API gateway and client encryption and decryption interaction method

Abstract

The application discloses an API gateway and client encryption and decryption interaction method, and belongs to the technical field of API gateway. In the scheme, the API gateway allocates a key and an APPID for the client according to the UID of the client, the client sends the message content to the API gateway after encrypting the message content by using the encryption key, if the client key is expired or disabled, the API gateway prompts the client to send a key update request, the API gateway generates a new key and an APPID for the client after receiving the key update request, if the client key is still valid, the API gateway sends the message of the client to the backend application service after decrypting the message, and sends the response message returned by the backend application service back to the client after encrypting the response message. The scheme of the application realizes encryption and decryption interaction between the API gateway and the client, improves the development and debugging efficiency, realizes exclusive use and dynamic update of the client key, and provides higher level security protection.

Description

Technical Field

[0001] The present invention relates to the field of API gateway technology, and in particular to an encryption and decryption interaction method between an API gateway and a client. Background Art

[0002] A microservice system consists of multiple backend application services and an API (Application Programming Interface) gateway. The backend application services are responsible for processing client business requests, and the API gateway is responsible for forwarding data between the client and the various backend application services. For message security reasons, the message exchanges between the client and the backend application services often need to be encrypted.

[0003] Existing technologies typically rely on direct encryption and decryption between the client and backend application services. The client and backend application services negotiate an encryption and decryption solution, develop it independently, and then jointly debug the client and backend application services. For systems with a large number of backend application services, all backend application services must develop encryption and decryption functions and independently debug them with the client, hindering overall project progress. Changing the encryption algorithm, modifying the key, or even leaking the key requires modifying all backend application services, which is inefficient and easily introduces security risks.

[0004] Existing solutions also use API gateways to perform encryption and decryption interactions with clients, eliminating the need for backend application services to perform encryption and decryption operations, thus improving development efficiency. However, in these solutions, clients typically share keys and cannot dynamically update client keys, posing significant security risks. Summary of the Invention

[0005] The technical problem to be solved by the present invention is: in view of the above-mentioned defects of the existing technology, a method for encryption and decryption interaction between an API gateway and a client is provided, which generates a unique key for each client and supports dynamic update of the key.

[0006] To achieve the above objectives, the present invention provides an API gateway and client encryption and decryption interaction method, the method comprising the following steps:

[0007] Step S1: After the client logs in for the first time, it sends a message to the API gateway with UID and APPID_INIT; the UID is the client user ID, and the APPID_INIT is the unified initial APPID value set after the client is installed;

[0008] Step S2: The API gateway assigns keys to the client based on the UID. The keys include the front-end encryption key, the front-end decryption key, the gateway encryption key, and the gateway decryption key. The gateway generates a unique APPID corresponding to the keys and then returns the APPID, the front-end encryption key, and the front-end decryption key to the client.

[0009] In step S3, the client stores the APPID, front-end encryption key, and front-end decryption key sent by the API gateway locally, encrypts the message content using the front-end encryption key, and then sends the encrypted message to the API gateway with the UID and APPID.

[0010] In step S4, the API gateway determines whether the key corresponding to the APPID is expired or disabled. If so, it jumps to step S8. Otherwise, the API gateway uses the gateway decryption key corresponding to the APPID to decrypt the message content sent by the client, and then sends the decrypted message content to the backend application service with the UID and APPID.

[0011] Step S5: The backend application service receives and processes the message sent by the API gateway, and sends a plaintext response message to the API gateway. The response message carries the UID and APPID in the message received by the backend application service.

[0012] Step S6: The API gateway encrypts the message content sent by the backend application service based on the UID and APPID in the response message using the gateway encryption key corresponding to the APPID. The API gateway then sends the encrypted message content to the client along with the UID and APPID.

[0013] Step S7: The client uses the locally stored front-end decryption key to decrypt the received encrypted response message and obtain the plaintext content of the response message from the back-end application service. If it needs to continue communicating with the back-end application service, it jumps to step S3; otherwise, the communication process ends.

[0014] In step S8, the API gateway sends a key expiration message to the client, and the client sends a key update request to the API gateway, which carries the UID and APPID; the API gateway determines whether the key update request sent by the client is legal. If it is legal, it regenerates a new key for the client according to the method of step S2, and encrypts the new key with the gateway encryption key corresponding to the APPID sent by the client and sends it to the client; then jumps to step S3.

[0015] Preferably, in step S2, before returning the APPID, the front-end encryption key, and the front-end decryption key to the client, the process further includes:

[0016] The API gateway stores the UID, APPID, front-end encryption key, front-end decryption key, gateway encryption key, gateway decryption key, key status, and key validity period as a piece of key information; wherein the key status is set to "enabled" and the key validity period is set to the key expiration time.

[0017] Preferably, before step S4, the following steps are further included:

[0018] The API gateway determines whether the UID sent by the client matches the APPID. If they do not match, it returns a key error prompt message to the client and does not forward the message sent by the client to the backend application service. If they match, it finds the corresponding key information based on the APPID.

[0019] Preferably, the encryption and decryption interaction method between the API gateway and the client also includes support for different key types, and the specific method is as follows:

[0020] Set key type rules in API Gateway;

[0021] The API gateway parses the key type rules, assigns a key to the client based on the key type rules, associates the key type with the key and stores it locally, and sends the key type to the client.

[0022] Both the client and API gateway have built-in encryption and decryption algorithms corresponding to different key types. Select the corresponding encryption and decryption algorithm based on the key type.

[0023] Preferably, when the client is not logged in, it carries APPID_INIT to interact with the backend application service. The API gateway does not distribute keys, and transparently transmits messages between the client and the backend application service.

[0024] Preferably, the API gateway provides a key management function through a visual configuration interface, and the key management function includes disabling a key and modifying a key expiration time.

[0025] Preferably, in step S8, the method in which the API gateway sends a key expiration message to the client is: the API gateway sends an abnormal error code indicating that the key has expired to the client.

[0026] Preferably, in step S8, the method in which the API gateway sends a key expiration message to the client is: the API gateway uses the gateway encryption key corresponding to the APPID sent by the client to encrypt the message indicating the key expiration and then sends it to the client, and the client uses the locally stored front-end decryption key to decrypt the message sent by the API gateway.

[0027] Preferably, after the client and API gateway encrypt the message content, they perform hash calculation on the ciphertext and send the ciphertext and the hash calculation result together to the message recipient; after receiving the message, the message recipient first performs hash calculation on the message content and compares the hash calculation result with the hash calculation result sent by the message sender. If the two are inconsistent, a message indicating a hash calculation error is returned to the message sender.

[0028] Preferably, carrying UID and APPID_INIT, carrying UID and APPID means carrying through the header of an HTTP message.

[0029] The present invention has the following beneficial effects: In the solution of the present invention, the API gateway allocates a key and an APPID corresponding to the key to the client based on the client's UID. The client uses the encryption key in the key to encrypt the message content and then sends it to the API gateway. The API gateway determines whether the client's key is expired or disabled. If it is expired or disabled, it prompts the client to send a key update request. After receiving the key update request, the API gateway generates a new key and APPID for the client. If the client key is still valid, the API gateway decrypts the client's message and sends it to the back-end application service. When receiving the response message from the back-end application service, it encrypts the response message and sends it back to the client. The solution of the present invention improves development and debugging efficiency by performing encryption and decryption interaction between the API gateway and the client, realizes exclusive use and dynamic update of client keys, and provides a higher level of security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0031] Figure 1 A schematic diagram of the steps of the encryption and decryption interaction method between the API gateway and the client provided in an embodiment of the present invention.

[0032] Figure 2 A schematic diagram of a multi-client processing scenario provided by an embodiment of the present invention.

[0033] Figure 3 Schematic diagram of the interaction process between the client, API gateway, and backend application services provided in an embodiment of the present invention.

[0034] Figure 4 A schematic diagram of the key information structure on the API gateway side provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0036] The embodiments of the present invention are described in further detail below in conjunction with the accompanying drawings. It should be understood that the embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0037] In the microservice architecture, the API gateway serves as the entry point for the interaction between the front-end and back-end application services, and is responsible for the security logic processing of the front-end and back-end interactions. The present invention provides a solution in which the front-end encrypts and the gateway decrypts when the front-end and back-end application services interact; when the back-end returns data, the gateway encrypts and the front-end decrypts. This solution does not affect the business logic of the back-end service, does not require the back-end service to connect to the encryption and decryption service, and ensures the decoupling of the overall architecture.

[0038] like Figure 1 As shown, an embodiment of the present invention provides an API gateway and client encryption and decryption interaction method, the method comprising the following steps:

[0039] Step S1: After the client logs in for the first time, it sends a message to the API gateway with UID and APPID_INIT; the UID is the client user identifier, and the APPID_INIT is the unified initial APPID value set after the client is installed.

[0040] In this embodiment of the present invention, UID is the client user identifier, which can be assigned by the backend application service when the client registers, or a system ID or other value that can identify the client can be used. APPID_INIT is a unified initial APPID value set after the client is installed and is shared by all clients. After the client logs in for the first time, when sending a message to the API gateway with UID and APPID_INIT, a preset fixed encryption key and encryption algorithm can be used. The API gateway uses the corresponding decryption key and decryption algorithm to decrypt the message.

[0041] In some embodiments of the present invention, carrying the UID and APPID_INIT refers to carrying them in the header of an HTTP message, for example, by extending the uid and appid fields in the HTTP header and filling in the values ​​of UID and APPID_INIT, respectively. Alternatively, the UID and APPID_INIT values ​​can be passed to the API gateway by customizing the HTTP body data structure and extending the uid and appid fields. The present invention does not impose any particular restrictions on the specific method.

[0042] In some embodiments of the present invention, the client is not logged in and carries APPID_INIT to interact with the backend application service. The API gateway does not distribute keys and transparently transmits messages between the client and the backend application service.

[0043] In step S2, the API gateway assigns keys to the client based on the UID. The keys include the front-end encryption key, the front-end decryption key, the gateway encryption key, and the gateway decryption key, and generates a unique APPID corresponding to the keys, and then returns the APPID, the front-end encryption key, and the front-end decryption key to the client.

[0044] When a client sends a message to the API gateway, it encrypts the message using the front-end encryption key. The API gateway receives the message from the client, decrypts it using the gateway decryption key, and sends the plaintext message to the back-end application service. The back-end application service processes the message and returns a plaintext response message to the API gateway. The API gateway encrypts the plaintext response message using the gateway encryption key and sends the encrypted response message to the client. The client decrypts the encrypted response message using the front-end decryption key to obtain the plaintext response message. For asymmetric encryption algorithms, the front-end encryption key is the public key, and the gateway decryption key is the corresponding private key. For symmetric encryption algorithms, the front-end encryption key and gateway decryption key are the same, and the gateway encryption key and front-end decryption key are the same, but the front-end encryption key and gateway encryption key are different.

[0045] like Figure 2 As shown, in embodiments of the present invention, the API gateway assigns keys to clients based on their UIDs, ensuring that each client has its own unique key and isolating clients from each other, thereby improving security. In some embodiments of the present invention, the API gateway uses the SM2 algorithm to generate new keys for clients based on their UIDs. The SM2 algorithm combines the current time to generate keys, ensuring a low key duplication rate.

[0046] In the embodiment of the present invention, APPID is used as an identification code of the key, and the APPID can be generated according to the key content. The present invention does not impose any special restrictions on the specific method for generating the APPID.

[0047] In the embodiment of the present invention, in order to facilitate the management of the client's key, the API gateway further includes the following before returning the key message to the client:

[0048] The API gateway stores the UID, APPID, front-end encryption key, front-end decryption key, gateway encryption key, gateway decryption key, key status, and key validity period as a piece of key information; wherein the key status is set to "enabled" and the key validity period is set to the key expiration time.

[0049] In this embodiment of the present invention, the key status has three values: "Enabled", "Updating", and "Disabled". For newly generated keys, the key status is set to "Enabled". When the API gateway detects that a key has expired, it changes the key status to "Updating". After the API gateway issues a new key, the key status of the old key is set to "Disabled".

[0050] In this embodiment of the present invention, the key validity period is set to 90 days. After the API gateway assigns a new key to the client, it adds the expiration date 90 days after the current time to the key validity period field. After receiving a request from the client, the current time is compared with the time in the key validity period field. If the current time is later than the time in the key validity period field, the client key is determined to have expired.

[0051] In some embodiments of the present invention, the API gateway provides key management functionality through a visual configuration interface. This functionality includes disabling keys and modifying key expiration times. For example, if a client's key is discovered to be leaked, the API gateway can use the visual configuration interface to find the client's valid key and change its key status to "disabled." When the API gateway receives a message from the client and finds that its key status is "disabled," it prompts the client to send a key update request.

[0052] In step S3, the client stores the APPID, front-end encryption key, and front-end decryption key sent by the API gateway locally, encrypts the message content using the front-end encryption key, and then sends the encrypted message to the API gateway with the UID and APPID.

[0053] In some embodiments of the present invention, carrying the UID and APPID refers to carrying them through the header of the HTTP message, for example, extending the uid and appid fields in the HTTP Header, and filling in the values ​​of the UID and APPID respectively. In addition, the values ​​of the UID and APPID can be passed to the API gateway by customizing the HTTP body data structure and extending the uid and appid fields. The present invention does not impose any special restrictions on the specific method. Because the client, API gateway, and back-end application services all need to pass the values ​​of the UID and APPID, for convenience, a unified method can be agreed upon, such as passing them through specific fields in the HTTP Header.

[0054] If the client obtains the key for the first time through step S1, the API gateway may not forward the client's message to the backend application service after returning the key to the client. After the client receives the key, it may encrypt the message with the key and resend the previous message.

[0055] In step S4, the API gateway determines whether the key corresponding to the APPID is expired or disabled. If it is expired or disabled, jump to step S8. Otherwise, the API gateway uses the gateway decryption key corresponding to the APPID to decrypt the message content sent by the client, and then carries the UID and APPID to send the decrypted message content to the backend application service.

[0056] In some embodiments of the present invention, before step S4, the following steps are further included:

[0057] The API gateway determines whether the UID sent by the client matches the APPID. If they do not match, it returns a key error prompt message to the client and does not forward the message sent by the client to the backend application service. If they match, it finds the corresponding key information based on the APPID.

[0058] If a client steals another client's APPID and key information and sends it to the API gateway along with its own UID, the API gateway can identify this situation by determining whether the UID sent by the client matches the APPID, return a key error prompt to the client, and for security reasons, not forward the message to the backend.

[0059] In step S5, the backend application service receives and processes the message sent by the API gateway, and sends a plaintext response message to the API gateway. The response message carries the UID and APPID in the message received by the backend application service.

[0060] The backend application service receives plaintext messages and does not need to encrypt or decrypt them.

[0061] Step S6, the API gateway encrypts the message content sent by the backend application service according to the UID and APPID in the response message using the gateway encryption key corresponding to the APPID, and then sends the encrypted message content to the client carrying the UID and APPID.

[0062] Step S7, the client decrypts the received encrypted response message using the locally stored front-end decryption key to obtain the plaintext content of the response message of the backend application service, and jumps to step S3 if it is needed to continue to communicate with the backend application service, otherwise the communication process is ended.

[0063] After the client receives the response message sent by the API gateway, the UID and APPID in the message can be compared with the locally stored APPID, and if they do not match, the API gateway is reported of an exception.

[0064] Step S8, the API gateway sends a key expiration message to the client, the client sends a key update request to the API gateway, the request carrying the UID and APPID, the API gateway judges whether the key update request sent by the client is legal, if it is legal, a new key is generated for the client according to the method of step S2, and the new key is encrypted using the gateway encryption key corresponding to the APPID sent by the client and then sent to the client, and then jumps to step S3.

[0065] In the embodiment of the application, after the API gateway detects that the key is expired, the stored key state is modified to "update", and after the key update is successful, the key state of the old key is modified to "disable".

[0066] In some embodiments of the application, in step S8, the method for the API gateway to send a key expiration message to the client is that the API gateway sends an exception error code indicating key expiration to the client. After the client identifies the exception error code indicating key expiration, the client sends a key update request to the API gateway.

[0067] In other embodiments of the application, in step S8, the method for the API gateway to send a key expiration message to the client is that the API gateway encrypts a message indicating key expiration using the gateway encryption key corresponding to the APPID sent by the client and then sends the encrypted message to the client, and the client decrypts the message sent by the API gateway using the locally stored front-end decryption key. After the client obtains the key expiration message from the decrypted data, the client sends a key update request to the API gateway.

[0068] In some embodiments of the application, the API gateway and client encryption and decryption interaction method further includes support for different key types, and the specific method is as follows:

[0069] Setting a key type rule in the API gateway; the key type can be an asymmetric key, a symmetric key, or a specific encryption and decryption algorithm. The API gateway can be configured to apply an asymmetric key, a symmetric key, or a specific encryption and decryption algorithm to all client applications in the visual configuration interface, or different key types can be applied to different client applications according to certain rules. Preferably, an asymmetric key is applied to all client applications.

[0070] The API gateway parses the key type rule, assigns a key to the client according to the key type rule, stores the key type together with the key locally, and sends the key type to the client;

[0071] The client and the API gateway both have built-in encryption and decryption algorithms corresponding to different key types, and the corresponding encryption and decryption algorithm is selected according to the key type.

[0072] In some embodiments of the application, a set of asymmetric encryption algorithms and a set of symmetric encryption algorithms are built into the client and the API gateway, such as selecting SM2 as the asymmetric encryption algorithm and SM4 as the symmetric encryption algorithm. If the API gateway is configured to apply an asymmetric key to all client applications, the API gateway generates an asymmetric key and sets the key type to "asymmetric", and the client and the API gateway both use the SM2 algorithm for encryption and decryption; if the API gateway is configured to apply a symmetric key to all client applications, the API gateway generates a symmetric key and sets the key type to "symmetric", and the client and the API gateway both use the SM4 algorithm for encryption and decryption.

[0073] In some embodiments of the application, in order to further improve the security of communication, the client and the API gateway encrypt the message content, then perform a hash calculation on the ciphertext, and send the ciphertext and the hash calculation result to the message receiver; after receiving the message, the message receiver first performs a hash calculation on the message content, and compares the hash calculation result with the hash calculation result sent by the message sender. If they are not consistent, the message sender is returned a message prompting a hash calculation error.

[0074] Figure 3 The encryption and decryption message interaction flowchart for using an asymmetric key and performing a hash calculation on the encryption result.

[0075] Figure 4 The key information structure diagram stored for the API gateway, in which the key type field is expanded.

[0076] The present invention has the following beneficial effects: In the solution of the present invention, the API gateway allocates a key and an APPID corresponding to the key to the client based on the UID of the client. The client uses the encryption key in the key to encrypt the message content and then sends it to the API gateway. The API gateway determines whether the client's key is expired or disabled. If it is expired or disabled, the client is prompted to send a key update request. After receiving the key update request, the API gateway generates a new key and APPID for the client; if the client key is still valid, the API gateway decrypts the client's message and sends it to the back-end application service, and upon receiving the response message from the back-end application service, it encrypts the response message and sends it back to the client. The solution of the present invention performs encryption and decryption interaction with the client through the API gateway. Because the API gateway is centrally set up, the use of the API gateway to perform encryption and decryption interaction with the client only requires joint debugging between the API gateway and the client. Compared with the encryption and decryption method between the back-end application service and the client, the efficiency and security are significantly improved. The solution of the present invention realizes exclusive use and dynamic update of client keys, providing a higher level of security protection.

[0077] In addition, the graphical setting interface provided by the API gateway allows direct management of client keys, which is more convenient and quick.

[0078] The above is only a specific embodiment of the present invention and cannot be used to limit the scope of the present invention. Equal changes made by ordinary technicians in this technical field based on this creation, as well as changes well known to technicians in this field, should still fall within the scope of the present invention.

Claims

1. A method for encryption and decryption interaction between an API gateway and a client, characterized in that: The method comprises the following steps: Step S1: After the client logs in for the first time, it sends a message to the API gateway with UID and APPID_INIT; the UID is the client user ID, and the APPID_INIT is the unified initial APPID value set after the client is installed; Step S2: The API gateway assigns keys to the client based on the UID. The keys include the front-end encryption key, the front-end decryption key, the gateway encryption key, and the gateway decryption key. The gateway generates a unique APPID corresponding to the keys and then returns the APPID, the front-end encryption key, and the front-end decryption key to the client. In step S3, the client stores the APPID, front-end encryption key, and front-end decryption key sent by the API gateway locally, encrypts the message content using the front-end encryption key, and then sends the encrypted message to the API gateway with the UID and APPID. In step S4, the API gateway determines whether the key corresponding to the APPID is expired or disabled. If so, it jumps to step S8. Otherwise, the API gateway uses the gateway decryption key corresponding to the APPID to decrypt the message content sent by the client, and then sends the decrypted message content to the backend application service with the UID and APPID. Step S5: The backend application service receives and processes the message sent by the API gateway, and sends a plaintext response message to the API gateway. The response message carries the UID and APPID in the message received by the backend application service. Step S6: The API gateway encrypts the message content sent by the backend application service based on the UID and APPID in the response message using the gateway encryption key corresponding to the APPID. The API gateway then sends the encrypted message content to the client along with the UID and APPID. Step S7: The client uses the locally stored front-end decryption key to decrypt the received encrypted response message and obtain the plaintext content of the response message from the back-end application service. If it needs to continue communicating with the back-end application service, it jumps to step S3; otherwise, the communication process ends. In step S8, the API gateway sends a key expiration message to the client, and the client sends a key update request to the API gateway, which carries the UID and APPID; the API gateway determines whether the key update request sent by the client is legal. If it is legal, it regenerates a new key for the client according to the method of step S2, and encrypts the new key with the gateway encryption key corresponding to the APPID sent by the client and sends it to the client; then jumps to step S3.

2. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: In step S2, before returning the APPID, the front-end encryption key, and the front-end decryption key to the client, the process further includes: The API gateway stores the UID, APPID, front-end encryption key, front-end decryption key, gateway encryption key, gateway decryption key, key status, and key validity period as a piece of key information; wherein the key status is set to "enabled" and the key validity period is set to the key expiration time.

3. The API gateway and client encryption and decryption interaction method according to claim 2 is characterized in that: Before step S4, the following steps are also included: The API gateway determines whether the UID sent by the client matches the APPID. If they do not match, it returns a key error prompt message to the client and does not forward the message sent by the client to the backend application service. If they match, it finds the corresponding key information based on the APPID.

4. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: The API gateway and client encryption and decryption interaction method also includes support for different key types. The specific method is as follows: Set key type rules in API Gateway; The API gateway parses the key type rules, assigns a key to the client based on the key type rules, associates the key type with the key and stores it locally, and sends the key type to the client. Both the client and API gateway have built-in encryption and decryption algorithms corresponding to different key types. Select the corresponding encryption and decryption algorithm based on the key type.

5. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: When the client is not logged in, it carries APPID_INIT to interact with the backend application service. The API gateway does not distribute keys and transparently transmits messages between the client and the backend application service.

6. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: The API gateway provides key management functions through a visual configuration interface, and the key management functions include disabling keys and modifying key expiration times.

7. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: In step S8, the method in which the API gateway sends a key expiration message to the client is: the API gateway sends an abnormal error code indicating that the key has expired to the client.

8. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: In step S8, the method in which the API gateway sends a key expiration message to the client is as follows: the API gateway uses the gateway encryption key corresponding to the APPID sent by the client to encrypt the message indicating key expiration and sends it to the client, and the client uses the locally stored front-end decryption key to decrypt the message sent by the API gateway.

9. The API gateway and client encryption and decryption interaction method according to claim 1 is characterized in that: After the client and API gateway encrypt the message content, they perform hash calculation on the ciphertext and send the ciphertext and the hash calculation result together to the message recipient; after receiving the message, the message recipient first performs hash calculation on the message content and compares the hash calculation result with the hash calculation result sent by the message sender. If the two are inconsistent, a message indicating a hash calculation error is returned to the message sender.

10. The API gateway and client encryption and decryption interaction method according to claim 1, characterized in that: The carrying of UID and APPID_INIT and carrying of UID and APPID refers to carrying through the header of the HTTP message.

Images