A data interface secure exchange method

Abstract

A data interface security system and exchange method based on a user agent client module and a service agent client module, belonging to the technical field of internet communication, solves the problem that the prior art cannot guarantee the consistency of user data and service data requests. The user module installs the user agent client module, the service module installs the service agent client module, the management module assigns public keys and private keys to the user agent client module and the service agent client module, the request parameters of the agent module and the service module are exchanged, the user agent client module requests the public key from the service agent client module and generates a digest and a signature, the blockchain module sends the digest and the signature to the service agent client module, and the service agent client module verifies the digest and the signature using the private key. The data interface security exchange method can be applied to scenarios where data interfaces are used or network protocols such as use interfaces are used for data exchange.

Description

Technical Field

[0001] This invention relates to the field of Internet communication technology, and more specifically to a data interface security system and exchange method. Background Technology

[0002] Currently, the data interface uses gateway authorization, such as Basic, OAuth, and JWT for authentication.

[0003] Basic is a basic authentication method that uses an encoded username and password to verify a user's identity. It involves adding an Authorization field to the HTTP request header with the value "Basic[username:password]" for verification.

[0004] OAuth is an authorization framework that allows users to authorize third-party applications to access information they store on another service provider without sharing passwords. This authorization is accomplished by having the user log in to the service provider and authorize them to perform a specific range of actions. Once authorized, the service provider issues an access token to the application, which is used to access the user's information.

[0005] JWT is a tokenized authentication method that uses JSON objects to encode user information as tokens. These tokens can be used by applications to verify user identity, and they are stateless, meaning applications do not need to retrieve user information from data storage. The biggest advantage of JWT is its self-contained nature, meaning it can contain all necessary information, such as expiration time and required permissions. All of the above methods rely on gateway logs for auditing.

[0006] However, existing data interfaces suffer from a lack of mutual trust between user data and service data. In other words, the consistency of request and response data cannot be guaranteed between user data and service data. Even with gateways or log auditing methods, mutual recognition between the two parties cannot be guaranteed, and it is impossible to prevent log tampering, ensure data consistency, or achieve authoritative mutual trust.

[0007] In summary, existing technologies cannot guarantee the consistency between user data and service provider data requests. Summary of the Invention

[0008] This invention solves the problem that existing technologies cannot guarantee the consistency between user data and service provider data requests.

[0009] The present invention discloses a data interface security system based on a user agent client module, the system comprising the following modules:

[0010] The first user module is used to send a request to the first user agent client module and provide the user request parameters to the first user agent client module.

[0011] The first user agent client module is used to concatenate the user request parameters, user information, and user information parameters in sequence to form concatenated information, and then find the public key of the first service agent client module, which generates a digest and a signature for the concatenated information respectively.

[0012] The first user agent client module is used to save the user request parameters, user information, user information parameters, digest and signature to the first blockchain module respectively, and record the blockchain information;

[0013] The first blockchain module is used to synchronously send the user request parameters, user information, user information parameters, digest, signature and blockchain information to the first service provider agent client module and the first management module, respectively.

[0014] The first service provider's proxy client module is used to determine whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it will send the user's request parameters to the first service provider module. If not, it will end the operation.

[0015] The first service provider module is used to receive request parameters from the user.

[0016] The first management module is used to distribute public and private keys to the first service provider's agent client module;

[0017] The first management module is used to verify the user's request parameters, user information, digest, signature, and blockchain information;

[0018] The first management module is used to trace the request parameters of the first user module.

[0019] Furthermore, in one embodiment of the present invention, the user information parameters include the user timestamp, the user IP address, and the user request unique ID.

[0020] Furthermore, in one embodiment of the present invention, the first service provider proxy client module is used to determine whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information, specifically:

[0021] The first service provider's agent client module pulls the user request parameters, user information, user information parameters, digest, and signature from the blockchain module. It then concatenates these parameters in sequence to form a concatenated message. Using its private key, it generates a digest and signature for the concatenated message. Finally, the first service provider's agent client module checks whether the extracted digest and signature match the digest and signature generated by its private key for the concatenated message.

[0022] The present invention discloses a data interface security system based on a service-party proxy client module, the system comprising the following modules:

[0023] After the second service provider module sends a request to the second service provider proxy client module, it also provides the service provider request parameters to the second service provider proxy client module.

[0024] The second service provider proxy client module is used to concatenate the service provider request parameters, service provider information and service provider information parameters in sequence to form concatenated information, and then find the public key of the second user proxy client module, which generates a digest and a signature for the concatenated information respectively.

[0025] The second service provider agent client module saves the service provider request parameters, service provider information, service provider information parameters, digest and signature to the second blockchain module, and records the blockchain information.

[0026] The second blockchain module is used to synchronously send the service provider request parameters, service provider information, service provider information parameters, digest, signature and blockchain information to the second user agent client module and the second management module, respectively.

[0027] The second user's proxy client module determines whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it sends the service request parameters to the second user module. If not, it ends the operation.

[0028] The second user module is used to receive request parameters from the service provider.

[0029] The second management module is used to distribute public and private keys to the second user's agent client module;

[0030] The second management module is used to verify the service provider's request parameters, service provider information, digest, signature, and blockchain information.

[0031] The second management module is used to trace the request parameters of the second service provider module.

[0032] Furthermore, in one embodiment of the present invention, the service provider information parameters include the service provider timestamp, the service provider IP address, and the service provider request unique ID.

[0033] Furthermore, in one embodiment of the present invention, the second user proxy client module is used to determine whether the digest and signature generated by its public key on the concatenated information are consistent with the digest and signature generated by its private key on the concatenated information, specifically:

[0034] The second user agent client module pulls the service provider request parameters, service provider information, service provider information parameters, digest, and signature from the blockchain module. It then concatenates the service provider request parameters, service provider information, and service provider information parameters in sequence to form concatenated information. After generating a digest and signature for the concatenated information using its private key, the second user agent client module determines whether the pulled digest and signature are consistent with the digest and signature generated by its private key for the concatenated information.

[0035] The present invention discloses a secure data interface exchange method, which is implemented based on a data interface security system based on a user proxy client and a data interface security system based on a service proxy client as described above. Specifically:

[0036] When the first agent module and the second service module exchange request parameters, the first management module allocates a public key and a private key to the first service agent client module, and the second management module allocates a public key and a private key to the second user agent client module.

[0037] The first user module, the first user agent client module, the first blockchain module, the first service provider agent client module, and the first service provider module are executed sequentially.

[0038] The first service module sends the user's request parameters to the second service module, and the second service module retrieves the service request parameters based on the user's request parameters.

[0039] By executing the second service provider module, the second service provider agent client module, the second blockchain module, the second user agent client module, and the second user module in sequence, the secure exchange of request parameters between the first agent module and the second service provider module is completed.

[0040] This invention solves the problem that existing technologies cannot guarantee the consistency of data requests between the user and the service provider. Specific beneficial effects include:

[0041] 1. The data interface secure exchange method described in this invention addresses the issue that existing technologies cannot guarantee the consistency between user data and service provider data requests. This invention installs a user agent client module on the user module and a service agent client module on the service module. The management module allocates public and private keys to both the user agent client module and the service agent client module. When the agent module and the service module exchange request parameters, the public and private keys can provide dual protection for the request parameters. Combined with a blockchain module, this not only achieves a decentralized data exchange and usage method, saving steps, but also ensures the consistency between the request parameters provided by the user module and the request parameters provided by the service module.

[0042] 2. The data interface secure exchange method described in this invention allows the management module to verify the user's request parameters, user information, digest, signature, and blockchain information simultaneously with the service provider's request parameters, service provider information, digest, signature, and blockchain information when the proxy module and service provider module exchange request parameters. Furthermore, the management module can trace the request parameters between the user module and service provider module. Therefore, when the proxy module and service provider module exchange request parameters, the management module can effectively monitor the request parameters of both modules, preventing data tampering and improving the security of transmitting request parameters.

[0043] 3. The data interface security system based on the user agent client module described in this invention, when the user module sends request parameters to the service module, in order to ensure the security of the request parameter transmission, this invention allocates a public key and a private key to the service agent client module through the management module. The user agent client module signs with the public key of the service agent client module, and the service agent client module verifies the signature with the private key, thus ensuring the security of the request parameter transmission.

[0044] The secure data interface exchange method described in this invention can be applied to scenarios where data interfaces are used or network protocols such as interfaces are used for data exchange. Attached Figure Description

[0045] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0046] Figure 1 This is a data interface security system diagram of the user agent client module as described in Implementation Method 1;

[0047] Figure 2 This is a data interface security system diagram of the service provider agent client module described in Implementation Method 2;

[0048] Figure 3This is a flowchart of the secure data interface exchange method described in Implementation Method 3. Detailed Implementation

[0049] Various embodiments of the present invention will now be clearly and completely described with reference to the accompanying drawings. The embodiments described with reference to the drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0050] Implementation Method 1: This implementation method describes a data interface security system based on a user agent client module. The system includes the following modules:

[0051] The first user module is used to send a request to the first user agent client module and provide the user request parameters to the first user agent client module.

[0052] The first user agent client module is used to concatenate the user request parameters, user information, and user information parameters in sequence to form concatenated information, and then find the public key of the first service agent client module, which generates a digest and a signature for the concatenated information respectively.

[0053] The first user agent client module is used to save the user request parameters, user information, user information parameters, digest and signature to the first blockchain module respectively, and record the blockchain information;

[0054] The first blockchain module is used to synchronously send the user request parameters, user information, user information parameters, digest, signature and blockchain information to the first service provider agent client module and the first management module, respectively.

[0055] The first service provider's proxy client module is used to determine whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it will send the user's request parameters to the first service provider module. If not, it will end the operation.

[0056] The first service provider module is used to receive request parameters from the user.

[0057] The first management module is used to distribute public and private keys to the first service provider's agent client module;

[0058] The first management module is used to verify the user's request parameters, user information, digest, signature, and blockchain information;

[0059] The first management module is used to trace the request parameters of the first user module.

[0060] In this embodiment, the user information parameters include the user timestamp, the user IP address, and the user's unique request ID.

[0061] In this embodiment, the first service provider proxy client module is used to determine whether the digest and signature generated by its public key on the concatenated information are consistent with the digest and signature generated by its private key on the concatenated information, specifically:

[0062] The first service provider's agent client module pulls the user request parameters, user information, user information parameters, digest, and signature from the blockchain module. It then concatenates these parameters in sequence to form a concatenated message. Using its private key, it generates a digest and signature for the concatenated message. Finally, the first service provider's agent client module checks whether the extracted digest and signature match the digest and signature generated by its private key for the concatenated message.

[0063] In this embodiment, such as Figure 1 As shown, a first user agent client module is installed in the first user module, a first service agent client module is installed in the first service module, and a public key and a private key are allocated to the first service agent client module by the first management module.

[0064] When the first user module submits user request parameters to the first user agent client module, the first user agent client module uses the public key of the first service agent client module to digest and sign the concatenated information, and uploads the user request parameters, the digest and signature of the concatenated information using the public key of the first service agent client module, and other information to the first blockchain module.

[0065] The first service provider's agent client module extracts the user's request parameters, the digest and signature of the concatenated information using the public key of the first service provider's agent client module, and verifies the signature of the concatenated information using the private key of the first service provider's agent client module. If the signature verification is successful, the first service provider's agent client module sends the user's request parameters to the first service provider module.

[0066] The first management module mainly includes functions such as key management in the allocation process. Users can apply for the first user module in the first management module and install it locally. The first service module can manage the first user module, such as deactivation.

[0067] The first management module can retrieve information from the first blockchain module and then perform statistical display locally to count the usage of the first user module and the usage of the first service module. It can also trace data usage based on the hash of a single call.

[0068] After the first user module requests data services, it will form a route management based on the first service provider proxy client module and the first user proxy client module, and shield the load link in the usage.

[0069] The first service provider's agent client module can mount the interface. After mounting, the first user's agent client module will automatically synchronize the data interface information.

[0070] In this process of transmitting user request parameters from the first user module to the first service module, the first management module distributes public and private keys to the first service agent client module respectively, thereby implementing a dual encryption procedure using public and private keys. This improves the security of the user request parameter transmission process and enables a decentralized data exchange and usage model through the first blockchain module.

[0071] Implementation Method 2: The data interface security system based on a service-party proxy client module described in this implementation method includes the following modules:

[0072] The system includes the following modules:

[0073] After the second service provider module sends a request to the second service provider proxy client module, it also provides the service provider request parameters to the second service provider proxy client module.

[0074] The second service provider proxy client module is used to concatenate the service provider request parameters, service provider information and service provider information parameters in sequence to form concatenated information, and then find the public key of the second user proxy client module, which generates a digest and a signature for the concatenated information respectively.

[0075] The second service provider agent client module saves the service provider request parameters, service provider information, service provider information parameters, digest and signature to the second blockchain module, and records the blockchain information.

[0076] The second blockchain module is used to synchronously send the service provider request parameters, service provider information, service provider information parameters, digest, signature and blockchain information to the second user agent client module and the second management module, respectively.

[0077] The second user's proxy client module determines whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it sends the service request parameters to the second user module. If not, it ends the operation.

[0078] The second user module is used to receive request parameters from the service provider.

[0079] The second management module is used to distribute public and private keys to the second user's agent client module;

[0080] The second management module is used to verify the service provider's request parameters, service provider information, digest, signature, and blockchain information.

[0081] The second management module is used to trace the request parameters of the second service provider module.

[0082] In this embodiment, the service provider information parameters include the service provider timestamp, the service provider IP address, and the service provider request unique ID.

[0083] In this embodiment, the second user proxy client module is used to determine whether the digest and signature generated by its public key on the concatenated information are consistent with the digest and signature generated by its private key on the concatenated information, specifically:

[0084] The second user agent client module pulls the service provider request parameters, service provider information, service provider information parameters, digest, and signature from the blockchain module. It then concatenates the service provider request parameters, service provider information, and service provider information parameters in sequence to form concatenated information. After generating a digest and signature for the concatenated information using its private key, the second user agent client module determines whether the pulled digest and signature are consistent with the digest and signature generated by its private key for the concatenated information.

[0085] In this embodiment, such as Figure 2 As shown, a second service provider agent client module is installed in the second service provider module, and a second user agent client module is installed in the second user module. The second management module allocates public and private keys to the second user agent client module respectively.

[0086] When the second service provider module submits the service provider request parameters to the second service provider agent client module, the second service provider agent client module uses the public key of the second user agent client module to digest and sign the concatenated information, and uploads the service provider request parameters, the digest and signature of the concatenated information using the public key of the second user agent client module, and other information to the second blockchain module.

[0087] The second user agent client module extracts the service provider request parameters, the digest and signature of the concatenated information using the public key of the second user agent client module, and other information from the second blockchain module. It then uses the private key of the second user agent client module to verify the signature of the concatenated information. If the signature verification is successful, the second user agent client module sends the service provider request parameters to the second user module.

[0088] The second management module mainly includes functions such as key management in the allocation process. Users can apply for the second service provider module on the second management module and install it locally. The second user module can manage the second service provider module, such as canceling it.

[0089] The second management module can retrieve information from the second blockchain module and then perform statistical display locally to count the usage of the second service module and the usage of the second user module. It can also trace data usage based on the hash of a single call.

[0090] After the second service provider module requests data services, it will form a route management based on the second user agent client module and the second service provider agent client module, and shield the load link in the usage.

[0091] The second-party proxy client module can mount the interface. After mounting, the second-party proxy client module will automatically synchronize the data interface information.

[0092] In this process of transmitting service request parameters from the second service provider module to the second user module, the second management module distributes public and private keys to the second user agent client module respectively, thereby implementing a dual encryption procedure using public and private keys. This improves the security of the service request parameter transmission process and enables decentralized data exchange through the second blockchain module.

[0093] Implementation Method 3: A secure data interface exchange method described in this implementation method is implemented based on a data interface security system based on a user proxy client as described in Implementation Method 1 and a data interface security system based on a service proxy client as described in Implementation Method 2. Specifically:

[0094] When the first agent module and the second service module exchange request parameters, the first management module allocates a public key and a private key to the first service agent client module, and the second management module allocates a public key and a private key to the second user agent client module.

[0095] The first user module, the first user agent client module, the first blockchain module, the first service provider agent client module, and the first service provider module are executed sequentially.

[0096] The first service module sends the user's request parameters to the second service module, and the second service module retrieves the service request parameters based on the user's request parameters.

[0097] By executing the second service provider module, the second service provider agent client module, the second blockchain module, the second user agent client module, and the second user module in sequence, the secure exchange of request parameters between the first agent module and the second service provider module is completed.

[0098] In this embodiment, such as Figure 3As shown, the secure data interface exchange method includes the following steps:

[0099] The first management module allocates public and private keys to the first service provider agent client module, the second management module allocates public and private keys to the second user agent client module, the first user module installs the first user agent client module, the first service provider module installs the first service provider agent client module, the second user module installs the second user agent client module, and the second service provider module installs the second service provider agent client module.

[0100] In step S1, the first user agent client module automatically synchronizes routing information, security key, and blockchain authorization information from the first management module. Similarly, the second service agent client module automatically synchronizes routing information, security key, and blockchain authorization information from the second management module. That is, when the first user module sends request parameters to the first service module, the first user agent client module uses the public key of the first service agent client module to sign and digest the request, and the first service agent client module uses its private key to verify the signature. Likewise, when the second service module sends requested parameters to the second user module, the second service agent client module uses the public key of the second user agent client module to sign and digest the request, and the second user agent client module uses its private key to verify the signature.

[0101] Step S2: The first user module initiates an interface request or data exchange request by directly accessing the first user proxy client module according to its needs. The first user module assembles the request parameters according to its own needs and interface specifications, and provides the user request parameters to the first user proxy client module.

[0102] Step S3: The first user proxy client module concatenates the user request parameters, user information, user timestamp, user IP, and user request unique ID in sequence to form concatenated information. After obtaining the public key of the first service provider proxy client module, the first service provider proxy client module uses the public key to generate a digest and a signature from the concatenated information using asymmetric algorithms. Here, the signature algorithm can be SM2, RSA, or ECC, and the digest algorithm can be md5, sm3, or sha256.

[0103] In step S4, the first user agent client module saves the user request parameters, user information, user timestamp, user IP, user request unique ID, digest and signature to the first blockchain module, and records the block height and hash of the first blockchain module, etc.

[0104] In step S5, the first blockchain module forwards the user request parameters, user information, user timestamp, user IP, user request unique ID, digest, signature, and blockchain information to the first service provider agent client module via routing information. At the same time, the first blockchain module synchronizes the user request parameters, user information, user timestamp, user IP, user request unique ID, digest, signature, and blockchain information to the first management module.

[0105] Step S6: After receiving the user request parameters, user information, user timestamp, user IP, user request unique ID, digest, signature, and blockchain information forwarded by the first blockchain module, the first service provider agent client module will pull the user request parameters, user information, user timestamp, user IP, user request unique ID, digest, and signature from the first blockchain module. The first service provider agent client module will then concatenate the user request parameters, user information, user timestamp, user IP, user request unique ID, digest, and signature in sequence to form concatenated information. The first service provider agent client module will then digest and sign the concatenated information using its private key and compare it with the received digest and signature. That is, the first service provider agent client module will digest and sign the concatenated information using its public key. If they match, the first service provider agent client module will forward the user request parameters to the first service provider module, which will then send the user request parameters to the second service provider module. The second service provider module will then retrieve the service provider request parameters based on the user request parameters.

[0106] Step S7: The second service provider module sends the service provider request parameters to the second service provider proxy client module. After receiving the service provider request parameters, the second service provider proxy client module concatenates the service provider request parameters, service provider information, service provider timestamp, service provider IP, and service provider request unique ID in sequence to form concatenated information. After obtaining the public key of the second user proxy client module, the second user proxy client module uses the public key to generate a digest and a signature from the concatenated information using asymmetric algorithms. Here, the signature algorithm can be SM2, RSA, or ECC, and the digest algorithm can be md5, sm3, or sha256.

[0107] In step S8, the second service provider proxy client module saves the service provider request parameters, service provider information, service provider timestamp, service provider IP, service provider request unique ID, digest and signature to the second blockchain module, and records the block height and hash of the second blockchain module, etc.

[0108] In step S9, the second blockchain module forwards the service provider request parameters, service provider information, service provider timestamp, service provider IP, service provider request unique ID, digest, signature, and blockchain information to the second user agent client module via routing information. At the same time, the second blockchain module synchronizes the service provider request parameters, service provider information, service provider timestamp, service provider IP, service provider request unique ID, digest, signature, and blockchain information to the second management module.

[0109] In step S10, after the second user agent client module receives the service provider request parameters, service provider information, service provider timestamp, service provider IP, service provider request unique ID, digest, signature, and blockchain information forwarded by the second blockchain module, the second user agent client module will pull the service provider request parameters, service provider information, service provider timestamp, service provider IP, service provider request unique ID, digest, and signature from the second blockchain module. The second user agent client module will then concatenate the service provider request parameters, service provider information, service provider timestamp, service provider IP, and service provider request unique ID in sequence to form concatenated information. Finally, the second user agent client module will use its private... After the key is used to digest and sign the concatenated information, it is compared with the received digest and signature. That is, the public key of the second user's agent client module digests and signs the concatenated information. If they match, it means that the exchange of request parameters is complete and the request parameters are true and valid. This exchange process is permanently stored in the first management module, the second management module, the first blockchain module, and the second blockchain module. If there is any objection to the request parameters, or if the use of the request parameters needs to be traced, the request parameters sent or received by the first user module can be compared with the request parameters on the first blockchain module. Due to the characteristics of the first blockchain module, the request parameters cannot be tampered with using its records.

[0110] This embodiment, based on the secure data interface exchange method described in this invention, provides a practical implementation method:

[0111] Under the existing data exchange model, two government departments exchange data on the results of their cases, allowing data to travel more and citizens to travel less. The exchange is conducted through interfaces, reducing the need for offline materials. However, issues such as the accuracy, authenticity, and tampering of the data during the exchange process remain unresolved. Furthermore, the data may contain user privacy information, making it impossible to guarantee that the data will not be misused.

[0112] Therefore, the data interface secure exchange method described in this embodiment is adopted to build a multi-party mutual trust alliance chain. Multiple parties use this secure exchange method to exchange data. For example, in the housing provident fund loan business, real estate certificates of natural resources are required, and in the real estate mortgage release, housing provident fund loan settlement certificates are required. When both parties use this secure exchange method in the data exchange process, there are the following advantages:

[0113] 1) The data provided by both parties is authoritative and credible, and can be verified through the blockchain module, with mutual recognition of the data;

[0114] 2) The data will not be tampered with during the exchange process;

[0115] 3) The entire exchange process is recorded, and neither party will abuse it. This allows for effective supervision without infringing on user privacy.

[0116] The foregoing has provided a detailed description of a data interface security system and exchange method based on a user proxy client module and a service proxy client module proposed in this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A secure data interface exchange method, said exchange method being implemented based on a data interface security system based on a user-side proxy client and a data interface security system based on a service-side proxy client, characterized in that, Specifically: When the first agent module and the second service module exchange request parameters, the first management module allocates a public key and a private key to the first service agent client module, and the second management module allocates a public key and a private key to the second user agent client module. The first user module, the first user agent client module, the first blockchain module, the first service provider agent client module, and the first service provider module are executed sequentially. The first service module sends the user's request parameters to the second service module, and the second service module retrieves the service request parameters based on the user's request parameters. By executing the second service provider module, the second service provider agent client module, the second blockchain module, the second user agent client module, and the second user module in sequence, the secure exchange of request parameters between the first agent module and the second service provider module is completed. The data interface security system based on a user agent client includes the following modules: The first user module is used to send a request to the first user agent client module and provide the user request parameters to the first user agent client module. The first user agent client module is used to concatenate the user request parameters, user information, and user information parameters in sequence to form concatenated information, and then find the public key of the first service agent client module, which generates a digest and a signature for the concatenated information respectively. The first user agent client module is used to save the user request parameters, user information, user information parameters, digest and signature to the first blockchain module respectively, and record the blockchain information; The first blockchain module is used to synchronously send the user request parameters, user information, user information parameters, digest, signature and blockchain information to the first service provider agent client module and the first management module, respectively. The first service provider's proxy client module is used to determine whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it will send the user's request parameters to the first service provider module. If not, the operation will end. The first service provider module is used to receive request parameters from the user. The first management module is used to distribute public and private keys to the first service provider's agent client module; The first management module is used to verify the user's request parameters, user information, digest, signature, and blockchain information; The first management module is used to trace the request parameters of the first user module. The data interface security system based on a service provider proxy client includes the following modules: The second service provider module sends a request to the second service provider proxy client module and then provides the service provider request parameters to the second service provider proxy client module. The second service provider proxy client module is used to concatenate the service provider request parameters, service provider information and service provider information parameters in sequence to form concatenated information, and then find the public key of the second user proxy client module, which generates a digest and a signature for the concatenated information respectively. The second service provider agent client module saves the service provider request parameters, service provider information, service provider information parameters, digest and signature to the second blockchain module, and records the blockchain information. The second blockchain module is used to synchronously send the service provider request parameters, service provider information, service provider information parameters, digest, signature and blockchain information to the second user agent client module and the second management module, respectively. The second user's proxy client module determines whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information. If they are consistent, it sends the service request parameters to the second user module. If not, it ends the operation. The second user module is used to receive request parameters from the service provider; The second management module is used to distribute public and private keys to the second user's agent client module; The second management module is used to verify the service provider's request parameters, service provider information, digest, signature, and blockchain information. The second management module is used to trace the request parameters of the second service provider module.

2. The secure data interface exchange method according to claim 1, characterized in that, The user information parameters include the user timestamp, user IP address, and user request unique ID.

3. The secure data interface exchange method according to claim 1, characterized in that, The first service provider's proxy client module is used to determine whether the digest and signature generated by its public key on the concatenated information are consistent with the digest and signature generated by its private key on the concatenated information. Specifically: The first service provider's agent client module pulls the user request parameters, user information, user information parameters, digest, and signature from the blockchain module. It then concatenates these parameters in sequence to form a concatenated message. Using its private key, it generates a digest and signature for the concatenated message. Finally, the first service provider's agent client module checks whether the extracted digest and signature match the digest and signature generated by its private key for the concatenated message.

4. The secure data interface exchange method according to claim 1, characterized in that, The service provider information parameters include the service provider timestamp, service provider IP address, and service provider request unique ID.

5. A secure data interface exchange method according to claim 1, characterized in that, The second user proxy client module is used to determine whether the digest and signature generated by its public key pair of the concatenated information are consistent with the digest and signature generated by its private key pair of the concatenated information, specifically: The second user agent client module pulls the service provider request parameters, service provider information, service provider information parameters, digest, and signature from the blockchain module. It then concatenates the service provider request parameters, service provider information, and service provider information parameters in sequence to form concatenated information. After generating a digest and signature for the concatenated information using its private key, the second user agent client module determines whether the pulled digest and signature are consistent with the digest and signature generated by its private key for the concatenated information.

Images