure the target party's interface based on account information and encryption keys, specifically including: obtaining interface access information sent by the requester, the interface access information including the interface to be accessed and the interface access order, and encrypting the interface access information using a selected preset encryption method; determining whether the interface access information matches the account information, and if they match, obtaining the corresponding encryption key based on the account information to decrypt the interface access information; obtaining the interface list sent by the target party, selecting and arranging the interfaces in the interface list according to the interface access information, and establishing a mapping relationship between the account in the account information and the interface to be accessed. Obtain the request information from the requester, which includes account information and business information, and encrypt the business information using a preset encryption method; Determine whether the account has permission to access the interface based on the account information. If it does, obtain the corresponding encryption key based on the account information to decrypt the business information. If decryption is successful, the account information is recorded, which includes at least the account, the requested interface, and the request time. After completing the recording, access the target party's interface and use the decrypted business information to perform business processing; The business results are encrypted using an encryption key and then sent back to the requester. In scenarios where a single request involves multiple API calls, a compensatory transaction TCC mechanism is used to confirm API access. For each API call, corresponding Try, Commit, and Cancel operations are registered, and the API call status is marked as Try success or Try fail. When all APIs are in the Try success state, a Commit operation is performed. When any API is in the Try fail state, a Cancel rollback operation is performed on all successful APIs.

2. The method according to claim 1, characterized in that, The step of configuring the target party's interface based on account information and encryption keys also includes: Establish a mapping table between all requesters and the interfaces to be accessed, store it in a Redis cache, and map the data in the mapping table to the corresponding binary data using a BitMap.

3. The method according to claim 1, characterized in that, The method also sets an interface access timeout mechanism, including: Set the timeout period for a single interface. If an access request exceeds the set time, the interface will be automatically re-accessed. Set a total timeout for all interfaces. If the cumulative timeout for all interfaces exceeds the set timeout, the request is deemed to have timed out, and an access exception is returned directly to the requester.

4. The method according to claim 1, characterized in that, The method also includes an interface access confirmation mechanism, including: For each operation by the requester, an confirmation and cancellation operation is set up. If all interfaces are accessed successfully, the request is considered successful, the interface access is confirmed, and the interface access is performed. If one interface access fails, the successful interface access is rolled back, the interface access is cancelled, and the result is returned to the requester.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the request information from the requesting party to establish a secure channel, the request information including the requesting party's digital certificate; The request information is sent back to the target party, and the response information from the target party is received. If the received feedback is "agree", a secure channel is established between the requester and the target, and a direct login key is set for the requester using a preset encryption method based on the secure channel; The direct login key will be returned to the requester.

6. A method for achieving secure integration with a third-party system, characterized in that, A platform for connecting requesters and target parties, including: Obtain the request information and private key from the requester. The request information includes account information and business information, and the private key is a symmetric key. An asymmetric key is generated using an asymmetric encryption algorithm, wherein the asymmetric key includes a public key and a private key; The public key is used to encrypt the private key to obtain a dual key. The private key is then used to encrypt the business information to obtain ciphertext information. Based on the account information, determine whether the account has the right to access the interface. If it does, use the private key to decrypt the dual key and trigger the use of the decrypted special key to decrypt the ciphertext information to obtain the decrypted business information. If the dual-key decryption fails or the private key decryption fails, the key mismatch will be directly determined and an error message will be returned to the requester. If decryption is successful, the account information is recorded. After recording, the target party's interface is accessed, and the decrypted business information is used for business processing. The business results are encrypted and then sent back to the requester. In scenarios where a single request involves multiple API calls, a compensatory transaction TCC mechanism is used to confirm API access. For each API call, corresponding Try, Commit, and Cancel operations are registered, and the API call status is marked as Try success or Try fail. When all APIs are in the Try success state, a Commit operation is performed. When any API is in the Try fail state, a Cancel rollback operation is performed on all successful APIs.

7. A platform for secure interfacing with third-party systems, characterized in that, Applied between the requester and the target, including: The account module is used to obtain the requester's registration information, create account information based on the registration information, encrypt the account information using a preset encryption method, and generate an encryption key; The configuration module is used to configure the target party's interfaces based on account information and encryption keys. Specifically, it includes: obtaining interface access information sent by the requester, the interface access information including the interfaces to be accessed and the interface access order; encrypting the interface access information using a selected preset encryption method; determining whether the interface access information matches the account information; if they match, obtaining the corresponding encryption key based on the account information to decrypt the interface access information; obtaining the interface list sent by the target party; selecting and arranging the interfaces in the interface list according to the interface access information; and establishing a mapping relationship between the account in the account information and the interfaces to be accessed. The first communication module is used to obtain the request information from the requester, which includes account information and business information, and encrypts the business information using a preset encryption method. The judgment module is used to determine whether the account has the right to access the interface based on the account information. If it does, it obtains the corresponding encryption key based on the account information to decrypt the business information. The recording module is used to record the account information if the decryption is successful. The account information includes at least the account, the request interface, and the request time. The business processing module is used to access the target party's interface after completing the recording, and to perform business processing using the decrypted business information; The second communication module is used to encrypt the business results according to the encryption key and send them back to the requester. In scenarios where a single request involves multiple API calls, a compensatory transaction TCC mechanism is used to confirm API access. For each API call, corresponding Try, Commit, and Cancel operations are registered, and the API call status is marked as Try success or Try fail. When all APIs are in the Try success state, a Commit operation is performed. When any API is in the Try fail state, a Cancel rollback operation is performed on all successful APIs.

8. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the method for achieving secure third-party interfacing as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for achieving secure third-party interfacing as described in any one of claims 1 to 6.

Images