Method and apparatus for protecting backend interface call, electronic device and storage medium

Abstract

The present disclosure provides a protection method and device for backend interface call, electronic equipment and storage medium, belonging to the field of information security. The method comprises: a front-end gateway receives an API request of the front-end, the API request uses a target API path after obfuscation processing; the front-end gateway determines a target API path before obfuscation processing corresponding to the target API path after obfuscation processing according to the target API path after obfuscation processing; and the front-end gateway forwards the target API path before obfuscation processing to a service gateway. The technical solution of the present disclosure can improve the security of the backend interface call.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a method, apparatus, electronic device, and storage medium for protecting backend interface calls. Background Technology

[0002] Currently, since the emergence of the front-end and back-end separation architecture, when the front-end wants to access back-end services, it usually calls the back-end's API (Application Programming Interface) interface information in plaintext in the front-end project code. This exposes the back-end interface information to the public Internet in the form of code, which provides potential attackers with an entry point to attack the system, resulting in low security. Summary of the Invention

[0003] To address at least one technical problem in the prior art, this disclosure provides a method, apparatus, electronic device, and storage medium for protecting backend interface calls, thereby improving the security of backend interface calls.

[0004] According to a first aspect of this disclosure, a method for protecting backend API calls is provided, comprising:

[0005] The front-end gateway receives API requests from the front-end, and the API requests use obfuscated target API paths;

[0006] The front-end gateway determines the original target API path corresponding to the obfuscated target API path based on the obfuscated target API path.

[0007] The front-end gateway forwards the target API path before obfuscation to the service gateway.

[0008] Optionally, before the front-end gateway receives the API request from the front-end, the method further includes:

[0009] Obfuscate the API paths in the front-end code to form obfuscated API paths.

[0010] Optionally, the obfuscation of API paths in the front-end code to form obfuscated API paths includes:

[0011] Traverse the API paths of the front-end code to obtain the API paths to be processed;

[0012] The API path to be processed is subjected to sentence vector encryption and salting to form an obfuscated API path.

[0013] Optionally, the step of performing sentence vector encryption and salting on the API path to be processed to form an obfuscated API path includes:

[0014] The feature information of the API path to be processed is extracted using sentence vectors;

[0015] The feature information is encrypted and salted to obtain the obfuscated API path.

[0016] Optionally, the step of extracting feature information of the API path to be processed using sentence vectors includes:

[0017] The feature information of the API path to be processed is extracted using a sentence vector RNN model.

[0018] Optionally, in response to the compilation of the front-end project, a sentence vector encryption and salting process is triggered on the API path to be processed to update the obfuscated API path.

[0019] Optionally, a mapping file is constructed between the API path before obfuscation and the API path after obfuscation, and the mapping file is uploaded to the cloud distributed storage module.

[0020] Optionally, the front-end gateway determines the target API path before obfuscation based on the obfuscated target API path, including:

[0021] The target API path before obfuscation is determined by using the target API path after obfuscation and a pre-stored mapping file between the API path before obfuscation and the API path after obfuscation.

[0022] According to a second aspect of this disclosure, a protection device for backend interface calls is provided, comprising:

[0023] The front-end gateway receiving module is used to receive API requests from the front end, wherein the API requests use the obfuscated target API path;

[0024] The front-end gateway determination module is used to determine the target API path before obfuscation that corresponds to the target API path after obfuscation, based on the target API path after obfuscation.

[0025] The front-end gateway forwarding module is used to forward the target API path before obfuscation to the service gateway.

[0026] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0027] Processor; and

[0028] Stored program memory,

[0029] The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of the preceding descriptions.

[0030] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the method according to any one of the preceding statements.

[0031] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program, wherein, when executed by a processor of a computer, the computer program is used to cause the computer to perform the method according to any of the preceding claims.

[0032] One or more technical solutions provided in this application embodiment use an obfuscated target API path for API requests. The front-end gateway determines the target API path before obfuscation corresponding to the obfuscated target API path based on the obfuscated target API path, and forwards the target API path before obfuscation to the service gateway to realize the back-end port call corresponding to the target API path before obfuscation, thereby improving the security of back-end interface calls. Attached Figure Description

[0033] The accompanying drawings illustrate exemplary embodiments of the present disclosure and, together with the description thereof, serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0034] Figure 1 A flowchart illustrating a method for protecting backend interface calls according to an exemplary embodiment of this disclosure is shown;

[0035] Figure 2 A sub-flowchart of a method for protecting backend interface calls according to an exemplary embodiment of the present disclosure is shown;

[0036] Figure 3 Another flowchart of a method for protecting backend interface calls according to an exemplary embodiment of the present disclosure is shown;

[0037] Figure 4 A schematic block diagram of a protection device for backend interface calls according to an exemplary embodiment of the present disclosure is shown;

[0038] Figure 5 A structural block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0039] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0040] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0041] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0042] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0043] The present disclosure is described below with reference to the accompanying drawings.

[0044] See Figure 1 A method for protecting backend API calls, comprising:

[0045] S101, the front-end gateway receives API requests from the front-end, and the API requests use the obfuscated target API path.

[0046] The backend interface call protection method of this disclosure is used in frontend projects to protect backend interface calls, thereby improving the security of backend interface calls.

[0047] In this embodiment of the disclosure, the front-end API request uses the obfuscated target API path. Compared with the target API path before obfuscation, the obfuscated target API path still cannot be directly used by the attacker to carry out attacks after the information is exposed to the attacker, thus improving security.

[0048] In this embodiment of the disclosure, the obfuscated target API path is the obfuscated API path corresponding to the corresponding IPI request.

[0049] Before executing S101, API paths in the front-end code can be obfuscated to form obfuscated API paths. These obfuscated API paths contain the obfuscated target API path. In other words, before executing S101, the target API path in the front-end code is obfuscated, resulting in an obfuscated target API path. The advantage of obfuscating API paths in the front-end code is increased security, making it more difficult for attackers to directly identify and exploit API paths, thereby increasing the cost and difficulty of attacks.

[0050] In a more specific embodiment, see Figure 2 The API paths in the front-end code are obfuscated to form obfuscated API paths, including:

[0051] S201, traverse the API paths in the front-end code to obtain the API paths to be processed.

[0052] S202, perform sentence vector encryption and salting on the API path to be processed to form an obfuscated API path.

[0053] In this embodiment, the front-end code is traversed to obtain the API path, and it is obfuscated through sentence vector encryption and salting. This method not only enhances security, making the API path difficult to directly parse and guess, but also effectively prevents automated attacks and protects the application's business logic. The API path in the front-end code can be stored in an API file, so the API paths in the API file can be traversed to obtain the API path to be processed.

[0054] In a more specific embodiment, see Figure 3 The API path to be processed undergoes sentence vector encryption and salting, including:

[0055] S301, extract feature information of the API path to be processed using sentence vectors;

[0056] S302, the feature information is encrypted and salted to obtain the obfuscated API path.

[0057] In this embodiment, sentence vectors are used to extract feature information from the API path to be processed; this feature information is then encrypted and salted to obtain an obfuscated API path. Sentence vectors capture and represent the semantic features of textual information, encryption ensures confidentiality, and salting increases the complexity and uniqueness of the cipher, ensuring that even two identical original API paths will produce different encryption results. In this way, the generated obfuscated API path maintains its semantic features while increasing the difficulty for external attackers to parse the real API path, thereby effectively improving the security of the API interface. This method protects data security and enhances the concealment and anti-attack capabilities of API calls.

[0058] Specifically, to capture the potential information of API paths, a sentence vector RNN (Recurrent Neural Network) model can be used to extract feature information from the API paths to be processed. The principle behind using a sentence vector RNN to extract feature information from API paths is based on the ability of RNNs to process sequential data. The API path is treated as a text sequence, and the model learns the dependencies within the sequence to extract high-dimensional feature representations. RNN models are particularly effective for text data with contextual dependencies (such as the various levels of structure within an API path) because they can remember previous input information and use it to process subsequent inputs. The advantage of this method is its ability to capture potential, complex patterns and structural relationships within the API path, thus providing richer and more discriminative features for subsequent encryption and salting processes, enhancing security and resistance to attacks. For example, the RNN model structure can include an input layer, an RNN layer, and an output layer. The input layer receives the serialized API paths. The RNN layer includes one or more recurrent layers, each receiving the current input and the hidden state from the previous time step, and outputting a new hidden state. Output layer: This layer transforms the output of the last time step of the RNN or the output of the entire sequence into the desired feature representation for subsequent encryption. This structure makes RNNs particularly suitable for processing data with inherent sequential relationships, such as API interface paths, enabling the extraction of deep semantic and structural information.

[0059] Specifically, to further enhance security, during the front-end project compilation, a sentence vector encryption and salting process for the API paths to be processed can be triggered in response to the front-end project compilation, thereby updating the obfuscated API paths. The principle behind triggering this process in response to front-end project compilation is to tightly integrate API path security processing with the development workflow. This process is executed automatically each time the front-end project is compiled, utilizing sentence vector technology from natural language processing to extract features from the API paths, and then increasing the complexity and unpredictability of these paths through encryption and salting algorithms.

[0060] Specifically, to better obtain the obfuscated API paths, a mapping file is constructed between the API paths before and after obfuscation, and this mapping file is uploaded to the cloud distributed storage module. This enables efficient path resolution between different servers or services, ensuring that the correct API can be quickly and securely located and invoked even in a distributed system.

[0061] The obfuscation processing in this disclosure is handled during the front-end compilation stage, and is described below with more specific embodiments:

[0062] When developers build and compile the front-end, they perform sentence vector encryption and salting protection on the API files that call the back-end interface in plaintext in the front-end code. This ensures that even if the front-end code is exposed to the public network or passed to attackers, they cannot know the real path of the back-end interface or the real purpose of the corresponding interface. Therefore, they cannot attack the back-end interface service, which ultimately increases the cost for attackers to attack and damage the back-end service and improves security.

[0063] For example, developers trigger a Jenkins job (Jenkins is an open-source automation server) to build the front-end code, push the built resource package to an NPM (Node Package Manager) private server, log in to the target server to pull the corresponding version of the resource package for deployment. During the build process, a custom Webpack Loader can be used to process the API interface addresses in the back-end API file interface code in the front-end code using sentence vector RNN. After converting the sentence vector RNN into text, a general encryption algorithm combined with timestamp protection is applied to obtain a new API path, replacing the original API path. That is, the API path before obfuscation replaces the API path before obfuscation. API paths in the code that do not need obfuscation can be recorded in the API whitelist and ignored during API path sentence vector feature extraction. At this time, the API paths in the built front-end code resource package are specially processed API paths. Using sentence vector RNN to extract interface API addresses, the API path can be converted into an index sequence through an RNN model, then the model is trained and features are extracted. The model structure, hyperparameters, and training methods can be adjusted as needed to improve the feature extraction effect. Based on the feature information extracted by RNN, the feature information is encrypted and salted to enhance the double-layer protection of interface information. Simultaneously, by using timestamp-based salting, the API code and mapping files of the backend interface are regenerated with each Jenkins build, effectively resisting DDoS (Distributed Denial of Service) attacks. The mapping file between the API path before and after obfuscation during API path vector encryption is stored in a local directory on the Jenkins server. A Go script is executed in the Jenkins pipeline to process the mapping file in the local Jenkins server directory. The Go script reads the mapping file from the local Jenkins server directory and stores it in distributed cloud storage.

[0064] In a more specific embodiment, the stage of automatically protecting the front-end code by encryption and salting it via sentence vectors during compilation includes the following steps:

[0065] 1. Trigger the Jenkins Job to build the front-end code.

[0066] 1. Configure the Jenkins Job build front-end code.

[0067] 1) Create a new job in Jenkins, configure the Git repository address and the conditions for triggering a build (e.g., scheduled triggering, code commit triggering, etc.). Git is a distributed version control system.

[0068] 2) Add commands to the build steps to build the front-end code, such as using npm, yarn, or other build tools to build the front-end project. npm and yarn are JavaScript package managers.

[0069] 2. Developers push the built resource package to the NPM private server.

[0070] 1) Add a command to push to the private NPM server in the build step of the Jenkins Job.

[0071] 2) Configure NPM authentication information in Jenkins to ensure successful push to the private server.

[0072] 3. Deploy the front-end project code to the target server.

[0073] 1) Deploy a simple HTTP server on the target server to host the front-end resource package.

[0074] 2) Write a script on the target server to download a specified version of the resource package from the NPM private server and extract it to the directory of the HTTP server.

[0075] 3) Use SSH (Secure Shell, a network protocol) or other remote command execution methods to execute deployment scripts in subsequent build steps of the Jenkins Job.

[0076] For example, the script is as follows:

[0077] #Jenkins Job Build Steps

[0078] # Install dependencies

[0079] npm install

[0080] #Building front-end code

[0081] npm run build

[0082] # Push the built resource package to the NPM private server

[0083] npm publish--registry=https: / / ******.com--access=public;

[0084] # The script deployed to the target server: deploy.sh

[0085] #! / bin / bash

[0086] #Download the specified version of the resource package

[0087] Npminstall your-package@1.0.0--registry=https: / / ******.com

[0088] # Extract the resource package to the HTTP server directory

[0089] tar-xvf your-package-1.0.0.tar.gz-C / var / www / html;

[0090] Then, you can execute the deploy.sh script by running the ssh command in the subsequent build steps of the Jenkins job: ssh user@your-target-server'bash-s' <deploy.sh。

[0091] 2. Use a custom Webpack Loader to perform sentence vector encryption and salt protection on the compiled code.

[0092] 1. Write a custom Webpack Loader in the front-end code.

[0093] 1) Create a new Webpack Loader to handle API paths in the backend API call code.

[0094] 2) In the Loader, write logic to traverse the paths in the API files. For paths not in the whitelist, perform a Recurrent Neural Network (RNN) algorithm on them and encrypt them using a combination of encryption and timestamps. Replace the original API path code with this encrypted data. The RNN is used to extract feature information from the interface paths and encrypts and salts these features. Direct encryption is avoided to prevent clients from brute-forcing decryption and exposing the interface information. Adding timestamps ensures that the backend API paths in the Redis mapping file within the project code are automatically updated each time Jenkins builds, preventing users from using the same address for a different type of DDoS attack.

[0095] The sentence vector RNN model is used to extract features from the API path. The detailed process is as follows:

[0096] Import the necessary PyTorch libraries:

[0097] import torch

[0098] …

[0099] Define the RNN model:

[0100] class RNN(nn.Module):

[0101] def forward(self,x):

[0102] h0=torch.zeros(self.num_layers,x.size(0),self.hidden_size)

[0103] out, _ = self.rnn(x, h0)

[0104] out = self.fc(out[:,-1,:])

[0105] return out

[0106] Data preparation: Convert the API path string into an index sequence and create a character-to-index mapping:

[0107] api_path='https: / / api.******.com / products'

[0108] char_to_idx={char:idx for idx,char in enumerate(set(api_path))}

[0109] idx_to_char={idx:char for char,idx in char_to_idx.items()}

[0110] api_path_idx=torch.tensor([char_to_idx[char]for char in api_path]).unsqueeze(0)

[0111] Set model parameters:

[0112] input_size = len(char_to_idx)

[0113] hidden_size = 128

[0114] num_layers=1

[0115] output_size = 64

[0116] Instantiate the model, define the loss function and optimizer:

[0117] model=RNN(input_size,hidden_size,num_layers,output_size)

[0118] criterion=nn.CrossEntropyLoss()

[0119] optimizer=optim.Adam(model.parameters(),lr=0.001)

[0120] Training the model:

[0121]

[0122] Feature extraction:

[0123] with torch.no_grad():

[0124] features=model(api_path_idx)

[0125] print('Extracted features:',features)

[0126] 3) API paths in the whitelist will not be processed.

[0127] 2. Configure Webpack to automatically replace backend API code in the frontend project code during compilation.

[0128] 1) In the Webpack configuration file, apply the custom Loader to the API files that need to be processed.

[0129] 2) Use the test attribute to match the files that need to be processed, and then specify the use of a custom loader.

[0130]

[0131]

[0132] 3. Compile an API whitelist file.

[0133] Create an API whitelist file that lists the backend APIs that do not require special code processing.

[0134]

[0135] 4. Update the build process.

[0136] In the build process, the backend API call code in the frontend code is first processed with statement vectors and then encrypted and salted before other packaging operations are performed. Specifically, a custom loader is used to process files in the frontend code that call backend API paths before other packaging operations are performed. This ensures that the backend API path code in the built frontend code resource package is encrypted with statement vectors, while API interface code on the whitelist is not processed.

[0137] 3. Store the API interface address information before and after obfuscation on the Jenkins server.

[0138] 1. Update the custom Webpack Loader.

[0139] In the Loader, while processing the API call code from the front-end code to the back-end API interface and replacing the original API interface address code, the mapping relationship between the original API interface address and the encrypted API interface address is recorded. This mapping relationship is then saved to an object.

[0140] 2. Save the mapping file to the local directory.

[0141] After the Webpack build is complete, the object storing the mapping relationships is written to a JSON file. This file is then stored in the local directory of the Jenkins server. During the build process, after executing the Webpack build, a file named api-mapping.json is generated, which contains the mapping relationships between the raw backend API and the vector encryption API, stored in the local directory of the Jenkins server.

[0142] 4. Use a custom Go script to parse local files protected by Jenkins.

[0143] The Jenkins pipeline executes a Go script to process the api-mapping file in the Jenkins server. The specific Go script code implementation is as follows:

[0144]

[0145] your-go-app is the executable file of the Go application, and api-mapping.json is a statement vector-encrypted mapping file. In the pipeline, the code is checked out first, then the Go script is compiled, and finally the script is executed to process the api-mapping.json file.

[0146] 5. Automatically store API information before and after obfuscation in the cloud using a custom Go script.

[0147] 1. Create a configuration file.

[0148] Create a configuration file that contains environment information such as the cloud distributed storage connection address.

[0149] 2. Update the Go script;

[0150] Add logic to your Go application to read and parse the contents of the configuration file and the api-mapping.json file.

[0151] 3. Execute the application in the Jenkins pipeline.

[0152] 1) Add a step to the Jenkins pipeline to execute a Go script.

[0153] 2) Ensure that the configuration file and api-mapping.json file are accessible on the Jenkins server.

[0154] 4. Store the contents of api-mapping.json in a distributed cloud storage.

[0155] S102, the front-end gateway determines the target API path before obfuscation, which corresponds to the target API path before obfuscation, based on the target API path after obfuscation.

[0156] In this embodiment of the disclosure, the target API path before obfuscation is the API path before obfuscation corresponding to the IPI request.

[0157] In one embodiment, the target API path before obfuscation corresponding to the target API path after obfuscation is determined based on the target API path after obfuscation and a pre-stored mapping file between the API path before obfuscation and the API path after obfuscation.

[0158] In one embodiment, when a user accesses a functional page on the front end, the API request corresponding to that page is forwarded through the front-end gateway using an API path encrypted with a Recurrent Neural Network (RNN). Upon receiving the request, the front-end gateway uses the RNN-encrypted API path to query the corresponding real API path in the cloud's distributed storage.

[0159] In a more specific embodiment, the decryption phase during execution includes the following steps:

[0160] 1. Obtain the raw API interface information from the distributed storage through a customized Lua script in the front-end gateway.

[0161] User-initiated page requests are API requests encrypted and protected by sentence vectors in the front-end project via the front-end gateway. Upon receiving the API request, the front-end gateway uses the sentence vector-encrypted API as the key to query the corresponding real API path in the cloud's distributed storage.

[0162] 1. Write Lua scripts in the front-end gateway OpenResty to handle API requests.

[0163] Lua scripts can receive API requests from clients.

[0164] 1) Extract the API path of sentence vector encryption from the request.

[0165] 2) Use sentence vector encryption to query the corresponding real URL in the cloud distributed storage.

[0166] 3) Replace the API path in the request with the encrypted API path obtained from the query with the actual API path.

[0167] 4) Forward the request to the business gateway corresponding to the actual API.

[0168] 5) The business gateway routes to the backend service and returns the response from the backend service to the client.

[0169] 2. Embed Lua scripts into the front-end gateway configuration to handle API requests.

[0170] This Lua script can be executed using `content_by_lua_block` or `access_by_lua_block` in the OpenResty front-end gateway configuration file. Ensure that the Lua module is configured in OpenResty to support Lua script execution.

[0171] This Lua script extracts the sentence-vector encrypted API path from the request and then queries the cloud distributed storage for the actual API path. If the actual API path is found, the sentence-vector encrypted API path in the request is replaced with the actual API path, and the request is forwarded to the business gateway. If the actual API path is not found, a 404 error is returned.

[0172] When the front-end code is built and compiled via a Jenkins job, a custom Webpack Loader performs RNN (Recursive Numerical Network) encryption and salting on the API calls of the front-end code, making the API call code in the code specially processed. The specially processed and compiled code resource package is then pushed to an NPM private server and finally deployed to the target server. Simultaneously, the API path mapping information after RNN encryption and salting is stored in Redis via a Go script. When a client's API request uses the RNN-encrypted and salted API path, the front-end gateway OpenResty receives the request, uses the RNN-encrypted and salted API path to query the corresponding real API path in the cloud distributed storage, and forwards the retrieved API path to the back-end service gateway. This solution enhances API security through RNN encryption and salting, and also automatically performs RNN encryption and salting on code in the front-end project that is easily accessible to attackers using Jenkins and the front-end project's custom Webpack file. Each Jenkins build re-processes the back-end interface code in the front-end project with RNN encryption and salting, resulting in high security, performance, and scalability.

[0173] S103, the front-end gateway forwards the target API path before obfuscation to the service gateway.

[0174] Specifically, the front-end gateway can query the actual API path and forward it to the business gateway, which in turn routes the request to the service gateway.

[0175] The technical solution of this disclosure involves specially protecting the backend interface information code called in the frontend project during the frontend project compilation process. This makes the backend interface information unreadable in the relevant calling code of the frontend project, and the interface name used each time the frontend is released changes, increasing the difficulty for attackers to obtain backend interface information by analyzing the frontend code. This security measure effectively reduces the security risks faced by the system, protects the backend interface from malicious attacks, improves the overall security of the system, comprehensively enhances the system's security protection capabilities, and ensures the stable and reliable operation of the system.

[0176] The technical solution of this disclosure uses a custom Webpack Loader to perform sentence vector encryption and salting on the backend API paths in the frontend code, replacing the original API paths in the code. This technology not only enhances system security but also ensures that even if the frontend code is obtained by an attacker, the true API path of the backend interface cannot be parsed. This reduces the risk of exposing backend services and improves the overall confidentiality of the system.

[0177] The technical solution of this disclosure, combining Jenkins' automated build process and Go scripts, automates the uploading of encrypted and salted vector mapping files to cloud distributed storage. This process not only automates the management of mapping files but also ensures the dynamic change of the backend API path during each build, effectively blocking DDoS attacks and other security threats. This dynamic update mechanism increases the attacker's uncertainty, significantly reducing the likelihood and efficiency of attacks.

[0178] The technical solution of this disclosure involves a front-end gateway receiving API requests with encrypted and salted sentence vectors using OpenResty. It then interacts with cloud distributed storage via a custom Lua script to parse out the actual API path. These actual paths are then forwarded to the business gateway, ensuring correct request processing. This mechanism not only protects the backend data path but also reduces the direct pressure on the server. Furthermore, this strategy effectively prevents malicious users from bypassing the front-end and directly attacking backend services, further enhancing the security and stability of the overall network architecture.

[0179] See Figure 4 A backend interface calling device, comprising:

[0180] The front-end gateway receiving module 401 is used to receive API requests from the front end. The API requests use the obfuscated target API path.

[0181] The front-end gateway determination module 402 is used to determine the target API path before obfuscation, which corresponds to the target API path before obfuscation, based on the target API path after obfuscation.

[0182] The front-end gateway forwarding module 403 is used to forward the target API path before obfuscation to the service gateway.

[0183] In one embodiment, a backend interface calling device further includes an obfuscation module for obfuscating API paths in frontend code to form obfuscated API paths.

[0184] In one embodiment, the obfuscation module, used to obfuscate API paths in the front-end code to form obfuscated API paths, specifically performs the following:

[0185] Traverse the API paths of the front-end code to obtain the API paths to be processed;

[0186] The API path to be processed is subjected to sentence vector encryption and salting to form an obfuscated API path.

[0187] In one embodiment, the obfuscation module, when performing sentence vector encryption and salting on the API path to be processed to form the obfuscated API path, specifically performs the following:

[0188] The feature information of the API path to be processed is extracted using sentence vectors;

[0189] The feature information is encrypted and salted to obtain the obfuscated API path.

[0190] In one embodiment, the obfuscation processing module, when extracting feature information of the API path to be processed using sentence vectors, is specifically used for:

[0191] The feature information of the API path to be processed is extracted using a sentence vector RNN model.

[0192] In one embodiment, the obfuscation module is used to trigger the sentence vector encryption and salting process of the API path to be processed in response to the compilation of the front-end project, so as to update the obfuscated API path.

[0193] In one embodiment, the obfuscation module is used to construct a mapping file between the API path before obfuscation and the API path after obfuscation, and upload the mapping file to the cloud distributed storage module.

[0194] In one embodiment, the front-end gateway determination module 402 is used to determine the target API path before obfuscation corresponding to the target API path before obfuscation based on the target API path after obfuscation. Specifically, it is used to determine the target API path before obfuscation corresponding to the target API path after obfuscation by using the target API path after obfuscation and a pre-stored mapping file between the API path before obfuscation and the API path after obfuscation.

[0195] Exemplary embodiments of this disclosure also provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform a method according to an embodiment of this disclosure.

[0196] Exemplary embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to embodiments of this disclosure.

[0197] Exemplary embodiments of this disclosure also provide a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this disclosure.

[0198] refer to Figure 5 The present invention describes a structural block diagram of an electronic device 500 that can serve as a server or client of the present disclosure, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0199] Electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded into random access memory (RAM) 503 from storage unit 508. RAM 503 may also store various programs and data required for device operation. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0200] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, output unit 507, storage unit 508, and communication unit 509. Input unit 506 can be any type of device capable of inputting information to electronic device 500. Input unit 506 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 507 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 508 may include, but is not limited to, disk and optical disk. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0201] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above. For example, in some embodiments, the methods of the embodiments of this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. In some embodiments, the computing unit 501 can be configured to perform the methods of the embodiments of this disclosure by any other suitable means (e.g., by means of firmware).

[0202] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0203] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0204] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0205] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0206] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0207] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

Claims

1. A method for protecting backend interface calls, characterized in that, include: Obfuscate the API paths in the front-end code to form obfuscated API paths; The front-end gateway receives API requests from the front-end, and the API requests use obfuscated target API paths; The front-end gateway determines the original target API path corresponding to the obfuscated target API path based on the obfuscated target API path. The front-end gateway forwards the target API path before obfuscation to the service gateway; The obfuscation of API paths in the front-end code to form obfuscated API paths includes: Traverse the API paths of the front-end code to obtain the API paths to be processed; The feature information of the API path to be processed is extracted using sentence vectors; The feature information is encrypted and salted to obtain the obfuscated API path.

2. The method according to claim 1, characterized in that, The extraction of feature information from the API path to be processed using sentence vectors includes: The feature information of the API path to be processed is extracted using a sentence vector RNN model.

3. The method according to claim 1, characterized in that, In response to the front-end project compilation, a sentence vector encryption and salting process is triggered on the API path to be processed, so as to update the obfuscated API path.

4. The method according to claim 3, characterized in that, Construct a mapping file between the API paths before and after obfuscation, and upload the mapping file to the cloud distributed storage module.

5. The method according to any one of claims 1 to 4, characterized in that, The front-end gateway determines the original target API path corresponding to the obfuscated target API path based on the obfuscated target API path, including: The target API path before obfuscation is determined by using the target API path after obfuscation and a pre-stored mapping file between the API path before obfuscation and the API path after obfuscation.

6. A protection device for backend interface calls, characterized in that, include: The obfuscation module is used to obfuscate API paths in the front-end code to generate obfuscated API paths. The front-end gateway receiving module is used to receive API requests from the front end, wherein the API requests use the obfuscated target API path; The front-end gateway determination module is used to determine the target API path before obfuscation that corresponds to the target API path after obfuscation, based on the target API path after obfuscation. The front-end gateway forwarding module is used to forward the target API path before obfuscation to the service gateway; The obfuscation module is used to obfuscate API paths in the front-end code to generate obfuscated API paths. Specifically, it is used for: Traverse the API paths of the front-end code to obtain the API paths to be processed; The feature information of the API path to be processed is extracted using sentence vectors; The feature information is encrypted and salted to obtain the obfuscated API path.

7. An electronic device, characterized in that, include: processor; as well as Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the method according to any one of claims 1-5.

Images