Application programming interface gateway data processing method with identity verification function

Abstract

The invention provides an application programming interface gateway data processing method with an identity verification function, and the method comprises the steps: receiving request information, determining a target database according to identity information and an initial identifier of request content, and carrying out the format conversion of the initial identifier of the request content according to a first format, a target identifier of the request content is generated, at least one target application programming interface is determined according to the application programming interface calling sequence, the target identifier is sent to a collection platform through the at least one target application programming interface, and the collection platform obtains result data from a target database according to the target identifier, and sending the result data to the application programming interface gateway, converting the format of the result data according to the second format to obtain a to-be-returned result, and sending the to-be-returned result to the client. According to the method and the device, the parameter processing capability is enhanced, flexible configuration management is realized, and the API gateway can adapt to various types of data processing requests.

Description

Technical Field

[0001] The present application relates to the technical field of interface gateways, and in particular to an application programming interface gateway data processing method with an identity authentication function. Background Art

[0002] In modern information systems, cross-system data interaction between different systems is becoming more and more common. With the development of technologies such as the Internet, the Internet of Things, and big data, the demand for data collection, processing, and transmission has increased significantly. Especially in large enterprises, data interaction involving multiple business systems has become particularly important. These systems often use different technical architectures, protocols, and data formats. Therefore, how to achieve safe, reliable, and efficient data interaction has become an urgent problem to be solved.

[0003] In the prior art, a plurality of backend service interfaces are centralized into one gateway through a traditional application programming interface (API) gateway, which provides API services in a unified manner and provides simple identity authentication and permission verification functions.

[0004] However, the API gateway in the prior art can only perform simple format conversion and verification, and has poor parameter processing capabilities, resulting in the API gateway being unable to adapt to various types of data processing requests. Summary of the invention

[0005] The purpose of this application is to provide an application programming interface gateway data processing method with identity authentication function in view of the deficiencies in the above-mentioned prior art, so as to solve the problem that the API gateway in the prior art cannot adapt to various types of data processing requests.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0007] In a first aspect, the present application provides an application programming interface gateway data processing method with an identity authentication function, the method being applied to an application programming interface gateway, the method comprising:

[0008] Receive request information sent by the client, the request information including identity information and an initial identifier of the request content;

[0009] Determine a target database in a collection platform according to the identity information and the initial identifier of the request content, and convert the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content, wherein the collection platform includes multiple databases;

[0010] Determine at least one target application programming interface according to the current application programming interface call sequence in the application programming interface gateway, and send the target identifier to the collection platform through the at least one target application programming interface, and the collection platform obtains result data from the target database according to the target identifier, and sends the result data to the application programming interface gateway;

[0011] The result data is format-converted according to a second format corresponding to the client to obtain a result to be returned, and the result to be returned is sent to the client.

[0012] Optionally, determining a target database in a collection platform according to the identity information and the initial identifier of the request content, and converting the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content includes:

[0013] Determining the target database according to the initial identifier;

[0014] Perform identity authentication and authority verification based on the identity information to determine whether the client has the authority to access the target database;

[0015] If so, the identifier of the requested content is formatted according to the first format corresponding to the target database to generate a target identifier of the requested content.

[0016] Optionally, performing identity authentication and authority verification according to the identity information to determine whether the client has authority to access the target database includes:

[0017] Convert the identity information into a first format corresponding to the target database to generate target identity information;

[0018] Acquire authorization information corresponding to the target database, the authorization information including: identity information allowing access to the target database;

[0019] The target identity information is matched with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has the authority to access the target database.

[0020] Optionally, the method further comprises:

[0022] Acquire configuration information sent by a gateway management platform, wherein the configuration information is generated by the gateway management platform based on an update instruction input by a user and a load balancing strategy, wherein the load balancing strategy is used to indicate an application programming interface call sequence in the application programming interface gateway;

[0023] The application programming interface is updated according to the configuration information, the application programming interface calling sequence of the application programming interface gateway is adjusted, and an application programming interface configuration log is generated.

[0024] Optionally, sending the result to be returned to the client includes:

[0025] According to the preset security control policy, the result to be returned is encrypted and the encrypted return result is sent to the client.

[0026] Optionally, the encrypting the result to be returned according to a preset security control policy includes:

[0027] Determine whether the result to be returned is binary data;

[0028] If so, the result to be returned is filtered and a watermark is added.

[0029] Optionally, before sending the result to be returned to the client, the method further includes:

[0030] Sending a reply request to the client;

[0031] Receive the reply request response information sent by the client.

[0032] In a second aspect, the present application provides a data processing system, the system comprising the application programming interface gateway, gateway management platform, collection platform and client of the first aspect;

[0033] The application programming interface gateway is respectively connected to the gateway management platform, the acquisition platform and the client for communication;

[0034] The application programming interface gateway is used to perform data processing based on the method steps described in the first aspect.

[0035] In a third aspect, the present application provides an application programming interface gateway data processing device with an identity authentication function, the device comprising:

[0036] A receiving module, used to receive request information sent by a client, wherein the request information includes identity information and an initial identifier of the request content;

[0037] a first conversion module, configured to determine a target database in a collection platform according to the identity information and the initial identifier of the request content, and to convert the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content, wherein the collection platform includes a plurality of databases;

[0038] a sending module, configured to determine at least one target application programming interface according to the current application programming interface calling sequence in the application programming interface gateway, and send the target identifier to the collection platform through the at least one target application programming interface, and the collection platform obtains result data from the target database according to the target identifier, and sends the result data to the application programming interface gateway;

[0039] The second conversion module is used to convert the format of the result data according to a second format corresponding to the client to obtain the result to be returned, and send the result to be returned to the client.

[0040] Optionally, the first conversion module is specifically configured to:

[0041] Determining the target database according to the initial identifier;

[0042] Perform identity authentication and authority verification based on the identity information to determine whether the client has the authority to access the target database;

[0043] If so, the identifier of the requested content is formatted according to the first format corresponding to the target database to generate a target identifier of the requested content.

[0044] Optionally, the first conversion module is specifically configured to:

[0045] Convert the identity information into a first format corresponding to the target database to generate target identity information;

[0046] Acquire authorization information corresponding to the target database, the authorization information including: identity information allowing access to the target database;

[0047] The target identity information is matched with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has the authority to access the target database.

[0048] Optionally, the first conversion module is further used for:

[0049] Acquire configuration information sent by a gateway management platform, wherein the configuration information is generated by the gateway management platform based on an update instruction input by a user and a load balancing strategy, wherein the load balancing strategy is used to indicate an application programming interface call sequence in the application programming interface gateway;

[0050] The application programming interface is updated according to the configuration information, the application programming interface calling sequence of the application programming interface gateway is adjusted, and an application programming interface configuration log is generated.

[0051] Optionally, the second conversion module is specifically configured to:

[0052] According to the preset security control policy, the result to be returned is encrypted and the encrypted return result is sent to the client.

[0053] Optionally, the second conversion module is specifically configured to:

[0054] Determine whether the result to be returned is binary data;

[0055] If so, the result to be returned is filtered and a watermark is added.

[0056] Optionally, the second conversion module is further used for:

[0057] Sending a reply request to the client;

[0058] Receive the reply request response information sent by the client.

[0059] In a fourth aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the above-mentioned application programming interface gateway data processing method with identity authentication function.

[0060] In a fifth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned application programming interface gateway data processing method with identity authentication function are executed.

[0061] The beneficial effects of the present application are as follows: first, the request information sent by the client is received, and then the target database in the collection platform is determined based on the identity information and the initial identifier of the request content, and the initial identifier of the request content is formatted according to the first format corresponding to the target database to generate a target identifier of the request content. Since the format conversion may include parameter desensitization processing and value conversion, etc., this solution has complex parameter processing capabilities. Then, at least one target API is determined according to the current API call sequence in the API gateway, thereby realizing unified API configuration management, and the target identifier is sent to the collection platform through the target API. After receiving the result data sent by the collection platform, the result data is formatted to obtain the result to be returned, thereby further improving the parameter processing capability, and the result to be returned is sent to the client. Through the above method, this solution enhances the parameter processing capability and has flexible configuration management, which allows the API gateway to adapt to various types of data processing requests. Description of the drawings

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1 It is a schematic diagram of an application scenario of an application programming interface gateway data processing method with identity authentication function provided by the present application;

[0064] Figure 2 It is a flowchart of an application programming interface gateway data processing method with identity authentication function provided in an embodiment of the present application;

[0065] Figure 3 It is a timing diagram of an API gateway data processing method provided in an embodiment of the present application;

[0066] Figure 4 It is a flowchart of a target identifier for generating request content provided by an embodiment of the present application;

[0067] Figure 5 It is a flowchart of a method for determining whether a client has permission to access a target database provided by an embodiment of the present application;

[0068] Figure 6 It is a structural diagram of an application programming interface gateway data processing device with identity authentication function provided in an embodiment of the present application;

[0069] Figure 7It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0071] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0072] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0073] In order to meet the data interaction needs between different systems, API gateways came into being. As the middleware for communication between systems, API gateways provide unified interface management, security control, traffic management, data processing and other functions. It not only simplifies the complexity of system integration, but also improves the security and efficiency of data interaction between systems.

[0074] In the prior art, in order to achieve safe, reliable and efficient data interaction, a traditional API gateway is proposed. The traditional API gateway can perform unified interface management, and perform identity authentication and permission verification on the data request issued by the client to ensure that only legitimate users can access the API, and provide functions such as load balancing, current limiting and fuse to ensure the high availability of the system. Finally, it can perform log recording, provide real-time monitoring and alarm functions, and facilitate operation and maintenance management. Although the traditional API gateway can solve the basic cross-system data interaction problem, it lacks flexible parameter processing capabilities when facing complex data interaction requirements. For example, the traditional API gateway can only perform simple format conversion and verification on the request and response data, and cannot meet the complex parameter processing requirements. When updating the configuration of the traditional API gateway, it often needs to restart the service, which will affect the data request and response being processed, and reduce the availability of the API gateway. In addition, the security control of the traditional API gateway is relatively extensive, and it is impossible to uniformly manage each API and filter and process the response data, which poses a security risk.

[0075] In the prior art, there is also a data processing platform that can provide complex parameter processing capabilities and data conversion functions. However, this data processing platform requires in-depth customization and complex configuration, which increases the difficulty and cost of system integration, and the complex data processing logic may lead to performance bottlenecks, making it difficult to meet the processing requirements of high concurrency and large data volumes. Finally, this data processing platform usually lacks unified identity authentication and permission management functions, and its security is difficult to guarantee.

[0076] In the prior art, there are three other ways to achieve data interaction. One is an open source API gateway that can provide a plug-in mechanism to expand functions, such as Kong. However, the plug-in mechanism of this gateway requires a high development cost and cannot be adapted to specific business scenarios. The second is an API gateway that provides cloud service integration capabilities, such as Amazon Web Services (AWS). The configuration and management of this gateway is relatively complex and needs to rely on the AWS ecosystem, which increases the cost of use and the risk of lock-in.

[0077] In summary, the existing technology has the problems of insufficient parameter processing capability, inflexible configuration management, insufficiently sophisticated security control and high configuration cost.

[0078] Based on this, the present application proposes an application programming interface gateway data processing method with an identity authentication function. The method is applied to the API gateway, first receiving the request information sent by the client, and then performing format conversion and parameter processing on the identity information in the request information and the initial identifier of the request content, and determining the target database in the acquisition platform, so that the present solution has complex parameter processing capabilities. Then, at least one target API is determined according to the current API call sequence in the API gateway to implement unified configuration management, and the target identifier is sent to the acquisition platform through the target API. After receiving the result data sent by the acquisition platform, the result data is format converted to obtain the result to be returned, thereby performing fine-grained security control on the result data, and sending the result to be returned to the client. Through the above method, the present solution enhances the parameter processing capability and has flexible configuration management, so that the API gateway can adapt to various types of data processing requests.

[0079] Before introducing the specific solution, the use scenario of the application programming interface gateway data processing method with identity authentication function is introduced first. Figure 1 This is a schematic diagram of an application scenario of an application programming interface gateway data processing method with identity authentication function provided by this application. Figure 1 As shown, the data processing method of the application programming interface gateway with identity authentication function is applied in the API gateway, and the API gateway can be applied in the data processing system. In addition to the API gateway, the data processing system also includes a gateway management platform, a collection platform and a client, wherein the collection platform can be connected to multiple databases. The API gateway is respectively connected to the gateway management platform, the collection platform and the client in communication, wherein the client can be multiple, for executing the data processing method of the application programming interface gateway with identity authentication function.

[0080] Next, refer to Figure 2 The specific steps of the data processing method of the application programming interface gateway with identity authentication function are introduced. Figure 2 It is a flow chart of an application programming interface gateway data processing method with identity authentication function provided in an embodiment of the present application.

[0081] S201. Receive request information sent by a client, where the request information includes identity information and an initial identifier of the request content.

[0082] Optionally, the user can send a request message through the client to obtain the required data from the collection platform through the API gateway. It is worth noting that the API gateway can connect to multiple clients, and this embodiment is described by taking one client sending a request message as an example.

[0083] The identity information included in the request information may include an account number, a password, a key, a token, etc. The initial identification of the requested content may be used to indicate the identification of the target database in the acquisition platform and the identification of the requested content. As an optional implementation, the initial identification of the requested content may request binary data. Binary data may include pictures, files, and streaming media, etc.

[0084] S202. Determine a target database in the collection platform according to the identity information and the initial identifier of the request content, and convert the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content, wherein the collection platform includes multiple databases.

[0085] As an optional implementation, the target database in the acquisition platform can be determined based on the initial identification of the request content, and then identity authentication and permission verification can be performed based on the identity information. If the verification passes, it is determined that the result data can be obtained from the target database.

[0086] As another implementation, identity authentication and permission verification can be performed based on the identity information to confirm whether the user has access rights. If so, the target database is determined based on the initial identification of the request content. It is worth noting that this implementation is applicable to the case where the identity authentication conditions and permission verification conditions of each database in the acquisition platform are consistent.

[0087] Optionally, a format requirement comparison table of each database may be obtained from the gateway management platform. The format requirement comparison table includes the data format of the data received by each database, such as the first format corresponding to the target database.

[0088] Specifically, it can be determined in advance whether the format of the initial identifier of the request content is the first format corresponding to the target database, and if so, no format conversion is required. If not, the format of the initial identifier is converted to the first format.

[0089] As an example, the requestbody format may be converted into the param format, or the JSON format may be converted into the Uniform Resource Locator (URL) path format or the querystring parameter format of the target database, or the request header in the initial identifier may be deleted.

[0090] It is worth noting that in the process of converting the format of the initial identifier, the initial identifier can be desensitized and authentication information can be added. Desensitization can be filtering and replacing sensitive information in the initial identifier. Exemplarily, sensitive information in the initial identifier includes passwords, keys, and tokens. The authentication information is used to indicate that the target identifier has passed the desensitization process.

[0091] That is, the format of the target identifier of the request content complies with the first format corresponding to the target database and does not include sensitive information.

[0092] S203. Determine at least one target API according to the current API call sequence in the API gateway, and send the target identifier to the collection platform through the at least one target API. The collection platform obtains result data from the target database according to the target identifier and sends the result data to the API gateway.

[0093] Optionally, the API gateway can schedule multiple APIs. Users can set each API online through the gateway management platform, including setting API parameters and API call order. Specifically, API parameters can include API updates and releases, and the API call order can be, for example, polling or random.

[0094] Optionally, after the target API is determined, the target identifier is sent to the collection platform through routing forwarding via the target API gateway.

[0095] S204: Convert the result data into a format according to the second format corresponding to the client to obtain the result to be returned, and send the result to be returned to the client.

[0096] Optionally, the second format corresponding to the client may be the same as the format of the initial identifier. The second format is the format of the data that the current client can use. If the API gateway is connected to multiple clients, the second format corresponding to each client may be different.

[0097] As an optional implementation, the format conversion of the result data may include conversion of the parameter format of the data, such as converting the param format into the requestbody format.

[0098] Optionally, in addition to converting the parameter format of the result data, the result technology may also be fine-grained filtered and processed to ensure the security of the results to be returned.

[0099] As an optional implementation, when sending the results to be returned to the client, routing forwarding can also be performed according to the current API call sequence in the API gateway.

[0100] In this embodiment, the request information sent by the client is first received, and then the target database in the collection platform is determined according to the identity information and the initial identifier of the request content, and the initial identifier of the request content is formatted according to the first format corresponding to the target database to generate the target identifier of the request content. Since the format conversion can include parameter desensitization processing and value conversion, etc., this solution has complex parameter processing capabilities. Then, at least one target API is determined according to the current API call sequence in the API gateway, thereby realizing unified API configuration management, and the target identifier is sent to the collection platform through the target API. After receiving the result data sent by the collection platform, the result data is formatted to obtain the result to be returned, thereby further improving the parameter processing capability, and the result to be returned is sent to the client. Through the above method, this solution enhances the parameter processing capability and has flexible configuration management, which can enable the API gateway to adapt to various types of data processing requests.

[0101] As an optional implementation, the API gateway may include an API processing module, an identity authentication module, and a parameter processing module. Figure 3 This is a timing diagram of an API gateway data processing method provided by an embodiment of the present application. Figure 3 As shown, the client sends the request information to the API processing module, and the API processing module sends the identity information to the identity authentication module for identity authentication and permission verification, and receives the identity authentication result and permission verification result sent by the identity authentication module. After the identity authentication result and permission verification result show that the verification is passed, the API processing module sends the initial identifier of the request content to the parameter processing module for format conversion, and receives the target identifier of the request content returned by the parameter processing module. Then, the API processing module sends the target identifier of the request content to the collection platform according to the API call sequence, and receives the result data sent by the collection platform. After receiving the result data, the API processing module sends the result data to the parameter processing module for format conversion, receives the result to be returned, and then sends the result to be returned to the client.

[0102] Next, refer to Figure 4 The specific process of determining the target database in the collection platform according to the identity information and the initial identifier of the request content in the above step S202, converting the format of the initial identifier of the request content according to the first format corresponding to the target database, and generating the target identifier of the request content is introduced.

[0103] S401. Determine the target database according to the initial identifier.

[0104] Optionally, the initial identifier may include an identifier of the target database. After the API gateway is connected to the collection platform, it may obtain the identifiers of each database in the collection platform, thereby determining the target database according to the initial identifier.

[0105] S402: Perform identity authentication and authority verification based on the identity information to determine whether the client has the authority to access the target database.

[0106] As an optional implementation, the API gateway can obtain the identity authentication conditions and permission verification conditions of each database in the collection platform. After determining the target database, the API gateway can determine the identity authentication conditions and permission verification conditions of the target database. Among them, the identity authentication conditions can be used to indicate whether there is permission to access the database, and the permission verification conditions are used to indicate what kind of data in the database can be accessed.

[0107] S403: If yes, convert the format of the identifier of the requested content according to the first format corresponding to the target database to generate a target identifier of the requested content.

[0108] Optionally, if not, an identity and authority verification failure message is returned to the client.

[0109] As an optional implementation, the format conversion may include parameter desensitization processing and value conversion.

[0110] In this embodiment, after the target database is determined by the initial identification, identity authentication and permission verification are performed according to the identity information, thereby realizing unified management of identity authentication and permission verification, ensuring system security and legal access of users. If the verification is passed, the identification of the request content is formatted according to the first format corresponding to the target database, and the target identification of the request content is generated, thereby supporting complex parameter processing capabilities and adapting to various types of data processing requests under the premise of ensuring the integrity and validity of the request data.

[0111] Further, refer to Figure 5 The specific steps of performing identity authentication and authority verification according to the identity information in the above step S402 to determine whether the client has the authority to access the target database are introduced.

[0112] S501: Convert the identity information into a first format corresponding to a target database to generate target identity information.

[0113] Optionally, since the formats of the identity information provided by various clients are not uniform, in order to ensure uniform identity authentication, the format of the identity information in the request information is converted according to the first format corresponding to the target database.

[0114] S502: Obtain authorization information corresponding to the target database, where the authorization information includes: identity information that is allowed to access the target database.

[0115] Optionally, the identity information allowed to access the target database includes identity verification conditions and permission verification conditions.

[0116] As an optional implementation, the authorization information of each database may be format-converted to a unified third format, and then the identity information in the request information may be converted to the third format to obtain the target identity information.

[0117] S503: Match the target identity information with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has the authority to access the target database.

[0118] Optionally, if the match fails, an identity authentication failure message is returned to the client.

[0119] As an optional implementation, after matching the target identity information with the authorization information corresponding to the target database, an identity authentication credential may be generated for subsequent reference.

[0120] In this embodiment, the identity information is formatted in a first format corresponding to the target database to generate target identity information, obtain authorization information corresponding to the target database, and match the target identity information with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has permission to access the target database, thereby achieving unified management of identity authentication and permission verification.

[0121] As an optional implementation, the application programming interface gateway data processing method with identity authentication function may also include the following implementation:

[0122] Optionally, obtain the configuration information sent by the gateway management platform, which is generated by the gateway management platform based on the update instructions and load balancing strategy input by the user, and the load balancing strategy is used to indicate the API call sequence in the API gateway. Update the API according to the configuration information, adjust the API call sequence of the API gateway, and generate an API configuration log.

[0123] Among them, users can learn about the current online APIs and offline APIs, as well as the working status of each API, and send update instructions through the gateway management platform. The update instructions are used to instruct the gateway management platform to manage each API. The management content includes updating and upgrading API routes, parameters and load balancing strategies, as well as publishing and deleting APIs.

[0124] As an optional implementation method, the API forwarding configuration can be modified online and activated through the gateway management platform.

[0125] It is worth noting that when users perform online hot configuration of APIs through the gateway management platform, it will not affect the normal operation of other APIs.

[0126] Optionally, a load balancing strategy can be used to dynamically distribute requests to the collection platform through the API based on different load and performance indicators.

[0127] Optionally, the API configuration log may include usage records, change records, change content, etc. of each API for user reference.

[0128] In this embodiment, by obtaining the configuration information sent by the gateway management platform, updating the API according to the configuration information, adjusting the API call order of the API gateway, and generating an API configuration log, flexible configuration management is provided without affecting the requests being processed, thereby ensuring the availability of the system.

[0129] As an optional implementation, the API gateway data processing method with identity authentication function also includes the following implementation:

[0130] Optionally, according to a preset security control policy, the returned result is encrypted and the encrypted returned result is sent to the client.

[0131] The preset security control policy may be based on the encryption requirements set by the client or the target database. Each client or target database may be set with an independent preset security control policy.

[0132] Exemplarily, the encryption settings may include verification, filtering, and the like.

[0133] As an optional implementation, after encryption is completed, an encryption log may be generated for review.

[0134] In this embodiment, by encrypting the results to be returned, the security of the data sent to the client can be guaranteed and leakage of sensitive information can be avoided.

[0135] As an optional implementation, according to a preset security control policy, the process of encrypting the result to be returned may include: determining whether the result to be returned is binary data, and if so, filtering the result to be returned and adding a watermark.

[0136] Optionally, when the request information is used to request binary data, since the amount of binary data is large, the binary data needs to be filtered to filter out sensitive information or irrelevant information.

[0137] Optionally, to ensure data security, a watermark may be added to binary data, such as a picture or document.

[0138] In this embodiment, by filtering the binary data and adding a watermark, the forwarding efficiency is improved while ensuring data security.

[0139] As an optional implementation, before sending the result to be returned to the client, the following steps may also be included:

[0140] Optionally, send a reply request to the client.

[0141] Optionally, after the result to be returned is generated, a reply request may be sent to the client to determine whether the client is qualified to accept the result to be returned.

[0142] Optionally, receive reply request response information sent by the client.

[0143] Optionally, if the client is qualified to receive the result to be returned, a reply request response message is sent to the API gateway.

[0144] As an optional implementation, if no reply request response information is received within a preset time period, the result to be returned is not sent.

[0145] In this embodiment, by sending reply information to the client and receiving reply request response information, the result to be returned can be sent while the client is online, thereby ensuring data security.

[0146] Based on the same inventive concept, an embodiment of the present application also provides an application programming interface gateway data processing device with an identity authentication function corresponding to the application programming interface gateway data processing method with an identity authentication function. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned application programming interface gateway data processing method with an identity authentication function in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0147] Reference Figure 6 As shown, it is a structural schematic diagram of an application programming interface gateway data processing device with identity authentication function provided in an embodiment of the present application, the device includes: a receiving module 601, a first conversion module 602, a sending module 603 and a second conversion module 604; wherein:

[0148] The receiving module 601 is used to receive the request information sent by the client, wherein the request information includes the identity information and the initial identification of the request content;

[0149] A first conversion module 602 is used to determine a target database in a collection platform according to the identity information and the initial identifier of the request content, and to convert the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content, wherein the collection platform includes multiple databases;

[0150] The sending module 603 is used to determine at least one target application programming interface according to the current application programming interface calling sequence in the application programming interface gateway, and send the target identifier to the collection platform through the at least one target application programming interface, and the collection platform obtains result data from the target database according to the target identifier, and sends the result data to the application programming interface gateway;

[0151] The second conversion module 604 is used to convert the format of the result data according to the second format corresponding to the client to obtain the result to be returned, and send the result to be returned to the client.

[0152] Optionally, the first conversion module 602 is specifically configured to:

[0153] Determining the target database according to the initial identifier;

[0154] Perform identity authentication and authority verification based on the identity information to determine whether the client has the authority to access the target database;

[0155] If so, the identifier of the requested content is formatted according to the first format corresponding to the target database to generate a target identifier of the requested content.

[0156] Optionally, the first conversion module 602 is specifically configured to:

[0157] Convert the identity information into a first format corresponding to the target database to generate target identity information;

[0158] Acquire authorization information corresponding to the target database, the authorization information including: identity information allowing access to the target database;

[0159] The target identity information is matched with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has the authority to access the target database.

[0160] Optionally, the first conversion module 602 is further configured to:

[0161] Acquire configuration information sent by a gateway management platform, wherein the configuration information is generated by the gateway management platform based on an update instruction input by a user and a load balancing strategy, wherein the load balancing strategy is used to indicate an application programming interface call sequence in the application programming interface gateway;

[0162] The application programming interface is updated according to the configuration information, the application programming interface calling sequence of the application programming interface gateway is adjusted, and an application programming interface configuration log is generated.

[0163] Optionally, the second conversion module 604 is specifically configured to:

[0164] According to the preset security control policy, the result to be returned is encrypted and the encrypted return result is sent to the client.

[0165] Optionally, the second conversion module 604 is specifically configured to:

[0166] Determine whether the result to be returned is binary data;

[0167] If so, the result to be returned is filtered and a watermark is added.

[0168] Optionally, the second conversion module 604 is further configured to:

[0169] Sending a reply request to the client;

[0170] Receive the reply request response information sent by the client.

[0171] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0172] The present application also provides an electronic device, such as Figure 7 , which is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, includes: a processor 701, a memory 702 and a bus. The memory 702 stores machine-readable instructions executable by the processor 701 (for example, Figure 6 The receiving module 601, the first conversion module 602, the sending module 603 and the second conversion module 604 in the device are respectively used for executing the execution instructions, etc.), when the computer device is running, the processor 61 communicates with the memory 702 through a bus, and when the machine-readable instructions are executed by the processor 61, the above-mentioned application programming interface gateway data processing method with identity authentication function is executed.

[0173] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned application programming interface gateway data processing method with identity authentication function are executed.

[0174] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0175] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0176] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A method for processing data of an application programming interface gateway with identity authentication function, characterized in that: The method is applied to an application programming interface gateway, and the method comprises: Receive request information sent by the client, the request information including identity information and an initial identifier of the request content; Determine a target database in a collection platform according to the identity information and the initial identifier of the request content, and convert the format of the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content, wherein the collection platform includes multiple databases; Determine at least one target application programming interface according to the current application programming interface call sequence in the application programming interface gateway, and send the target identifier to the collection platform through the at least one target application programming interface, and the collection platform obtains result data from the target database according to the target identifier, and sends the result data to the application programming interface gateway; The result data is format-converted according to a second format corresponding to the client to obtain a result to be returned, and the result to be returned is sent to the client.

2. The method for processing data of an application programming interface gateway with identity authentication function according to claim 1, characterized in that: The step of determining a target database in a collection platform according to the identity information and the initial identifier of the request content, and converting the initial identifier of the request content according to a first format corresponding to the target database to generate a target identifier of the request content includes: Determining the target database according to the initial identifier; Perform identity authentication and authority verification based on the identity information to determine whether the client has the authority to access the target database; If so, the identifier of the requested content is formatted according to the first format corresponding to the target database to generate a target identifier of the requested content.

3. The method for processing data of an application programming interface gateway with identity authentication function according to claim 2, characterized in that: The performing identity authentication and authority verification according to the identity information to determine whether the client has the authority to access the target database includes: Convert the identity information into a first format corresponding to the target database to generate target identity information; Acquire authorization information corresponding to the target database, the authorization information including: identity information allowing access to the target database; The target identity information is matched with the authorization information corresponding to the target database. If the match is successful, it is determined that the client has the authority to access the target database.

4. The method for processing data of an application programming interface gateway with identity authentication function according to claim 1, characterized in that: The method further comprises: Acquire configuration information sent by a gateway management platform, wherein the configuration information is generated by the gateway management platform based on an update instruction input by a user and a load balancing strategy, wherein the load balancing strategy is used to indicate an application programming interface call sequence in the application programming interface gateway; The application programming interface is updated according to the configuration information, the application programming interface calling sequence of the application programming interface gateway is adjusted, and an application programming interface configuration log is generated.

5. The method for processing data of an application programming interface gateway with identity authentication function according to claim 1, characterized in that: The sending the result to be returned to the client includes: According to the preset security control policy, the result to be returned is encrypted and the encrypted return result is sent to the client.

6. The method for processing data of an application programming interface gateway with identity authentication function according to claim 5, characterized in that: The step of encrypting the result to be returned according to the preset security control strategy includes: Determine whether the result to be returned is binary data; If so, the result to be returned is filtered and a watermark is added.

7. The method for processing data of an application programming interface gateway with identity authentication function according to claim 1, characterized in that: Before sending the result to be returned to the client, the method further includes: Sending a reply request to the client; Receive the reply request response information sent by the client.

8. A data processing system, characterized in that the system comprises: The application programming interface gateway, gateway management platform, collection platform and client according to any one of claims 1 to 7; The application programming interface gateway is respectively connected to the gateway management platform, the acquisition platform and the client for communication; The application programming interface gateway is used to perform data processing based on the method steps described in any one of claims 1-7.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-readable instructions to perform the steps of the application programming interface gateway data processing method with identity authentication function as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the application programming interface gateway data processing method with identity authentication function as claimed in any one of claims 1 to 7 are executed.

Images