Http interface authentication method and related device

Abstract

The application discloses an HTTP interface authentication method and related equipment, and the method is applied to an interface service end; the method adopts a pre-allocated key and a signature parameter to decrypt authorization parameters from an interface calling end to obtain a plaintext string; then, a timestamp parameter and a current random number in the plaintext string are judged in sequence, and whether the current request is overdue and whether the current random number exists in a cache are specifically judged; if the current request is overdue or the current random number exists in the cache, it is judged that the current request is illegal and the current request is ignored; the request is not processed; if the current request is not overdue and the current random number does not exist in the cache, it is judged that the current request is legal and the current request is processed; the method can effectively prevent intermediate attacks through unified authentication of the interface, improve the security of the interface service, and guarantee the data safety in the interface communication process; the method is simple and feasible, has strong universality and is convenient to implement, and has good popularization and application value.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of Internet data exchange, and particularly relates to an HTTP interface authentication method and related equipment. BACKGROUND

[0002] The global Internet is increasingly developed, and a considerable part of data exchange in the Internet is implemented through an interface mode based on an HTTP protocol. The HTTP interface is based on the HTTP protocol and is a general and commonly used means of Internet data exchange. The HTTP protocol itself is stateless, and when an interface is called, the context and the current state do not need to be considered, the complexity is reduced, and the decoupling between business systems is realized.

[0003] However, in the communication process of the existing data exchange based on the HTTP interface, there is a lack of authentication measures, and the data of privacy and sensitive interfaces cannot be effectively protected in terms of security, confidentiality and integrity. Once the above situation occurs, a series of serious negative effects may be caused, which involve individuals, organizations and even the whole society.

[0004] Therefore, the existing data exchange based on the HTTP interface is prone to unlimited fake requests and attacks due to the lack of effective authentication measures. SUMMARY

[0005] In order to overcome the shortcomings of the above-mentioned technologies, the application provides an HTTP interface authentication method and related equipment, which can solve the technical problem that the existing data exchange based on the HTTP interface is prone to unlimited fake requests and attacks due to the lack of effective authentication measures.

[0006] In order to achieve the above-mentioned purposes, the technical scheme adopted by the application is as follows:

[0007] An HTTP interface authentication method applied to an interface service end, comprising the following steps:

[0008] Decrypting an authorization parameter from an interface calling end based on a pre-allocated key and a signature parameter to obtain a plaintext string, wherein the plaintext string contains a timestamp parameter and a current random number;

[0009] Judging whether the current request is overdue based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued:

[0010] Judging whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed.

[0011] Further, after judging that the current request is legal and processing the current request, the current random number is stored in the cache and the expiration time of the cache is set.

[0012] Further, before the interface calling end transmits the authorization parameter to the interface service end, the interface service end pre-allocates a key and a signature parameter for the interface calling end.

[0013] Further, after allocating the key and the signature parameter, when the interface calling end calls the service interface of the interface service end, the interface service end converts the request body into a json format.

[0014] Further, after the interface service end converts the request body into a json format, the interface calling end encrypts the request body by using the pre-allocated key and the signature parameter to obtain an encrypted string; the interface calling end puts the encrypted string into the authorization parameter in the request header and transmits the authorization parameter to the interface service end.

[0015] Further, based on the pre-allocated key and the signature parameter, the authorization parameter from the interface calling end is decrypted, and if the decryption is successful, it is judged that the current request is legal and a plaintext string is obtained; otherwise, it is judged that the current request is illegal and the current request is ignored.

[0016] Further, the preset time is 5 minutes.

[0017] An http interface authentication system for implementing the steps of the above http interface authentication method, comprising:

[0018] A decryption module for decrypting the authorization parameter from the interface calling end based on the pre-allocated key and the signature parameter to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number;

[0019] A timeout judgment module for judging whether the current request is timed out based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued;

[0020] A random number judgment module for judging whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, it is judged that the current request is illegal and the current request is ignored; otherwise, it is judged that the current request is legal and the current request is processed.

[0021] An apparatus comprising:

[0022] A memory for storing a computer program;

[0023] A processor for executing the computer program to implement the steps of the above http interface authentication method.

[0024] A computer readable storage medium stores a computer program, which is executed by a processor to implement the steps of the http interface authentication method.

[0025] Compared with the prior art, the present application has the following advantages:

[0026] The present application also provides an http interface authentication method, which is applied to an interface service end. The method decrypts authorization parameters from an interface calling end according to a pre-allocated key and signature parameters to obtain a plaintext string. Then, the timestamp parameter and the current random number in the plaintext string are judged in sequence, specifically whether the current request is overdue and whether the current random number exists in the cache. If the current request is overdue or the current random number exists in the cache, it is judged that the current request is illegal and the current request is ignored. The request is not processed. If it is not overdue and the current random number does not exist in the cache, it is judged that the current request is legal and the current request is processed. The unified authentication of the interface can effectively prevent intermediate attacks and improve the security of the interface service, ensuring the data security in the interface communication process. The method is simple, feasible, universal and easy to implement, and has good popularization and application value.

[0027] In addition, the present application also has the following advantages:

[0028] First, enhance the security of the interface: decrypt the authorization parameters by pre-allocated key and signature parameters, ensure that only the calling end with correct key can successfully access the interface, effectively prevent unauthorized access and data tampering risk.

[0029] Second, improve the request verification efficiency: the method uses the timestamp parameter to judge whether the request is overdue, and checks whether the current random number exists in the cache to prevent replay attacks. This double verification mechanism can quickly and accurately judge the legality of the request, improving the security and stability of the interface.

[0030] Third, reduce the server load: for illegal or repeated requests (such as overdue requests or requests containing used random numbers), the server can quickly identify and ignore, avoiding unnecessary processing overhead, thereby reducing the load of the server.

[0031] Fourth, support high concurrency scenarios: since the method is based on the cache mechanism to check the random number, it can maintain high processing efficiency in high concurrency scenarios, ensuring the stability and response speed of the interface.

[0032] Fifth, simplify development and management: the method provides a unified interface authentication mechanism, simplifies the development of interface security process, and is also beneficial to the unified management and monitoring of the interface by the system administrator.

[0033] Sixth, easy to extend and integrate: the method has good scalability and integration, and can be customized and optimized according to actual needs to adapt to the needs of different systems and business scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 A flowchart of an http interface authentication method provided for an embodiment of the application is shown in the figure.

[0035] Figure 2 A flowchart of an http interface authentication method provided for the application is shown in the figure.

[0036] Figure 3 A structural diagram of an http interface authentication system provided for the application is shown in the figure. DETAILED DESCRIPTION

[0037] The application provides an http interface authentication method, as shown in the figure, comprising the following steps: Figure 2

[0038] S1: based on the pre-allocated key and signature parameter, the authorization parameter from the interface calling end is decrypted to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number.

[0039] S2: based on the timestamp parameter, judge whether the current request is overdue; if it exceeds the preset time (preferably 5 minutes), ignore the current request, otherwise continue to the next step.

[0040] S3: based on the random number in the cache and the current random number, judge whether the current request is legal; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed.

[0041] Further comprising:

[0042] S4: after judging that the current request is legal and processing the current request, the current random number is stored in the cache and the expiration time of the cache is set.

[0043] Specifically, before the interface calling end transmits the authorization parameter to the interface service end, the interface service end pre-allocates the key and signature parameter for the interface calling end.

[0044] After allocating the key and signature parameter, when the interface calling end calls the service interface of the interface service end, the interface service end converts the request body into json format. ​

[0045] The interface service end converts the request body into a json format, and the interface calling end uses a pre-allocated key and a signature parameter to perform aes gcm encryption on the request body, to obtain an encrypted string; the interface calling end places the encrypted string in an authorization parameter in a request header, and transmits the authorization parameter to the interface service end.

[0046] Based on the pre-allocated key and the signature parameter, the authorization parameter from the interface calling end is decrypted, if the decryption is successful, it is judged that the current request is legal and a plaintext string is obtained; otherwise, it is judged that the current request is illegal and the current request is ignored.

[0047] As shown in Figure 3 The application further provides an http interface authentication system, comprising: a decryption module configured to decrypt the authorization parameter from the interface calling end based on the pre-allocated key and the signature parameter, to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number; a timeout judgment module configured to judge whether the request is timed out based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued; a random number judgment module configured to judge whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, it is judged that the current request is illegal and the current request is ignored; otherwise, it is judged that the current request is legal and the current request is processed.

[0048] The application further provides a device, comprising: a memory configured to store a computer program; and a processor configured to execute the computer program to implement the steps of the http interface authentication method.

[0049] The processor executes the computer program to implement the steps of the http interface authentication, for example: based on the pre-allocated key and the signature parameter, the authorization parameter from the interface calling end is decrypted to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number; based on the timestamp parameter, it is judged whether the request is timed out; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued; based on the random number in the cache and the current random number, it is judged whether the current request is legal; if the current random number is the same as any random number in the cache, it is judged that the current request is illegal and the current request is ignored; otherwise, it is judged that the current request is legal and the current request is processed.

[0050] Alternatively, the processor implements the functions of the modules in the above system when executing the computer program, for example: a decryption module configured to decrypt authorization parameters from an interface calling end based on a pre-allocated key and signature parameters to obtain a plaintext string; the plaintext string contains a timestamp parameter and a current random number; a timeout judgment module configured to judge whether the request is timed out based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued; a random number judgment module configured to judge whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed.

[0051] Illustratively, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a preset function, which are used to describe the execution process of the computer program in the http interface authentication device. For example, the computer program can be divided into a decryption module, a timeout judgment module and a random number judgment module; the specific functions of each module are as follows: the decryption module is configured to decrypt authorization parameters from an interface calling end based on a pre-allocated key and signature parameters to obtain a plaintext string; the plaintext string contains a timestamp parameter and a current random number; the timeout judgment module is configured to judge whether the request is timed out based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued; the random number judgment module is configured to judge whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed.

[0052] The http interface authentication device can be a desktop computer, a notebook, a palm computer and a cloud server, etc. The http interface authentication device can include, but is not limited to, a processor, a memory. Those skilled in the art can understand that the above is an example of the http interface authentication device, and does not constitute a limitation on the http interface authentication device, and can include more components than the above, or combine certain components, or different components, for example, the http interface authentication device can also include an input / output device, a network access device, a bus, etc.

[0053] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The processor is a control center of the http interface authentication, and connects various parts of the http interface authentication device through various interfaces and lines.

[0054] The memory can be used to store the computer program and / or modules, and the processor realizes various functions of the http interface authentication device by running or executing the computer program and / or modules stored in the memory, and calling the data stored in the memory.

[0055] The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc.; and the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory devices.

[0056] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the http interface authentication method.

[0057] If the modules / units of the http interface authentication system are realized in the form of software function units and sold or used as independent products, the modules / units can be stored in a computer readable storage medium.

[0058] Based on such understanding, the present application implements all or part of the processes in the above-mentioned http interface authentication method, and can also be completed by instructing relevant hardware through a computer program. The computer program can be stored in a computer readable storage medium, and the computer program can implement the steps of the above-mentioned http interface authentication method when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, executable files or preset intermediate forms, etc.

[0059] The computer readable storage medium can include any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. that can carry the computer program code.

[0060] It should be noted that the content contained in the computer readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable storage medium does not include electrical carrier signals and telecommunication signals.

[0061] The present application will be further described below in conjunction with the embodiments and the accompanying drawings:

[0062] Embodiments

[0063] As mentioned in the background: in the existing communication process of data exchange based on the http interface, there is a lack of authentication measures, which is easy to be unlimitedly forged and attacked, resulting in the security, confidentiality and integrity of the interface data of the privacy type and sensitive type cannot be effectively guaranteed; once the above-mentioned situation occurs, a series of serious negative effects may be produced, which involve individuals, organizations and even the whole society.

[0064] In order to solve the above-mentioned problems, the present embodiment provides an http interface authentication method, which can effectively solve the problem of unlimitedly forged and attacked interface data by intermediaries in the communication process.

[0065] As shown in the figure, the present embodiment provides an http interface authentication method, and the specific steps are as follows: Figure 1

[0066] First step: the interface service end allocates two fixed parameters for the interface calling end:

[0067] secret key (secret key).

[0068] add (signature). ​

[0069] The second step, when the interface calling end calls the service interface of the interface service end, the interface service end converts the request body of this request into a json format string.

[0070] After conversion into the json format, the request body is encrypted using the encryption mode of aes gcm by using the secret key provided by the interface service end and the add signature, and a string of ciphertext is obtained after successful encryption.

[0071] The encrypted ciphertext string is placed in the auth authorization parameter of the request header, and the encrypted authorization parameter includes the timestamp and a current random number generated by the interface calling end when the service calling end requests.

[0072] The third step, the interface service end decrypts the auth authorization parameter in the header transmitted by the interface calling end according to the secret key and the add signature parameter, if the decryption fails, the request is illegal, and this request is not processed.

[0073] The fourth step, if the interface service end decrypts the auth authorization parameter in the header transmitted by the interface calling end successfully, a meaningful plaintext string is obtained, the timestamp parameter in the plaintext is obtained, and the current time is compared with the system current time to judge whether the request exceeds 5 minutes (current time - timestamp parameter value > 5 minutes), only the request within 5 minutes is legal and effective, and the request exceeding 5 minutes is not processed.

[0074] The interface service end obtains the random number in the plaintext, checks whether the random number exists in the redis cache of the service end, if the random number exists, the request is repeated or fake, the request is illegal, and the replay attack is prevented.

[0075] The sixth step, if the above request conditions are legal, the random number is stored in the redis cache, and the expiration time of the cache is set to be less than 5 minutes.

[0076] The seventh step, finally, the interface business processing is performed, and the processing result is returned to the interface calling end.

[0077] In summary, the present application provides an http interface authentication method, compared with the existing authentication method, the present method has the following advantages:

[0078] First, enhance interface security: decrypt the authorization parameters with pre-allocated keys and signature parameters, ensuring that only the calling end with the correct key can successfully access the interface, effectively preventing unauthorized access and data tampering risks.

[0079] Second, improve request verification efficiency: this method uses timestamp parameters to determine if the request is overdue, and checks if the current random number exists in the cache to prevent replay attacks. This dual verification mechanism can quickly and accurately determine the legitimacy of the request, improving the security and stability of the interface.

[0080] Third, reduce server load: for illegal or repeated requests (such as overdue requests or requests containing used random numbers), the server can quickly identify and ignore them, avoiding unnecessary processing overhead and reducing server load.

[0081] Fourth, support high-concurrency scenarios: since this method is based on cache mechanism for random number checking, it can maintain high processing efficiency in high-concurrency scenarios, ensuring the stability and response speed of the interface.

[0082] Fifth, simplify development and management: this method provides a unified interface authentication mechanism, simplifying the development process for interface security and facilitating system administrators to manage and monitor the interface.

[0083] Sixth, easy to extend and integrate: this method has good scalability and integration, and can be customized and optimized according to actual needs to adapt to different system and business scenarios.

[0084] As can be seen, this method decrypts the authorization parameters from the interface calling end with pre-allocated keys and signature parameters to obtain plaintext strings, then judges the timestamp parameter and the current random number in the plaintext string in turn, specifically judging whether the current request is overdue and whether the current random number exists in the cache; if the current request is overdue or the current random number exists in the cache, it is judged that the current request is illegal and the current request is ignored; the request is not processed; if it is not overdue and the current random number does not exist in the cache, it is judged that the current request is legal and the current request is processed; this method can effectively prevent intermediate attacks through the unified authentication of the interface, improve the security of the interface service, and ensure the data security in the interface communication process.

[0085] The above embodiment is only one of the implementation ways of the technical solution of the present application, and the scope of protection claimed by the present application is not limited to this embodiment, but also includes any changes, substitutions and other implementation ways easily thought of by those skilled in the art within the technical scope disclosed by the present application.

Claims

1. An http interface authentication method applied to an interface server, characterized in that, The method comprises the following steps: decrypting the authorization parameter from the interface calling end based on the pre-allocated key and signature parameter to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number; judging whether the current request is overdue based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued: judging whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed; allocating a key and a signature parameter for the interface calling end by the interface service end before the interface calling end transmits the authorization parameter to the interface service end; after the key and the signature parameter are allocated, the interface service end converts the request body into a json format when the interface calling end calls the service interface of the interface service end; after the interface service end converts the request body into a json format, the interface calling end encrypts the request body using the pre-allocated key and signature parameter by aes gcm to obtain an encrypted string; the interface calling end puts the encrypted string into the authorization parameter in the request header and transmits the authorization parameter to the interface service end; decrypting the authorization parameter from the interface calling end based on the pre-allocated key and signature parameter, if the decryption is successful, judging that the current request is legal and obtaining a plaintext string; otherwise, judging that the current request is illegal and ignoring the current request.

2. The method of claim 1, wherein the http interface authentication method is characterized in that, Further comprising storing the current random number in the cache and setting the expiration time of the cache after judging that the current request is legal and processing the current request.

3. The method of claim 1, wherein the http interface authentication method is characterized by, The preset time is 5 minutes.

4. An http interface authentication system for implementing the steps of the http interface authentication method according to any one of claims 1-3, characterized in that, The method comprises the following steps: a decryption module for decrypting the authorization parameter from the interface calling end based on the pre-allocated key and signature parameter to obtain a plaintext string; wherein the plaintext string contains a timestamp parameter and a current random number; a timeout judgment module for judging whether the current request is overdue based on the timestamp parameter; if the preset time is exceeded, the current request is ignored, otherwise the next step is continued; a random number judgment module for judging whether the current request is legal based on the random number in the cache and the current random number; if the current random number is the same as any random number in the cache, the current request is judged to be illegal and ignored; otherwise, the current request is judged to be legal and processed.

5. An apparatus, comprising: The method comprises the following steps: a memory for storing a computer program; a processor for executing the computer program to implement the steps of the http interface authentication method of any one of claims 1-3.

6. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 5. The computer program is executed by the processor to implement the steps of the http interface authentication method of any one of claims 1-3.

Images