Interface code generation method, device, computer equipment and storage medium

Abstract

The present application belongs to the field of security protection technology, and relates to an interface code generation method, device, computer equipment and storage medium, the method comprising: first obtaining the user's original demand interface description, then calling the specification details and regulatory rules to identify its security compliance, identifying the risk demand interface, obtaining the newly added interface data corresponding to the risk demand interface, and classifying it according to the preset security interface category to obtain the security interface category information, outputting the security design scheme corresponding to the security interface category information in a preset format, and generating an interface code for controlling security access. The present application effectively solves the problem of potential security risks in interface design by identifying the security compliance of the original demand and formulating a security design scheme for the risk interface. In addition, the full-process security management and control from demand analysis to code generation significantly improves the security and compliance of the interface, reduces security risks for the enterprise, and enhances the overall protection capabilities of the system.

Description

Technical Field

[0001] The present application relates to the field of security protection technology, and in particular to an interface code generation method, device, computer equipment and storage medium. Background Art

[0002] The Security Development Lifecycle (SDLC) is a security engineering methodology for web and app development. It aims to reduce security vulnerabilities during the R&D process, helping developers mitigate product security issues and improve product security quality. Security vulnerabilities can arise from design flaws or coding errors in application software or operating systems, or from design flaws or illogical logic flows during business interactions.

[0003] Common security vulnerabilities such as XSS (cross-site scripting), CSRF (cross-site request forgery), and SQL injection are purely technical vulnerabilities that can be mitigated through a unified architecture, unified middleware, unified interceptors, and unified controls. However, unauthorized access security vulnerabilities are business logic vulnerabilities that cannot be addressed with a single tool.

[0004] Currently, the industry's prevention of unauthorized access vulnerabilities mainly relies on expert identification, design, and coding to avoid unauthorized access security vulnerabilities.

[0005] However, the applicant found that the traditional method of preventing unauthorized vulnerabilities not only has high manpower costs, but also has low efficiency and is very easy to miss. This shows that the traditional method of preventing unauthorized vulnerabilities still has security risks.

[0006] Application Contents

[0007] The purpose of the embodiments of the present application is to propose an interface code generation method, device, computer equipment and storage medium to solve the problem of low interception accuracy in traditional methods for preventing unauthorized vulnerabilities.

[0008] In order to solve the above technical problems, the embodiment of the present application provides an interface code generation method, which adopts the following technical solutions:

[0009] Obtain the original demand interface description sent by the user terminal;

[0010] Calling specification details and regulatory rules, and performing security compliance identification processing on the original requirement interface description according to the specification details and regulatory rules, to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules;

[0011] Obtaining newly added interface data corresponding to the risk requirement interface description;

[0012] Classify the newly added interface data according to the preset security interface category to obtain security interface category information;

[0013] Acquire a security design solution corresponding to the security interface category information according to a preset format;

[0014] An interface code for controlling security access is generated according to the security design solution.

[0015] Furthermore, after the step of obtaining the original demand interface description sent by the user terminal, the following steps are also included:

[0016] Performing noise removal processing on the original demand interface description according to text cleaning technology to obtain a cleaned original demand interface description;

[0017] Performing semantic analysis on the cleaned original demand interface description according to natural language processing technology to obtain preliminary semantic analysis results;

[0018] Matching and mapping the preliminary semantic analysis results according to a preset interface description template to obtain an interface description element list;

[0019] Constructing a structured data model according to the interface description element list;

[0020] The data of each field of the structured data model is converted into JSON format to obtain a standardized original requirement interface description.

[0021] Furthermore, the step of generating an interface code for controlling secure access according to the security design solution specifically includes the following steps:

[0022] Parsing the security design solution according to the code generator to obtain preliminary configuration data;

[0023] Calling a code template library and obtaining a predefined template corresponding to the preliminary configuration data in the code template library;

[0024] The preliminary configuration data and the predefined template are integrated to obtain the interface code.

[0025] Furthermore, after the step of generating the interface code for controlling security access according to the security design solution, the method further includes the following steps:

[0026] Performing a comprehensive scan on the interface code using a static code analysis tool to obtain a comprehensive scan result;

[0027] If the comprehensive scan result contains a security vulnerability, there is no need to modify the interface code;

[0028] If a security vulnerability is found in the comprehensive scan result, the vulnerability location and vulnerability type of the security vulnerability are recorded;

[0029] An automatic repair function corresponding to the vulnerability type is called, and the security vulnerability is corrected according to the automatic repair function to obtain a corrected interface code.

[0030] Furthermore, after the step of generating the interface code for controlling security access according to the security design solution, the method further includes the following steps:

[0031] Monitor the behavior of the interface code during runtime using a dynamic code analysis tool, and record abnormal behaviors and triggering conditions during runtime of the interface code to obtain abnormal behavior data;

[0032] The effectiveness of the security access control mechanism of the interface code is analyzed based on the abnormal behavior data, and an analysis report is generated.

[0033] In order to solve the above technical problems, the embodiment of the present application further provides an interface code generation device, which adopts the following technical solution:

[0034] The demand acquisition module is used to obtain the original demand interface description sent by the user terminal;

[0035] A security compliance identification and acquisition module is used to call specification details and regulatory rules, and perform security compliance identification processing on the original requirement interface description based on the specification details and regulatory rules to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules;

[0036] A new interface acquisition module is added, used to obtain new interface data corresponding to the risk requirement interface description;

[0037] A classification module, configured to classify the newly added interface data according to a preset security interface category to obtain security interface category information;

[0038] A solution acquisition module is used to acquire a security design solution corresponding to the security interface category information according to a preset format;

[0039] A code generation module is used to generate interface code for controlling security access according to the security design solution.

[0040] Furthermore, the device further comprises:

[0041] A noise removal module is used to perform noise removal processing on the original demand interface description according to a text cleaning technology to obtain a cleaned original demand interface description;

[0042] A semantic analysis module is used to perform semantic analysis on the cleaned original demand interface description based on natural language processing technology to obtain preliminary semantic analysis results;

[0043] A matching and mapping module is used to match and map the preliminary semantic analysis results according to a preset interface description template to obtain a list of interface description elements;

[0044] A model building module, configured to build a structured data model according to the interface description element list;

[0045] The format conversion module is used to convert the data of each field of the structured data model into JSON format to obtain a standardized original requirement interface description.

[0046] Furthermore, the code generation module includes:

[0047] A parsing submodule, configured to parse the security design solution according to the code generator to obtain preliminary configuration data;

[0048] A template acquisition submodule, configured to call a code template library and acquire a predefined template corresponding to the preliminary configuration data in the code template library;

[0049] The data integration submodule is used to integrate the preliminary configuration data and the predefined template to obtain the interface code.

[0050] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0051] The system comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the interface code generation method as described above when executing the computer-readable instructions.

[0052] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0053] The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the interface code generation method described above.

[0054] The present application provides an interface code generation method, including: obtaining the original requirement interface description sent by the user terminal; calling the specification details and regulatory rules, and performing security compliance identification processing on the original requirement interface description according to the specification details and regulatory rules, and obtaining a risk requirement interface description that does not comply with the specification details and regulatory rules; obtaining new interface data corresponding to the risk requirement interface description; classifying the new interface data according to a preset security interface category to obtain security interface category information; obtaining a security design scheme corresponding to the security interface category information according to a preset format; and generating an interface code for controlling security access according to the security design scheme. Compared with the existing technology, the present application effectively solves the security risk problem in interface design by performing security compliance identification on the original requirements and formulating a security design scheme for the risk interface. In addition, the present application realizes full-process security management and control from requirement analysis to code generation, significantly improving the security and compliance of the interface, reducing security risks for enterprises, and enhancing the overall protection capabilities of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0056] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0057] Figure 2 This is a flowchart of the implementation of the interface code generation method provided in Example 1 of the present application;

[0058] Figure 3 This is a schematic diagram of the structure of the interface code generation device provided in Example 2 of the present application;

[0059] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0061] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0062] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0063] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0064] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0065] The terminal devices 101, 102, and 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptop computers, desktop computers, etc.

[0066] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0067] It should be noted that the interface code generation method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the interface code generation device is generally set in the server / terminal device.

[0068] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0069] Example 1

[0070] Continue to refer Figure 2 , shows a flow chart of an embodiment of the interface code generation method according to the present application. The interface code generation method includes: step S201, step S202, step S203, step S204, step S205 and step S206.

[0071] In step S201, the original required interface description sent by the user terminal is obtained.

[0072] In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for convenience of understanding and are not used to limit the present application.

[0073] In the embodiments of this application, the present application applies a large model to the SDLC. Although the large model cannot independently complete all SDLC tasks, it can enhance functionality, improve development security, and enhance product quality by splitting tasks, designing processes, and providing feedback and corrections. The specific application process of the large model is as follows:

[0074] (1) Identify security risks in business requirement interface orchestration;

[0075] (2) Identify interfaces for security based on business needs;

[0076] (3) Conduct security design based on security identification content;

[0077] (4) Generate code based on the design content.

[0078] In step S202, the specification details and regulatory rules are called, and the original requirement interface description is subjected to security compliance identification processing according to the specification details and regulatory rules to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules.

[0079] In the embodiments of this application, security risks in business requirements are identified, such as whether they violate internal regulations and regulatory requirements; whether there are security risks at the demand level, etc. This application classifies internal regulations into 25 categories based on dimensions such as data classification and grading, asset security, content security, and access authorization.

[0080] In the embodiment of the present application, in order to identify the security risks of business needs, the present application constructs the following four components of the large model input prompt:

[0081] 1) Instructions: Given a requirement description, analyze the security risks of the business requirement;

[0082] 2) Context: List the specific industry regulations and supervisory rules for each category;

[0083] 3) Input data: requirement description and its application information;

[0084] 4) Output prompt: Output the requirements that do not meet security compliance, and output in the format of function point: specific function description - reason for non-compliance: specific regulatory rules; if the requirements do not involve security risks, the output will be empty.

[0085] Input the above-constructed prompt information into the big model to get the result of whether the business requirements design security risks.

[0086] In step S203, newly added interface data corresponding to the risk requirement interface description is obtained.

[0087] In the embodiment of the present application, in order to obtain the security identification result of the interface, the four components of the large model input prompt are constructed as follows:

[0088] Obtain the required specific interfaces and interface dependencies based on business needs.

[0089] 1) Instructions: Given a requirement description, analyze the specific interfaces and interface orchestration relationships required by the business requirements;

[0090] 2) Context: List the four attribute fields of each interface information one by one (interface ID, interface input and output definition, interface function description and dependent interface);

[0091] 3) Input data: requirement description (detailed task objectives), process orchestration configuration (input parameters, output parameters, attributes);

[0092] 4) Output prompt: Output the input and output definitions of the newly added interface according to the interface ID list and arrangement process.

[0093] The above-constructed prompt information is input into the large model to obtain the calling relationship between the interface IDs involved in the requirements.

[0094] In step S204, the newly added interface data is classified according to the preset security interface category to obtain security interface category information.

[0095] In the embodiment of the present application, the security identification content is divided into 7 categories, specifically including: security parameterization SQL, that is, whether there is a new or modified SQL; security sensitive information, that is, whether there is information transmission and storage of personal sensitive data specifications; security input verification, that is, whether there is new or modified user data input; and security access control.

[0096] In the embodiment of the present application, the four components of constructing the large model input prompt are as follows:

[0097] 1) Instructions: Given the functional description and input and output definitions of the newly added interface, analyze and obtain the security identification results.

[0098] 2) Context: List the seven categories of security identification content mentioned above one by one;

[0099] 3) Input data: Added functional description and input and output definitions of the new interface;

[0100] 4) Output prompt: Output in the format of interface ID-identified security content. If no security identification content is involved, the output is blank.

[0101] The above-constructed prompt information is input into the large model to obtain the security identification result of the new interface.

[0102] In step S205, a security design solution corresponding to the security interface category information is obtained according to a preset format.

[0103] In the embodiment of the present application, in order to obtain the security design logic of the interface, the interfaces involving security identification content are sorted out, and the four components of the large model input prompt are constructed as follows:

[0104] 1) Instructions: Given the functional description and input / output definitions of the new interface and the dependency relationship with the existing interfaces, analyze and derive a security design solution.

[0105] 2) Context: List the interface information involved in security identification content and the corresponding security design examples one by one.

[0106] 3) Input data: Add input and output descriptions of new interfaces, and restrictions on upstream and downstream interfaces;

[0107] 4) Output prompt: Output the security design plan of the newly added interface in the following format.

[0108] Category: Input Validation

[0109] Interface ID: 001

[0110] Field 1 {Chinese name: User password field; English name: User password; Data type: string; Allowed values: Letters and numbers, no special characters; Minimum character length: 6; Maximum character length: 64}

[0111] Category: Access Control

[0112] Interface ID: 001

[0113] {Interface path, interface description, who can access this API, how to ensure that the API can only be accessed by legitimate users}

[0114] The above-constructed prompt information is input into the large model to obtain a security design solution with different security identification contents for a specific interface.

[0115] In step S206, an interface code for controlling security access is generated according to the security design solution.

[0116] In the embodiment of the present application, if there is a security design content that requires input and output verification, in order to avoid XSS cross-site scripting attacks, a unified interceptor can be directly added to the code to solve the problem;

[0117] If security access control is involved, in order to avoid unauthorized access vulnerabilities, the main task is to verify the permissions of the interface.

[0118] The permission verification is divided into three types for coding: interface permission, user status, and interface operable object filtering.

[0119] The four components of constructing a large model input prompt for secure access control are as follows:

[0120] 1) Instructions: Based on the security design content and interface definition in step 3, use Java code to implement access control functions;

[0121] 2) Context: List the corresponding permission verification instructions and examples one by one, such as verifying the status of the user accessing the current interface, verifying whether the current user has the permission for the current interface, verifying whether the current user has the permission for the current operation object, etc.

[0122] 3) Input data: The security design content includes each interface of the access control category and the requirement description:

[0123] 4) Output prompt: Output interface related codes.

[0124] The above-constructed prompt information is input into the large model to obtain the code related to the security access control of the specific interface.

[0125] In some optional implementation methods of the embodiments of the present application, the above-generated security design identification content is encapsulated into a plug-in and embedded in the developer platform to assist in generating security design content for developers to refer to and supplement. Code is generated for the supplemented security design content of the access control and input verification categories, and code examples are provided. After the developer supplements the code details, they can proceed to the next step of security audit and testing according to the normal process.

[0126] In actual application, it may be difficult for a large model to give the most correct code in one go, so continuous prompts and corrections are required until the same process design can be reused in a specific business scenario. This application uses ChatGPT as a control group (the data is fictitious test data) and uses the open source ChatG LM2+LangChain deployed in-house as an experimental group for process debugging. Considering data security management and actual resource application limitations, ChatG LM2+LangChain is not as effective as ChatGPT in response speed and accuracy, but it still has great reference significance for actual implementation, and greatly reduces code logic errors or security vulnerabilities caused by human development and design.

[0127] In an embodiment of the present application, an interface code generation method is provided, including: obtaining an original requirement interface description sent by a user terminal; calling specification details and regulatory rules, and performing security compliance identification processing on the original requirement interface description according to the specification details and regulatory rules, to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules; obtaining new interface data corresponding to the risk requirement interface description; classifying and processing the new interface data according to a preset security interface category to obtain security interface category information; obtaining a security design scheme corresponding to the security interface category information according to a preset format; and generating an interface code for controlling security access according to the security design scheme. Compared with the prior art, the present application effectively solves the security risk problem in interface design by performing security compliance identification on the original requirement and formulating a security design scheme for the risk interface. In addition, the present application realizes full-process security management and control from requirement analysis to code generation, significantly improving the security and compliance of the interface, reducing security risks for the enterprise, and enhancing the overall protection capability of the system.

[0128] In some optional implementations of the embodiments of the present application, after step S201, the following steps are further included:

[0129] The original requirement interface description is subjected to noise removal processing based on text cleaning technology to obtain the cleaned original requirement interface description;

[0130] Perform semantic analysis on the cleaned original requirement interface description using natural language processing technology to obtain preliminary semantic analysis results;

[0131] Match and map the preliminary semantic analysis results according to the preset interface description template to obtain a list of interface description elements;

[0132] Build a structured data model based on the interface description element list;

[0133] Convert each field data of the structured data model into JSON format to obtain a standardized original requirement interface description.

[0134] In an embodiment of the present application, after receiving the original demand interface description sent by the user, the original text data needs to be preprocessed. Specifically, the text cleaning method in NLP (natural language processing) technology is adopted, such as removing stop words, punctuation marks and HTML tags; then, the NLTK library is used to perform word segmentation, part-of-speech tagging and syntactic analysis on the cleaned text data, and the dependency parsing function in the Spacy library is used to extract key sentence structures and semantic information.

[0135] In an embodiment of the present application, in the semantic information matching stage, the preset interface description template can be represented by a JSON object, for example, `template = {"interface name":"","interface address":"","request method":"","request parameters":,"return result":"","interface description":"","call example":"","abnormal situation":"","remarks":""}`. By matching the preliminary semantic analysis results, the extracted keywords are mapped to the corresponding template fields. As an example, assuming that the request method is identified as "POST" during the word segmentation and part-of-speech tagging process, the request method field `template = "POST"` in the template is updated.

[0136] In an embodiment of the present application, when constructing a structured data model, the interface description element list is converted into a dictionary form, and each field is completed, for example, `data_mode l = {"Interface name":"User login","Interface address":" / ap i / log ogi n","Request method":"POST","Request parameters":[{"Parameter name":"user name","Type":"str ing"}],"Return result":"Login successful","Interface description":"User login interface","Call example":"POST / ap i / log in{user name:test","Exception situation":"User name does not exist","Remarks":"Please make sure the username has been registered"}`.

[0137] In the embodiment of the present application, when generating standardized interface description data, the structured data model is converted into JSON format using Python's json library.

[0138] In some optional implementations of the embodiments of the present application, the integrity and correctness of the JSON data can be verified through predefined rules and verification procedures. For example, it is possible to check whether the required fields are empty and whether the field type is correct, and to perform field existence and non-empty verification through `assert "interface name" i nj son_data and j son_data,"interface name cannot be empty"`.

[0139] In some optional implementations of the embodiments of the present application, step S206 specifically includes the following steps:

[0140] Analyze the security design plan according to the code generator to obtain preliminary configuration data;

[0141] Calling a code template library and obtaining a predefined template corresponding to the preliminary configuration data in the code template library;

[0142] Integrate preliminary configuration data and predefined templates to obtain interface code.

[0143] In an embodiment of the present application, in order to enable the code generator to parse the security design plan document and generate a security access control code framework, first, the present application uses natural language processing (NLP) technology to parse the security design plan document and extract key configuration parameters and security policies; through parsing, the present application uses regular expressions to extract specific parameters such as "OAuth0" and "AES-256"; the code generator searches for the corresponding template in the predefined code template library according to the extracted configuration parameters; the code generator integrates these template fragments with the extracted information to generate a code framework that includes interface security access control.

[0144] In some optional implementations of the embodiments of the present application, after step S206, the following steps are further included:

[0145] Perform a comprehensive scan of the interface code using static code analysis tools to obtain comprehensive scan results;

[0146] If a comprehensive scan reveals a security vulnerability, there is no need to modify the interface code;

[0147] If a security vulnerability is found in the comprehensive scan results, the location and type of the vulnerability will be recorded;

[0148] The automatic repair function corresponding to the vulnerability type is called, and the security vulnerability is corrected according to the automatic repair function to obtain a corrected interface code.

[0149] In an embodiment of the present application, after obtaining the interface code, the interface code is passed to a static code analysis tool for a comprehensive scan. The static code analysis tool uses known security rules, such as the rules in the CWE (Common Weakness Enumeration) list, to detect potential security vulnerabilities in the code.

[0150] In an embodiment of the present application, if a vulnerability is found, the present application will record the specific location and type of the vulnerability. This information will generate a vulnerability report. Based on the vulnerability report, the code generator will call the automatic repair function. The repair strategy will locate the SQL query part in the code and replace the vulnerable string concatenation statement with a safe parameterized query syntax.

[0151] In the embodiment of the present application, a fully automated process is implemented from parsing the security design plan document to generating the final security code framework, ensuring high security and traceability of the code.

[0152] In some optional implementations of the embodiments of the present application, after step S206, the following steps are further included:

[0153] Monitor the runtime behavior of the interface code using dynamic code analysis tools, record abnormal behavior and triggering conditions during the runtime of the interface code, and obtain abnormal behavior data;

[0154] Analyze the effectiveness of the security access control mechanism of the interface code based on abnormal behavior data and generate an analysis report.

[0155] In the embodiment of the present application, the dynamic code analysis tool is mainly used to monitor the behavior of the code during runtime. The dynamic code analysis tool can be Dynat race or New Relic, etc.

[0156] In this application, an embodiment records abnormal behavior and its triggering conditions during code execution. For example, during a user registration request, input data triggered an unhandled exception. Based on this abnormal behavior data, the application analyzes whether the interface's security access control mechanism is effective, determines whether there are vulnerabilities that bypass authentication or permission control, and generates a detailed analysis report.

[0157] In the embodiment of the present application, the aforementioned analysis report is combined to propose improvement suggestions for interface code optimization and security reinforcement, thereby ensuring that they are implemented in the subsequent development process.

[0158] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0159] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0160] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware via computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0161] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0162] Example 2

[0163] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of an interface code generation device, which is similar to the embodiment of the present invention. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0164] like Figure 3 As shown, the interface code generating device 200 of the embodiment of the present application includes:

[0165] The demand acquisition module 210 is used to obtain the original demand interface description sent by the user terminal;

[0166] The security compliance identification and acquisition module 220 is used to call the specification details and regulatory rules, and perform security compliance identification processing on the original requirement interface description based on the specification details and regulatory rules to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules;

[0167] A new interface acquisition module 230 is used to acquire new interface data corresponding to the risk requirement interface description;

[0168] Classification module 240, for classifying the newly added interface data according to the preset security interface category to obtain security interface category information;

[0169] Solution acquisition module 250, used to obtain the security design solution corresponding to the security interface category information according to a preset format;

[0170] The code generation module 260 is used to generate interface codes for controlling security access according to the security design solution.

[0171] In an embodiment of the present application, an interface code generation device 200 is provided, comprising: a requirements acquisition module 210 for acquiring an original requirements interface description sent by a user terminal; a security compliance identification acquisition module 220 for invoking specification details and regulatory rules and performing security compliance identification processing on the original requirements interface description based on the specification details and regulatory rules to obtain a risky requirements interface description that does not comply with the specification details and regulatory rules; a new interface acquisition module 230 for acquiring new interface data corresponding to the risky requirements interface description; a classification module 240 for classifying the new interface data according to preset security interface categories to obtain security interface category information; a solution acquisition module 250 for acquiring, in a preset format, a security design solution corresponding to the security interface category information; and a code generation module 260 for generating interface code for controlling secure access based on the security design solution. Compared with the existing technology, this application effectively solves the security risks in interface design by identifying the security compliance of the original requirements and formulating a security design plan for the risky interface. In addition, this application realizes the full-process security management from requirements analysis to code generation, significantly improving the security and compliance of the interface, reducing security risks for enterprises, and enhancing the overall protection capabilities of the system.

[0172] In some optional implementations of the embodiments of the present application, the apparatus 200 further includes:

[0173] A noise removal module is used to remove noise from the original requirement interface description based on text cleaning technology to obtain the cleaned original requirement interface description;

[0174] The semantic analysis module is used to perform semantic analysis on the cleaned original requirement interface description based on natural language processing technology to obtain preliminary semantic analysis results;

[0175] The matching and mapping module is used to match and map the preliminary semantic analysis results according to the preset interface description template to obtain a list of interface description elements;

[0176] A model building module is used to build a structured data model based on the interface description element list;

[0177] The format conversion module is used to convert the data of each field of the structured data model into JSON format to obtain a standardized original requirement interface description.

[0178] In some optional implementations of the embodiments of the present application, the code generation module includes:

[0179] The parsing submodule is used to parse the security design plan according to the code generator to obtain preliminary configuration data;

[0180] The template acquisition submodule is used to call the code template library and obtain the predefined template corresponding to the preliminary configuration data in the code template library;

[0181] The data integration submodule is used to integrate preliminary configuration data and predefined templates to obtain interface code.

[0182] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device according to an embodiment of the present application.

[0183] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected via a system bus. It should be noted that the figure only shows the computer device 300 having components 310-330, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art will understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0184] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0185] The memory 310 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disk, optical disk, etc. In some embodiments, the memory 310 may be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 may also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Of course, the memory 310 may also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of the interface code generation method. In addition, the memory 310 can also be used to temporarily store various data that has been output or is about to be output.

[0186] In some embodiments, the processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to execute computer-readable instructions stored in the memory 310 or process data, such as computer-readable instructions for executing the interface code generation method.

[0187] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0188] The computer equipment provided in this application effectively solves the security risks in interface design by identifying the security compliance of original requirements and formulating security design plans for risky interfaces. In addition, it realizes full-process security management from requirements analysis to code generation, significantly improves the security and compliance of the interface, reduces security risks for enterprises, and enhances the overall protection capabilities of the system.

[0189] The present application also provides another embodiment, namely, providing a computer-readable storage medium, which stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the interface code generation method as described above.

[0190] The computer-readable storage medium provided in this application effectively solves the security risks in interface design by identifying the security compliance of original requirements and formulating security design plans for risky interfaces. In addition, it realizes the whole process security management from requirements analysis to code generation, significantly improves the security and compliance of the interface, reduces security risks for enterprises, and enhances the overall protection capabilities of the system.

[0191] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0192] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A method for generating interface code, characterized in that: The steps include: Obtain the original demand interface description sent by the user terminal; Calling specification details and regulatory rules, and performing security compliance identification processing on the original requirement interface description according to the specification details and regulatory rules, to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules; Obtaining newly added interface data corresponding to the risk requirement interface description; Classify the newly added interface data according to the preset security interface category to obtain security interface category information; Acquire a security design solution corresponding to the security interface category information according to a preset format; An interface code for controlling security access is generated according to the security design solution.

2. The interface code generation method according to claim 1, characterized in that: After the step of obtaining the original demand interface description sent by the user terminal, the following steps are also included: Performing noise removal processing on the original demand interface description according to text cleaning technology to obtain a cleaned original demand interface description; Performing semantic analysis on the cleaned original demand interface description according to natural language processing technology to obtain preliminary semantic analysis results; Matching and mapping the preliminary semantic analysis results according to a preset interface description template to obtain an interface description element list; Constructing a structured data model according to the interface description element list; The data of each field of the structured data model is converted into JSON format to obtain a standardized original requirement interface description.

3. The interface code generation method according to claim 1, characterized in that: The step of generating an interface code for controlling secure access according to the security design solution specifically includes the following steps: Parsing the security design solution according to the code generator to obtain preliminary configuration data; Calling a code template library and obtaining a predefined template corresponding to the preliminary configuration data in the code template library; The preliminary configuration data and the predefined template are integrated to obtain the interface code.

4. The interface code generation method according to claim 3, characterized in that: After the step of generating an interface code for controlling secure access according to the security design solution, the method further includes the following steps: Performing a comprehensive scan on the interface code using a static code analysis tool to obtain a comprehensive scan result; If the comprehensive scan result shows a security vulnerability, there is no need to modify the interface code; If a security vulnerability exists in the comprehensive scan result, the vulnerability location and vulnerability type of the security vulnerability are recorded; An automatic repair function corresponding to the vulnerability type is called, and the security vulnerability is corrected according to the automatic repair function to obtain a corrected interface code.

5. The interface code generation method according to claim 1, characterized in that: After the step of generating an interface code for controlling secure access according to the security design solution, the method further includes the following steps: Monitor the behavior of the interface code during runtime using a dynamic code analysis tool, and record abnormal behaviors and triggering conditions during runtime of the interface code to obtain abnormal behavior data; The effectiveness of the security access control mechanism of the interface code is analyzed based on the abnormal behavior data, and an analysis report is generated.

6. An interface code generating device, characterized in that: include: The demand acquisition module is used to obtain the original demand interface description sent by the user terminal; A security compliance identification and acquisition module is used to call specification details and regulatory rules, and perform security compliance identification processing on the original requirement interface description based on the specification details and regulatory rules to obtain a risk requirement interface description that does not comply with the specification details and regulatory rules; A new interface acquisition module is added, used to obtain new interface data corresponding to the risk requirement interface description; A classification module, configured to classify the newly added interface data according to a preset security interface category to obtain security interface category information; A solution acquisition module is used to acquire a security design solution corresponding to the security interface category information according to a preset format; A code generation module is used to generate interface code for controlling security access according to the security design solution.

7. The interface code generating device according to claim 6, characterized in that: The device further comprises: A noise removal module is used to perform noise removal processing on the original demand interface description according to a text cleaning technology to obtain a cleaned original demand interface description; A semantic analysis module is used to perform semantic analysis on the cleaned original demand interface description based on natural language processing technology to obtain preliminary semantic analysis results; A matching and mapping module is used to match and map the preliminary semantic analysis results according to a preset interface description template to obtain a list of interface description elements; A model building module, configured to build a structured data model according to the interface description element list; The format conversion module is used to convert the data of each field of the structured data model into JSON format to obtain a standardized original requirement interface description.

8. The interface code generating device according to claim 6, characterized in that: The code generation module includes: A parsing submodule, configured to parse the security design solution according to the code generator to obtain preliminary configuration data; A template acquisition submodule, configured to call a code template library and acquire a predefined template corresponding to the preliminary configuration data in the code template library; The data integration submodule is used to integrate the preliminary configuration data and the predefined template to obtain the interface code.

9. A computer device comprising a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the interface code generation method according to any one of claims 1 to 5 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the interface code generation method according to any one of claims 1 to 5.

Images