Request processing method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a request processing method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring a target request sent by a user application terminal, transmitting the target request in a network partition communicating with the user application terminal, and verifying the user application terminal through an independent API gateway in the network partition; and when it is determined that an associated service exists in an API interface corresponding to the target request through the API application system in the network partition, generating a proxy request and sending the proxy request to a target network partition corresponding to the associated service through a one-way proxy server in the network partition so as to feed back corresponding service data to the user application terminal. According to the method provided by the invention, hardware isolation among the network partitions is realized, cross-region transmission is realized through the independently deployed network partitions, the implementation cost of API interface service isolation operation is reduced, and the safety and reliability of API operation are improved.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to a request processing method, device, electronic device, storage medium and program product. Background Art

[0002] Currently, users conduct banking IT or financial business through the open API interface of the banking system. Since different types of API interfaces have significant differences in security level, supervision level, availability level, etc., it is necessary to manage the architecture of centralized deployment of API interfaces in a hierarchical and classified manner during business operations.

[0003] Existing technologies use VPC virtual network technology to perform "logical partitioning" on a single network, and set access policies between logical partitions to achieve "logical isolation" between "partitions". This allows each "logically isolated" network partition to be independently deployed, managed, and maintained, thereby achieving classified operation and management of API interfaces.

[0004] However, the physical underlying layer of each network partition after "logical isolation" is still in a centralized deployment form, and in the centralized deployment mode, resource failures and network bandwidth bottlenecks affect the efficiency and accuracy of business operations, further leading to reduced business operation quality and service levels. Summary of the invention

[0005] The embodiments of the present application provide a request processing method, device, electronic device, storage medium and program product to improve the efficiency and accuracy of request processing.

[0006] In a first aspect, an embodiment of the present application provides a request processing method, including:

[0007] Obtaining the target request sent by the user application terminal;

[0008] Through the API gateway that communicates with the user application terminal, the user application terminal is legally verified. When it is determined that the user application terminal has passed the verification, the target request is transmitted to the API application system in the same network partition as the API gateway;

[0009] Based on the target request, the API application system determines the API interface corresponding to the target request, and determines whether there is any associated business in the API interface. The associated business is the business associated with the API interface in each network partition outside the current network partition. When it is determined that there is an associated business, a proxy request is generated according to the associated business, and the proxy request is transmitted to the target network partition corresponding to the associated business through the one-way proxy server in the current network partition. The current network partition refers to the network partition where the API gateway and the API application system are located.

[0010] Based on the proxy request, the proxy request is verified through the target network partition, and after the verification is passed, the business corresponding to the target API interface is transmitted to the user application terminal. The target API interface is the API interface corresponding to the associated business in the target network partition.

[0011] Optionally, before obtaining the target request sent by the user application terminal, the method includes:

[0012] Establish network partitions corresponding to different business categories, and establish partition firewalls between each network partition to control traffic isolation;

[0013] Among them, establishing a network partition corresponding to any service category includes:

[0014] Establish corresponding network partitions based on business categories, which include intranet firewalls, API gateways, and API application systems corresponding to business categories;

[0015] Determine the public domain name for communicating with the network partition, the public domain name corresponds to the service category, so that users corresponding to the service category can request the corresponding service based on the public domain name; determine the API interfaces corresponding to the service category, and deploy them in the API application system corresponding to the service category, so that the API application system can provide the corresponding service to users of the service category;

[0016] When it is determined that there are associated services in each API interface corresponding to the service category, at least one unidirectional proxy server is configured in the network partition where the API application system is located according to the associated services.

[0017] Optionally, after obtaining the target request, the method includes:

[0018] When the API application system determines that there is no associated business for the API interface corresponding to the target request, the business corresponding to the API interface is transmitted to the user application terminal through the API gateway in the current network partition.

[0019] Optionally, after determining through the API application system that an API interface corresponding to the target request has an associated business, the method includes:

[0020] Determine the target API interface and target network partition according to the associated business, generate a proxy request through the API application system of the current network partition, and determine the one-way proxy server corresponding to the target network partition in the current network partition; send the proxy request to the target partition firewall through the one-way proxy server, and the target partition firewall is located between the target network partition and the current network partition;

[0021] Based on the one-way proxy server, the target partition firewall determines whether there is a routing policy corresponding to the target network partition. If so, the proxy request is transmitted to the API gateway in the target network partition.

[0022] Optionally, based on the proxy request, the proxy request is verified through the target network partition, and after the verification is passed, the service corresponding to the target API interface is transmitted to the user application terminal, including:

[0023] The target API gateway in the target network partition verifies the legitimacy of the API application system that generates the proxy request;

[0024] If it is determined that the API application system verification has passed, the proxy request is transmitted to the target API application system in the target network partition, so that the target API application system feeds back the business corresponding to the target API interface to the user application terminal.

[0025] Optionally, when launching a new application in any network partition, the method includes:

[0026] Launch new applications in the network partition at any time and determine the new API interfaces corresponding to the new applications;

[0027] After the new application is launched, it is determined that the API interface corresponding to the target request is a new API interface, and when the new API interface has associated business, a proxy request is generated according to the new API interface, and the target network partition corresponding to the associated business is determined; the proxy request is transmitted to the target network partition through a one-way proxy server corresponding to the target network partition in the network partition, so that the target network partition responds based on the proxy request.

[0028] In a second aspect, an embodiment of the present application provides a request processing device, including:

[0029] An acquisition module, used to acquire a target request sent by a user application terminal;

[0030] A processing module is used to verify the legitimacy of the user application terminal through an API gateway that communicates with the user application terminal, and when it is determined that the user application terminal has passed the verification, transmit the target request to the API application system in the same network partition as the API gateway;

[0031] A processing module is used to determine the API interface corresponding to the target request through the API application system based on the target request, and determine whether there is an associated business in the API interface, where the associated business is the business associated with the API interface in each network partition outside the current network partition; when it is determined that there is an associated business, a proxy request is generated according to the associated business, and the proxy request is transmitted to the target network partition corresponding to the associated business through a one-way proxy server in the current network partition, where the current network partition refers to the network partition where the API gateway and the API application system are located;

[0032] The processing module is used to verify the proxy request through the target network partition based on the proxy request, and transmit the business corresponding to the target API interface to the user application terminal after the verification is passed. The target API interface is the API interface corresponding to the associated business in the target network partition.

[0033] Optionally, the processing module is used to establish network partitions corresponding to different service categories, and establish partition firewalls between each network partition to control traffic isolation;

[0034] Among them, establishing a network partition corresponding to any service category includes:

[0035] Establish corresponding network partitions based on business categories, which include intranet firewalls, API gateways, and API application systems corresponding to business categories;

[0036] Determine the public domain name for communicating with the network partition, the public domain name corresponds to the service category, so that users corresponding to the service category can request the corresponding service based on the public domain name; determine the API interfaces corresponding to the service category, and deploy them in the API application system corresponding to the service category, so that the API application system can provide the corresponding service to users of the service category;

[0037] When it is determined that there are associated services in each API interface corresponding to the service category, at least one unidirectional proxy server is configured in the network partition where the API application system is located according to the associated services.

[0038] Optionally, the processing module is used to, after obtaining the target request, transmit the business corresponding to the API interface to the user application terminal through the API gateway in the current network partition when it is determined through the API application system that there is no associated business with the API interface corresponding to the target request.

[0039] Optionally, a processing module is used to determine a target API interface and a target network partition according to the associated business, generate a proxy request through the API application system of the current network partition, and determine a one-way proxy server corresponding to the target network partition in the current network partition; send the proxy request to a target partition firewall through the one-way proxy server, and the target partition firewall is located between the target network partition and the current network partition;

[0040] Based on the one-way proxy server, the target partition firewall determines whether there is a routing policy corresponding to the target network partition. If so, the proxy request is transmitted to the API gateway in the target network partition.

[0041] Optionally, a processing module is used to perform legal verification on the API application system that generates the proxy request through a target API gateway in the target network partition;

[0042] If it is determined that the API application system verification has passed, the proxy request is transmitted to the target API application system in the target network partition, so that the target API application system feeds back the business corresponding to the target API interface to the user application terminal.

[0043] Optionally, the processing module is used to launch a new application in any network partition at any time when launching the new application in the network partition; and determine a new API interface corresponding to the new application;

[0044] After the new application is launched, it is determined that the API interface corresponding to the target request is a new API interface, and when the new API interface has associated business, a proxy request is generated according to the new API interface, and the target network partition corresponding to the associated business is determined; the proxy request is transmitted to the target network partition through a one-way proxy server corresponding to the target network partition in the network partition, so that the target network partition responds based on the proxy request.

[0045] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0046] Memory stores computer-executable instructions;

[0047] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0048] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0049] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0050] The request processing method, device, electronic device, storage medium and program product provided in the embodiments of the present application obtain a target request sent by a user application terminal, and transmit the target request within a network partition that communicates with the user application terminal, and verify the user application terminal through an independent API gateway within the network partition. After the verification is passed, the API interface corresponding to the target request is determined through an independent API application system within the network partition, and when there is an associated business with the API interface, a proxy request is generated and sent to the target network partition corresponding to the associated business through an independent unidirectional proxy server within the network partition, so that after the target network partition verifies the proxy request of the current network partition, the corresponding business is fed back to the user application terminal, hardware isolation between different network partitions is achieved, and cross-zone transmission is achieved through independently deployed network partitions, thereby reducing the cost of conducting business based on the API interface and improving the accuracy and reliability of processing user requests and business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0052] Figure 1 A flowchart of the request processing method provided for this application;

[0053] Figure 2 A schematic diagram of the network partition structure provided for this application;

[0054] Figure 3 A schematic diagram of the structure of the request processing method provided for this application;

[0055] Figure 4 A schematic diagram of the structure of the request processing device provided by this application;

[0056] Figure 5 A schematic diagram of the structure of the electronic device provided in this application.

[0057] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0058] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0059] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0060] First, the terms involved in this application are explained:

[0061] API (Application Programming Interface): Application programming interface refers to a set of definitions, procedures and protocols used for business exchange and / or data exchange between application processes;

[0062] Open API: refers to an open API standard that allows developers to easily define exchange data and / or services to achieve cross-platform interactive operations and data transmission between different cloud services.

[0063] DMZ (Demilitarized Zone): is a network security architecture located between the internal network and the external network. It is used to separate the traffic between the internal network and the external network. The DMZ includes but is not limited to web service servers, mail service servers and other service servers that provide external services.

[0064] At present, when users handle some banking services, they usually need to conduct IT business or data exchange with other organizations to complete the business processing. Therefore, the existing technology builds cross-platform applications based on open API technology to achieve interoperability and data transmission between different platforms or cloud services. For example, for business applications in the banking system, based on the needs of different users, the API interface corresponding to the business application is provided to users with corresponding needs, so that users can obtain the corresponding business of the banking system application according to the open API interface. However, due to the significant differences in security level, regulatory level, availability level, etc., different categories of API interfaces have significant differences in security level, regulatory level, availability level, etc. Therefore, in the process of business operation, by changing the single network partition of the centralized deployment architecture into multiple isolated network partitions, and classifying the API interfaces according to the specified level dimension, the API interfaces of the same category are deployed in the same partition, so as to realize independent deployment, independent management, and independent maintenance of different partitions, thereby realizing the classified operation of API interfaces.

[0065] One method of classified operation of API interfaces in the existing technology is to achieve logical isolation in the API application system through VPC virtual private cloud technology, that is, to divide the connected network into several logically isolated network partitions through VPC virtual network technology, and deploy each API application in the network partition belonging to the corresponding category according to the category of the API interface, so as to achieve classified isolation management of API applications. However, the interfaces of each API application through logical isolation are deployed in the same hardware resource cluster, and the physical bottom layer of each network partition is still in a centralized deployment form. The isolation effect between the centralized deployed network partitions is poor, and it is easy to affect the efficiency and accuracy of business development due to resource failures and network bandwidth bottlenecks.

[0066] In order to reduce the impact of resource failures and network bandwidth bottlenecks on business development under centralized deployment, another method of the prior art is to build multiple physically isolated network partitions from the underlying physical facilities, that is, to deploy the hardware infrastructure separately between each network partition to achieve physical isolation. When communication linkage is required between network partitions, data exchange between different network partitions is achieved through dedicated network equipment and communication protocols. However, the security and reliability of communication between network partitions are guaranteed by the suppliers of dedicated network equipment and communication protocols. Therefore, this method has low scalability and compatibility, which increases the management, operation and maintenance costs of the API application system.

[0067] The request processing method provided by the present application obtains the target request sent by the user application terminal, verifies whether the user application terminal is legal through the API gateway corresponding to the user application terminal, and transmits the target request to the API application system in the same network partition when it is determined that the user application terminal has passed the verification, so as to determine whether there is an associated business through the API interface corresponding to the target request of the API application system. When it is determined that there is an associated business, the target API interface and target network partition corresponding to the associated business are determined, and a proxy request is generated, which is transmitted to the target network partition through the one-way proxy server in the current network partition to verify the proxy request through the target network partition, and the business corresponding to the target API interface is transmitted to the user application terminal after the verification is passed. Compared with the prior art, the present application realizes the physical isolation between different network partitions, reduces the operation and maintenance costs of the application system corresponding to the API interface, and at the same time, improves the accuracy and security of data processing, and further improves the response efficiency to user requests.

[0068] The request processing method provided in this application is intended to solve the above technical problems in the prior art.

[0069] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0070] Figure 1 A flowchart of the request processing method provided for this application is as follows: Figure 1 As shown, the method includes:

[0071] S101: Acquire a target request sent by a user application terminal.

[0072] More specifically, a target request sent by a user application terminal is obtained.

[0073] Optionally, the user sends a target request to a corresponding network partition through a public network to which the application terminal is connected.

[0074] Optionally, before obtaining the target request sent by the user application terminal, network partitions corresponding to different business categories are established, and partition firewalls are established between each network partition to control traffic isolation.

[0075] In a possible embodiment, a network partition corresponding to any business category is established, including: establishing a network partition corresponding to the business category according to the business category, the network partition including an intranet firewall, an API gateway, and an API application system corresponding to the business category; determining a public domain name for communicating with the network partition, the public domain name corresponding to the business category, so that users corresponding to the business category can request corresponding services based on the public domain name; and determining each API interface corresponding to the business category, and deploying them in the API application system corresponding to the business category, so that the API application system can provide corresponding services to users of the business category.

[0076] For example, the classification standard is determined according to the banking business classification and / or technology classification, and the API interfaces are grouped according to the classification standard. Figure 2 As shown, after grouping each API interface, a Class I API application system and a Class II API application system are obtained, wherein the Class I API application system is each API interface of the Class I business, and the Class II API application system is each API interface of the Class II business. Network partition 1 is established for Class I business, and the public network domain name of the Class I user corresponding to the Class I business is configured as a.com. Class I users send requests to network partition 1 through the a.com public network to obtain Class I API business traffic through network partition 1; network partition 2 is established for Class II business, and the public network domain name of the Class II user corresponding to the Class II business is configured as b.com. Class II users send requests to network partition 2 through the b.com public network to obtain Class II API business traffic through network partition 2. The network partitions corresponding to Class I and Class II businesses are isolated by partition firewalls.

[0077] Optionally, each network partition includes hardware devices such as servers, storage devices, firewalls, and software such as operating systems and databases corresponding to the business category.

[0078] For example, Figure 2 As shown, the first type of network partition includes the first type of web server, the first type of API gateway and the first type of API application system corresponding to the first type of business. The a.com public network is isolated from the first type of web server through the DMZ firewall corresponding to the first type of business, and the first type of web server and the first type of API gateway are isolated through the intranet firewall corresponding to the first type of business; the second type of network partition includes the second type of web server, the second type of API gateway and the second type of API application system corresponding to the second type of business. The b.com public network is isolated from the second type of web server through the DMZ firewall corresponding to the second type of business, and the second type of web server and the second type of API gateway are isolated through the intranet firewall corresponding to the second type of business.

[0079] Optionally, when it is determined that there are associated services in each API interface corresponding to the API application system, at least one one-way proxy server is configured in the network partition corresponding to the API application system according to the associated services. The embodiment of the present application solves the problem of resource sharing between partitions in the prior art by independently deploying network partitions corresponding to each business category, reduces the accuracy and reliability of data transmission due to resource failure, and further improves the reliability of the request processing process by configuring a one-way proxy server and a partition firewall.

[0080] S102. When it is determined that the user application terminal has passed the verification through the API gateway communicating with the user application terminal, the target request is transmitted to the API application system in the same network partition as the API gateway.

[0081] More specifically, the API gateway that communicates with the user application terminal performs legal verification on the user application terminal. When it is determined that the user application terminal has passed the verification, the target request is transmitted to the API application system in the same network partition as the API gateway. The current network partition refers to the network partition where the API gateway and the API application system are located.

[0082] Optionally, after obtaining the target request sent by the user application terminal, determine the network partition that communicates with the public network connected to the user application terminal, and obtain the API gateway that communicates with the user application terminal. When it is determined that the API gateway in the network partition receives the target request carrying the signature, the user application terminal corresponding to the above signature is determined by the API gateway, and the public key of the user application terminal is obtained, thereby verifying the above target request carrying the signature based on the user application terminal public key. Among them, the target request carrying the signature is generated by the user application terminal after signing the original data of the target request by the user application terminal private key. The user application terminal public key and the user application terminal private key are the public-private key pair of the user application terminal generated by the user application terminal based on the asymmetric public-private key signature technology (that is, the user application terminal public key and the user application terminal private key), and the generated user application terminal public key is sent to the API gateway that has an asymmetric public-private key signature agreement with the user application terminal. The method of sending the user application terminal public key from the user application terminal to the API gateway in the embodiment of the present application is a technical means well known to those skilled in the art, and the embodiment of the present application does not limit the sending method of the user application terminal public key.

[0083] In a possible embodiment, when the API gateway determines that the target request of the user application terminal has passed verification, the target request is transmitted to the API application system in the same network partition as the API gateway through the API gateway in the network partition.

[0084] In a possible embodiment, when it is determined through the API gateway that the target request of the user application terminal fails to pass verification, a reminder message that the application terminal corresponding to the target request does not have the corresponding business access authority is fed back to the application terminal.

[0085] S103: When it is determined that there is an associated business in the API interface corresponding to the target request, a proxy request is generated and transmitted to the target network partition through a one-way proxy server in the current network partition.

[0086] More specifically, based on the target request, the API application system determines the API interface corresponding to the target request, and determines whether there is any associated business in the API interface. The associated business is the business associated with the API interface in each network partition outside the current network partition. When it is determined that there is an associated business, a proxy request is generated according to the associated business, and the proxy request is transmitted to the target network partition corresponding to the associated business through the one-way proxy server in the current network partition.

[0087] Optionally, after obtaining the target request, the API application system determines whether the API interface corresponding to the target request has any associated business. If no associated business exists, the business corresponding to the API interface is transmitted to the user application terminal through the API gateway in the current network partition.

[0088] Exemplarily, the API application system within the current network partition determines the API interface corresponding to the target request, and determines whether the API interface has any associated business. When it is determined that there is no associated business, it determines the API application corresponding to the API interface, and transmits the business traffic corresponding to the API application to the API gateway within the current network partition. After the API gateway verifies the API interface and / or API application corresponding to the business traffic, it feeds back the business traffic to the user application terminal.

[0089] Optionally, when the API interface corresponding to the target request has an associated business, a proxy request is generated by the API application system in the current network partition, and the proxy request is transmitted to the target network partition corresponding to the associated business through the unidirectional proxy server in the current network partition.

[0090] Exemplarily, the one-way proxy server is used to indicate the transmission relationship between the API interface of the associated service and the target API interface corresponding to the associated service in the current network partition. The embodiment of the present application determines the associated service of the API interface corresponding to the target request through the API application system, and further issues an access request to the relevant network partition based on the associated service, thereby improving the reliability of processing user requests.

[0091] In a possible embodiment, after determining that the API interface corresponding to the target request has an associated business through the API application system, the target API interface and the target network partition are determined according to the associated business, a proxy request is generated through the API application system of the current network partition, and the one-way proxy server corresponding to the target network partition in the current network partition is determined; the proxy request is sent to the target partition firewall through the one-way proxy server, and the target partition firewall is located between the target network partition and the current network partition. Based on the one-way proxy server, the target partition firewall determines whether there is a routing policy corresponding to the target network partition. If so, the proxy request is transmitted to the API gateway in the target network partition; if not, the proxy request is rejected from passing through the target partition firewall.

[0092] In a possible embodiment, the one-way proxy server that sends the proxy request is verified through the partition firewall. When it is determined that there is a corresponding policy between the one-way proxy server and the target network partition, it is determined that the one-way proxy server that sends the proxy request has been verified, and a channel is opened to transmit the proxy request to the API gateway in the target network partition. Based on the hardware-isolated network partition, the embodiment of the present application realizes the business linkage of different types of API interfaces across the isolation boundary, and verifies the one-way proxy server in the network partition through the partition firewall, which improves the processing efficiency of cross-network partition requests and the data security during the processing process, and further enhances the accuracy and reliability of the management and operation of the API application system.

[0093] S104: Verify the proxy request through the target network partition, and after the verification is passed, transmit the service corresponding to the target API interface to the user application terminal.

[0094] More specifically, based on the proxy request, the proxy request is verified through the target network partition, and after the verification is passed, the service corresponding to the target API interface is transmitted to the user application terminal.

[0095] Optionally, the API application system that generates the proxy request is legally verified through the target API gateway within the target network partition, wherein the legal verification method in this embodiment is similar to the implementation principle and technical effect corresponding to the method of the API gateway verifying the user application terminal in step S102, both of which are based on asymmetric public-private key signature technology for legal verification, and the above-mentioned technology is a technical means known to those skilled in the art, and will not be repeated here in this embodiment.

[0096] In a possible embodiment, if the target API gateway determines that the API application system has passed the verification, the proxy request is transmitted to the target API application system in the target network partition; the business corresponding to the target API interface is fed back to the user application terminal through the target API application system. The embodiment of the present application performs legal verification on the proxy request through the API gateway in the target network partition, and after the verification is passed, the business corresponding to the target API interface is fed back to the user application terminal through the API application system in the target network partition, thereby improving the security of the request processing process, as well as the accuracy and reliability of the request processing results.

[0097] The request processing method provided in the embodiment of the present application establishes a corresponding network partition for each business category and isolates the network partitions through partition firewalls, so that users of different categories can access services across regions, thereby improving data security, solving the problem of high cost of isolation through dedicated hardware equipment and protocols in the prior art, and realizing effective requests for cross-region services.

[0098] In the prior art, when a new API application is added to an API application system, it is necessary to add a correspondence between the new API application and other API applications in the corresponding firewall so that the firewall determines whether to open a channel based on the correspondence. Therefore, the complexity of the firewall policy is increased, and currently it is necessary to execute a policy change on the firewall every preset change cycle, which makes it difficult for the new API application to be launched in time, reduces the efficiency of application launch, and cannot provide corresponding services to users in time, thereby reducing the user experience.

[0099] Optionally, when a new application is launched in any network partition, the new application is launched in the network partition at any time; and a new API interface corresponding to the new application is determined; after the new application is launched, it is determined that the target API interface corresponding to the target request is the new API interface, and when the new API interface has an associated business, a proxy request is generated according to the new API interface, and the target network partition corresponding to the associated business is determined; the proxy request is transmitted to the target network partition through a one-way proxy server corresponding to the target network partition in the network partition, so that the target network partition responds based on the proxy request.

[0100] In a possible embodiment, when a new API application needs to be added to the API application system within the network partition, the business category of the new API interface corresponding to the new API application is determined, and the new API application is deployed in the network partition corresponding to the business category. After the new API application is deployed online, it is determined that the API interface corresponding to the target request has an associated business based on the target request obtained in real time, and when the target API interface of the associated business is a new API interface, a proxy request corresponding to the new API interface can be directly generated, and after determining the target network partition corresponding to the associated business, the proxy request is transmitted to the target network partition through the one-way proxy server corresponding to the target network partition in the network partition, so that the target network partition transmits the business corresponding to the new API application to the user application terminal based on the proxy request. The application of the network partition of this application and the applications of other network partitions are in different networks and do not affect each other, so that the application can be online at any time and instant access after going online is realized, thereby improving the management and operation efficiency of the application.

[0101] The embodiment of the present application establishes independent network partitions for different categories of API application systems. When the API application system needs to add a new API application, it can be directly launched in the network partition of the corresponding category without affecting other API applications, thereby improving the efficiency of application launch, reducing the cost of operating and maintaining the application system corresponding to the API interface, and further enhancing the user experience.

[0102] Figure 3 A schematic diagram of the structure of the request processing method provided for this application, such as Figure 3 As shown, in this embodiment Figure 2Based on the network partition structure of the embodiment, a cross-network partition request processing method is described in detail. For the scenario where the first type of business is non-financial business and the second type of business is financial business, and based on the first type of API application system being an enterprise management system, the enterprise management system includes various API interfaces of enterprise management related types, and the second type of API application system being a financial application system, the financial application system includes various API interfaces of financial service related types, a user of the enterprise management type connects the user application terminal to the public network with the domain name a.com, and issues a loan request based on the public network, so that the loan request is transmitted to the first type of web server in network partition 1 through the DMZ firewall in network partition 1, and the first type of web server in network partition 1 sends the loan request to the first type of API gateway in network partition 1 through the intranet firewall in network partition 1, and the user application terminal is legally verified by the first type of API gateway. If it is determined that the user application terminal passes the verification, the loan request is sent to the enterprise management system, and the API interface corresponding to the loan request is determined to be the financing API interface through the enterprise management system, and when it is determined that the financing API interface has an associated loan business, the target API interface corresponding to the loan business is determined to be the loan API interface in network partition 2 corresponding to the financial business.

[0103] Optionally, the enterprise management system generates a loan request corresponding to the loan API interface and sends it to the one-way proxy server 1 indicating the network partition 2 in the network partition 1. The loan request is sent to the partition firewall between the network partition 1 and the network partition 2 through the one-way proxy server 1. The partition firewall verifies whether the one-way proxy server 1 is a one-way proxy pointing to the network partition 2 according to a preset policy. When it is determined that the verification of the one-way proxy server 1 is passed, the partition firewall opens the traffic access channel, so that the traffic corresponding to the loan request enters the network partition 2 through the channel.

[0104] Optionally, the traffic corresponding to the loan request is received through the second-class API gateway in network partition 2, and the enterprise management system is legally verified through the second-class API gateway. When it is determined that the enterprise management system has passed the verification, the loan request is sent to the financial application system, and the target API interface corresponding to the loan request is determined by the financial application system to be the loan API interface in network partition 2, and the loan business corresponding to the loan API interface is fed back to the user application terminal.

[0105] The request processing method provided in this embodiment can be executed Figure 3 In the embodiment, the second type of user sends a target request to the network partition 2 to obtain the target service, such as Figure 3 As shown by the dotted line, its implementation principle and technical effect are similar to those of the above embodiment, and will not be described in detail in this embodiment.

[0106] The request processing method provided in the embodiment of the present application initiates a request to the corresponding network partition through a user application terminal, determines whether the request requires cross-partition communication through an enterprise management system independently deployed in the network partition, and when cross-partition communication is determined, sends a request to another network partition through a one-way proxy server, so as to achieve low-cost isolation between network partitions for communication of various business categories while realizing cross-zone business access, improve the security of business data under different network partitions, and reduce the maintenance cost and management difficulty of various categories of API interfaces and corresponding applications.

[0107] Figure 4 A schematic diagram of the structure of the request processing device provided by this application, such as Figure 4 As shown, the request processing device 40 provided in this embodiment includes:

[0108] Acquisition module 401, used to acquire a target request sent by a user application terminal;

[0109] The processing module 402 is used to perform legal verification on the user application terminal through the API gateway communicating with the user application terminal, and when it is determined that the user application terminal has passed the verification, transmit the target request to the API application system in the same network partition as the API gateway;

[0110] Processing module 402 is used to determine the API interface corresponding to the target request through the API application system based on the target request, and determine whether there is an associated business in the API interface, where the associated business is a business associated with the API interface in each network partition outside the current network partition; when it is determined that there is an associated business, generate a proxy request according to the associated business, and transmit the proxy request to the target network partition corresponding to the associated business through a one-way proxy server in the current network partition, where the current network partition refers to the network partition where the API gateway and the API application system are located;

[0111] Processing module 402 is used to verify the proxy request through the target network partition based on the proxy request, and transmit the service corresponding to the target API interface to the user application terminal after the verification is passed. The target API interface is the API interface corresponding to the associated service in the target network partition.

[0112] Optionally, the processing module 402 is used to establish network partitions corresponding to different service categories, and establish partition firewalls between each network partition to control traffic isolation;

[0113] Among them, establishing a network partition corresponding to any service category includes:

[0114] Establish corresponding network partitions based on business categories, which include intranet firewalls, API gateways, and API application systems corresponding to business categories;

[0115] Determine the public domain name for communicating with the network partition, the public domain name corresponds to the service category, so that users corresponding to the service category can request the corresponding service based on the public domain name; determine the API interfaces corresponding to the service category, and deploy them in the API application system corresponding to the service category, so that the API application system can provide the corresponding service to users of the service category;

[0116] When it is determined that there are associated services in each API interface corresponding to the service category, at least one unidirectional proxy server is configured in the network partition where the API application system is located according to the associated services.

[0117] Optionally, the processing module 402 is used to transmit the business corresponding to the API interface to the user application terminal through the API gateway in the current network partition after obtaining the target request and when it is determined through the API application system that there is no associated business with the API interface corresponding to the target request.

[0118] Optionally, the processing module 402 is used to determine the target API interface and the target network partition according to the associated business, generate a proxy request through the API application system of the current network partition, and determine a one-way proxy server corresponding to the target network partition in the current network partition; send the proxy request to the target partition firewall through the one-way proxy server, and the target partition firewall is located between the target network partition and the current network partition;

[0119] Based on the one-way proxy server, the target partition firewall determines whether there is a routing policy corresponding to the target network partition. If so, the proxy request is transmitted to the API gateway in the target network partition.

[0120] Optionally, the processing module 402 is used to perform legal verification on the API application system that generates the proxy request through the target API gateway in the target network partition;

[0121] If it is determined that the API application system verification has passed, the proxy request is transmitted to the target API application system in the target network partition, so that the target API application system feeds back the business corresponding to the target API interface to the user application terminal.

[0122] Optionally, the processing module 402 is used to launch a new application in any network partition at any time when launching the new application in the network partition; and determine a new API interface corresponding to the new application;

[0123] After the new application is launched, it is determined that the API interface corresponding to the target request is a new API interface, and when the new API interface has associated business, a proxy request is generated according to the new API interface, and the target network partition corresponding to the associated business is determined; the proxy request is transmitted to the target network partition through a one-way proxy server corresponding to the target network partition in the network partition, so that the target network partition responds based on the proxy request.

[0124] The request processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0125] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0126] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0127] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0128] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0129] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk storage.

[0130] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0131] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0132] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0133] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0134] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0135] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0138] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a service device, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0139] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0140] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A request processing method, characterized in that: include: Obtaining the target request sent by the user application terminal; Through the API gateway that communicates with the user application terminal, the user application terminal is legally verified, and when it is determined that the user application terminal has passed the verification, the target request is transmitted to the API application system in the same network partition as the API gateway; Based on the target request, determine the API interface corresponding to the target request through the API application system, and determine whether there is an associated business in the API interface, where the associated business is a business associated with the API interface in each network partition outside the current network partition; when it is determined that there is an associated business, generate a proxy request according to the associated business, and transmit the proxy request to the target network partition corresponding to the associated business through a one-way proxy server in the current network partition, where the current network partition refers to the network partition where the API gateway and the API application system are located; Based on the proxy request, the proxy request is verified through the target network partition, and after the verification is passed, the business corresponding to the target API interface is transmitted to the user application terminal, and the target API interface is the API interface corresponding to the associated business in the target network partition.

2. The method according to claim 1, characterized in that Before obtaining the target request sent by the user application terminal, the method includes: Establish network partitions corresponding to different business categories, and establish partition firewalls between each network partition to control traffic isolation; Among them, establishing a network partition corresponding to any service category includes: Establishing a corresponding network partition based on the business category, wherein the network partition includes an intranet firewall, an API gateway, and an API application system corresponding to the business category; Determine a public domain name for communicating with the network partition, the public domain name corresponds to the service category, so that users corresponding to the service category request corresponding services based on the public domain name; and determine each API interface corresponding to the service category, and deploy them in the API application system corresponding to the service category, so that the API application system provides corresponding services to users of the service category; When it is determined that there are associated services in each API interface corresponding to the service category, at least one unidirectional proxy server is configured in the network partition where the API application system is located according to the associated services.

3. The method according to claim 1, characterized in that After obtaining the target request, the method includes: When the API application system determines that there is no associated business in the API interface corresponding to the target request, the business corresponding to the API interface is transmitted to the user application terminal through the API gateway in the current network partition.

4. The method according to any one of claims 1 to 3, characterized in that: After determining, by the API application system, that the API interface corresponding to the target request has an associated business, the method includes: Determine the target API interface and the target network partition according to the associated business, generate a proxy request through the API application system of the current network partition, and determine a one-way proxy server corresponding to the target network partition in the current network partition; send the proxy request to a target partition firewall through the one-way proxy server, and the target partition firewall is located between the target network partition and the current network partition; Based on the one-way proxy server, determine whether there is a routing policy corresponding to the target network partition through the target partition firewall. If so, transmit the proxy request to the API gateway in the target network partition.

5. The method according to claim 4, characterized in that Based on the proxy request, verifying the proxy request through the target network partition, and transmitting the service corresponding to the target API interface to the user application terminal after the verification is passed, including: Performing legal verification on the API application system that generates the proxy request through the target API gateway in the target network partition; If it is determined that the API application system has passed the verification, the proxy request is transmitted to the target API application system in the target network partition, so that the target API application system feeds back the business corresponding to the target API interface to the user application terminal.

6. The method according to claim 1, characterized in that When a new application is launched in any network partition, the method includes: Launching the newly added application in the network partition at any time; and determining a newly added API interface corresponding to the newly added application; After the newly added application is launched, if it is determined that the API interface corresponding to the target request is a newly added API interface and there is an associated business with the newly added API interface, a proxy request is generated according to the newly added API interface, and the target network partition corresponding to the associated business is determined; the proxy request is transmitted to the target network partition through a one-way proxy server corresponding to the target network partition within the network partition, so that the target network partition responds based on the proxy request.

7. A request processing device, characterized in that: include: An acquisition module, used to acquire a target request sent by a user application terminal; A processing module, configured to perform a legal verification on the user application terminal through an API gateway communicating with the user application terminal, and when it is determined that the user application terminal has passed the verification, transmit the target request to an API application system in the same network partition as the API gateway; The processing module is used to determine the API interface corresponding to the target request through the API application system based on the target request, and determine whether there is an associated business in the API interface, where the associated business is a business associated with the API interface in each network partition outside the current network partition; when it is determined that there is an associated business, generate a proxy request according to the associated business, and transmit the proxy request to the target network partition corresponding to the associated business through a one-way proxy server in the current network partition, where the current network partition refers to the network partition where the API gateway and the API application system are located; The processing module is used to verify the proxy request through the target network partition based on the proxy request, and transmit the business corresponding to the target API interface to the user application terminal after the verification is passed. The target API interface is the API interface corresponding to the associated business in the target network partition.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images