A method and system for intercepting application programming interfaces (APIs).

Abstract

This invention provides an application programming interface (API) interception method and system. It obtains a preset interception policy and synchronizes the policy to the user space of the API interceptor. If the interception policy is blocking, the policy in the user space is synchronized to the kernel space of the API interceptor via a BPF map, and blocking is performed in the kernel space. If the interception policy is tampering, the message content is tampered with and sent in the user space using an AF_XDP socket. The interception policy and content can be customized according to actual needs, flexibly addressing various API interception scenarios, improving the security and compliance of API calls, and enhancing accuracy and speed.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, specifically relating to an application programming interface (API) interception method and system. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Application Programming Interfaces (APIs) are the primary means by which various applications and services exchange data and integrate functions, mainly based on network communication for data interaction. Currently, the main methods for intercepting network communication and APIs include intercepting Transmission Control Protocol (TCP) sessions and intercepting data at the server's network interface card (NIC).

[0004] According to the inventor, current API interception mainly includes the following three methods. The first method is as follows: Figure 1 As shown, this method primarily utilizes the characteristics of the RST flag in a TCP connection to intercept sessions. By capturing network packets to obtain key information about the TCP connection, including source and destination IP addresses and ports, and the TCP sequence numbers for both the request and response directions, an RST packet is generated in the corresponding direction to forcibly disconnect the TCP session chain. However, this approach has high requirements for the timeliness of RST packet delivery: the RST packet must arrive at the requesting end before the actual response packet. Therefore, this method places high demands on the efficiency of request packet parsing and network latency. Furthermore, in the internet environment, to prevent IP address spoofing or forgery attacks, ISPs typically enable source IP protection mechanisms. Under this mechanism, this TCP interception method will be unable to reach the destination machine. Additionally, after blocking using TCP RST, the communication anomaly can be directly detected at the destination end through packet capture or interface viewing (such as browser error messages), resulting in a relatively high risk of exposure.

[0005] The second option is as follows: Figure 2 As shown, XDP technology is used to intercept information from specific IPs. Specifically, XDP is used to obtain the network 5-tuple information triggered by the login action, and the login process information generated by the login server is obtained by correlating it with the server's login logs. Simultaneously, based on a self-learning strategy, XDP technology can be used to discard packets from abnormal IPs. However, this solution has too coarse an interception granularity, intercepting all sessions under the IP, which may result in false positives.

[0006] The third option is as follows: Figure 3As shown, this approach also uses XDP technology for content interception. However, this scheme specifically uses XDP to intercept all network packets in the network card and uses the Hyperscan library to perform regular expression matching on the packet content to determine if there are any security risks. If a security risk is found, the packet is dropped; otherwise, it is allowed to pass to the kernel protocol stack. This scheme has the problem that Hyperscan cannot run in kernel mode. To implement the above scheme, the packets need to be copied from the network card driver layer to user mode before regular expression matching can be performed. This operation and subsequent regular expression matching will consume CPU resources, causing a certain amount of CPU performance consumption, especially in high-concurrency scenarios. In addition, the packet dropping operation in this scheme needs to be performed in kernel mode. If regular expression matching is completed in user mode and then entered kernel mode, there will be a certain packet delay, which may affect the processing speed of subsequent packets in high-concurrency scenarios, causing overall packet delay.

[0007] In summary, existing API interception solutions all have certain shortcomings, with issues in performance, speed, and accuracy. Summary of the Invention

[0008] To address the aforementioned problems, this invention proposes an application programming interface (API) interception method and system. This system allows for customized interception strategies and content based on actual needs, flexibly responding to various API interception scenarios, improving the security and compliance of API calls, and enhancing accuracy and speed.

[0009] According to some embodiments, the present invention adopts the following technical solution:

[0010] An application programming interface (API) interception method includes the following steps:

[0011] Obtain the preset interception policy and synchronize the interception policy to the user space of API interception;

[0012] If the interception policy is blocking, the policy in user space is synchronized to the kernel space of API interception through BPF map, and the blocking is performed in kernel space;

[0013] If the interception strategy is tampering, the AF_XDP socket is used to complete the tampering and sending of the message content in user space.

[0014] As an alternative implementation, the interception policy includes actions and rules. The actions include blocking or content tampering. The rules include interception rules and tampering rules. The interception rules support blocking specified IPs, ports, and protocol types, blocking specific message content, and blocking based on multiple conditions. The tampering rules support modifying IPs, ports, MAC addresses, and data content.

[0015] As an alternative implementation, the policy in user space is synchronized to the kernel space for API interception. The specific process of blocking in kernel space includes obtaining the original content of the data packet by the fast data path XDP after the data packet arrives.

[0016] Data parsing is completed within the fast data path to obtain the offsets of the network interface layer, network layer, transport layer, and application layer, as well as the corresponding IP, port, protocol type, and data content.

[0017] Rules for obtaining data packets;

[0018] Determine whether the current data packet needs to be discarded by comparing the rules;

[0019] When the packet is set to be dropped, it will be dropped directly and will not enter the subsequent kernel protocol stack; otherwise, it will enter the protocol stack normally for subsequent user-space applications to read.

[0020] As a further implementation, a fast data path hook is mounted in the network card driver to determine whether a data packet has arrived.

[0021] As an alternative implementation method, the specific process of using the AF_XDP socket to complete message content modification and transmission in user space includes:

[0022] Create the Xsk mapping in kernel mode;

[0023] Create a socket of type AF_XDP in user space, register the corresponding RX / TX ring, and bind the socket;

[0024] User space creates user memory and registers it with the AF_XDP socket;

[0025] Store the socket in the Xsk mapping;

[0026] Determine if the current packet belongs to the AF_XDP socket queue; if so, forward it to the user-space RX ring.

[0027] Read and parse the messages in the RX ring, and modify the messages after matching the target information according to the existing tampering policy;

[0028] The modified message is placed back into the TX ring, and the XDP is waited for to complete message transmission.

[0029] As a further implementation, when binding a socket, the socket is bound to a specified queue of a specified network interface card.

[0030] As a further implementation, when user space creates user memory and registers it to the AF_XDP socket, it also includes creating the fill ring and composition ring of the user memory and mapping them to user space.

[0031] An application programming interface (API) interception system, comprising:

[0032] The policy management module is configured to obtain a preset interception policy and synchronize the interception policy to the user space of API interception;

[0033] The blocking module is configured to synchronize the policy in user space to the kernel space of API interception via BPF map if the blocking policy is to block, and then block in kernel space.

[0034] The tampering module is configured to use the AF_XDP socket in user space to tamper with and send the message content if the interception policy is tampering.

[0035] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the steps in the above method.

[0036] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the steps in the method described above.

[0037] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0038] This invention directly intercepts APIs on the server side, eliminating various interferences encountered by API interception methods in the network communication process, improving the success rate of API interception, and reducing interception interference caused by network environment factors.

[0039] This invention proposes two API interception methods—blocking and tampering—based on different strategies. The blocking method does not involve data switching between kernel and user modes, offering higher processing efficiency than existing solutions. It also supports customizable packet dropping policies, allowing for customized packet dropping effects based on various conditions or combinations of conditions such as IP address, port, and packet content. Furthermore, the API initiator is largely unaware of the blocking action, and it is untraceable. The tampering method can correct the request content of the packet, preventing API privilege escalation or data leakage.

[0040] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0041] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0042] Figure 1 This is a solution in existing technology that utilizes the characteristics of the RST flag in a TCP connection to intercept sessions;

[0043] Figure 2 This is one of the existing technologies that uses XDP technology to intercept specific IPs;

[0044] Figure 3 This is the second solution in the existing technology that uses XDP technology to intercept specific IPs;

[0045] Figure 4 This is a schematic diagram of the method flow in this embodiment;

[0046] Figure 5 This is a schematic diagram of the blocking process in this embodiment;

[0047] Figure 6 This is a schematic diagram of the tampering process in this embodiment. Detailed Implementation

[0048] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0049] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0050] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0051] Example 1

[0052] An API interception method based on XDP is proposed, which allows for customization of interception strategies and content according to actual needs, flexibly addressing various API interception scenarios and improving the security and compliance of API calls.

[0053] like Figure 4 As shown, it includes the following steps:

[0054] Step 1: Deploy the Agent on the application server to monitor all API requests sent to the local machine.

[0055] Step 2: The management side pre-sets the interception strategy according to actual needs and sends it to the policy management module on the Agent side.

[0056] The interception strategy includes actions and rules, among which:

[0057] Interception actions include blocking or content tampering.

[0058] The blocking rules support blocking specified IP addresses, ports, and protocol types; they also support blocking specific message content; and they support blocking based on multiple conditions.

[0059] Tampering rules support modifying IP addresses, ports, MAC addresses, and specific data content.

[0060] Step 3: After receiving the policy, the policy management module on the Agent side synchronizes the policy to the user space of the API interceptor.

[0061] Step 4: If the policy is blocking, the user space synchronizes the policy from the user space to the kernel space for API interception via BPF map. The blocking process is then implemented in the kernel space.

[0062] Step 5: If the strategy is tampering, the AF_XDP socket technology is used directly to complete the content tampering and sending process in user space.

[0063] In this embodiment, as Figure 5 As shown, the blocking process in step four includes:

[0064] (1) Mount the xdp hook in the network card driver. xdp stands for eXpress Data Path. When a data packet arrives at the network card, xdp obtains the original content of the data packet.

[0065] (2) Data parsing is completed within xdp to obtain the offset bits of the network interface layer, network layer, transport layer, and application layer, as well as the corresponding IP, port, protocol type, data content, and other information.

[0066] (3) The relevant packet dropping rules can be obtained by querying the bpf map.

[0067] (4) Determine whether the current data packet needs to be discarded by comparing the rules.

[0068] (5) Based on the implementation principle of XDP, when XDP_DROP is returned, the data packet will be directly discarded and will not enter the subsequent kernel protocol stack; when XDP_PASS is returned, it will enter the protocol stack normally for subsequent user-mode applications to read.

[0069] like Figure 6 As shown, step five of the tampering process includes the following steps:

[0070] (a) Create a bpf map of type BPF_MAP_TYPE_XSKMAP in kernel mode and name it Xskmap.

[0071] (b) Create a socket of type AF_XDP in user space and register the corresponding RX RING and TX RING.

[0072] Bind the socket to the specified queue of the specified network interface card.

[0073] (c) Create a UMEM in user space and register it to the AF_XDP socket.

[0074] (d) Create the FILL RING and COMPLETION RING in UMEM and map them to user space.

[0075] (e) Store the socket in Xskmap.

[0076] In the axdp program, it determines whether the current packet belongs to the AF_XDP socket queue. If so, it forwards the packet to the user-space RX RING through the bpf_redirect_map interface.

[0077] (f) Read and parse the messages in the RX RING, and modify the messages after matching the target information according to the existing tampering policy.

[0078] (g) Put the modified message back into the TX RING and wait for XDP to complete the message transmission.

[0079] The above embodiment differs from existing solutions that use TCP connection blocking. Existing solutions require RST packets to arrive at the destination before actual response packets during data interception, thus placing high demands on packet parsing efficiency and network latency (to ensure a successful blocking rate, the response time in an intranet environment needs to be within 10 milliseconds, and in an internet environment, within 20 milliseconds to achieve the ideal blocking effect). Furthermore, in an internet environment, to prevent IP address spoofing or forgery attacks, operators typically enable source IP protection mechanisms. Under this mechanism, this type of TCP interception will fail to reach the destination machine. This embodiment directly intercepts the API on the server side, eliminating various interferences encountered by API interception methods in the network communication process.

[0080] The blocking method in this embodiment does not involve data switching between kernel mode and user mode, resulting in higher processing efficiency compared to existing solutions. It also supports customizable packet dropping policies, allowing for customized packet dropping effects based on various conditions or combinations of conditions such as IP address, port, and packet content. Furthermore, the API initiator is largely unaware of the blocking action, and it is untraceable.

[0081] The tampering method in this embodiment can correct the request content of the message and avoid API privilege escalation or data leakage.

[0082] Example 2

[0083] An application programming interface (API) interception system, comprising:

[0084] The policy management module is configured to obtain a preset interception policy and synchronize the interception policy to the user space of API interception;

[0085] The blocking module is configured to synchronize the policy in user space to the kernel space of API interception via BPF map if the blocking policy is to block, and then block in kernel space.

[0086] The tampering module is configured to use the AF_XDP socket in user space to tamper with and send the message content if the interception policy is tampering.

[0087] The above modules are mainly deployed on the client side, while the Agent is deployed on the application server side to monitor all API requests sent to the local machine.

[0088] It also includes a management module, which pre-sets interception policies based on actual needs and distributes them to the agent's policy management module.

[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made by those skilled in the art without creative effort within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for intercepting application programming interfaces (APIs), characterized in that, Includes the following steps: Obtain the preset interception policy and synchronize the interception policy to the user space of API interception; If the interception policy is blocking, the policy in user space is synchronized to the kernel space of API interception through BPF map, and the blocking is performed in kernel space; If the interception strategy is tampering, the AF_XDP socket is used to complete the tampering and sending of the message content in user space; The policy in user space is synchronized to the kernel space for API interception. The specific process of blocking in kernel space includes obtaining the original content of the data packet by the fast data path after the data packet arrives. Data parsing is completed within the fast data path to obtain the offsets of the network interface layer, network layer, transport layer, and application layer, as well as the corresponding IP, port, protocol type, and data content. Rules for obtaining data packets; Determine whether the current data packet needs to be discarded by comparing the rules; When the packet is set to be dropped, it will be dropped directly and will not enter the subsequent kernel protocol stack; otherwise, it will enter the protocol stack normally for subsequent user-space applications to read.

2. The application programming interface (API) interception method as described in claim 1, characterized in that, The interception strategy includes actions and rules. The actions include blocking or content tampering. The rules include interception rules and tampering rules. The interception rules support blocking specified IPs, ports and protocol types, blocking specific message content, and blocking with multiple conditions. The tampering rules support modification of IP address, port, MAC address, and data content.

3. The application programming interface (API) interception method as described in claim 1, characterized in that, Attach a fast data path hook to the network card driver to determine if a data packet has arrived.

4. The application programming interface (API) interception method as described in claim 1, characterized in that, The specific process of using the AF_XDP socket to complete message content modification and transmission in user space includes: Create the Xsk mapping in kernel mode; Create a socket of type AF_XDP in user space, register the corresponding RX / TX ring, and bind the socket; User space creates user memory and registers it with the AF_XDP socket; Store the socket in the Xsk mapping; Determine if the current packet belongs to the AF_XDP socket queue; if so, forward it to the user-space RX ring. Read and parse the messages in the RX ring, and modify the messages after matching the target information according to the existing tampering policy; The modified message is placed back into the TX ring, and the XDP is waited for to complete message transmission.

5. The application programming interface (API) interception method as described in claim 4, characterized in that, When binding a socket, the socket is bound to a specified queue of the specified network interface card.

6. The application programming interface (API) interception method as described in claim 4, characterized in that, When user space creates user memory and registers it to the AF_XDP socket, it also includes creating the fill ring and composition ring of user memory and mapping them to user space.

7. An application programming interface (API) interception system, characterized in that, include: The policy management module is configured to obtain a preset interception policy and synchronize the interception policy to the user space of API interception; The blocking module is configured to synchronize the policy in user space to the kernel space of API interception via BPF map if the blocking policy is to block, and then block in kernel space. The tampering module is configured to use the AF_XDP socket to tamper with and send the message content in user space if the interception policy is tampering. The policy in user space is synchronized to the kernel space for API interception. The specific process of blocking in kernel space includes obtaining the original content of the data packet by the fast data path after the data packet arrives. Data parsing is completed within the fast data path to obtain the offsets of the network interface layer, network layer, transport layer, and application layer, as well as the corresponding IP, port, protocol type, and data content. Rules for obtaining data packets; Determine whether the current data packet needs to be discarded by comparing the rules; When the packet is set to be dropped, it will be dropped directly and will not enter the subsequent kernel protocol stack; otherwise, it will enter the protocol stack normally for subsequent user-space applications to read.

8. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, complete the steps of the method according to any one of claims 1-6.

9. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the steps of the method according to any one of claims 1-6.

Images