Interface secondary packaging risk identification method and device based on probe and computer equipment

Abstract

The embodiment of the invention discloses an interface secondary packaging risk identification method and device based on a probe and computer equipment. The method comprises the following steps: when a client sends an HTTP request to an application server, acquiring the HTTP request intercepted by a probe on an authorized application server to obtain API interface response content; performing watermark addition and content replacement on the API interface response content to obtain a watermark-containing JSON response; the JSON response containing the watermark is fed back to the authorized application server, so that the JSON response is forwarded to the client side by the authorized application server; recording watermark information; monitoring whether the data called by the unauthorized application server has a secondary packaging behavior or not by utilizing the watermark information; when the data has a secondary packaging behavior, giving an alarm; and generating a secondary encapsulation data exposure link. By implementing the method provided by the embodiment of the invention, the problems that a standardized solution for secondary packaging of the API cannot be provided in the prior art, and data leakage is difficult to detect and prevent in real time and accurately after data analysis can be solved.

Description

Technical Field

[0001] The present invention relates to a data leakage prevention method, and more specifically to a probe-based interface secondary packaging risk identification method, device and computer equipment. Background Art

[0002] The data provider provides data to authorized users through the API interface, but the authorized user passes the data to a third party through his own API interface after obtaining the data, resulting in data leakage. For example, a big data organization has a large amount of sensitive data and provides this data to subordinate districts, counties, commissions and bureaus through a secure API interface. Although the big data organization has clear regulations on data use and limits the scope of data use, the subordinate districts, counties, commissions and bureaus have developed their own API interfaces without authorization, resulting in some processed data being improperly shared with third parties. These API interfaces lack necessary security measures, such as data encryption and strict access control, which makes it easy for third parties to obtain these sensitive data and may abuse them, or even further spread them, causing serious data leakage incidents and bringing adverse effects to society and individuals. To prevent similar incidents from happening again, all parties need to strengthen API interface security, monitor data use, and ensure that data is legally shared within the authorized scope to protect privacy and data security.

[0003] However, there is currently no standardized technical solution for secondary packaging of API interfaces. Existing technologies can only rely on post-analysis logs and behavioral information for manual identification. However, in the era of big data, the amount of data is huge, and post-analysis is difficult to detect data leakage incidents and leakage points in real time, and the accuracy is limited.

[0004] Therefore, it is necessary to design a new method to solve the problem that the existing technology fails to provide a standardized solution for secondary packaging of API interfaces, and post-analysis data is difficult to detect and prevent data leakage in real time and accurately. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the prior art and provide a probe-based interface secondary packaging risk identification method, device and computer equipment.

[0006] To achieve the above object, the present invention adopts the following technical solution: a probe-based interface secondary packaging risk identification method, comprising:

[0007] When the client sends an HTTP request to the application server, the HTTP request intercepted by the probe on the authorized application server is obtained to obtain the API interface response content;

[0008] Adding a watermark and replacing the content of the API interface response to obtain a JSON response containing the watermark;

[0009] Feedback the JSON response containing the watermark to the authorization application server, so that the authorization application server forwards it to the client;

[0010] Record the watermark information corresponding to the JSON response containing the watermark;

[0011] Using the watermark information to monitor whether the unauthorized application server calls data for secondary packaging;

[0012] When data is encapsulated twice, an alarm is issued;

[0013] Generate a secondary packaging data exposure link.

[0014] A further technical solution is: adding a watermark and replacing the content of the API interface response to obtain a JSON response containing a watermark, including:

[0015] Parse the API response content to obtain the value of the JSON node;

[0016] Adding invisible watermark information at the end of the value of the JSON node to obtain content with watermark information;

[0017] The value of the JSON node in the API interface response content is replaced with the content with watermark information to obtain a JSON response containing the watermark.

[0018] Its further technical solution is: the watermark information includes API information, data provider and authorized application server.

[0019] A further technical solution is: using the watermark information to monitor whether the unauthorized application server calls data for secondary packaging, including:

[0020] When the unauthorized application server calls the API interface of the authorized application server, it is determined whether there is watermark information in the response data of the unauthorized application server when calling;

[0021] If watermark information exists in the response data, the response data is marked as sensitive data and recorded;

[0022] Determining whether the unauthorized application server has a probe installed;

[0023] If the unauthorized application server has a probe installed, it is determined that there is no secondary packaging of the data;

[0024] If the unauthorized application server does not have a probe installed, it is determined that the data has been repackaged.

[0025] A further technical solution is: when the data has secondary packaging behavior, an alarm is issued, including:

[0026] When data is twice packaged, an alarm message is generated and sent to the corresponding terminal, where the alarm message includes the possibility and severity of data leakage.

[0027] Its further technical solution is: the secondary packaging data exposure link includes the entire process of data flow from the data provider to the authorized call application server, and then to the unauthorized call application server.

[0028] The present invention also provides a probe-based interface secondary packaging risk identification device, comprising:

[0029] The content acquisition unit is used to acquire the HTTP request intercepted by the probe on the authorized application server when the client sends an HTTP request to the application server, so as to obtain the API interface response content;

[0030] A watermark adding unit, used to add a watermark and replace the content of the API interface response to obtain a JSON response containing a watermark;

[0031] A feedback unit, used for feeding back the JSON response containing the watermark to the authorization application server, so that the authorization application server forwards it to the client;

[0032] A recording unit, used to record the watermark information corresponding to the JSON response containing the watermark;

[0033] A monitoring unit, used to monitor whether there is secondary packaging behavior of the data called by the unauthorized application server using the watermark information;

[0034] The alarm unit is used to issue an alarm when the data is repackaged;

[0035] The link generation unit is used to generate a secondary encapsulation data exposure link.

[0036] Its further technical solution is: the watermark adding unit includes:

[0037] A parsing subunit, used to parse the API interface response content to obtain the value of the JSON node;

[0038] A traceless watermark adding subunit, used for adding traceless watermark information at the end of the value of the JSON node to obtain content with watermark information;

[0039] The content replacement subunit is used to replace the value of the JSON node in the API interface response content with the content with watermark information to obtain a JSON response containing the watermark.

[0040] The present invention further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above method when executing the computer program.

[0041] The present invention also provides a storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0042] The beneficial effects of the present invention compared with the prior art are: the present invention intercepts and processes the client's HTTP request and API interface response on the authorized application server, implements watermark technology and monitors the data transmission process to detect and warn of possible unauthorized data secondary packaging behavior and its exposure link, so as to solve the problem that the prior art fails to provide a standardized solution for API interface secondary packaging, and it is difficult to detect and prevent data leakage in real time and accurately through post-analysis data.

[0043] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0045] Figure 1 A schematic diagram of an application scenario of a probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of a flow chart of a probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a secondary packaging data exposure link provided by an embodiment of the present invention;

[0048] Figure 4 A schematic block diagram of a probe-based interface secondary packaging risk identification device provided in an embodiment of the present invention;

[0049] Figure 5 A schematic block diagram of a computer device provided for an embodiment of the present invention;

[0050] Figure 6 An interactive schematic diagram of a probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0053] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0054] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0055] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of the probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention. Figure 2A schematic flow chart of a probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention. The probe-based interface secondary packaging risk identification method is applied to a monitoring server. The monitoring server is mainly a secondary packaging monitoring system. The monitoring server interacts with the application server for data, and the application server interacts with the client for data. The application server is equipped with a built-in probe to form an authorized application server. The monitoring server uses the probe and data watermarking technology to watermark the response data of the API interface. These watermarks can confirm the source of the data and the identity of the requester. The watermarking process operates on the real response data of the interface to ensure that the data source and caller information in any transmission process can be accurately tracked and identified. The built-in probe of the application server has the ability to intercept and forward requests. Through the probe, the API request can be intercepted in advance and forwarded to the secondary packaging monitoring system; this operation ensures that the data flow trajectory of all API calls is complete and controllable. After intercepting the request, the probe enables the monitoring system to watermark the real response data of the interface. After receiving the request forwarded by the probe, the secondary packaging monitoring system will watermark the actual API interface response data; these watermarks not only mark the source of the data, but also include the identity information of the caller, thereby ensuring the security and traceability of the data. Because of the existence of the probe, the use of the API interface can be effectively managed and monitored, ensuring that the data transmission and processing process meet security standards, and can trace the source and destination of each data request.

[0056] Figure 2 FIG. 1 is a flow chart of a probe-based interface secondary packaging risk identification method provided in an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S170.

[0057] S110. When the client sends an HTTP request to the application server, the HTTP request intercepted by the probe on the authorized application server is obtained to obtain the API interface response content.

[0058] In this embodiment, the API interface response content refers to the content obtained after the probe on the authorized application server intercepts when the client sends an HTTP request to the application server.

[0059] In this embodiment, the client sends an HTTP request to the application server; the probe on the application server intercepts the HTTP request in advance and forwards the HTTP request to the secondary packaging detection system; the secondary packaging detection system sends a request to the application server as a monitoring client to obtain the API interface response content.

[0060] S120. Add a watermark and replace the content in the response of the API interface to obtain a JSON response containing the watermark.

[0061] In this embodiment, the JSON response containing the watermark refers to the content of the API interface response after adding the watermark information.

[0062] In one embodiment, the above step S120 may include steps S121 - S123.

[0063] S121. Parse the content of the API interface response to obtain the values of the JSON nodes.

[0064] In this embodiment, the values of the JSON nodes refer to the corresponding values of name and idCard in the content of the API interface response.

[0065] For example, if the content of the API interface response is {"name":"张三","idCard":"410883199912251155"}, after parsing the content, the corresponding values of name and idCard can be extracted to form the values of the JSON nodes.

[0066] S122. Add invisible watermark information at the end of the values of the JSON nodes to obtain the content with watermark information.

[0067] In this embodiment, the content with watermark information refers to the value formed by adding invisible watermark information at the end of the values of the JSON nodes. The watermark information includes API information, data provider, and authorized application server.

[0068] For example, adding invisible watermarks to the two values, the content after adding the watermark is: {"name":"张三

[0069] \u200d\u200c\u200c\u200c\u200d\u200c\u200c\u200c","idCard":"410883199912251155\u200d\u200c\u200c\u200c\u200d\u200c\u200c\u200c"}.

[0070] S123. Replace the values of the JSON nodes in the content of the API interface response with the content with watermark information to obtain a JSON response containing the watermark.

[0071] In this embodiment, replace the values of the JSON nodes in the content of the API interface response with the content with watermark information. The watermark content is invisible zero - width characters.

[0072] In this embodiment, the digital watermarking technology is to embed some identification information directly into the digital carrier (including multimedia, documents, software, etc.) or indirectly (modify the structure of a specific area), which does not affect the use value of the original carrier and is not easy to be detected and modified again. However, it can be recognized and identified by the producer. Through this information hidden in the carrier, the purpose of confirming the content creator, purchaser, transmitting secret information, or judging whether the carrier has been tampered with can be achieved.

[0073] Traceless watermarking technology is one of the digital watermarking technologies and is a text watermarking technology based on feature coding. This type of technology uses special characters to be added to the end of the data content, which only produces visual changes that are difficult to distinguish in appearance, so as to hide information. The special characters used are zero-width control characters (invisible to the naked eye) in the Unicode encoding system. For example: Zhang San\u200d\u200c\u200c\u200c\u200d\u200c\u200c\u200c, only the character "Zhang San" can be seen. Multiple invisible characters are arranged in sequence to generate a watermark code, and the information stored in the watermark code can be recorded in the db carrier, such as: data source, caller information, data flow information, etc. A complete watermark link can be formed through multiple watermark information to determine the data flow direction and data exposure point.

[0074] S130, feeding back the JSON response containing the watermark to the authorized application server, so that the authorized application server forwards it to the client;

[0075] S140. Record the watermark information corresponding to the JSON response containing the watermark.

[0076] In this embodiment, probes are deployed on the data provider and the authorized application server. The probes are used to hijack the traffic in advance and forward it to the secondary packaging monitoring system. The system can watermark the data and record the calling behavior. When the authorized application server calls the data providing application API interface, the secondary packaging system marks the watermark and records the behavior. The information is shown in Table 1.

[0077] Table 1. Watermark information

[0078]

[0079] In this embodiment, the watermark information also includes an upstream watermark. Whether the upstream watermark exists indicates whether the current watermarking is a secondary packaging behavior.

[0080] S150: Use the watermark information to monitor whether the unauthorized application server calls data for secondary packaging.

[0081] In one embodiment, the above-mentioned step S150 may include steps S151 - S155 .

[0082] S151, when the unauthorized application server calls the API interface of the authorized application server, determine whether there is watermark information in the response data of the unauthorized application server when calling;

[0083] S152: If watermark information exists in the response data, mark the response data as sensitive data and record it.

[0084] In this embodiment, if Figure 6 As shown in Table 2, when an unauthorized application server calls the API interface of an authorized application server, the secondary packaging detection system will determine whether there is watermark information in the acquired data. If the data has watermark information, it indicates that the data needs to be protected. The secondary packaging detection system will record the corresponding watermark information, clear the original watermark, add new watermark information, and record the behavior. The watermark information is shown in Table 2.

[0085] Table 2. Watermark information

[0086]

[0087] S153, determining whether the unauthorized application server has a probe installed;

[0088] S154: If the unauthorized application server has a probe installed, determine that there is no secondary packaging of the data;

[0089] S155. If the unauthorized application server does not have a probe installed, it is determined that the data has been repackaged.

[0090] If the watermark information does not exist in the response data, the step S120 is executed.

[0091] In this embodiment, it is determined whether the unauthorized application server has a probe installed. If the probe is installed, it means that it is within the control scope and is an authorized application server, and there is no secondary packaging data leakage. If the probe is not installed, it is not within the control scope and is an untrusted application server, and there is secondary packaging data leakage.

[0092] S160: When data is encapsulated twice, an alarm is issued.

[0093] In this embodiment, when there is secondary packaging of data, an alarm message is generated and sent to a corresponding terminal, wherein the alarm message includes the possibility of data leakage and the severity of the data leakage.

[0094] S170: Generate a secondary packaging data exposure link.

[0095] In this embodiment, the secondary packaging data exposure link includes the entire process of data flow from the data provider to the authorized calling application server and then to the unauthorized calling application server.

[0096] The secondary packaging detection system sends a secondary packaging alarm, and based on two watermark information, namely the watermark information in Table 1 and Table 2, of course, in other embodiments, there can also be multiple watermark information, the number of watermark information is mainly determined by the number of upstream watermarks, and a complete secondary packaging data exposure link is drawn according to the watermark information: the link composed of the entire data flow from the data provider to the authorized application server and then to the unauthorized application server, such as Figure 3 As shown, it is also necessary to Figure 3 The flow direction is marked internally, such as which server the packet starts from, which servers it passes through in sequence, and which server it finally arrives at.

[0097] Of course, in real scenarios, the network environment may be very complex, and the trusted range of data flow can be determined by deploying probes. Data that exceeds the trusted range will be secondary packaged and leaked.

[0098] In this embodiment, the data provider provides the data to the authorized application server through the / weather / getweather interface. After the authorized application server repackages the data, it exposes the data to the unauthorized application server through the exposure interface / weather / from / getweather. This is a typical scenario of secondary packaging data exposure.

[0099] The method of this embodiment forms a trusted data flow range by installing probes in trusted application devices. Each trusted application server needs to install an Agent, which is used to identify the traffic from the data source on the one hand, and to add new watermarks to the traffic content before the data is sent out on the other hand. These watermarks can be tracked through the watermark tracing technology to view the complete transmission link and possible leakage points; the probe needs to verify whether the API traffic comes from the data provider, that is, whether it carries a watermark. If there is no watermark, it is released directly; if there is, it is necessary to extract the access source and recipient information from the request traffic, and dynamically generate a new watermark code; use the traceless watermark technology to update the new watermark to the returned traffic body. The probe forwards the processed return traffic to the client; when an unauthorized application attempts to call the interface, the system will perform an intelligent analysis of the returned traffic to determine whether there is a possibility of secondary packaging risk.

[0100] The method of this embodiment can ensure the integrity and security of data during data transmission, ensuring that the data will not be damaged due to unauthorized secondary packaging or leakage. This method is particularly important for highly sensitive and confidential data, and can effectively prevent potential security risks.

[0101] Specifically, watermark technology is used to add a mark to the data content, solving the problem of data being packaged and sent out after being stored on the disk. This scenario usually includes direct outbound transmission after an air relay and data being packaged and sent out after being stored on the disk.

[0102] Each watermark information consists of three elements: the specific API URL, the data provider, and the data receiver. This design ensures that the call link can be detailed and complete when tracing data. By deploying probes, the trusted range of network data flow is determined. No matter how complex the network scenario is, the probe can cover and identify the flow trajectory of data. This method ensures real-time monitoring, real-time analysis, and real-time alarm capabilities of data.

[0103] This method can not only realize real-time monitoring and alarm, but also realize real-time analysis during data transmission, which is crucial to ensure the security and integrity of data.

[0104] Through the above technologies and processes, the data transmission process can be effectively managed and tracked, ensuring that data is not tampered with or leaked without authorization during storage and transmission, thereby improving the security and credibility of overall data management.

[0105] Insert an authorization probe between the application server and the client to intercept and analyze API requests and responses in real time, ensuring that every link in the data flow is monitored and protected. Use watermark technology to mark the API response content so that each returned JSON response contains a unique identifier, which can track and identify possible secondary packaging behaviors and maintain data integrity and security even during data transmission. Implement an automated alarm system and data exposure link generation. When secondary packaging behavior of unauthorized application servers is detected, issue an alarm in a timely manner and record the corresponding data leakage path for subsequent analysis and improvement of security policies.

[0106] The above-mentioned probe-based interface secondary packaging risk identification method intercepts and processes the client's HTTP request and API interface response on the authorized application server, implements watermark technology and monitors the data transmission process to detect and warn of possible unauthorized data secondary packaging behavior and its exposure link, so as to solve the problem that the existing technology fails to provide a standardized solution for API interface secondary packaging, and it is difficult to detect and prevent data leakage in real time and accurately through post-analysis data.

[0107] Figure 4 FIG. 3 is a schematic block diagram of a probe-based interface secondary packaging risk identification device 300 provided in an embodiment of the present invention. Figure 4 As shown, corresponding to the above probe-based interface secondary packaging risk identification method, the present invention also provides a probe-based interface secondary packaging risk identification device 300. The probe-based interface secondary packaging risk identification device 300 includes a unit for executing the above probe-based interface secondary packaging risk identification method, and the device can be configured in a server. Figure 4 The probe-based interface secondary packaging risk identification device 300 includes a content acquisition unit 301, a watermark adding unit 302, a feedback unit 303, a recording unit 304, a monitoring unit 305, an alarm unit 306 and a link generation unit 307.

[0108] The content acquisition unit 301 is used to obtain the HTTP request intercepted by the probe on the authorized application server when the client sends an HTTP request to the application server, so as to obtain the API interface response content; the watermark adding unit 302 is used to add a watermark and replace the content of the API interface response content to obtain a JSON response containing a watermark; the feedback unit 303 is used to feed back the JSON response containing the watermark to the authorized application server, so as to be forwarded to the client by the authorized application server; the recording unit 304 is used to record the watermark information corresponding to the JSON response containing the watermark; the monitoring unit 305 is used to use the watermark information to monitor whether there is secondary packaging behavior in the data called by the unauthorized application server; the alarm unit 306 is used to issue an alarm when the data has secondary packaging behavior; the link generation unit 307 is used to generate a secondary packaging data exposure link.

[0109] In one embodiment, the watermark adding unit 302 includes a parsing subunit, a seamless watermark adding subunit and a content replacing subunit.

[0110] A parsing subunit is used to parse the API interface response content to obtain the value of the JSON node; a seamless watermark adding subunit is used to add seamless watermark information at the end of the value of the JSON node to obtain content with watermark information; a content replacement subunit is used to replace the value of the JSON node in the API interface response content with the content with watermark information to obtain a JSON response containing a watermark.

[0111] In one embodiment, the monitoring unit 305 includes an information determination subunit, a marking subunit, a probe determination subunit, a first determination subunit, and a second determination subunit.

[0112] The information judgment subunit is used to judge whether there is watermark information in the response data of the unauthorized application server when the unauthorized application server calls the API interface of the authorized application server; the marking subunit is used to mark the response data as sensitive data and record it if there is watermark information in the response data; the probe judgment subunit is used to judge whether the unauthorized application server has installed a probe; the first determination subunit is used to determine whether the data does not have secondary packaging behavior if the unauthorized application server has installed a probe; the second determination subunit is used to determine whether the data has been secondary packaged if the unauthorized application server has not installed a probe.

[0113] In one embodiment, the alarm unit 306 is used to generate an alarm message when there is secondary packaging of the data, and send it to the corresponding terminal, wherein the alarm message includes the possibility of data leakage and the severity of the data leakage.

[0114] It should be noted that technical personnel in the relevant field can clearly understand that the specific implementation process of the above-mentioned probe-based interface secondary packaging risk identification device 300 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and conciseness of the description, it will not be repeated here.

[0115] The above-mentioned probe-based interface secondary packaging risk identification device 300 can be implemented in the form of a computer program. The computer program can be used in a computer program such as Figure 5 Runs on the computer device shown.

[0116] See also Figure 5 , Figure 5 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0117] See also Figure 5 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0118] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a probe-based interface secondary packaging risk identification method.

[0119] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0120] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a probe-based interface secondary packaging risk identification method.

[0121] The network interface 505 is used to communicate with other devices over the network. Figure 5 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] The processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps:

[0123] When the client sends an HTTP request to the application server, the HTTP request intercepted by the probe on the authorized application server is obtained to obtain the API interface response content; a watermark is added to the API interface response content and the content is replaced to obtain a JSON response containing a watermark; the JSON response containing the watermark is fed back to the authorized application server, so that the authorized application server forwards it to the client; the watermark information corresponding to the JSON response containing the watermark is recorded; the watermark information is used to monitor whether there is secondary packaging behavior in the data called by the unauthorized application server; when the data is secondary packaged, an alarm is issued; and a secondary packaging data exposure link is generated.

[0124] The secondary packaging data exposure link includes the entire process of data flow from the data provider to the authorized calling application server and then to the unauthorized calling application server.

[0125] In one embodiment, when the processor 502 implements the step of adding a watermark and replacing the content of the API interface response to obtain a JSON response containing a watermark, the processor 502 specifically implements the following steps:

[0126] The API interface response content is parsed to obtain the value of the JSON node; a traceless watermark information is added to the end of the value of the JSON node to obtain the content with the watermark information; the value of the JSON node in the API interface response content is replaced with the content with the watermark information to obtain a JSON response containing the watermark.

[0127] The watermark information includes API information, data provider and authorized application server.

[0128] In one embodiment, when the processor 502 implements the step of using the watermark information to monitor whether the unauthorized application server calls data for secondary packaging, the processor 502 specifically implements the following steps:

[0129] When an unauthorized application server calls the API interface of an authorized application server, determine whether there is watermark information in the response data of the unauthorized application server when calling; if there is watermark information in the response data, mark the response data as sensitive data and record it; determine whether the unauthorized application server has a probe installed; if the unauthorized application server has a probe installed, determine that there is no secondary packaging of the data; if the unauthorized application server does not have a probe installed, determine that there is secondary packaging of the data.

[0130] In one embodiment, when the processor 502 implements the step of issuing an alarm when there is secondary packaging of data, the processor 502 specifically implements the following steps:

[0131] When data is twice packaged, an alarm message is generated and sent to the corresponding terminal, where the alarm message includes the possibility and severity of data leakage.

[0132] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0133] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0134] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:

[0135] When the client sends an HTTP request to the application server, the HTTP request intercepted by the probe on the authorized application server is obtained to obtain the API interface response content; a watermark is added to the API interface response content and the content is replaced to obtain a JSON response containing a watermark; the JSON response containing the watermark is fed back to the authorized application server, so that the authorized application server forwards it to the client; the watermark information corresponding to the JSON response containing the watermark is recorded; the watermark information is used to monitor whether there is secondary packaging behavior in the data called by the unauthorized application server; when the data is secondary packaged, an alarm is issued; and a secondary packaging data exposure link is generated.

[0136] The secondary packaging data exposure link includes the entire process of data flow from the data provider to the authorized calling application server and then to the unauthorized calling application server.

[0137] In one embodiment, when the processor executes the computer program to implement the step of adding a watermark and replacing the content of the API interface response to obtain a JSON response containing a watermark, the processor specifically implements the following steps:

[0138] The API interface response content is parsed to obtain the value of the JSON node; a traceless watermark information is added to the end of the value of the JSON node to obtain the content with the watermark information; the value of the JSON node in the API interface response content is replaced with the content with the watermark information to obtain a JSON response containing the watermark.

[0139] The watermark information includes API information, data provider and authorized application server.

[0140] In one embodiment, when the processor executes the computer program to implement the step of using the watermark information to monitor whether there is secondary packaging behavior in the data called by the unauthorized application server, the processor specifically implements the following steps:

[0141] When an unauthorized application server calls the API interface of an authorized application server, determine whether there is watermark information in the response data of the unauthorized application server when calling; if there is watermark information in the response data, mark the response data as sensitive data and record it; determine whether the unauthorized application server has a probe installed; if the unauthorized application server has a probe installed, determine that there is no secondary packaging of the data; if the unauthorized application server does not have a probe installed, determine that there is secondary packaging of the data.

[0142] In one embodiment, when the processor executes the computer program to implement the step of performing an alarm when there is secondary packaging of data, the processor specifically implements the following steps:

[0143] When data is twice packaged, an alarm message is generated and sent to the corresponding terminal, where the alarm message includes the possibility and severity of data leakage.

[0144] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0145] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0146] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0147] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0148] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0149] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A probe-based interface secondary packaging risk identification method, characterized in that: include: When the client sends an HTTP request to the application server, the HTTP request intercepted by the probe on the authorized application server is obtained to obtain the API interface response content; Adding a watermark and replacing the content of the API interface response to obtain a JSON response containing the watermark; Feedback the JSON response containing the watermark to the authorization application server, so that the authorization application server forwards it to the client; Record the watermark information corresponding to the JSON response containing the watermark; Using the watermark information to monitor whether the unauthorized application server calls data for secondary packaging; When data is encapsulated twice, an alarm is issued; Generate a secondary packaging data exposure link.

2. The probe-based interface secondary packaging risk identification method according to claim 1 is characterized in that: The step of adding a watermark and replacing the content of the API interface response content to obtain a JSON response containing a watermark includes: Parse the API response content to obtain the value of the JSON node; Adding invisible watermark information at the end of the value of the JSON node to obtain content with watermark information; The value of the JSON node in the API interface response content is replaced with the content with watermark information to obtain a JSON response containing the watermark.

3. The probe-based interface secondary packaging risk identification method according to claim 2 is characterized in that: The watermark information includes API information, data provider and authorized application server.

4. The probe-based interface secondary packaging risk identification method according to claim 1 is characterized in that: The method of using the watermark information to monitor whether the unauthorized application server calls data for secondary packaging includes: When the unauthorized application server calls the API interface of the authorized application server, it is determined whether there is watermark information in the response data of the unauthorized application server when calling; If watermark information exists in the response data, the response data is marked as sensitive data and recorded; Determining whether the unauthorized application server has a probe installed; If the unauthorized application server has a probe installed, it is determined that there is no secondary packaging of the data; If the unauthorized application server does not have a probe installed, it is determined that the data has been repackaged.

5. The probe-based interface secondary packaging risk identification method according to claim 1, characterized in that: When the data is encapsulated twice, an alarm is issued, including: When data is twice packaged, an alarm message is generated and sent to the corresponding terminal, where the alarm message includes the possibility and severity of data leakage.

6. The probe-based interface secondary packaging risk identification method according to claim 1, characterized in that: The secondary packaging data exposure link includes the entire process of data flow from the data provider to the authorized calling application server and then to the unauthorized calling application server.

7. A probe-based interface secondary packaging risk identification device, characterized in that: include: The content acquisition unit is used to acquire the HTTP request intercepted by the probe on the authorized application server when the client sends an HTTP request to the application server, so as to obtain the API interface response content; A watermark adding unit, used to add a watermark and replace the content of the API interface response to obtain a JSON response containing a watermark; A feedback unit, used for feeding back the JSON response containing the watermark to the authorization application server, so that the authorization application server forwards it to the client; A recording unit, used to record the watermark information corresponding to the JSON response containing the watermark; A monitoring unit, used to monitor whether there is secondary packaging behavior of the data called by the unauthorized application server using the watermark information; The alarm unit is used to issue an alarm when the data is repackaged; The link generation unit is used to generate a secondary encapsulation data exposure link.

8. The probe-based interface secondary packaging risk identification device according to claim 7, characterized in that: The watermark adding unit comprises: A parsing subunit, used to parse the API interface response content to obtain the value of the JSON node; A traceless watermark adding subunit, used for adding traceless watermark information at the end of the value of the JSON node to obtain content with watermark information; The content replacement subunit is used to replace the value of the JSON node in the API interface response content with the content with watermark information to obtain a JSON response containing the watermark.

9. A computer device, characterized in that: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images