Application programming interface detection method and device and storage medium

Abstract

The invention relates to an application programming interface detection method and device and a storage medium. The API detection method comprises the following steps: acquiring a first API request; deleting authentication information in the first API request to obtain a second API request; sending the second API request to a business server; receiving response information sent by the business server in response to the second API request; and if it is determined that the response information represents that the second API request is authenticated successfully, determining that the API is an API with an authentication defect. According to the method and the device, the authentication defect of the application programming interface is detected before information leakage occurs.

Description

Technical Field

[0001] The present disclosure relates to the field of data security, and in particular to an application programming interface detection method, device and storage medium. Background Art

[0002] With the development of society, the security requirements of application programming interfaces (APIs) in corporate business are getting higher and higher. If information leakage occurs, it will cause huge losses to the company. Therefore, it is necessary to detect APIs that may leak information. In related technologies, there are existing technologies such as web crawlers and business traffic monitoring that can detect API security. Pre-emptive protection against API information leakage has received widespread attention in the industry. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present disclosure provides an application programming interface detection method, device and storage medium.

[0004] According to a first aspect of an embodiment of the present disclosure, an application programming interface (API) detection method is provided, the method comprising: obtaining a first API request; deleting authentication information in the first API request to obtain a second API request; sending the second API request to a business service end; receiving response information sent by the business service end in response to the second API request; if it is determined that the response information indicates that the second API request is authenticated, determining that the API is an API with an authentication defect.

[0005] In one embodiment, obtaining the first API request includes: obtaining all access traffic of the business server through a gateway and / or an application firewall, and the business server is used to access the API; obtaining API access traffic based on the all access traffic; and obtaining the first API request based on the API access traffic.

[0006] In one implementation, the API access traffic includes: API request information and API response information, the API request information includes a request line, a request header, and a request body, and the API response information includes a response header and a response body.

[0007] In one implementation, deleting the authentication information in the API request includes: deleting key information identifying a legitimate identity in the API request and identity information of the client.

[0008] In one embodiment, determining that the response information represents that the second API request is authenticated includes: obtaining a response status code of the response information, and / or parsing an identification code of the response body in the response information; if the response status code is a first predefined value and / or the identification code is a second predefined value, determining that the response information represents that the second API request is authenticated.

[0009] According to a second aspect of an embodiment of the present disclosure, an application programming interface API detection device is provided, the device comprising: an acquisition unit, used to acquire a first API request, and to receive response information sent by a business service end in response to a second API request; a processing unit, used to delete the authentication information in the first API request, to obtain a second API request, and when it is determined that the response information indicates that the second API request is authenticated, to determine that the first API request is an API request with an authentication defect; and a sending unit, used to send the second API request to the business service end.

[0010] In one embodiment, the acquisition unit acquires the first API request in the following manner: acquiring all access traffic of a business server through a gateway and / or an application firewall, wherein the business server is used to access the API; acquiring API access traffic based on the all access traffic; and acquiring the first API request based on the API access traffic.

[0011] In one implementation, the API access traffic includes: API request information and API response information, the API request information includes a request line, a request header, and a request body, and the API response information includes a response header and a response body.

[0012] In one implementation, the processing unit deletes the authentication information in the API request in the following manner: deleting the key information identifying the legal identity in the API request and the identity information of the client.

[0013] In one embodiment, the processing unit determines that the response information indicates that the second API request is authenticated in the following manner: obtaining a response status code of the response information, and / or parsing an identification code of the response body in the response information; if the response status code is a first predefined value and / or the identification code is a second predefined value, determining that the response information indicates that the second API request is authenticated.

[0014] According to a third aspect of an embodiment of the present disclosure, an application programming interface API detection device is provided, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to: execute the method described in the first aspect or any one of the embodiments of the first aspect.

[0015] According to a fourth aspect of an embodiment of the present disclosure, a storage medium is provided, in which instructions are stored. When the instructions in the storage medium are executed by a processor of a terminal, the terminal is enabled to execute the method described in the first aspect or any one of the embodiments of the first aspect.

[0016] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: obtaining the request information of the API on the business server as the first API request, and deleting the authentication information contained in the request information to obtain the second API request, using the deleted second API request to send an access request to the business server, and based on the response information of the server to the API request, determining whether the response information represents whether the second API request is passed, and then judging whether the API has an authentication defect, thereby realizing the detection of all API authentication defects containing sensitive information on the business server before information leakage occurs, and avoiding the occurrence of information leakage.

[0017] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0019] Figure 1 The figure is a flow chart of an API detection method according to an exemplary embodiment.

[0020] Figure 2 The figure is a flow chart of an API detection method according to an exemplary embodiment.

[0021] Figure 3 The present invention is a flowchart showing a method of deleting authentication information requested in an API according to an exemplary embodiment.

[0022] Figure 4 The present invention is a flowchart showing a method of determining that response information indicates that a second API request has been authenticated according to an exemplary embodiment.

[0023] Figure 5 The figure is a flow chart of an API detection method according to an exemplary embodiment.

[0024] Figure 6 The present invention is a flowchart of a method for detecting defects in API certification according to an exemplary embodiment.

[0025] Figure 7 The present invention is a flowchart of another API certification defect detection method according to an exemplary embodiment.

[0026] Figure 8 yes Figure 5 Implementation effect diagram of step S57.

[0027] Fig. 9 The figure is a block diagram of an API detection device according to an exemplary embodiment.

[0028] Fig.10 It is a block diagram of a device for API detection according to an exemplary embodiment.

[0029] Fig.11 It is a block diagram of a device for API detection according to an exemplary embodiment. DETAILED DESCRIPTION

[0030] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present disclosure.

[0031] The API detection method provided in the embodiment of the present disclosure is applied to the authentication defect detection scenario of the API contained in the business service end.

[0032] API (Application Programming Interface) is a set of predefined interfaces that aims to provide applications and developers with the ability to access a set of routines based on certain software or hardware without having to access the source code or understand the details of the internal working mechanism.

[0033] In related technologies, with the development of Internet technology, the number of scenarios for accessing data on the Internet has increased, and almost all open web pages contain APIs. For example, users can log in to some web pages of a company and access some of the information through the APIs open to the public. For example, by clicking on the company introduction on a company's official website, you can access the company's founding time, main business and other information through the API corresponding to the content.

[0034] However, for the business server, some APIs need to be kept confidential and not open to the public, such as APIs that contain sensitive customer information. Therefore, the business server must protect the access security of these APIs containing sensitive information, that is, perform authentication defect detection on them.

[0035] In the related art, for API authentication defect detection containing sensitive information, a web crawler (also known as a web spider, which is a program or script that automatically captures World Wide Web information according to certain rules) can be used to perform regular judgment on the access traffic of the business server, thereby completing the detection of the API of the business server. For example, a web crawler is used to crawl the request information and response information of a web page, and the obtained content is judged by regular judgment to determine whether there is leakage of sensitive information on the web page. If information leakage occurs, the API with authentication defects is found based on the detected sensitive information, thereby completing the detection of API authentication defects. However, based on the characteristics of the web crawler, if the request information does not make an access request to certain APIs, some APIs cannot be detected, and the API is missed; in addition, even if this detection method can cover all APIs, it is possible that due to the lack of parameter settings of the web crawler, some sensitive information cannot be crawled, and thus the sensitive information cannot be detected, that is, sensitive information is missed.

[0036] In the related technology, for API authentication defect detection containing sensitive information, a method of monitoring the business traffic of the business service end can also be used to complete the detection of the API. For example, the business traffic of a certain enterprise is monitored and obtained in real time. If it is found that its business traffic contains sensitive information, the access to the API corresponding to the sensitive information is immediately blocked, thereby preventing the continued leakage of sensitive information. However, when this method is implemented, even if the API where the information leakage occurs is found, the information leakage has already occurred, and there is a lag; in addition, when using this method to monitor the business traffic of an enterprise, it may block some APIs in the ordinary business of the enterprise that need to provide sensitive information to customers, thereby affecting the normal daily operations of the enterprise.

[0037] In view of this, an embodiment of the present disclosure provides an API detection method, which is applied to a business server and detects the data security of all APIs of the business server through the functions of the business server itself.

[0038] In the disclosed embodiment, based on all access traffic of the business service API provided by the business service gateway or application firewall, the API containing sensitive information is screened out, the authentication information in the API request information is removed, and the obtained request information is used to request access to the business service, and whether the corresponding API has an authentication defect is determined based on whether the server passes the access request. Compared with web crawlers and monitoring of enterprise business traffic, this solves the problem that APIs with authentication defects can only be detected after information leakage occurs and that all APIs cannot be detected, and will not affect the daily business operations of the business service.

[0039] In the embodiments of the present disclosure, the business service end may be a server used by a business service end manager to provide external business services, or may be a terminal used by business maintenance personnel, which is not limited in the present disclosure.

[0040] In the disclosed embodiment, the first API request refers to request information for an API containing sensitive information obtained from a business service end, and the second API request refers to request information obtained after the identity authentication information is removed from the first API request, which will not be defined again later.

[0041] In the disclosed embodiment, the business service end can provide all data passing through the service end, including but not limited to the access request and response information of the internal staff of the business service end, and the access request and response information of the external staff to the business service end. Through the data provided by the business service end, all access requests to the service end can be obtained, thereby obtaining the first API request; in addition, according to the response information of the business service end to the second API request, it can be judged whether the API has an authentication defect.

[0042] In the disclosed embodiment, the business server can filter out APIs containing sensitive information. For example, when a query for certain sensitive information is sent to the business server, the business server can respond and provide all APIs containing the sensitive information.

[0043] In addition, the business server can provide and identify sensitive information contained in the encapsulated API, and can also provide the function of marking the API containing the specified sensitive information. By searching the information stored in the marked API, the API containing sensitive information can be found.

[0044] In the disclosed embodiment, since what needs to be verified is the authentication defect of the API, the business service end can determine whether the corresponding API can execute the authentication mechanism through its own response to the second API request. If there is no authentication information in the application access request information of the API, and the API can still provide data normally, it is determined that the API is at risk of information leakage.

[0045] Figure 1 is a flow chart of an API detection method according to an exemplary embodiment. Figure 1 As shown, the API detection method includes the following steps.

[0046] In step S11, a first API request is obtained.

[0047] Among them, access traffic refers to all data on API access applications and server responses, including the request information and response information corresponding to the API. This data is saved and provided by the business server and can be viewed by the business server at any time.

[0048] Therefore, in the embodiment of the present disclosure, the user can extract the request information part of the API access traffic provided by the business server as the first API request.

[0049] In step S12, the authentication information in the API request is deleted to obtain a second API request.

[0050] In the disclosed embodiment, the second API request may apply for access to the business server through legal means.

[0051] In the embodiment of the present disclosure, after the first API request is obtained, the request information in the first API request is processed, and the part that can reflect the client identity authentication information is deleted, thereby obtaining the second API request.

[0052] In the disclosed embodiment, when deleting the part related to the client identity authentication information, the business server can modify the content in the first API request based on the data provided by the business server to obtain the second API request. For example, the business server obtains the code part in the first API request, performs regular expression judgment on the identity information contained therein, screens out the identity authentication information part and deletes the parameters therein, thereby modifying the original first API request into the second API request.

[0053] In the disclosed embodiment, the business service end has the functions of sending access requests and responding to the access requests.

[0054] In step S13, a second API request is sent to the business server.

[0055] In the disclosed embodiment, the business server may, based on the sending request access function provided by the business server, use the second API request as an access request and submit an API access application to the business server.

[0056] In step S14, response information sent by the business service end in response to the second API request is received.

[0057] In the disclosed embodiment, the business server may receive complete response information of the business server to the access request after initiating an access request to the business server in step S13 based on the request response function provided by the business server.

[0058] After receiving the response information of the business server to the second API request, it is necessary to analyze the content of the response information because it is impossible to know whether the API has an authentication defect based on the response information alone.

[0059] In step S15, if it is determined that the response information indicates that the second API request is authenticated, then the first API request is determined to be an API with an authentication defect.

[0060] In the disclosed embodiment, the business server can determine whether the business server has authenticated the access request based on the response information of the business server to the second API request; if the business server has authenticated the access request, it is considered that the API corresponding to the access request has an authentication defect, thereby completing the detection.

[0061] Through the above method, the business server can complete the detection of API authentication defects based on the access traffic provided by the business server, as well as the functions of sending access requests and responding to requests provided by the business server. Therefore, the present disclosure can achieve the goal of performing security detection on the API included in the business server in advance before information leakage occurs, and prevent losses caused by authentication defects in the API.

[0062] When the business server detects the API of the business server, in addition to the method to detect whether the API has authentication defects, it also needs to ensure that all APIs containing sensitive information on the business server are screened out, otherwise omissions may occur, resulting in some APIs that may have information leakage risks but cannot be detected. Therefore, when the business server obtains the first API request, it needs to check all the APIs it contains, that is, the inspection content can cover all API-related access data.

[0063] Figure 2 is a flow chart of an API detection method according to an exemplary embodiment. Figure 2 As shown, obtaining the first API request includes the following steps.

[0064] In step S21, all access traffic of the business server is obtained through the gateway and / or application firewall.

[0065] In the disclosed embodiment, in order to obtain all access traffic of the business server, it is necessary to apply for data from a carrier that can control all access traffic, such as a gateway or an application firewall.

[0066] When the client and the server communicate with each other through the business server, if the client needs to call information or methods in the server, it needs to apply through an intermediate route, which is called a gateway. In the disclosed embodiment, the gateway can store all access traffic initiated by the client to the business server. For example, if the client wants to access the API of the business server, it needs to send an access request to the API. At this time, the API gateway working on the business server will receive the request information. As long as the request information is legal, the API gateway will pass the request and hand it over to other parts of the business server for processing.

[0067] In the disclosed embodiment, the gateway is placed between the client and the server to manage the API interaction between the client and the server. As the only entrance to the server, all access requests from the client must pass through the gateway.

[0068] Therefore, in the present disclosure, by obtaining the access traffic of the API from the API gateway, the entire access traffic of the API can be obtained.

[0069] When protection is needed for network protocols, a protection system is needed that can control access to applications and intercept all access data. The system used to provide information security protection for these network protocols is called an application firewall.

[0070] In the embodiments of the present disclosure, the application firewall used has at least the function of intercepting all access traffic, for example, a Web application firewall specifically used to protect the HTTP protocol.

[0071] In the disclosed embodiment, the application firewall may be built into the system of the business server, and the business server may access all API-related data intercepted in the application firewall, that is, all access traffic, by issuing an access request to the application firewall.

[0072] Therefore, the present disclosure may adopt the method of obtaining data from a gateway and / or an application firewall to ensure that no API access traffic is missed.

[0073] In step S22, the API access traffic is obtained based on the total access traffic.

[0074] In the disclosed embodiment, the first API request should include access request information of the corresponding API. The first API request should be extracted from all API access traffic obtained in step S11, and the extracted content should have API request details and response details.

[0075] In the disclosed embodiment, the access request information corresponding to the API has the structure that a page access request of a normal web page should have.

[0076] In the embodiment of the present disclosure, the composition structure of the request detailed information is the basic structure of requesting page access in the http protocol, and each parameter is a conventional parameter of the http protocol. The value of the parameter is determined by the client's address, the client's access content, etc. The present disclosure will not explain the parameters and their values ​​contained in the request response information.

[0077] It should be understood that the above request detailed information consists of a request line, a request header, and a request body.

[0078] The request line for requesting detailed information can be:

[0079] "requestline":"POST / * / * / * / getDetailV2 HTTP / 1.1"

[0080] Among them, POST is the most common HTTP method. The remaining part is the requested URL address, which can be combined with the Host attribute of the message header to form a complete request URL, which is not written here; and getDetailV2HTTP / 1.1 in the request line is the HTTP protocol used by the request.

[0081] The request header in the request details starts with "requestheaders" and contains various parameters. It has multiple attributes in the format of "attribute name: attribute value". For example: "host":"a.com", which means that the client address is a.com.

[0082] In the disclosed embodiment, the business server obtains detailed information of the client through the information in the request header.

[0083] Request details The request body begins with "requestbody", which encodes the components in a page form into a formatted string in the form of key-value pairs. It can carry multiple parameter data and is used to pass request parameters.

[0084] In the disclosed embodiment, the business service end response information corresponding to the API has the structure that a normal web page response request should have, namely, a response header and a response body.

[0085] In the embodiment of the present disclosure, the composition structure of the response detailed information is the basic structure of requesting page access in the http protocol, and each parameter is the agreed parameter of the http protocol. The value of the parameter is determined by the server address, the server's response content to the client, etc. This disclosure will not explain the parameters and their values ​​contained in the response information.

[0086] It should be understood that the above response details consist of a response header and a response body. The response header in the above detailed response information begins with respheaders, which is used to instruct the client how to process the response body. For example: if the corresponding parameter of content-type in the response header is "application / json; charset=utf-8", it means that the client is informed to process it in json format and the encoding format is utf-8.

[0087] The response body in the detailed response information starts with "respbody", which is the actual content sent by the Web server to the client. For example, if the response body contains "phone: 888888888", it means that the business server provides the client with a mobile phone number, and the mobile phone number is 888888888.

[0088] In step S23, an API request is obtained based on the API access traffic.

[0089] In the disclosed embodiment, when API access traffic is obtained, detailed request information is screened out as the first API request obtained.

[0090] Figure 3 FIG. 1 is a flowchart showing a method of deleting authentication information requested in an API according to an exemplary embodiment. Figure 3 As shown, deleting the authentication information requested in the API includes the following steps.

[0091] In step S31, the key information identifying the legal identity in the API request is deleted.

[0092] In the disclosed embodiment, after obtaining the first API request, the API request needs to be processed and then resent to the business server in the form of a request. Before sending, all identity authentication information needs to be removed to detect whether the API in the business server has identity authentication requirements.

[0093] In the disclosed embodiment, by deleting the identity authentication information in the first API request, a second API request can be obtained. This request is a legitimate request that does not contain key information identifying a legitimate identity and client identity information, and can be directly sent to the business server to apply for access to the API.

[0094] In the disclosed embodiment, the key information for identifying the legal identity in the first API request can be set by the business server and agreed upon with the client. For example, the key information can be the most common token parameter in the HTTP request, which indicates the key for identifying the legality of the API request; the key is generally included in the url parameter or body parameter in the request. When the business server reads the parameter, it will verify whether the parameter is legal. If it is legal, the request information corresponding to the token is considered legal.

[0095] In step S32, the identity information of the client is deleted.

[0096] In the disclosed embodiment, the client identity authentication information in the first API request is generally present in the request header. For example, the client identity authentication information can be the cookie and authorization header in the HTTP request; these two headers can be used to identify the client identity. When the business service end receives the request information, it will first verify the legitimacy of the client identity based on the cookie and authorization header. If the client identity is verified to be legitimate, it will proceed to the subsequent steps, for example, returning the response information to the client.

[0097] It should be understood that the identity authentication information and client identity information contained in the first API request of the embodiment of the present disclosure exist in different parts of the first API request, so the deletion of the two will not affect each other. Therefore, the execution order of the above steps S31 and S32 is not limited. In the embodiment of the present disclosure, after using the second API request to initiate an access request to the business server and obtaining the response content of the business server, it is necessary to determine whether the second API request is authenticated by the business server.

[0098] Figure 4 is a flowchart showing a method of determining that response information indicates that a second API request has been authenticated according to an exemplary embodiment. Figure 4 As shown, determining that the response information indicates that the second API request is authenticated includes the following steps.

[0099] In step S41, a response status code of the response information is obtained, and / or an identification code of a response body in the response information is parsed.

[0100] In the disclosed embodiment, after the business server receives the access request for the second API request, a response message is generated after processing by the HTTP protocol or the internal protocol of the business server. The response status code of the response message and / or the identification code of the response body in the response message generally appear in the response message of the business server to the second API request.

[0101] In the embodiment of the present disclosure, the response status code of the response information is generally a status code generated by the page based on the HTTP protocol.

[0102] In the disclosed embodiment, the identification code of the response body in the response information generally appears in the response body of the business server, and the specific value is freely set by the business server. The status code is not affected by the HTTP protocol. It is a special status code agreed upon internally by the client and the server, and is used to reflect whether the access request has passed the authentication of the business server.

[0103] In step S42, if the response status code is the first predefined value / or the identification code is the second predefined value, it is determined that the response information indicates that the second API request is authenticated.

[0104] In the embodiment of the present disclosure, after obtaining the response status code and / or the identification code in the response body, the business server needs to judge their values ​​to determine whether the tested API has any information leakage.

[0105] In the disclosed embodiment, when judging the response status code in the response information, it is necessary to be based on the provisions of the network protocol. For example, when the HTTP protocol is used, when the status code is 200, the status code indicates that the business server has passed the verification and processed the request information, thereby determining that the API of the business server can be accessed without authentication information, and then determining that the API has an authentication defect and there is a risk of information leakage.

[0106] In the disclosed embodiment, when judging the identification code of the response body in the response information, it is necessary to base it on the special status code agreed upon internally by the business server and the client. For example, the business server sets the parameter code as the identification code for interacting with the client. When the code value is 200, it indicates that the access is legal and authenticated. When the client sends a legal request and is authenticated by the business server, the response body in the response information provided by the business server contains the code. If the business server detects that the code value is 200, it is considered that the business server has received legal access and has processed the request, thereby determining that the business server's API can be accessed without authentication information, and then determining that the API has authentication defects and there is a risk of information leakage.

[0107] The present disclosure also provides an API detection method, the flow chart of which is as follows: Figure 5 shown.

[0108] In step S51, all access traffic of the business server is obtained.

[0109] In the embodiment of the present disclosure, all access traffic of the business server includes but is not limited to API-related access traffic.

[0110] In step S52, the API assets are identified and stored.

[0111] In the disclosed embodiment, API assets refer to all content related to the API, including the access traffic of the API and the data contained in the API.

[0112] In step S53, the API assets are marked.

[0113] In the disclosed embodiment, when it is detected that the access traffic contains sensitive information, the API that encapsulates the sensitive information is marked, so as to be used in subsequent steps to screen out the API containing the sensitive information.

[0114] In step S54, it is confirmed that the API contains sensitive information.

[0115] In the disclosed embodiment, after the API is labeled, the information in the API needs to be checked to determine whether the information contained in the API corresponds to the label, and then confirm that the API contains sensitive information.

[0116] In step S55, the API is checked for authentication defects.

[0117] In the disclosed embodiment, after confirming that the API contains sensitive information, it is necessary to perform an authentication defect check on it, and determine whether the API has a risk of information leakage based on the check results.

[0118] In step S56, it is confirmed that the API has an authentication defect.

[0119] In step S57, API information is output.

[0120] After the business server detects that the API has an authentication defect, it needs to feed back the inspection result to the business server manager so that the business server manager can modify and maintain the API with the authentication defect. Therefore, the business server needs to output the API information with the authentication defect.

[0121] The present disclosure also provides an API certification defect detection method, as shown in the flowchart. Figure 6 shown.

[0122] In step S61, detailed information of the API request is obtained.

[0123] In the disclosed embodiment, the request details should be the legitimate request access information about the API stored by the business server.

[0124] In step S62, the key information identifying the legal identity in the request parameter is deleted.

[0125] In the disclosed embodiment, the key information identifying the legal identity in the request parameter can be freely set by the business service end, including but not limited to the token value.

[0126] In step S63, the identity information of the client in the request parameters is deleted.

[0127] In step S64, the request is resent.

[0128] In the disclosed embodiment, after the authentication information is deleted to obtain new request information, ie, the second API request, an access request is made to the business server using the second API request.

[0129] In step S65, the response information of the request is obtained.

[0130] In the disclosed embodiment, after the re-access application is submitted, the business server will respond to it, and the business server can obtain its response information.

[0131] In step S66, the http status code is extracted.

[0132] In the embodiment of the present disclosure, after obtaining the response information of the business server to the second API request, the business server can extract the corresponding http status code according to the content of the response information.

[0133] In step S67, it is determined that the status code is a first predefined value.

[0134] In the embodiment of the present disclosure, the status code is a first predefined value, which indicates that the business server has approved the access request. For example, the http status code is 200, which indicates that the access is approved.

[0135] In step S68, the API is identified as having an authentication defect.

[0136] In the disclosed embodiment, when the status code is determined to be the first predefined value, it indicates that a request without an identity identifier can also access sensitive information in the API, and thus it is necessary to identify the API as having an authentication defect for modification and maintenance by the administrator of the business service end.

[0137] Figure 7 A flow chart of another API certification defect detection method is shown according to an exemplary embodiment.

[0138] In the disclosed embodiment, the administrator of the business service end may also set other parameters to reflect whether sensitive information in the API in the business service end is accessed, for example, a parameter such as a second predefined value is set in the response of the business service end. By judging the second predefined value in the response information of the business service end, it can be known whether the business service end has passed the second API request.

[0139] It should be understood that Figure 7 Step S70 and Figure 6 Step S61, Figure 7 Step S71 and Figure 6 Step S62, Figure 7 Step S72 and Figure 6 Step S63, Figure 7 Step S73 and Figure 6 Step S64, Figure 7 Step S74 and Figure 6 Step S65, Figure 7 Step S75 and Figure 6 Step S66, Figure 7 Step S76 and Figure 6 The specific operation contents are exactly the same and will not be described again here.

[0140] In step S77, the second predefined value in the response body is parsed and extracted.

[0141] In the disclosed embodiment, the business server may parse the response information and extract a second predefined value. The second predefined value exists in the response body, and the specific value is freely set by the business server manager.

[0142] In step S78, it is determined that the status identification code is a second predefined value.

[0143] In the disclosed embodiment, the business server can compare the status identification code in the obtained response body with the agreed second predefined value. If they are the same, it means that the business server has passed the second API request, and then determines that there is an authentication defect in the API.

[0144] In step S79, the API is identified as having an authentication defect.

[0145] In the embodiment of the present disclosure, after completing step S76 and step S78, the business service end can determine that the status identification code included in the response information is the same as the previously set status identification code, that is, it has processed and passed the access request to the API, and therefore determines that the API has an authentication defect. Therefore, it is necessary to identify the authentication defect of the API for the administrator of the business service end to modify and maintain.

[0146] Figure 8 This is a diagram showing the effect of implementing step S57.

[0147] In the embodiment of the present disclosure, the API information output in step S57 can be as follows: Figure 8 As shown, business service managers can use this diagram to find APIs that have information leakage risks.

[0148] It should be noted that the methods of outputting API information in the embodiments of the present disclosure include but are not limited to Figure 8 One of the displayed.

[0149] Through the above solution, the business server can use its own functions to complete the security detection of the API containing sensitive information on the business server, so as to block the information leakage before it occurs and avoid missing the API.

[0150] Based on the same concept, an embodiment of the present disclosure also provides an application programming interface API detection device.

[0151] It is understandable that the API device provided in the embodiment of the present disclosure includes hardware structures and / or software modules corresponding to the execution of each function in order to realize the above functions. In combination with the units and algorithm steps of each example disclosed in the embodiment of the present disclosure, the embodiment of the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present disclosure.

[0152] Fig. 9 1 is a block diagram of an application programming interface API detection device according to an exemplary embodiment. Fig. 9 The device includes an acquisition unit 101, a processing unit 102, and a sending unit 103.

[0153] The acquisition unit 101 is used to acquire the first API request and to receive the response information sent by the business server in response to the second API request; the processing unit 102 is used to delete the authentication information in the first API request to obtain the second API request, and when it is determined that the response information indicates that the second API request is authenticated, determine that the first API request is an API request with an authentication defect; the sending unit 103 is used to send the second API request to the business server.

[0154] In one embodiment, the acquisition unit 101 acquires the first API request in the following manner: through a gateway and / or an application firewall, all access traffic of the business server is acquired, and the business server is used to access the API; based on all access traffic, API access traffic is acquired; based on the API access traffic, the first API request is acquired.

[0155] In one implementation, the API access traffic includes: API request information and API response information, the API request information includes a request line, a request header, and a request body, and the API response information includes a response header and a response body.

[0156] In one implementation, the processing unit 102 deletes the authentication information in the API request in the following manner: deleting the key information identifying the legal identity in the API request and the identity information of the client.

[0157] In one embodiment, the processing unit 102 determines that the response information indicates that the second API request is authenticated in the following manner: obtaining the response status code of the response information, and / or parsing the identification code of the response body in the response information; if the response status code is a first predefined value and / or the identification code is a second predefined value, then determining that the response information indicates that the second API request is authenticated.

[0158] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0159] Fig.10 2 is a block diagram of an apparatus 200 for API detection according to an exemplary embodiment. For example, the apparatus 200 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0160] Reference Fig.10 , the device 200 may include one or more of the following components: a processing component 202 , a memory 204 , a power component 206 , a multimedia component 208 , an audio component 210 , an input / output (I / O) interface 212 , a sensor component 214 , and a communication component 216 .

[0161] The processing component 202 generally controls the overall operation of the device 200, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 202 may include one or more processors 220 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 202 may include one or more modules to facilitate interaction between the processing component 202 and other components. For example, the processing component 202 may include a multimedia module to facilitate interaction between the multimedia component 208 and the processing component 202.

[0162] The memory 204 is configured to store various types of data to support operations on the device 200. Examples of such data include instructions for any application or method operating on the device 200, contact data, phone book data, messages, pictures, videos, etc. The memory 204 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0163] The power component 206 provides power to the various components of the device 200. The power component 206 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 200.

[0164] The multimedia component 208 includes a screen that provides an output interface between the device 200 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 208 includes a front camera and / or a rear camera. When the device 200 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0165] The audio component 210 is configured to output and / or input audio signals. For example, the audio component 210 includes a microphone (MIC), and when the device 200 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 204 or sent via the communication component 216. In some embodiments, the audio component 210 also includes a speaker for outputting audio signals.

[0166] I / O interface 212 provides an interface between processing component 202 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0167] The sensor assembly 214 includes one or more sensors for providing various aspects of the status assessment of the device 200. For example, the sensor assembly 214 can detect the open / closed state of the device 200, the relative positioning of components, such as the display and keypad of the device 200, the sensor assembly 214 can also detect the position change of the device 200 or a component of the device 200, the presence or absence of user contact with the device 200, the orientation or acceleration / deceleration of the device 200 and the temperature change of the device 200. The sensor assembly 214 can include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 214 can also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 214 can also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.

[0168] The communication component 216 is configured to facilitate wired or wireless communication between the device 200 and other devices. The device 200 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 216 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 216 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0169] In an exemplary embodiment, the apparatus 200 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0170] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 204 including instructions, and the instructions can be executed by the processor 220 of the device 200 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0171] Fig.11 is a block diagram of a device 300 for API detection according to an exemplary embodiment. For example, the device 300 may be provided as a server. Fig.11The apparatus 300 includes a processing component 322, which further includes one or more processors, and a memory resource represented by a memory 332 for storing instructions executable by the processing component 322, such as an application. The application stored in the memory 332 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 322 is configured to execute instructions to perform the above-mentioned API detection method.

[0172] The device 300 may also include a power supply component 326 configured to perform power management of the device 300, a wired or wireless network interface 350 configured to connect the device 300 to a network, and an input / output (I / O) interface 358. The device 300 may operate based on an operating system stored in the memory 332, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0173] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 332 including instructions, and the instructions can be executed by the processing component 322 of the device 300 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0174] It is to be understood that in the present disclosure, "plurality" refers to two or more than two, and other quantifiers are similar. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. The singular forms "a", "the" and "the" are also intended to include plural forms, unless the context clearly indicates other meanings.

[0175] It is further understood that the terms "first", "second", etc. are used to describe various information, but such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other, and do not indicate a specific order or degree of importance. In fact, the expressions "first", "second", etc. can be used interchangeably. For example, without departing from the scope of the present disclosure, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information.

[0176] It can be further understood that, unless otherwise specified, “connection” includes a direct connection without other components between the two, and also includes an indirect connection with other components between the two.

[0177] It is further understood that, although the operations are described in a specific order in the drawings in the embodiments of the present disclosure, it should not be understood as requiring the operations to be performed in the specific order shown or in a serial order, or requiring the execution of all the operations shown to obtain the desired results. In certain environments, multitasking and parallel processing may be advantageous.

[0178] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modifications, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0179] It should be understood that the present disclosure is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the scope of the appended claims.

Claims

1. An application programming interface API detection method, characterized in that: The method comprises: Get the first API request; Deleting the authentication information in the first API request to obtain a second API request; Sending the second API request to the business server; Receiving response information sent by the business server in response to the second API request; If it is determined that the response information indicates that the second API request is authenticated, then it is determined that the API is an API with an authentication defect.

2. The method according to claim 1, characterized in that The obtaining of the first API request includes: Obtain all access traffic to the business server through a gateway and / or application firewall, where the business server is used to access the API; Based on the total access traffic, obtain API access traffic; Based on the API access traffic, the first API request is obtained.

3. The method according to claim 2, characterized in that The API access traffic includes: API request information and API response information, wherein the API request information includes a request line, a request header and a request body, and the API response information includes a response header and a response body.

4. The method according to claim 1, characterized in that: The deleting the authentication information in the API request includes: Delete the key information identifying the legal identity and the client's identity information in the API request.

5. The method according to claim 1, characterized in that The determining that the response information indicates that the second API request is authenticated includes: Obtaining a response status code of the response information, and / or parsing an identification code of a response body in the response information; If the response status code is a first predefined value and / or the identification code is a second predefined value, it is determined that the response information indicates that the second API request is authenticated.

6. An application programming interface API detection device, characterized in that: The device comprises: An acquisition unit, used to acquire the first API request, and to receive response information sent by the business server in response to the second API request; A processing unit, configured to delete the authentication information in the first API request, obtain a second API request, and determine that the first API request is an API request with an authentication defect when it is determined that the response information indicates that the second API request is authenticated; A sending unit is used to send the second API request to the business server.

7. The device according to claim 6, characterized in that The acquisition unit acquires the first API request in the following manner: Obtain all access traffic to the business server through a gateway and / or application firewall, where the business server is used to access the API; Based on the total access traffic, obtain API access traffic; Based on the API access traffic, the first API request is obtained.

8. The device according to claim 7, characterized in that The API access traffic includes: API request information and API response information, wherein the API request information includes a request line, a request header and a request body, and the API response information includes a response header and a response body.

9. The device according to claim 6, characterized in that The processing unit deletes the authentication information in the API request in the following manner: Delete the key information identifying the legal identity and the client's identity information in the API request.

10. The device according to claim 6, characterized in that The processing unit determines that the response information indicates that the second API request is authenticated in the following manner: Obtaining a response status code of the response information, and / or parsing an identification code of a response body in the response information; If the response status code is a first predefined value and / or the identification code is a second predefined value, it is determined that the response information indicates that the second API request is authenticated.

11. An application programming interface API detection device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to: execute the method described in any one of claims 1 to 5.

12. A storage medium, characterized in that: The storage medium stores instructions, and when the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of claims 1 to 5.

Images