API (Application Program Interface) request access control method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the technical field of base frame operation and maintenance, and relates to an AP I interface request access control method and device, computer equipment and a storage medium, and the method comprises the steps: firstly receiving an access request of a user, obtaining AP I interface information and user identity information, then judging whether the user has an access permission according to a predefined permission rule, and if yes, sending the access request to the computer equipment; and if the access control logic does not have the authority, directly denying access, and if the access control logic has the authority, further verifying all interfaces of a module to which the AP I interface belongs to obtain an access verification result of a module level, and finally performing final access control on the requested AP I interface according to the access control logic and the module verification result. According to the access control method and device, through multi-level permission verification, the access safety of the AP I interface is guaranteed, the verification efficiency is improved, meanwhile, a module-level verification mode is adopted, permission management is more flexible, refined access control can be carried out according to service requirements, and the safety and availability of the system are effectively improved.

Description

Technical Field

[0001] The present application relates to the field of infrastructure operation and maintenance technology, and in particular to an API interface request access control method, device, computer equipment and storage medium. Background Art

[0002] API interface request access control is an important solution technology in the field of information technology. It is mainly used to manage and control API access solutions, providing secure access control, traffic management, and permission management functions.

[0003] At present, there are some solutions and technologies for API interface request access control in the industry, which can provide API access authentication and authorization functions. However, applicants have found that there are generally some defects and shortcomings: the main one is that the integration is complex. Due to the existence of different standards and protocols, it is difficult to integrate with existing systems and identity management systems. Secondly, traditional solutions cannot solve the problems of low scalability and poor performance in the face of high-load and large-scale API usage scenarios, which leads to challenges in the scalability and performance of the system. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose an API interface request access control method, apparatus, computer equipment and storage medium to solve the problems of poor scalability and performance of traditional API interface request access control methods.

[0005] In order to solve the above technical problems, the embodiment of the present application provides an API interface request access control method, which adopts the following technical solution:

[0006] Receiving an access request carrying user identification information sent by a user terminal;

[0007] Acquire API interface information according to the access request;

[0008] Acquire user identity information according to the user identification information;

[0009] Calling a predefined permission rule, and judging whether the user role of the API interface information and the user identity information has access rights according to the permission rule;

[0010] If the user role does not have the access permission, outputting no access permission information to the user terminal;

[0011] If the user role has the access permission, the permissions of all API interfaces under the module to which the API interface of the API interface information belongs are verified to obtain a module access verification result;

[0012] Access control processing is performed on the API interface of the access request according to the access control logic and the module access verification result.

[0013] Furthermore, the step of calling a predefined permission rule and determining whether the user role of the API interface information and the user identity information has access rights according to the permission rule specifically includes the following steps:

[0014] According to the API interface and request method of the access request, extract the request path and obtain the resource identifier;

[0015] Querying the access control list for the resource permission corresponding to the resource identifier;

[0016] Obtaining role information corresponding to the user identity information, and querying role permissions corresponding to the user role information;

[0017] Whether the user role of the user identity information has access rights is determined according to whether the role rights include the resource rights.

[0018] Furthermore, after the step of performing access control processing on the API interface of the access request according to the access control logic and the module access verification result, the following steps are also included:

[0019] Monitor the access behavior and request flow of the API interface of the access request in real time to obtain log record data;

[0020] The log record data is stored in a secure log server.

[0021] Furthermore, the step of storing the log record data in the security log server specifically includes the following steps:

[0022] The log record data is encrypted according to a secure encryption method.

[0023] Furthermore, after the step of real-time monitoring the access behavior and request flow of the API interface of the access request to obtain log record data, the following steps are also included:

[0024] Record the number of requests from the same IP or user role in a preset unit time in real time, and determine whether the number of requests meets the preset suspicious number threshold;

[0025] If the number of requests meets the preset suspicious number threshold, a risk assessment is performed on the user role according to a risk assessment algorithm to obtain a risk assessment result;

[0026] Dynamically limit or dynamically block the access request of the user role according to the risk assessment result.

[0027] In order to solve the above technical problems, the embodiment of the present application also provides an API interface request access control device, which adopts the following technical solution:

[0028] A request acquisition module, used to receive an access request carrying user identification information sent by a user terminal;

[0029] An interface information acquisition module, used to acquire API interface information according to the access request;

[0030] An identity information acquisition module, used to acquire user identity information according to the user identification information;

[0031] An access permission judgment module is used to call a predefined permission rule and judge whether the user role of the API interface information and the user identity information has access permission according to the permission rule;

[0032] A no-access-rights module, configured to output no-access-rights information to the user terminal if the user role does not have the access rights;

[0033] An access permission module is used to verify the permissions of all API interfaces under the module to which the API interface of the API interface information belongs if the user role has the access permission, and obtain a module access verification result;

[0034] The access control module is used to perform access control processing on the API interface of the access request according to the access control logic and the module access verification result.

[0035] Furthermore, the access authority determination module includes:

[0036] A resource identifier acquisition submodule, used to extract the request path and obtain the resource identifier according to the API interface and request method of the access request;

[0037] A resource permission acquisition submodule, used to query the resource permission corresponding to the resource identifier in the access control list;

[0038] The role authority acquisition submodule is used to acquire the role information corresponding to the user identity information and query the role authority corresponding to the user role information;

[0039] The access permission judgment submodule is used to judge whether the user role of the user identity information has access permission according to whether the role permission includes the resource permission.

[0040] Furthermore, the device also includes:

[0041] A real-time monitoring module is used to monitor the access behavior and request flow of the API interface of the access request in real time to obtain log record data;

[0042] The log storage module is used to store the log record data in the security log server.

[0043] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0044] It includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the above-mentioned API interface request access control method when executing the computer-readable instructions.

[0045] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0046] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the API interface request access control method described above are implemented.

[0047] The present application provides an API interface request access control method, including: receiving an access request carrying user identification information sent by a user terminal; obtaining API interface information according to the access request; obtaining user identity information according to the user identification information; calling a predefined permission rule, and judging whether the user role of the API interface information and the user identity information has access rights according to the permission rule; if the user role does not have the access rights, outputting no access rights information to the user terminal; if the user role has the access rights, verifying the permissions of all API interfaces under the module to which the API interface of the API interface information belongs, and obtaining a module access verification result; performing access control processing on the API interface of the access request according to the access control logic and the module access verification result. Compared with the prior art, the present application not only ensures the security of API interface access, but also improves the verification efficiency through multi-level permission verification, and at the same time adopts a module-level verification method, making permission management more flexible, and can perform refined access control according to business needs, effectively improving the security and availability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0050] Figure 2 This is a flowchart of the implementation of the API interface request access control method provided in Example 1 of the present application;

[0051] Figure 3 It is a structural diagram of an API interface request access control device provided in Embodiment 2 of the present application;

[0052] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0054] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0055] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0056] like Figure 1As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0057] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0058] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0059] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0060] It should be noted that the API interface request access control method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the API interface request access control device is generally set in the server / terminal device.

[0061] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0062] Embodiment 1

[0063] Continue to refer Figure 2 , shows a flow chart of an embodiment of an API interface request access control method according to the present application. The API interface request access control method comprises: step S201, step S202, step S203, step S204, step S205, step S206 and step S207.

[0064] In step S201, an access request carrying user identification information sent by a user terminal is received.

[0065] In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for the convenience of understanding and are not used to limit the present application.

[0066] In step S202, API interface information is obtained according to the access request.

[0067] In an embodiment of the present application, when a user initiates a request, the system first obtains information such as the API interface name, interface URL, interface type (such as GET, POST, etc.), and the module to which the interface belongs from the request.

[0068] In an embodiment of the present application, in order to obtain the detailed properties of the API interface, for example, the API interface name is getUserData, the various properties of the interface can be queried from the interface list, including the interface address https: / / api.example.com / getUserData, the interface parameters are userID and token, and the interface return value is a JSON object containing user data.

[0069] In step S203, user identity information is obtained according to the user identification information.

[0070] In this embodiment of the present application, the user's identity information, such as user ID, user name (assuming it is "JohnDoe"), role (assuming it is "administrator"), etc., will be queried from the database based on the user ID (assuming it is 12345) to determine the user's specific identity and role.

[0071] In step S204, a predefined permission rule is called, and it is determined according to the permission rule whether the user role of the API interface information and the user identity information has access rights.

[0072] In the embodiment of the present application, the predefined permission rules are a set of rules that define which user roles can access which resources or perform which operations. These rules can be based on roles, user groups or other attributes.

[0073] In step S205, if the user role does not have access rights, no access rights information is output to the user terminal.

[0074] In step S206, if the user role has access rights, the permissions of all API interfaces under the module to which the API interface of the API interface information belongs are verified to obtain a module access verification result.

[0075] In the embodiment of the present application, the verification process for the permissions of all API interfaces under the module to which the API interface belongs may be implemented as follows:

[0076] ①Module identification:

[0077] First, you need to determine the module that the API interface belongs to. Each API interface usually belongs to a specific business module, such as user management, order processing, etc.

[0078] ②Permission rule mapping:

[0079] Define a set of permission rules for each module. These rules define which API interfaces under the module can be accessed by different user roles.

[0080] ③ User roles and permissions acquisition:

[0081] When a user attempts to access an API interface, the system needs to obtain the user's role information and corresponding permissions.

[0082] ④Traverse all API interfaces in the module:

[0083] The system needs to have a list or registry that records the information of all API interfaces under the module.

[0084] ⑤Authorization verification:

[0085] For each API interface in the module, the system verifies it according to the permission rules to determine whether the current user role has the right to access it.

[0086] ⑥Summary of module access verification results:

[0087] The access verification results of each API interface are summarized to form the access verification results of the module.

[0088] ⑦Response to user:

[0089] Based on the summary results, the system can decide whether to allow the user to access the module, or provide partial access rights.

[0090] ⑧Record and feedback:

[0091] The system records the verification process and results for audit and feedback purposes.

[0092] In step S207, access control processing is performed on the API interface of the access request according to the access control logic and the module access verification result.

[0093] In actual application, suppose we have an online library management system with the following roles and permission rules:

[0094] ①Administrator: can access all book information and user information;

[0095] ② Librarian: can access book information but not user information;

[0096] ③ Ordinary users: can only access the reading permissions of books, and cannot modify or delete books.

[0097] Now, a librarian tries to access the user information API interface:

[0098] User Authentication: Librarians log into the system using a username and password.

[0099] User role identification: The system confirms the role of librarian.

[0100] API interface information acquisition: Librarian requests access to user information API.

[0101] Permission match: The system checks the permission rules and finds that the librarian does not have permission to access user information.

[0102] Access control decision: The system denies the librarian's request and returns an error message, such as "You do not have permission to access this resource."

[0103] Logging and Monitoring: The system logs the access attempt and the decision to deny it.

[0104] Through this process, the system ensures that only authorized users can access sensitive information, thereby protecting the security and integrity of the data.

[0105] In an embodiment of the present application, a method for controlling access to an API interface request is provided, including: receiving an access request carrying user identification information sent by a user terminal; obtaining API interface information according to the access request; obtaining user identity information according to the user identification information; calling a predefined permission rule, and judging whether the user role of the API interface information and the user identity information has access rights according to the permission rule; if the user role does not have access rights, outputting information about no access rights to the user terminal; if the user role has access rights, verifying the permissions of all API interfaces under the module to which the API interface of the API interface information belongs, and obtaining a module access verification result; performing access control on the API interface of the access request according to the access control logic and the module access verification result. Compared with the prior art, the present application not only ensures the security of API interface access but also improves the verification efficiency through multi-level permission verification, and at the same time adopts a module-level verification method, making permission management more flexible, and can perform refined access control according to business needs, effectively improving the security and availability of the system.

[0106] In some optional implementations of the embodiments of the present application, the above step S204 specifically includes the following steps:

[0107] According to the API interface and request method of the access request, extract the request path and obtain the resource identifier;

[0108] Query the access control list for the resource permission corresponding to the resource identifier;

[0109] Obtain the role information corresponding to the user identity information, and query the role permissions corresponding to the user role information;

[0110] Whether the user role of the user identity information has access rights is determined based on whether the role rights include resource rights.

[0111] In the embodiment of the present application, detailed information of the user is obtained through the user ID, which can be queried from the user database. For example, if the user ID is 12345, the corresponding user name is Zhang San, and the user role is Admin.

[0112] In an embodiment of the present application, based on the user role, the access control rules can be used to determine the Admin role's access rights to all API interfaces. For example, the Admin role can access the getUserData interface, and the access control rules stipulate that the Admin role cannot access the deleteUser interface.

[0113] In an embodiment of the present application, when the access control rules do not explicitly mention a certain API interface, the access control rules of the user identity can be further queried. For example, the access control rules for a specific user, Zhang San, explicitly allow access to the getUserData interface, but do not mention access rights to the deleteUser interface.

[0114] In an embodiment of the present application, whether the interface is open to access rights for all users can be determined based on the access control rules of the API interface.

[0115] In an embodiment of the present application, if the access control rules based on the API interface do not clearly define the access rights of a certain interface, the user role, user identity and the access control rules of the API interface can be combined to comprehensively determine whether the user has access rights.

[0116] In an embodiment of the present application, a simple combination rule algorithm is used, for example, the permission weight of the user role is set to 6, the permission weight of the user identity is set to 3, and the permission weight of the API interface is set to 1. By calculating the total weight value, if the total value is greater than 5, access is allowed, otherwise access is denied. As an example, assuming that Zhang San's user role and identity both allow access to a certain interface, and the interface is open to all users, the calculation result is 6 (role) + 3 (identity) + 1 (interface) = 0, and the final judgment result is that access is allowed.

[0117] In the embodiment of the present application, when obtaining all relevant access permission judgment results, if any rule explicitly denies the access permission, the final judgment result is denial.

[0118] In an embodiment of the present application, the final access permission judgment result can be obtained by sorting the rule priorities, for example, user-specific rules have the highest priority, followed by user role rules, and finally API interface rules.

[0119] In the embodiment of the present application, if all access permission judgment results are allowed, for example, the user role, identity and interface rules all allow access to the getUserData interface, then the final judgment result is that access is allowed.

[0120] In an embodiment of the present application, the final access permission judgment result is output through the access permission judgment result interface. For example, a request for Zhang San to access the getUserData interface returns a result of allowing access, while a request to access the deleteUser interface returns a result of denying access.

[0121] In the embodiment of the present application, by comprehensively analyzing the user role, user identity and access control rules of the API interface, the user's access rights to the API interface can be accurately determined.

[0122] In the embodiments of the present application, the business process of authority verification can be strictly completed to ensure system security and user experience.

[0123] In some optional implementations of the embodiments of the present application, after step S207, the following steps are further included:

[0124] Monitor the access behavior and request flow of the API interface of the access request in real time to obtain log record data;

[0125] Stores logging data on a secure log server.

[0126] In an embodiment of the present application, information such as request ID, user ID, request time, request method, request URL, request header, request body, and client IP can be obtained by monitoring the input of the API interface.

[0127] In an embodiment of the present application, a logging function is used to record the parsed request data, including request ID, user ID, request time, request method, request URL, request header, request body, client IP and other information.

[0128] In an embodiment of the present application, the request can be processed by the server, a response status code, a response header and a response body can be obtained, and the response time of the processing request can be recorded.

[0129] In an embodiment of the present application, the request and response data are combined to integrate the request ID, user ID, request time, request method, request URL, request header, request body, client IP, response status code, response header, response body, response time and exception information (if any) into a complete log record.

[0130] In some optional implementations of the embodiments of the present application, a secure encryption method can be used to encrypt the integrated log records to ensure the security of the log data during transmission and storage. The encrypted log records are then sent to a secure log server through a secure transmission protocol and stored on the server.

[0131] In an embodiment of the present application, on the log server, the stored log data is indexed and classified through the log management system, and a search index is generated based on attributes such as user ID, request time, and request method to facilitate subsequent auditing and abnormal behavior analysis.

[0132] In the embodiment of the present application, the integrity, security and auditability of request and response data are ensured.

[0133] In some optional implementations of the embodiments of the present application, after the above step of real-time monitoring of the access behavior and request flow of the API interface of the access request to obtain log record data, the following steps are also included:

[0134] Record the number of requests from the same IP or user role in a preset unit time in real time, and determine whether the number of requests meets the preset suspicious number threshold;

[0135] If the number of requests meets the preset suspicious number threshold, the user role is subjected to risk assessment processing according to the risk assessment algorithm to obtain the risk assessment result;

[0136] Dynamically limit or block access requests of user roles based on risk assessment results.

[0137] In an embodiment of the present application, the number of requests from the same IP or user per unit time is obtained and recorded. By analyzing the request frequency, it is determined whether there is abnormal request behavior. Once it is determined that the request frequency is too high, the IP or user is marked as suspicious. Based on the marking information, the number of failed requests such as authentication failures and parameter errors of the corresponding IP or user is counted. If the failed attempts are frequent, the monitoring intensity of the IP or user is further enhanced, and its detailed request log is recorded.

[0138] In an embodiment of the present application, by analyzing the detailed request log, the length, format, value range and other characteristics of the request parameters can be extracted and analyzed. If abnormal or illegal parameters are found, the request is marked as high risk.

[0139] In an embodiment of the present application, a risk profile of the user can be generated in combination with factors such as the user's historical behavior, access pattern, and credibility. Based on the risk profile, the user's current risk level can be determined. Based on the user's risk level, the consumption of system resources by their requests can be dynamically evaluated, and the CPU, memory, bandwidth and other resource consumption data of each request can be recorded. If the resource consumption is abnormal, the risk level of the user is further increased.

[0140] In an embodiment of the present application, a risk assessment algorithm can be used to dynamically adjust the access control policy based on the user's risk profile. If the user's risk level is high, their request will be limited or blocked.

[0141] In an embodiment of the present application, the user's behavior and system resource consumption can be continuously monitored and recorded, and the user's risk level can be re-evaluated regularly. If the user's behavior tends to be normal, the access control policy can be adjusted accordingly to reduce the current limiting or blocking level.

[0142] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0143] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0144] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0145] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0146] Embodiment 2

[0147] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of an API interface request access control device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0148] like Figure 3 As shown, the API interface request access control device 200 of the embodiment of the present application includes:

[0149] The request acquisition module 210 is used to receive an access request carrying user identification information sent by a user terminal;

[0150] The interface information acquisition module 220 is used to obtain API interface information according to the access request;

[0151] The identity information acquisition module 230 is used to acquire the user identity information according to the user identification information;

[0152] The access permission determination module 240 is used to call a predefined permission rule and determine whether the user role of the API interface information and the user identity information has the access permission according to the permission rule;

[0153] The no-access-rights module 250 is used to output no-access-rights information to the user terminal if the user role does not have access rights;

[0154] The access permission module 260 is used to verify the permissions of all API interfaces under the module to which the API interface of the API interface information belongs if the user role has the access permission, and obtain the module access verification result;

[0155] The access control module 270 is used to perform access control processing on the API interface of the access request according to the access control logic and the module access verification result.

[0156] In an embodiment of the present application, an API interface request access control device 200 is provided, including: a request acquisition module 210, used to receive an access request carrying user identification information sent by a user terminal; an interface information acquisition module 220, used to obtain API interface information according to the access request; an identity information acquisition module 230, used to obtain user identity information according to the user identification information; an access permission judgment module 240, used to call a pre-defined permission rule, and judge whether the user role of the API interface information and the user identity information has access permission according to the permission rule; a no-access permission module 250, used to output no-access permission information to the user terminal if the user role does not have access permission; an access permission module 260, used to verify the permissions of all API interfaces under the module to which the API interface of the API interface information belongs if the user role has access permission, and obtain a module access verification result; an access control module 270, used to perform access control processing on the API interface of the access request according to the access control logic and the module access verification result. Compared with the existing technology, this application uses multi-level permission verification to ensure the security of API interface access and improve verification efficiency. At the same time, it adopts module-level verification to make permission management more flexible and can perform refined access control according to business needs, effectively improving the security and availability of the system.

[0157] In some optional implementations of the embodiments of the present application, the access authority determination module includes:

[0158] The resource identifier acquisition submodule is used to extract the request path and obtain the resource identifier according to the API interface and request method of the access request;

[0159] A resource permission acquisition submodule is used to query the resource permission corresponding to the resource identifier in the access control list;

[0160] The role permission acquisition submodule is used to obtain the role information corresponding to the user identity information and query the role permission corresponding to the user role information;

[0161] The access permission judgment submodule is used to judge whether the user role of the user identity information has access permission according to whether the role permission includes resource permission.

[0162] In some optional implementations of the embodiments of the present application, the above-mentioned API interface request access control device 200 further includes:

[0163] A real-time monitoring module is used to monitor the access behavior and request flow of the API interface of the access request in real time and obtain log record data;

[0164] The log storage module is used to store log record data in the security log server.

[0165] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of a computer device according to an embodiment of the present application.

[0166] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0167] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0168] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 310 can be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 can also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory 310 can also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of the API interface request access control method, etc. In addition, the memory 310 can also be used to temporarily store various data that have been output or are to be output.

[0169] The processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to run the computer-readable instructions stored in the memory 310 or process data, such as running the computer-readable instructions of the API interface request access control method.

[0170] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0171] The computer device provided in this application not only ensures the security of API interface access but also improves verification efficiency through multi-level permission verification. At the same time, it adopts module-level verification to make permission management more flexible and can perform refined access control according to business needs, effectively improving the security and availability of the system.

[0172] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the API interface request access control method as described above.

[0173] The computer-readable storage medium provided in this application not only ensures the security of API interface access but also improves verification efficiency through multi-level permission verification. At the same time, it adopts a module-level verification method to make permission management more flexible and can perform refined access control according to business needs, effectively improving the security and availability of the system.

[0174] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0175] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. An API interface request access control method, characterized in that: The steps include: Receiving an access request carrying user identification information sent by a user terminal; Acquire API interface information according to the access request; Acquire user identity information according to the user identification information; Calling a predefined permission rule, and judging whether the user role of the API interface information and the user identity information has access rights according to the permission rule; If the user role does not have the access permission, outputting no access permission information to the user terminal; If the user role has the access permission, the permissions of all API interfaces under the module to which the API interface of the API interface information belongs are verified to obtain a module access verification result; Access control processing is performed on the API interface of the access request according to the access control logic and the module access verification result.

2. The API interface request access control method according to claim 1, characterized in that: The step of calling a predefined permission rule and determining whether the user role of the API interface information and the user identity information has access rights according to the permission rule specifically includes the following steps: According to the API interface and request method of the access request, extract the request path and obtain the resource identifier; Querying the access control list for the resource permission corresponding to the resource identifier; Obtaining role information corresponding to the user identity information, and querying role permissions corresponding to the user role information; Whether the user role of the user identity information has access rights is determined according to whether the role rights include the resource rights.

3. The API interface request access control method according to claim 1, characterized in that: After the step of performing access control processing on the API interface of the access request according to the access control logic and the module access verification result, the following steps are also included: Monitor the access behavior and request flow of the API interface of the access request in real time to obtain log record data; The log record data is stored in a secure log server.

4. The API interface request access control method according to claim 1, characterized in that: The step of storing the log record data in the security log server specifically comprises the following steps: The log record data is encrypted according to a secure encryption method.

5. The API interface request access control method according to claim 3, characterized in that: After the step of monitoring the access behavior and request flow of the API interface of the access request in real time to obtain log record data, the following steps are also included: Record the number of requests from the same IP or user role in a preset unit time in real time, and determine whether the number of requests meets the preset suspicious number threshold; If the number of requests meets the preset suspicious number threshold, a risk assessment is performed on the user role according to a risk assessment algorithm to obtain a risk assessment result; Dynamically limit or dynamically block the access request of the user role according to the risk assessment result.

6. An API interface request access control device, characterized in that: include: A request acquisition module, used to receive an access request carrying user identification information sent by a user terminal; An interface information acquisition module, used to acquire API interface information according to the access request; An identity information acquisition module, used to acquire user identity information according to the user identification information; An access permission judgment module is used to call a predefined permission rule and judge whether the user role of the API interface information and the user identity information has access permission according to the permission rule; A no-access-rights module, configured to output no-access-rights information to the user terminal if the user role does not have the access rights; An access permission module is used to verify the permissions of all API interfaces under the module to which the API interface of the API interface information belongs if the user role has the access permission, and obtain a module access verification result; The access control module is used to perform access control processing on the API interface of the access request according to the access control logic and the module access verification result.

7. The API interface request access control device according to claim 6, characterized in that: The access authority determination module includes: A resource identifier acquisition submodule, used to extract the request path and obtain the resource identifier according to the API interface and request method of the access request; A resource permission acquisition submodule, used to query the resource permission corresponding to the resource identifier in the access control list; The role authority acquisition submodule is used to acquire the role information corresponding to the user identity information and query the role authority corresponding to the user role information; The access permission judgment submodule is used to judge whether the user role of the user identity information has access permission according to whether the role permission includes the resource permission.

8. The API interface request access control device according to claim 6, characterized in that: The device also includes: A real-time monitoring module is used to monitor the access behavior and request flow of the API interface of the access request in real time to obtain log record data; The log storage module is used to store the log record data in the security log server.

9. A computer device, comprising a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the API interface request access control method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the API interface request access control method according to any one of claims 1 to 5 are implemented.

Images