API access control method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention relates to the technical field of API access control, and provides an API access control method and device, equipment, a storage medium and a program product, applied to a proxy server, the API access control method comprises the following steps: respectively creating an API-protection level mapping table and a user role-user level mapping table; the proxy application authenticates an interface, creates a key-user role mapping table, and returns key information to the client; and receiving a key carried when the client calls the service function interface, and performing API access control on the client according to the key, the API-protection level mapping table, the user role-user level mapping table and the key-user role mapping table. According to the embodiment of the invention, the authority control function and the application service function are deeply decoupled, the safety control left shift is realized, and the emergency resistance and quick adaptability of a service system when the service system faces complex network attacks and the service of the service system changes continuously are effectively improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of API access control, and in particular to an API access control method and apparatus, device, storage medium, and program product. Background Art

[0002] As a core component of software systems, the Application Programming Interface (API) has become the cornerstone of modern application architecture. API abstracts the functions of applications so that clients can easily call these functions, thereby implementing complex business logic and operations. Because APIs are easy to build and maintain, developers can quickly develop and deploy new features while improving the scalability and flexibility of applications. With the widespread application of technologies such as microservice architecture, cloud computing, big data, and the Internet of Things, APIs are becoming increasingly important in applications. The core functions of almost every modern application rely on API implementation.

[0003] However, it is precisely because of the widespread use and open nature of APIs that they have become a major target for attackers. The business functions carried by APIs are often highly sensitive and may involve users' personal data, financial information, internal corporate resources, and other key assets. Therefore, how to effectively control access to APIs has become an important issue in protecting sensitive business functions and data security.

[0004] Currently, most API access control solutions are integrated into the backend of the application, which makes it difficult to adapt to rapidly changing business needs and respond quickly to security incidents. Summary of the invention

[0005] The present disclosure aims to solve at least one of the problems existing in the prior art and provides an API access control method and apparatus, device, storage medium, and program product.

[0006] In one aspect of the present disclosure, there is provided an API access control method, which is applied to a proxy server;

[0007] The API access control method includes:

[0008] Create API-protection level mapping table and user role-user level mapping table respectively;

[0009] The proxy application authentication interface creates a key-user role mapping table and returns the key information to the client;

[0010] Receive the key carried by the client when calling the business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0011] Optionally, the proxy application authentication interface creates a key-user role mapping table and returns the key information to the client, including:

[0012] Modify the return value of the application authentication interface so that the corresponding API adds the successfully authenticated user role information to the corresponding authentication response;

[0013] Intercepting the authentication response and obtaining the user role information therein;

[0014] Generate a random value, encode the random value, use the encoded random value as a key corresponding to the user role information, and write it into the key-user role mapping table;

[0015] The authentication response is modified, the user role information therein is replaced with a key corresponding to the user role information, and the modified authentication response is returned to the client.

[0016] Optionally, the receiving a key carried by the client when calling a business function interface, and performing API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table, includes:

[0017] Receive an API call request sent by the client, where the API call request carries the client IP address and a key;

[0018] Determine whether the client IP address is in the blacklist. If so, directly discard the API call request; if not, query the protection level of the current API corresponding to the API call request according to the API-protection level mapping table. If the protection level of the current API is the preset level, forward the API call request to the current API. If the protection level of the current API is not the preset level, obtain the key in the API call request, query the user role corresponding to the obtained key according to the key-user role mapping table, and perform API access control according to the user role.

[0019] Optionally, performing API access control according to the user role includes:

[0020] According to the user role-user level mapping table, query the user level corresponding to the user role;

[0021] The user level corresponding to the user role is compared with the protection level of the current API. If the user level corresponding to the user role is greater than or equal to the protection level of the current API, the API call request is forwarded to the current API.

[0022] Optionally, the blacklist is established in the following manner:

[0023] The number of API accesses by the client in a unit time is recorded, and if the number of API accesses is higher than a preset threshold, the client IP address corresponding to the client is added to the blacklist.

[0024] Optionally, the creating of an API-protection level mapping table and a user role-user level mapping table respectively includes:

[0025] According to the sensitivity of the API and the permissions of the system roles, create an API-protection level mapping table and a user role-user level mapping table respectively.

[0026] Another aspect of the present disclosure provides an API access control device, which is applied to a proxy server;

[0027] The API access control device comprises:

[0028] A first creation module is used to create an API-protection level mapping table and a user role-user level mapping table respectively;

[0029] The second creation module is used to proxy the application authentication interface, create a key-user role mapping table, and return the key information to the client;

[0030] The control module is used to receive the key carried by the client when calling the business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0031] Another aspect of the present disclosure provides an electronic device, including:

[0032] at least one processor; and,

[0033] a memory communicatively connected to at least one processor; wherein,

[0034] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the API access control method described above.

[0035] Another aspect of the present disclosure provides a computer-readable storage medium storing a computer program, which implements the API access control method described above when executed by a processor.

[0036] Another aspect of the present disclosure provides a computer program product, including a computer program, which implements the API access control method described above when executed by a processor.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1. Provide two kinds of permission control methods: role-based access control and protection level-based access control. The permission control has a high degree of configuration flexibility.

[0039] 2. Based on the proxy configuration file, it has hot deployment capability and can quickly respond to emergencies. Other existing access control frameworks usually implement and maintain permission control logic in the application code. Once an unauthorized access problem occurs, not only will the rectification process take a long time, but the business will not be able to run during the rectification period. However, when encountering unauthorized access security issues, the operation and maintenance personnel of this disclosure only need to modify the proxy configuration file to change the API access control permissions in real time. Moreover, during the emergency response process, the application does not need to be offline for rectification, and the operation of business functions will not be affected.

[0040] 3. The high degree of decoupling of access control from business functions can not only intercept security risks in advance and achieve security left shift, but also effectively reduce the load pressure on the application backend.

[0041] 4. It has extremely high applicability, and its deployment implementation is independent of the application system architecture and development language. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0043] Figure 1 A flowchart of an API access control method provided in one embodiment of the present disclosure;

[0044] Figure 2 A flowchart of an API access control method provided by another embodiment of the present disclosure;

[0045] Figure 3 A schematic diagram of the structure of an API access control device provided by another embodiment of the present disclosure;

[0046] Figure 4A schematic structural diagram of an electronic device provided in another embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. However, it can be understood by those skilled in the art that in each embodiment of the present disclosure, many technical details are proposed in order to enable readers to better understand the present disclosure. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed for protection in the present disclosure can also be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present disclosure. The various embodiments can be combined and referenced with each other without contradiction.

[0048] An embodiment of the present disclosure relates to an API access control method, which is applied to a proxy server. The process is as follows: Figure 1 As shown, including:

[0049] Step S110, creating an API-protection level mapping table and a user role-user level mapping table respectively.

[0050] Specifically, the purpose of step S110 is to provide a judgment basis for API access control through the created API-protection level mapping table and user role-user level mapping table. Among them, the API-protection level mapping table is used to identify the protection level corresponding to each API, so that corresponding security protection measures can be taken for each API according to the corresponding protection level. The user role-user level mapping table is used to identify the user level corresponding to each user role, so that permission management and access control can be performed on each user role according to the corresponding user level.

[0051] Exemplarily, step S110 includes: creating an API-protection level mapping table and a user role-user level mapping table respectively according to the sensitivity of the API and the authority of the system role.

[0052] Specifically, the sensitivity of an API usually depends on the environment, data type, and security protection measures in which it is accessed and used. According to the different sensitivity of the API, the API can be divided into different protection levels. Generally, the higher the sensitivity of the API, the higher the corresponding protection level. For example, when the sensitivity of the API is level 0, level 1, level 2, level 3, etc., the protection level of the corresponding API can be set to level 0, level 1, level 2, level 3, etc., respectively, where the larger the number, the higher the corresponding sensitivity or protection level. Of course, in addition to using numbers to identify the protection level of the API, other forms can also be used to identify the protection level of the API. For example, the protection level of the API can be identified by letters, such as A, B, C, D, etc. from low to high. For another example, the protection level of the API can also be identified by text, such as low, medium, high, and the highest level from low to high.

[0053] Different system roles are usually assigned different permissions. For example, the administrator role is usually assigned all permissions, while the ordinary user role is usually assigned some permissions. Therefore, step S110 can determine the user level corresponding to the user role according to the number of permissions assigned to the user role, such as the more permissions assigned, the larger the user level corresponding to the user role. For example, when different user levels are represented by level 0, level 1, level 2, and level 3, for ordinary user roles, the corresponding user level can be any one of level 0, level 1, and level 2, and for administrator roles, the corresponding user level can be level 3, that is, the administrator role usually corresponds to the highest user level, and the user level corresponding to the ordinary user role is usually lower than the user level corresponding to the administrator role. Similar to the protection level of the API, in addition to being identified by numbers, user levels can also be identified by other forms such as letters and text, and this embodiment does not limit this.

[0054] This implementation creates an API-protection level mapping table and a user role-user level mapping table according to the sensitivity of the API and the permissions of the system roles, so that the API protection level, user role and its corresponding user level can be integrated into the API access control process, thereby improving the flexibility of API access control.

[0055] Step S120: The proxy application authenticates the interface, creates a key-user role mapping table, and returns the key information to the client.

[0056] Specifically, step S120 is mainly used to return key information to the client by creating a key-user role mapping table, so as to provide a basis for identifying the user role of the client performing API access in subsequent steps. The key-user role mapping table is used to identify the user role corresponding to each key.

[0057] Step S130, receiving the key carried by the client when calling the business function interface, and performing API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0058] Specifically, step S130 first needs to determine the user role corresponding to the client based on the key-user role mapping table according to the key carried by the client when calling the business function interface, and then determine the user level corresponding to the client based on the user role-user level mapping table according to the user role of the client, and determine the protection level of the API that the client requests to access based on the API-protection level mapping table, and then perform API access control on the client based on the user level corresponding to the client and the protection level of the API it requests to access.

[0059] Exemplarily, step S120 includes: modifying the return value of the application authentication interface so that the corresponding API adds the successfully authenticated user role information to the corresponding authentication response; intercepting the authentication response to obtain the user role information therein; generating a random value, encoding the random value, and using the encoded random value as the key corresponding to the user role information, writing it into the key-user role mapping table; modifying the authentication response, replacing the user role information therein with the key corresponding to the user role information, and returning the modified authentication response to the client.

[0060] Specifically, before accessing the API, the client usually needs to log in and authenticate through the application authentication interface to verify the identity of the client. When the client authentication succeeds, step S120 can modify the return value of the application authentication interface so that the successfully authenticated API adds the user role information of the client to the authentication response. The proxy server replaces the user role information in the authentication response with a key obtained by encoding a random value, returns the key information to the client, and writes the user role information, key and mapping relationship corresponding to the client into the key-user role mapping table to complete the creation of the key-user role mapping table.

[0061] This implementation method can effectively protect data privacy and ensure key transmission and storage security by using the authentication response to create a key-user role mapping table and returning the key to the client.

[0062] Exemplarily, step S130 includes: receiving an API call request sent by a client, the API call request carrying a client IP address and a key; determining whether the client IP address is in the blacklist, and if so, directly discarding the API call request; if not, querying the protection level of the current API corresponding to the API call request according to the API-protection level mapping table, if the protection level of the current API is the preset level, forwarding the API call request to the current API, if the protection level of the current API is not the preset level, obtaining the key in the API call request, querying the user role corresponding to the obtained key according to the key-user role mapping table, and performing API access control according to the user role.

[0063] Specifically, the preset level can be set according to actual needs. For example, the preset level can be set to level 0 (default value), which means that the protection level of the corresponding API is the lowest and all user roles can access it. At this time, if the level of the current API required to be called by the API call request is level 0, the API call request can be directly forwarded to the current API.

[0064] The key carried in the API call request may be set in the header of the API call request. In this case, step S130 may directly obtain the key in the API call request from the header of the API call request.

[0065] This implementation method can further improve data security and prevent security risks by implementing API access control using the client IP address and key carried in the API call request.

[0066] Exemplarily, API access control is performed based on user roles, including: querying the user level corresponding to the user role based on a user role-user level mapping table; comparing the user level corresponding to the user role with the protection level of the current API, and if the user level corresponding to the user role is greater than or equal to the protection level of the current API, forwarding the API call request to the current API.

[0067] Specifically, if the user level corresponding to the user role is greater than or equal to the protection level of the current API, it means that the user role has the right to access the current API, and the API call request corresponding to the user role can be directly forwarded to the current API. If the user level corresponding to the user role is less than the protection level of the current API, it means that the user role has no right to access the current API, and the API call request corresponding to the user role can be directly discarded.

[0068] By comparing the user level corresponding to the user role with the protection level of the current API, when the user level corresponding to the user role is greater than or equal to the protection level of the current API, the API call request corresponding to the user role is forwarded to the current API, which can further improve data security and ensure that only authorized user roles can access the corresponding API.

[0069] Exemplarily, the method of establishing the blacklist includes: recording the number of API accesses by the client in a unit time, and if the number of API accesses is higher than a preset threshold, adding the client IP address corresponding to the client to the blacklist.

[0070] Specifically, considering that an attacker may crack the key through brute force means, this embodiment determines whether it is necessary to add the client IP address to the blacklist by recording the number of API accesses of the same client IP address in a unit time. If the number of API accesses of a certain client IP address in a unit time is higher than a preset threshold, the client IP address may be the IP address used by the attacker and the client IP address needs to be added to the blacklist.

[0071] Compared with the prior art, the API access control method provided by the present disclosure has the following beneficial effects:

[0072] 1. Provide two kinds of permission control methods: role-based access control and protection level-based access control. The permission control has a high degree of configuration flexibility.

[0073] 2. Based on the proxy configuration file, it has hot deployment capability and can quickly respond to emergencies. Other existing access control frameworks usually implement and maintain permission control logic in the application code. Once an unauthorized access problem occurs, not only will the rectification process take a long time, but the business will not be able to run during the rectification period. However, when encountering unauthorized access security issues, the operation and maintenance personnel of this disclosure only need to modify the proxy configuration file to change the API access control permissions in real time. Moreover, during the emergency response process, the application does not need to be offline for rectification, and the operation of business functions will not be affected.

[0074] 3. The high degree of decoupling of access control from business functions can not only intercept security risks in advance and achieve security left shift, but also effectively reduce the load pressure on the application backend.

[0075] 4. It has extremely high applicability, and its deployment implementation is independent of the application system architecture and development language.

[0076] In order to enable those skilled in the art to better understand the above implementation, a specific example is provided below for illustration.

[0077] An API access control method, applied to a proxy server. Figure 2 As shown, the proxy server is connected to the application client and the application server respectively, and the proxy server is also provided with an authentication interface and a business interface. Among them, the authentication interface is used to control the login authentication of the application client. The business interface is used to control the API access of the application client.

[0078] Take the proxy server as Nginx reverse proxy server as an example, assuming that there are three user roles in the application system, namely: system administrator Admin, teacher Teacher, student Student, and there are four APIs, namely: system login login, add user addUser, set score setScores, query score queryScores. On this basis, the API access control method includes the following steps:

[0079] Step 1: First, create an API-protection level mapping table and a user role-user level mapping table according to business requirements. Both mapping tables are stored in the form of configuration files, where the file name of the API-protection level mapping table is api-protectionlevel.conf, and the file name of the user role-user level mapping table is role-level.conf.

[0080] The specific content of api-protectionlevel.conf is: the protection levels for querying scores, setting scores, and adding users are 1, 2, and 3 respectively, and the protection level for system login and other APIs is the default value 0. That is:

[0081] map$url$procetion_level{

[0082] "queryScores" "1";

[0083] "setScores" "2";

[0084] "addUser" "3";

[0085] default "0";

[0086] }

[0087] The specific content of role-level.conf is: the user levels of students, teachers, and system administrators are 1, 2, and 3 respectively, and the user level of other roles is the default value 0. That is:

[0088] map$role_name$role_level{

[0089] "student" "1";

[0090] "teacher" "2";

[0091] "admin" "3";

[0092] default "0";

[0093] }

[0094] Step 2: Modify the Nginx configuration file nginx.conf and reference the two mapping tables created in step 1 in the configuration file. The reference method is as follows:

[0095] include / path / to / api-protectionlevel.conf

[0096] include / path / to / role-level.conf

[0097] Modify the return value of the application authentication interface so that the API returns the login authentication information in JSON and returns the user role in the authentication information as a field. Specifically, the name of the field is role.

[0098] In the configuration file, the proxy login interface is logged in. During the proxy process, perform the following four steps:

[0099] 1) Access the response body through the Lua script and read the role information. The specific implementation is as follows:

[0100] body_filter_by_lua_block{

[0101] Get the response body

[0102] local body=ngx.shared.response_cache:get("response_body")

[0103] if body then

[0104] local json_data=cjson.decode(response_body) parse JSON

[0105] local role_value = json_data["role"] to read role information

[0106] end

[0107] }

[0108] 2) Use OPENSSL to create a 24-byte random value and encode it via BASE64.

[0109] 3) Modify the response header and add a key field to the response header, whose value is the encoded random value obtained in the previous step. That is:

[0110] local function generate_random_base64()

[0111] Use OPENSSL to create a 24-byte random value and BASE64 encode it

[0112] local handle=io.popen("openssl rand-base64 24")

[0113] local result=handle:read("*a")

[0114] end

[0115] local base64_encoded=generate_random_base64()

[0116] Setting the response header

[0117] ngx.header["role_key"]=base64_encoded

[0118] 4) Take the role information as VALUE, the above encoded random value, i.e. the key field, as KEY, and store the key-role mapping table role-key.conf. That is:

[0119] map$http_role_key$role_name{

[0120] "B5kpW5fO5OjX23H9+RnXQw==""student";

[0121] "z7jOq1 / XWqld0L+2On2H1g==""teacher";

[0122] "b8G3L+eC8VPtZrC5pkFZvg==""admin";

[0123] default "";

[0124] }

[0125] Step 3: Use Nginx to proxy other APIs and configure API access control policies. For example, perform fuzzy authentication based on level for the query score API: the score can be queried when the user role level is greater than the protection level of the API. Perform accurate authentication based on user role for the add user API: only when the user role is administrator can the corresponding API be accessed. The specific implementation is as follows:

[0126] location / queryScores{

[0127] if($role_level<$protection_level){

[0128] return 403;

[0129] }

[0130] }

[0131] location / addUser{

[0132] if($role_name!= "admin"){

[0133] return 403;

[0134] }

[0135] }

[0136] Next, the client only needs to add role_key to the header of the API call request (curl xxx-Hrole_key "B5kpW5fO5OjX23H9+RnXQw=="), and the Nginx reverse proxy server can perform API access control based on the API call request. For example, when the client requests the / queryScores API as a student, Nginx presets the variable $http_role_key, which is the value of role_key in the API call request header "B5kpW5fO5OjX23H9+RnXQw==", and then according to the key-role mapping table, $role_name can be automatically resolved to student, and further according to the role-level mapping table, $role_level can be automatically resolved to 1. Similarly, $protection_level can be automatically resolved to 1. After comparison, the user role level corresponding to the student role is equal to the protection level of the / queryScores API. Therefore, the authentication is passed, and the client is allowed to access the / queryScores API as a student. When the student role accesses / addUser, $role_name is automatically resolved to student. Since the user role corresponding to $role_name is not equal to admin, the access is denied.

[0137] Another embodiment of the present disclosure relates to an API access control device, which is applied to a proxy server, such as Figure 3 As shown, the API access control device includes a first creation module 310 , a second creation module 320 , and a control module 330 .

[0138] The first creation module 310 is used to create an API-protection level mapping table and a user role-user level mapping table respectively.

[0139] The second creation module 320 is used to proxy the application authentication interface, create a key-user role mapping table, and return the key information to the client.

[0140] The control module 330 is used to receive the key carried by the client when calling the business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0141] For the specific implementation method of the API access control device provided in the embodiment of the present disclosure, please refer to the description of the API access control method provided in the embodiment of the present disclosure, which will not be repeated here.

[0142] Compared with the prior art, the API access control device provided by the embodiments of the present disclosure has the following beneficial effects:

[0143] 1. Provide two kinds of permission control methods: role-based access control and protection level-based access control. The permission control has a high degree of configuration flexibility.

[0144] 2. Based on the proxy configuration file, it has hot deployment capability and can quickly respond to emergencies. Other existing access control frameworks usually implement and maintain permission control logic in the application code. Once an unauthorized access problem occurs, not only will the rectification process take a long time, but the business will not be able to run during the rectification period. However, when encountering unauthorized access security issues, the operation and maintenance personnel of this disclosure only need to modify the proxy configuration file to change the API access control permissions in real time. Moreover, during the emergency response process, the application does not need to be offline for rectification, and the operation of business functions will not be affected.

[0145] 3. The high degree of decoupling of access control from business functions can not only intercept security risks in advance and achieve security left shift, but also effectively reduce the load pressure on the application backend.

[0146] 4. It has extremely high applicability, and its deployment implementation is independent of the application system architecture and development language.

[0147] Another embodiment of the present disclosure relates to an electronic device, such as Figure 4 As shown, including:

[0148] at least one processor 401; and,

[0149] A memory 402 is communicatively connected to at least one processor 401; wherein,

[0150] The memory 402 stores instructions that can be executed by at least one processor 401 . The instructions are executed by at least one processor 401 so that the at least one processor 401 can execute the API access control method described in the above embodiment.

[0151] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0152] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0153] Another embodiment of the present disclosure relates to a computer-readable storage medium storing a computer program, which implements the API access control method described in the above embodiment when executed by a processor.

[0154] That is, those skilled in the art can understand that all or part of the steps in the method described in the above embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0155] Another embodiment of the present disclosure relates to a computer program product, including a computer program, which implements the API access control method described in the above embodiment when executed by a processor.

[0156] Those skilled in the art will appreciate that the above-mentioned embodiments are specific embodiments for implementing the present disclosure, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present disclosure.

Claims

1. An API access control method, characterized in that: Applicable to proxy servers; The API access control method includes: Create API-protection level mapping table and user role-user level mapping table respectively; The proxy application authentication interface creates a key-user role mapping table and returns the key information to the client; Receive the key carried by the client when calling the business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

2. The API access control method according to claim 1, characterized in that: The proxy application authentication interface creates a key-user role mapping table and returns the key information to the client, including: Modify the return value of the application authentication interface so that the corresponding API adds the successfully authenticated user role information to the corresponding authentication response; Intercepting the authentication response and obtaining the user role information therein; Generate a random value, encode the random value, use the encoded random value as a key corresponding to the user role information, and write it into the key-user role mapping table; The authentication response is modified, the user role information therein is replaced with a key corresponding to the user role information, and the modified authentication response is returned to the client.

3. The API access control method according to claim 1, characterized in that: The receiving a key carried by the client when calling a business function interface, and performing API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table, includes: Receive an API call request sent by the client, where the API call request carries the client IP address and a key; Determine whether the client IP address is in the blacklist. If so, directly discard the API call request; if not, query the protection level of the current API corresponding to the API call request according to the API-protection level mapping table. If the protection level of the current API is the preset level, forward the API call request to the current API. If the protection level of the current API is not the preset level, obtain the key in the API call request, query the user role corresponding to the obtained key according to the key-user role mapping table, and perform API access control according to the user role.

4. The API access control method according to claim 3, characterized in that: The API access control according to the user role includes: According to the user role-user level mapping table, query the user level corresponding to the user role; The user level corresponding to the user role is compared with the protection level of the current API. If the user level corresponding to the user role is greater than or equal to the protection level of the current API, the API call request is forwarded to the current API.

5. The API access control method according to claim 3, characterized in that: The blacklist is established in the following ways: The number of API accesses by the client in a unit time is recorded, and if the number of API accesses is higher than a preset threshold, the client IP address corresponding to the client is added to the blacklist.

6. The API access control method according to any one of claims 1 to 5, characterized in that: The step of creating an API-protection level mapping table and a user role-user level mapping table respectively includes: According to the sensitivity of the API and the permissions of the system roles, create an API-protection level mapping table and a user role-user level mapping table respectively.

7. An API access control device, characterized in that: Applicable to proxy servers; The API access control device comprises: A first creation module is used to create an API-protection level mapping table and a user role-user level mapping table respectively; The second creation module is used to proxy the application authentication interface, create a key-user role mapping table, and return the key information to the client; The control module is used to receive the key carried by the client when calling the business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

8. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the API access control method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the API access control method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the API access control method according to any one of claims 1 to 6 is implemented.

Images