Method and system for realizing interface encryption calling and storage medium

Abstract

The invention discloses a method and a system for realizing interface encryption calling, and a storage medium. The method comprises the following steps: regularly updating a master key according to time; generating a temporary key according to a master key of the API, and adding the temporary key to a request header of the proxy request; performing anomaly detection on API calling; if the API calling condition does not accord with the preset condition, the API calling is withdrawn, and an alarm is given, so that the safety of the API calling is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network communication, and in particular to a method, system and storage medium for implementing interface encryption calling. Background Art

[0002] API is an application programming interface, which is a set of predefined functions, protocols and tools for building software applications. API defines how different software components communicate with each other, allowing developers to access the functions or data of a specific service or application without having to understand its underlying implementation details.

[0003] In the daily software development process, APIs are called by developers in large quantities because of their good encapsulation. When third-party APIs are used in web applications, the API keys will be exposed, which may cause the system to be attacked, thus affecting security. Summary of the invention

[0004] To achieve the above purpose and other related purposes, the present invention discloses a method for implementing interface encryption calling, comprising: Update the master key regularly according to time; Generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; Perform anomaly detection on API calls; If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

[0005] Furthermore, the periodic updating of the master key includes: NewMasterKey=BLAKE3(OldMasterKey||CurrentTime||ServerSecret,OutputLength); Among them, NewMasterKey is the updated master key, OldMasterKey is the master key before the update, BLAKE3 is a high-speed encryption function, CurrentTime is the current time, ServerSecret is the security key used in the server configuration, || is a string concatenation operation, and OutputLength is the set output key length.

[0006] Furthermore, generating a temporary key according to the master key of the API includes: TempKey=Argon2(MasterKey⊕(Timestamp>>4)⊕Nonce,Rounds,Memory) Among them: MasterKey is the master key, Timestamp is the current timestamp, Nonce is a one-time random number, ⊕ is an XOR operation, >> is a bit right shift operation, Argon2 is a memory-hard hash function, Rounds is the number of hash iterations, and Memory is the amount of memory used.

[0007] Furthermore, the abnormality detection of the API call includes: AnomalyScore=tanh(α*RF+β*log(1+RP)+γ*IPEntropy) Among them, AnomalyScore is the detection score, RF is the request frequency, RP is the request pattern complexity, IPEntropy is the information entropy of the client IP address, α, β, γ are adjustment parameters, and tanh() is the hyperbolic tangent function used for normalization.

[0008] Furthermore, the abnormality detection of the API call includes: When the AnomalyScore is greater than the preset detection threshold, the API call is abnormal.

[0009] On the other hand, the present invention provides a system for implementing interface encryption calling, comprising: A key update module is used to update the master key regularly according to time; A temporary key generation module is used to generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; The anomaly detection module is used to perform anomaly detection on API calls. If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

[0010] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the program implements the above-described method when executed by a processor.

[0011] By adopting the above technical solution, the master key is first updated regularly according to time, and a temporary key is generated according to the master key of the API, and the temporary key is added to the request header of the proxy request. The security of the API call is increased by regularly replacing the master key and generating a temporary key according to the master key; then, the API call is detected for anomalies. When the API call is abnormal, the API call is withdrawn and an alarm is issued, which is convenient for developers to detect the call situation and further improves security. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0013] Figure 1 The present invention is a flowchart of a method for implementing interface encryption calling. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0015] Reference Figure 1 The embodiment of the present invention provides a method for implementing interface encryption calling, comprising the following steps: S1: Update the master key regularly according to time; S2: Generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; S3: Perform anomaly detection on API calls. If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

[0016] The updating of the master key according to time in S1 includes: NewMasterKey=BLAKE3(OldMasterKey||CurrentTime||ServerSecret,OutputLength); Among them, NewMasterKey is the updated master key, OldMasterKey is the master key before the update, BLAKE3 is a high-speed encryption function, CurrentTime is the current time, ServerSecret is the security key used in the server configuration, || is a string concatenation operation, OutputLength is the set output key length, and the specific rotation time is set by those skilled in the art according to actual conditions, which will not be repeated here.

[0017] By adopting the above technical solution, the master key is rotated and updated. Even if the master key is leaked in a certain period of time, it will be replaced in the subsequent rotation, which significantly reduces the risk of key leakage and improves the long-term security of the system. Blake3 is a high-speed encryption function, which is faster and more secure than existing hash functions such as MD5, SHA-1, SHA-2, SHA-3 and BLAKE2, and has higher algorithm versatility and more optimized calculation process, which further improves the security of the API call process.

[0018] The temporary key generated by S2 based on the API master key includes: TempKey=Argon2(MasterKey⊕(Timestamp>>4)⊕Nonce,Rounds,Memory) Among them: MasterKey is the master key, Timestamp is the current timestamp, Nonce is a one-time random number, ⊕ is an XOR operation, >> is a bit right shift operation, Argon2 is a memory-hard hash function, Rounds is the number of hash iterations, and Memory is the amount of memory used.

[0019] By adopting the above technical solution, the temporary key is generated using the Argon2 memory-difficult hash function. Argon2 is an advanced cryptographic hash function that provides a variety of configurable parameters to resist attacks in modern computing environments, increasing the difficulty of cracking. It is one of the most secure cryptographic hash functions currently available and can resist various attacks. When the temporary key is cracked, the master key cannot be reversely cracked. This is used in conjunction with the master key rotation method to further improve the security of the key and the system.

[0020] The abnormal detection of API calls in S3 includes: AnomalyScore=tanh(α*RF+β*log(1+RP)+γ*IPEntropy) Among them, AnomalyScore is the detection score, RF is the call request frequency, RP is the call request pattern complexity, IPEntropy is the information entropy of the client IP address, α, β, γ are adjustment parameters, which are set by technical personnel in this field according to actual conditions, and tanh() is a hyperbolic tangent function used for normalization.

[0021] In the above, RF is the number of API requests from the same source in a specific time period, and RP reflects the diversity and complexity of API call patterns. In this embodiment, the concept of information entropy is used to quantify the complexity: RP=-∑(pi*log2(pi)) Where pi is the probability of the i-th request pattern occurring.

[0022] For example, suppose we observe the following request pattern: GET / users:40% POST / orders:30% PUT / products:20% DELETE / comments:10% Then: RP=-(0.4log2(0.4)+0.3log2(0.3)+0.2log2(0.2)+0.1log2(0.1))≈1.85.

[0023] Higher RP values ​​indicate more diverse and complex request patterns, which is usually consistent with normal API usage, while abnormally low RP values ​​may indicate repetitive attacks or abnormal behavior. RF and RP work together to help the system more comprehensively evaluate API call behavior. High frequency (high RF) with low complexity (low RP) may indicate potential attack behavior, while high frequency with high complexity may be normal high-intensity use.

[0024] Furthermore, the abnormality detection of the API call includes: When the AnomalyScore is greater than the preset detection threshold, the API call is abnormal.

[0025] In this embodiment, the preset detection threshold is set to a dynamic value when: When AnomalyScore>μ+2σ, it means that the API call is abnormal.

[0026] Among them, μ is the mean value of AnomalyScore, σ is the standard deviation of AnomalyScore By adopting the above technical solutions, the system's adaptability and proactive defense capabilities are improved. Suspicious API call requests are automatically revoked based on dynamic thresholds, so that timely actions can be taken before security threats expand, minimizing potential losses.

[0027] An embodiment of the present invention provides a method for implementing interface encryption calls. First, the master key is updated regularly according to time, and a temporary key is generated according to the master key of the API, and the temporary key is added to the request header of the proxy request. The security of the API call is increased by regularly replacing the master key and generating a temporary key according to the master key; then, the API call situation is detected for abnormalities. When the API call situation is abnormal, the API call is withdrawn and an alarm is issued, which is convenient for developers to detect the call situation and further improves security.

[0028] An embodiment of the present invention further provides a system for implementing interface encryption calling, comprising: A key update module is used to update the master key regularly according to time; A temporary key generation module is used to generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; The anomaly detection module is used to perform anomaly detection on API calls. If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

[0029] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0030] Those skilled in the art will appreciate that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined.

[0031] For the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0032] It can be known from the description of the above implementation modes that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute the methods described in the various implementation modes of the present application or certain parts of the implementation modes.

[0033] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for implementing interface encryption calling, characterized in that: include: Update the master key regularly according to time; Generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; Perform anomaly detection on API calls; If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

2. The method according to claim 1, characterized in that The periodic updating of the master key comprises: NewMasterKey=BLAKE3(OldMasterKey||CurrentTime||ServerSecret,OutputLength); Among them, NewMasterKey is the updated master key, OldMasterKey is the master key before the update, BLAKE3 is a high-speed encryption function, CurrentTime is the current time, ServerSecret is the security key used in the server configuration, || is a string concatenation operation, and OutputLength is the set output key length.

3. The method according to claim 1, characterized in that Generating a temporary key according to the API master key includes: TempKey=Argon2(MasterKey⊕(Timestamp>>4)⊕Nonce,Rounds,Memory) Among them: MasterKey is the master key, Timestamp is the current timestamp, Nonce is a one-time random number, ⊕ is an XOR operation, >> is a bit right shift operation, Argon2 is a memory-hard hash function, Rounds is the number of hash iterations, and Memory is the amount of memory used.

4. The method according to claim 1, characterized in that: The abnormality detection of API calls includes: AnomalyScore=tanh(α*RF+β*log(1+RP)+γ*IPEntropy) Among them, AnomalyScore is the detection score, RF is the request frequency, RP is the request pattern complexity, IPEntropy is the information entropy of the client IP address, α, β, γ are adjustment parameters, and tanh() is the hyperbolic tangent function used for normalization.

5. The method according to claim 4, characterized in that The abnormality detection of API calls includes: When the AnomalyScore is greater than the preset detection threshold, the API call is abnormal.

6. A system for implementing interface encryption calling, characterized in that: include: A key update module is used to update the master key regularly according to time; A temporary key generation module is used to generate a temporary key based on the API master key and add the temporary key to the request header of the proxy request; The anomaly detection module is used to perform anomaly detection on API calls. If the API call situation does not match the preset situation, the API call will be withdrawn and an alarm will be issued.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method described in any one of claims 1 to 5 is implemented.

Images