Method and device for docking data security sandbox with API (Application Program Interface) data source, medium and equipment

Abstract

The invention provides a method and device for docking a data security sandbox with an API (Application Program Interface) data source, a medium and equipment. The method comprises the following steps: connecting an API (Application Program Interface) required to be called by a data user, and obtaining sample data through the API; carrying out desensitization treatment; acquiring sample data in the database in the debugging environment as simulation data, processing the simulation data by using the user code, and returning a processing result to the user, so that the user modifies the user code until the processing result obtained by processing the simulation data by using the modified user code meets the first user requirement, submitting the user code to a running environment; acquiring real data in the operation environment, and processing the real data by using the user code; auditing operation data generated in the execution process of the user code in the operation environment; and if the auditing result meets the security requirement and the compliance standard, providing a downloading channel of the processing result generated by the operation environment. According to the invention, the safety can be improved.

Description

Technical Field

[0001] The present invention relates to the field of resource access technology, and in particular to a method, device, medium and equipment for docking a data security sandbox with an API data source. Background Art

[0002] In the process of connecting to API data sources, security is a crucial consideration. Since API involves the transmission and access of data, a series of security measures must be taken to ensure that only authorized users can access specific API resources. Summary of the invention

[0003] In response to at least one of the above technical problems, an embodiment of the present invention provides a method, device, medium, and equipment for connecting a data security sandbox to an API data source.

[0004] According to a first aspect, a method for connecting a data security sandbox to an API data source provided by an embodiment of the present invention is performed by a data security sandbox, and the method includes:

[0005] Connect to the API interface that the data user needs to call, and obtain sample data through the API interface;

[0006] Check whether there is sensitive data in the sample data; if so, desensitize the sensitive data and store the desensitized sample data in the database; if not, store the sample data in the database;

[0007] In the debugging environment, sample data in the database is obtained, the obtained sample data is used as simulation data, the simulation data is processed by the user code, and the obtained processing result is returned to the user, so that the user can modify the user code according to the processing result, until the processing result obtained by processing the simulation data by the modified user code meets the first user requirement, and the user code that meets the first user requirement is submitted to the running environment;

[0008] In the operating environment, real data is acquired, and the real data is processed by using the user code to obtain a processing result;

[0009] The operation data generated during the execution of the user code in the operation environment is audited to obtain an audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing results generated by the operation environment is provided so that the data user can download the processing results.

[0010] In one embodiment, the API interface that the connection data user needs to call to obtain sample data includes:

[0011] Provide a filling page so that the data user can fill in the basic information and authentication information of the API interface to be called;

[0012] Perform a connection test on the API interface according to the preset interface request parameters and the basic information filled in by the data user on the filling page, and perform an authentication operation on the API interface according to the authentication information during the connection test;

[0013] If the connection test is successful and the authentication is passed, the data returned by the API interface for the interface request parameters is used as sample data.

[0014] In one embodiment, before using the data returned by the API interface for the interface request parameters as sample data, the method also includes: determining whether the data returned by the API interface for the interface request parameters meets the second user requirements; if not, modifying the interface request parameters until the data returned by the API interface for the modified interface request parameters meets the second user requirements.

[0015] In one embodiment, obtaining the sample data in the database includes: obtaining the sample data in the database by calling a first adapter; wherein the first adapter is used to obtain the sample data in the database according to request parameters in the debugging environment.

[0016] In one embodiment, the obtaining of the real data includes: obtaining the real data by calling a second adapter; wherein the second adapter is used to obtain the real data according to request parameters in the operating environment.

[0017] In one embodiment, auditing the operation data generated during the execution of the user code in the operation environment to obtain the audit result includes:

[0018] Using automated tools to review operational data generated during the execution of the user code to identify potential security risks and compliance issues;

[0019] If a potential security risk and / or compliance issue is identified through an automated tool, the identified potential security risk and / or compliance issue is sent to the user so that the user can determine the nature and severity of the potential security risk and / or compliance issue;

[0020] Generate an audit report based on the identified potential security risks and / or compliance issues, their nature, severity and suggested solutions, and use the audit report as the audit outcome;

[0021] Correspondingly, the method further includes: sending the audit report to the data user.

[0022] In one embodiment, the method further includes: obtaining download status of the processing result by the data user through a feedback mechanism.

[0023] According to a second aspect, a device for connecting a data security sandbox to an API data source provided by an embodiment of the present invention is deployed on a data security sandbox, and the device includes:

[0024] The interface access module is used to connect to the API interface that the data user needs to call and obtain sample data through the API interface;

[0025] A data checking module is used to check whether there is sensitive data in the sample data; if so, desensitize the sensitive data and store the desensitized sample data in a database; if not, store the sample data in the database;

[0026] A code debugging module is used to obtain sample data in the database in a debugging environment, use the obtained sample data as simulation data, process the simulation data using user code, and return the obtained processing result to the user, so that the user can modify the user code according to the processing result, until the processing result obtained after the simulation data is processed using the modified user code meets the first user requirement, and submit the user code that meets the first user requirement to the running environment;

[0027] A code running module, used for acquiring real data in the running environment, and processing the real data using the user code to obtain a processing result;

[0028] The audit analysis module is used to audit the operating data generated during the execution of the user code in the operating environment to obtain an audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing results generated by the operating environment is provided to enable the data user to download the processing results.

[0029] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method provided in the first aspect.

[0030] According to a fourth aspect, an embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0031] The method, device, medium and equipment for docking the data security sandbox with the API data source provided by the embodiment of the present invention first connects the API interface that the data user needs to call, obtains sample data through the API interface, and then performs desensitization processing, and stores the desensitized sample data in the database. In the debugging environment, the sample data in the database is obtained, the obtained sample data is used as simulation data, the simulation data is processed by the user code, and the obtained processing result is returned to the user, so that the user modifies the user code according to the processing result until the processing result obtained by processing the simulation data with the modified user code meets the first user requirement, and the user code that meets the first user requirement is submitted to the operating environment; in the operating environment, real data is obtained, and the real data is processed by the user code to obtain the processing result; the operating data generated during the execution of the user code in the operating environment is audited to obtain the audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing result generated by the operating environment is provided so that the data user can download the processing result. Since the embodiment of the present invention is implemented by the data security sandbox, the security of the entire process can be improved. Moreover, the API interface is made “available but invisible” during the computing process, meeting the need for data privacy protection and ensuring that the API interface can avoid the risk of data leakage and illegal access during the calling and interaction process. Sample data is used during the debugging phase, and only real data is used in the operating environment, which can further reduce the risk of real data leakage and misoperation. Moreover, the embodiment of the present invention adds an audit mechanism to the operating environment to ensure compliance and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of a process for connecting a data security sandbox to an API data source in one embodiment of the present invention;

[0033] Figure 2 It is a structural block diagram of a device for connecting a data security sandbox to an API data source in one embodiment of the present invention. DETAILED DESCRIPTION

[0034] In a first aspect, an embodiment of the present invention provides a method for connecting a data security sandbox to an API data source, the method being executed by the data security sandbox, see Figure 1 The method comprises the following steps S110 to S150:

[0035] S110, connecting to the API interface that the data user needs to call, and obtaining sample data through the API interface;

[0036] In one embodiment, the connection data user in S110 needs to call an API interface, and obtains sample data through the API interface, which may include the following three steps 11 to 13:

[0037] 11. Provide a filling page so that the data user can fill in the basic information and authentication information of the API interface to be called;

[0038] Among them, basic information, such as URL, name, etc.

[0039] The authentication information includes, for example, whether the authentication strategy is token authentication or key authentication.

[0040] 12. Perform a connection test on the API interface according to the preset interface request parameters and the basic information filled in by the data user on the filling page, and perform an authentication operation on the API interface according to the authentication information during the connection test;

[0041] 13. If the connection test is successful and the authentication is passed, the data returned by the API interface for the interface request parameters is used as sample data.

[0042] That is to say, a connection request is generated based on the interface request parameters, and the connection request is sent to the API interface according to the basic information of the API interface, thereby trying to connect to the API interface. If the connection is successful, the authentication operation is performed using the authentication information. If the authentication is successful, the return data of the API interface is used as sample data. Among them, the data returned by the API interface is the query data returned based on the interface request parameters.

[0043] Of course, if the connection is not successful, modify the interface request parameters until you can successfully connect to the API interface using the modified interface request parameters and receive the returned query data.

[0044] In one embodiment, before using the data returned by the API interface for the interface request parameter as sample data, the method may further include:

[0045] Determine whether the data returned by the API interface for the interface request parameters meets the second user requirements; if not, modify the interface request parameters until the data returned by the API interface for the modified interface request parameters meets the second user requirements.

[0046] The second user requires, for example, that the returned data cannot be empty. If the user's interface request parameter is a parameter for accessing the first page of the database data table, but the returned data is empty, the interface request parameter can be modified to a parameter for accessing the second page of the database data table.

[0047] It can be seen that S110 can verify the legitimacy and security of the API interface through connection testing. Through preset authentication strategies, such as key authentication and token authentication, it ensures that only authenticated API interfaces can be connected to the security sandbox.

[0048] S120, checking whether there is sensitive data in the sample data; if so, desensitizing the sensitive data and storing the desensitized sample data in a database; if not, storing the sample data in the database;

[0049] Specifically, a prefabricated algorithm can be used to scan sample data to check whether the sample data contains sensitive data. If sensitive data is contained, desensitization is performed. Different desensitization rules can be used to desensitize different sensitive data, and the desensitized data is temporarily stored in the database.

[0050] Specifically, reliable data storage technology can be used to ensure the reliability and integrity of data. Considering that the sample data format is not unique, the database used can be hive. Hive is a data warehouse tool based on Hadoop, which is used for data extraction, transformation, and loading. It is a mechanism that can store, query, and analyze large-scale data stored in Hadoop.

[0051] Of course, in addition to desensitizing, the received data can also be processed and analyzed, including data cleaning, conversion, aggregation and other operations.

[0052] S130, in the debugging environment, obtaining sample data from the database, using the obtained sample data as simulation data, processing the simulation data using the user code, and returning the obtained processing result to the user, so that the user can modify the user code according to the processing result, until the processing result obtained after processing the simulation data using the modified user code meets the first user requirement, and submitting the user code that meets the first user requirement to the running environment;

[0053] In one embodiment, obtaining the sample data in the database may include: obtaining the sample data in the database by calling a first adapter; wherein the first adapter is used to obtain the sample data in the database according to request parameters in the debugging environment.

[0054] It can be seen that a first adapter is written, installed and run in the debugging environment. When the first adapter is called, the first adapter can obtain sample data in the database, thereby ensuring that the sample data after S120 is applied in the debugging environment.

[0055] The user code refers to a user-defined code having a customized function, such as a code for the accumulated value of statistical data, a code for the average value of statistical data, etc. Different user codes have different functions.

[0056] Among them, in S130, the simulation data is processed by the user code to obtain the processing result, and then the processing result is returned to the user, so that the user can know whether the processing result meets his first user requirement, for example, whether the processing result corresponding to the user code used to calculate the average value calculates the average value of the simulation data. If it does not meet the first user requirement, the user needs to modify the user code, and after the modification, the simulation data is processed by the modified user code, and whether the processing result meets the first user requirement is judged again. This is repeated until the processing result obtained by processing the simulation data by the modified user code meets the first user requirement, so that the user code required by the first user is submitted to the running environment.

[0057] It can be seen that the purpose of S130 is to continuously modify and debug the user code in the debugging environment, so as to obtain the user code that meets the requirements.

[0058] S140, acquiring real data in the operating environment, and processing the real data using the user code to obtain a processing result;

[0059] In one embodiment, obtaining real data may include:

[0060] The real data is obtained by calling the second adapter; wherein the second adapter is used to obtain the real data according to the request parameters in the operating environment.

[0061] The second adapter can modify parameters based on the first adapter, so there is no need to rewrite the second adapter.

[0062] The second adapter can obtain real data when called, so that the user code can process the obtained real data in the running environment to obtain the processing result of the real data, thus realizing "data remains unchanged but program moves", ensuring the security of real data.

[0063] S150. Audit the operating data generated during the execution of the user code in the operating environment to obtain an audit result; if the audit result meets the security requirements and compliance standards, provide a download channel for the processing results generated by the operating environment so that the data user can download the processing results.

[0064] It is understood that the generated operation data is audited to ensure that the operations performed and the results generated in the sandbox environment meet the preset security and compliance standards. If the operation results meet the security requirements and compliance standards, the data user can download the results.

[0065] Among them, the review methods may include automatic tool review and manual review.

[0066] In one embodiment, the auditing of the operation data generated during the execution of the user code in the operation environment to obtain the audit result in S150 may include:

[0067] 21. Use automated tools to review operational data generated during the execution of the user code to identify potential security risks and compliance issues;

[0068] Among them, operation data may include system logs, application logs, network traffic, etc.

[0069] Among them, automated tools are used to batch process and audit sandbox operation data to improve audit efficiency and accuracy and identify potential security risks and compliance issues.

[0070] 22. If potential security risks and / or compliance issues are identified through automated tools, the identified potential security risks and / or compliance issues are sent to users to enable them to determine the nature and severity of the potential security risks and / or compliance issues;

[0071] Among them, in-depth analysis and investigation are carried out manually to determine the nature and severity of the problem.

[0072] Of course, the results of manual review can also be fed back to the automated tool to expand the review mechanism of the automated tool.

[0073] 23. Generate an audit report based on the identified potential security risks and / or compliance issues, their nature, severity and proposed solutions, and use the audit report as the audit result;

[0074] It can be seen that the audit results are presented in the form of a report, including the problems found, the nature and severity of the problems, and the recommended solutions.

[0075] Correspondingly, the method further includes: sending the audit report to the data user.

[0076] It is understandable that if the automated tool does not identify potential security risks and compliance issues, the data user can download the processing results generated by the operating environment. If the automated tool identifies potential security risks and compliance issues, the nature and severity are determined through manual review, and then an audit report is generated and returned to the data user. At this time, the data user cannot download the processing results generated by the operating environment.

[0077] In one embodiment, the method may further include: obtaining download status of the processing result by the data user through a feedback mechanism.

[0078] The download status may include the number and time of result downloads, thereby understanding the status and results of data usage.

[0079] It is understandable that the API data source in this solution refers to the API interface.

[0080] It is understandable that the method provided by the embodiment of the present invention can be executed by a data security sandbox. Among them, the data security sandbox provides a restricted execution environment for performing operations related to the data returned by the API interface, which helps prevent malicious code or unauthorized operations from damaging the system. By limiting the operations on the data returned by the API interface to the sandbox environment, even if security problems occur, their impact will be limited to a controllable range. In a sandbox environment, the API interface docking process generally includes steps such as API design, development, testing, and deployment. These steps need to be performed in a sandbox environment to ensure that the operations on the data returned by the API interface are verified and tested in a restricted environment.

[0081] It is understandable that the embodiment of the present invention provides a solution for connecting a data security sandbox to an API data source. The data security sandbox can provide a safe and reliable environment to implement testing, verification and interaction of API interfaces, thereby ensuring the security, privacy and compliance of data during transmission and processing. The embodiment of the present invention implements the "availability but invisibility" of API data sources during the calculation process, meeting the needs of data privacy protection. It ensures that the API interface can avoid the risk of data leakage and illegal access during the call and interaction process.

[0082] It is understandable that in the embodiments of the present invention, during the testing and development phase, developers and data users can safely and efficiently connect to API data sources without directly accessing the production environment, thereby reducing the risk of data leakage and misoperation. In addition, the embodiments of the present invention add an audit mechanism to the operating environment to ensure compliance and security. Adapters are also added to the operating environment and the debugging environment, so that the debugging environment accesses sample data, while the operating environment accesses real data.

[0083] It is understandable that the present invention connects the API data source in the data security sandbox, which makes it easier to integrate data from different sources into a unified security environment for processing, improves the fluidity and integration of data, and improves the user experience. After connecting to the API data source, since the API is usually equipped with a complete security mechanism, such as identity authentication, access control, data encryption, etc., it can ensure the security of data during transmission and interaction, further enhancing the protection capability of the data security sandbox.

[0084] In a second aspect, an embodiment of the present invention provides a device for connecting a data security sandbox to an API data source, wherein the device is deployed on the data security sandbox, see Figure 2 , the device 100 comprises:

[0085] The interface access module 110 is used to connect to the API interface that the data user needs to call and obtain sample data through the API interface;

[0086] The data checking module 120 is used to check whether there is sensitive data in the sample data; if so, desensitize the sensitive data and store the desensitized sample data in the database; if not, store the sample data in the database;

[0087] The code debugging module 130 is used to obtain sample data in the database in the debugging environment, use the obtained sample data as simulation data, process the simulation data using the user code, and return the obtained processing result to the user, so that the user can modify the user code according to the processing result, until the processing result obtained by processing the simulation data using the modified user code meets the first user requirement, and submit the user code that meets the first user requirement to the running environment;

[0088] A code running module 140 is used to obtain real data in the running environment, and process the real data using the user code to obtain a processing result;

[0089] The audit analysis module 150 is used to audit the operating data generated during the execution of the user code in the operating environment to obtain an audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing results generated by the operating environment is provided so that the data user can download the processing results.

[0090] In one embodiment, the interface access module is specifically used to: provide a filling page so that the data user can fill in the basic information and authentication information of the API interface to be called; perform a connection test on the API interface according to preset interface request parameters and the basic information filled in by the data user on the filling page, and perform an authentication operation on the API interface according to the authentication information during the connection test; if the connection test is successful and the authentication passes, the data returned by the API interface for the interface request parameters is used as sample data.

[0091] In one embodiment, before using the data returned by the API interface for the interface request parameters as sample data, the interface access module can also be used to: determine whether the data returned by the API interface for the interface request parameters meets the second user requirements; if not, modify the interface request parameters until the data returned by the API interface for the modified interface request parameters meets the second user requirements.

[0092] In one embodiment, the obtaining of sample data in the database in the code debugging module includes: obtaining sample data in the database by calling a first adapter; wherein the first adapter is used to obtain sample data in the database according to request parameters in the debugging environment.

[0093] In one embodiment, the obtaining of real data in the code execution module includes: obtaining the real data by calling a second adapter; wherein the second adapter is used to obtain the real data according to request parameters in the execution environment.

[0094] In one embodiment, the audit analysis module audits the operating data generated during the execution of the user code in the operating environment to obtain an audit result, including: using an automated tool to audit the operating data generated during the execution of the user code to identify potential security risks and compliance issues; if potential security risks and / or compliance issues are identified by the automated tool, the identified potential security risks and / or compliance issues are sent to the user so that the user can determine the nature and severity of the potential security risks and / or compliance issues; based on the identified potential security risks and / or compliance issues, the nature, severity and suggested solutions, an audit report is generated, and the audit report is used as the audit result;

[0095] Correspondingly, the device further includes:

[0096] The audit notification module is used to send the audit report to the data user.

[0097] In one embodiment, the apparatus further comprises:

[0098] The download feedback module is used to obtain the download status of the processing result by the data user through a feedback mechanism.

[0099] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0100] In a third aspect, an embodiment of the present invention provides a computer-readable medium, on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0101] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0102] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0103] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0104] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0105] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0106] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0107] In a fourth aspect, an embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any embodiment of the specification.

[0108] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0109] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0110] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0111] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for connecting a data security sandbox to an API data source, characterized in that: The method is performed by a data security sandbox, and the method includes: Connect to the API interface that the data user needs to call, and obtain sample data through the API interface; Check whether there is sensitive data in the sample data; if so, desensitize the sensitive data and store the desensitized sample data in the database; if not, store the sample data in the database; In the debugging environment, sample data in the database is obtained, the obtained sample data is used as simulation data, the simulation data is processed by the user code, and the obtained processing result is returned to the user, so that the user can modify the user code according to the processing result, until the processing result obtained by processing the simulation data by the modified user code meets the first user requirement, and the user code that meets the first user requirement is submitted to the running environment; In the operating environment, real data is acquired, and the real data is processed by using the user code to obtain a processing result; The operation data generated during the execution of the user code in the operation environment is audited to obtain an audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing results generated by the operation environment is provided so that the data user can download the processing results.

2. The method according to claim 1, characterized in that The API interface that the connection data user needs to call to obtain sample data includes: Provide a filling page so that the data user can fill in the basic information and authentication information of the API interface to be called; Perform a connection test on the API interface according to the preset interface request parameters and the basic information filled in by the data user on the filling page, and perform an authentication operation on the API interface according to the authentication information during the connection test; If the connection test is successful and the authentication is passed, the data returned by the API interface for the interface request parameters is used as sample data.

3. The method according to claim 2, characterized in that Before using the data returned by the API interface for the interface request parameters as sample data, the method further includes: Determine whether the data returned by the API interface for the interface request parameters meets the second user requirements; if not, modify the interface request parameters until the data returned by the API interface for the modified interface request parameters meets the second user requirements.

4. The method according to claim 1, characterized in that: The obtaining of sample data in the database includes: The sample data in the database is acquired by calling the first adapter; wherein the first adapter is used to acquire the sample data in the database according to the request parameters in the debugging environment.

5. The method according to claim 1, characterized in that The obtaining of real data comprises: The real data is obtained by calling the second adapter; wherein the second adapter is used to obtain the real data according to the request parameters in the operating environment.

6. The method according to claim 1, characterized in that The auditing of the operation data generated during the execution of the user code in the operation environment to obtain the audit result includes: Using automated tools to review operational data generated during the execution of the user code to identify potential security risks and compliance issues; If a potential security risk and / or compliance issue is identified through an automated tool, the identified potential security risk and / or compliance issue is sent to the user so that the user can determine the nature and severity of the potential security risk and / or compliance issue; Generate an audit report based on the identified potential security risks and / or compliance issues, their nature, severity and suggested solutions, and use the audit report as the audit outcome; Correspondingly, the method further includes: sending the audit report to the data user.

7. The method according to claim 6, characterized in that Also includes: The download status of the processing result by the data user is obtained through a feedback mechanism.

8. A device for connecting a data security sandbox to an API data source, characterized in that: The device is deployed on a data security sandbox, and includes: The interface access module is used to connect to the API interface that the data user needs to call and obtain sample data through the API interface; A data checking module is used to check whether there is sensitive data in the sample data; if so, desensitize the sensitive data and store the desensitized sample data in a database; if not, store the sample data in the database; A code debugging module is used to obtain sample data in the database in a debugging environment, use the obtained sample data as simulation data, process the simulation data using user code, and return the obtained processing result to the user, so that the user can modify the user code according to the processing result, until the processing result obtained after the simulation data is processed using the modified user code meets the first user requirement, and submit the user code that meets the first user requirement to the running environment; A code running module, used for acquiring real data in the running environment, and processing the real data using the user code to obtain a processing result; The audit analysis module is used to audit the operating data generated during the execution of the user code in the operating environment to obtain an audit result; if the audit result meets the security requirements and compliance standards, a download channel for the processing results generated by the operating environment is provided to enable the data user to download the processing results.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that The method comprises a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images