API (Application Program Interface) calling management and control system and authentication method for different security protection levels in specific field

Abstract

The invention provides an API (Application Program Interface) calling management and control system and authentication method for different security protection levels in a specific field. According to the system, APIs are isolated and deployed to matched API gateways according to security levels, so that the requirement of a specific field for resource isolation of different security protection levels is met. The core component comprises an API gateway management and control module, a caller registration module, an API subscription module, an authentication module and a display center module. In order to ensure the security and credibility of an API caller, an API calling authentication method for different security protection levels in a specific field is designed, and multi-level authentication control is carried out on the basis of an authorization certificate, an IP address, a security level attribute and an access authority. According to the technical scheme, the authorization range of the API resources is controlled, it is ensured that an API caller can only access the API resources matched with the safety protection level of the API caller, confidential data leakage caused by unauthorized access or unauthorized access is effectively prevented, and the high safety requirement for API protection in the specific field is met.

Description

Technical Field

[0001] The present invention relates to the technical field of computer program data interaction, and in particular to an API call management and control system and an authentication method for different security protection levels for specific fields. Background Art

[0002] With the rapid development of modern information technology and the Internet, API (application programming interface) has become a key technology for data interaction and service integration between different systems. With the widespread application of API, security issues are becoming increasingly prominent, especially in the digital transformation of specific fields. API calls not only need to process massive amounts of data, but also must ensure the security of the calling process and strictly prevent confidential information leakage and illegal access.

[0003] In certain specific areas, the security protection level attribute of the API matches its data security protection level. However, the current mainstream API call authentication and access control methods on the Internet cannot provide dynamic and multi-dimensional security protection for the calling process according to the API's security protection level. The authentication of the API interface usually adopts the AK / SK method, embedding the user information into the key user identifier and sending it to the server along with the request. The API caller refers to an application or service created or defined by the developer user that initiates an access request to the API through a network protocol. Its responsibilities include initiating a call request, passing parameters and authentication information, and receiving the returned response data. Since API callers in specific fields also have security protection level attributes, when calling multiple security protection level APIs, APIs with a security protection level higher than their own cannot be called, otherwise confidential data may be leaked or unauthorized access may occur. The existing AK / SK interface authentication method only contains user information, but does not contain the security protection level information of the API caller, so it is difficult to apply to multiple security protection level API authentication and access control in specific fields. Summary of the invention

[0004] In view of the fact that the current mainstream AK / SK interface authentication method on the Internet is difficult to apply to multiple security protection level API scenarios in specific fields, the present invention provides an API call management and control system with different security protection levels for specific fields, including:

[0005] API Gateway Control Module: It is used to uniformly manage API gateways with different security protection levels that are deployed in isolation, and is used as the unified entry point for the API call control system. API callers initiate access requests through this entry point.

[0006] API caller registration module: used by developers to register the IP address and security protection level of API callers to the API call management and control system. The API caller registration module generates access credentials and a key for requesting hash encryption for API callers, and collaborates with the API authentication module to perform content and permission verification when the API caller initiates an API access request.

[0007] API subscription module: performs subscription verification based on developer permissions and API caller security protection level. If the verification passes, the caller credentials are added to the API access whitelist. When the API caller initiates an access request, the API authentication module verifies the access rights again.

[0008] API authentication module: used to verify the legitimacy of the API caller's access request, including: based on the API caller's registration and subscription information, the access request is sequentially verified for credentials, IP address, security protection level, request content signature, and API access permission. After all verifications are passed, the API authentication module issues a temporary access token to the API caller for subsequent access;

[0009] API Display Center Module: As the portal module of the API call management system, it displays the APIs within the scope of the developer's authority based on the developer's identity information.

[0010] According to another aspect of the present invention, there is also provided a method for authenticating API calls with different security protection levels for a specific field, which is executed by an API call management and control system with different security protection levels for a specific field, and includes:

[0011] Step 101: Receive the IP address and security protection level of the API caller provided by the developer, and allow the API caller to register;

[0012] Step 102: The API call control system receives the registration information of the API caller, and generates a unique identifier as an access credential based on the caller's IP address and security protection level through a hash signature algorithm. At the same time, the API call control system creates an encryption key that uniquely corresponds to the access credential.

[0013] Step 103: After creating the access credentials and encryption key, the API call management system sends the access credentials and encryption key to the API caller and records their information;

[0014] Step 104: The API display center module receives developer access, allows the developer to select a desired API from the accessible API range, and initiates a subscription application based on the API caller's access credentials to obtain the corresponding API call permission;

[0015] Step 105: After receiving the subscription application, the API call management system determines the IP address, security protection level attributes, and developer of the API caller based on the access credentials, and compares the security protection level of the API caller with that of the subscribed API: when the API caller's security protection level is lower than the subscribed API's security protection level, the subscription is rejected; otherwise, it is allowed.

[0016] According to another aspect of the present invention, there is also provided a method for authenticating API calls with different security protection levels for a specific field, which is executed based on an API call management and control system with different security protection levels for a specific field, and includes:

[0017] Step 201: The developer constructs an access request to the subscription API, including the following:

[0018] a. HTTP request method;

[0019] b. Request URI;

[0020] c. Request parameters: including URL query parameters and parameters in the request body;

[0021] d. Request header information;

[0022] e. The subject of the request;

[0023] Step 202: Combine the HTTP request method, request URI, request parameters, request header information, and request subject into a string to be signed in a specific order and format to generate a signature, and use the encryption key and HMAC-SHA256 algorithm to perform a hash message authentication code encryption on the constructed string to generate a signature string for identifying the uniqueness and integrity of the current access request; wherein, the encryption key generation process is as follows: the API call control system generates a unique identifier as an access credential based on the IP address and security protection level of the API caller through a hash signature algorithm, and at the same time, the API call control system creates an encryption key that uniquely corresponds to the access credential;

[0024] Step 203: The client sends an API access request, carrying the following information:

[0025] Access credentials;

[0026] Signature: used to prove that the API access request is initiated by an API caller who has registered in the API call control system and has a legitimate key;

[0027] Key verification information: including the IP address and security protection level attributes of the API caller, which is used for subsequent verification and authentication process;

[0028] Timestamp;

[0029] Step 204: After receiving the API access request, the API call management and control system performs multi-level authentication on the API access request;

[0030] Step 205: If the authentication is successful, the API caller's access credential information is matched in the whitelist of API access. If a match is found, it means that the API caller has subscribed to the API and has access rights to the API. The access is performed. Otherwise, the request is rejected.

[0031] Step 206: The API call management system issues a temporary token with time validity to the API caller for access;

[0032] Step 207: When the API caller accesses the corresponding API, the temporary Token is carried in the request. After the API call management system verifies that the Token is valid and has not expired, it forwards the request to the backend API service and returns the response data.

[0033] The design ideas of the present invention mainly include the following contents:

[0034] (1) An API control system with API gateway as the core was designed. On the one hand, the system isolates APIs of different security protection levels and deploys them into an API gateway that matches the API's own security protection level to meet the security compliance requirements of specific fields for resource isolation of different security protection levels; on the other hand, based on the API's security protection level attributes, the authentication process of API calls at multiple security protection levels is reinforced. The core components of the API control system include the API gateway control module, the API caller registration module, the API subscription module, the API authentication module, and the API display center module.

[0035] (2) An API authorization access method based on a registration and subscription mechanism for specific fields is provided. Since API callers and APIs need to be distinguished according to security protection levels, this method refines the minimum authorization unit of API access from developer users to API callers created or defined by developers. This method requires API callers to go through the registration and subscription process before requesting access to the API. The registration process refers to the process in which the API caller submits its own IP address and security protection level attributes to the API control system to obtain access credentials and encryption keys; the subscription process refers to the process in which the developer initiates an application for API access rights in the API control system based on the API access credentials, and the API control system completes the authorization after verifying the security protection level.

[0036] (3) A multi-level API call authentication and access control method for specific fields is provided. In this method, when an API caller initiates an access request for the first time, it is necessary to carry the request signature, IP address, security protection level attributes and credentials, and obtain a temporary token for the corresponding API after layer-by-layer comparison and verification by the API control system. In subsequent API accesses, the caller uses the temporary token to access the corresponding API within the validity period to obtain response data.

[0037] Beneficial effects:

[0038] The present invention solves the shortcomings of the current AK / SK-based API authentication method in multiple security protection level scenarios in specific fields by establishing a multi-level, fine-grained API call authentication and access control method. The API management and control system of the present invention is based on the security protection level of the API, and identifies and manages the security level attributes of the API caller through a registration and subscription mechanism, thereby ensuring that the API caller can only access API resources that match its own level, and effectively prevents confidential data leakage caused by unauthorized access. At the same time, the system adopts isolated deployment of API gateways of different levels to strengthen API access control. The present invention not only implements multi-dimensional permission verification in the API call process, but also introduces a temporary token mechanism to improve the security and reliability of the authentication process, which meets the high security requirements for API protection in specific fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a model diagram that illustrates the relationship between the API management system, API callers, and APIs.

[0040] Figure 2 It is an architectural diagram of the API call control system that implements different security protection levels for specific fields.

[0041] Figure 3 It is a flowchart of API callers registering and subscribing in the API management system.

[0042] Figure 4 It is a process diagram for explaining API call authentication methods with different security protection levels for specific fields. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0044] Embodiment 1

[0045] This embodiment describes in detail the API call management and control system with different security protection levels for specific fields.

[0046] like Figure 1 As shown, the present invention provides an API management and use model suitable for a specific field, and abstracts the following key roles in the construction and use of the API management system:

[0047] (1) API Gateway: A system component used to centrally manage API interfaces that match its own security protection level. It is responsible for API publishing, authorization, rate limiting, routing, and monitoring.

[0048] (2) API caller: refers to an application or service created or defined by a developer, which initiates an access request to the API through a network protocol and is responsible for initiating the call request, passing parameters and authentication information, and receiving response data.

[0049] (3) API backend service: a system service that provides an API interface and has a corresponding security protection level based on the self-set data security protection level. The API backend service can provide multiple API interfaces with different security protection levels, but none of them is higher than its own security protection level.

[0050] exist Figure 1 In the API control and usage model, the API backend service publishes the interface to the API gateway of the corresponding security protection level based on the security protection level attributes of the API interface, and is managed uniformly by the API control system. Developers first register API callers to the API control system, and then subscribe and access the corresponding API based on permissions and the security protection level attributes of the API callers.

[0051] like Figure 2 As shown, the present invention designs an API call control system with different security protection levels for specific fields. Its core modules include API gateway control module, API caller registration module, API subscription module, API authentication module and API display center module.

[0052] API Gateway Control Module: The API Gateway Control Module manages isolated and deployed API gateways with different security protection levels. On the one hand, it distributes control strategies such as routing, downgrade, current limiting and circuit breaking to each API gateway. On the other hand, it serves as the unified entrance of the API call control system. API callers initiate access requests through this entrance. After the permission verification is passed, the API call control system routes the request to the API gateway with the corresponding security protection level through the load balancing mechanism. Figure 2 As shown, the API gateway control module controls API gateways of various security protection levels. Figure 2The following example shows three levels of API gateway security protection. As the core component of the API call management and control system, the API gateway is responsible for accessing and managing the API interface published by the backend service.

[0053] API caller registration module: Before calling the API, the developer needs to register the API caller's IP address, security protection level and other information to the API management system. The API caller registration module generates access credentials and a key for requesting hash encryption for the API caller, and when the API caller initiates an API access request, it collaborates with the API authentication module to perform content and permission verification.

[0054] API subscription module: performs subscription verification based on developer permissions and API caller security protection levels. If the verification passes, the caller credentials are added to the API access whitelist. When the API caller initiates an access request, the API authentication module is used to verify access rights again.

[0055] API authentication module: used to verify the legitimacy of the API caller's request. Based on the registration and subscription information of the API caller, the authentication module performs credential verification, IP address verification, security protection level verification, request content signature verification, and API access permission verification on the access request in sequence. After all verifications pass, the API authentication module issues a temporary access token (Token) to the API caller for subsequent access. In subsequent requests, only the validity period of the Token needs to be verified. After the multi-level verification passes, the system forwards the request to the corresponding API gateway and finally routes it to the corresponding API backend service.

[0056] API Display Center Module: As the portal module of the API management system, it displays the APIs within the scope of the developer's authority based on the developer's identity information. The display center provides basic information about the API interface, calling methods, and return result descriptions for developers to select and call as needed.

[0057] The system according to the implementation mode of the present invention takes the API gateway as the core component to build a control system for uniformly managing API interfaces with different security protection levels; a registration and subscription mechanism before API callers access and a multi-level authentication method for API call access are designed to ensure the security and trustworthiness of the requesting party and prevent the leakage of confidential data, thereby solving the problem that the current mainstream Internet authentication and access control methods cannot perform dynamic and multi-dimensional security protection for API calls according to the security protection level.

[0058] The API control system includes the API gateway control module, API caller registration module, API subscription module, API authentication module and API display center module. Each module works together to implement the registration and subscription operations before the API caller initiates an access request, as well as the multi-level call authentication when the request is initiated.

[0059] Embodiment 2

[0060] This embodiment describes in detail the process of API call authentication method with different security protection levels for specific fields.

[0061] Based on the API call control system proposed in Example 1, Figure 3 The process shown implements API call authentication methods with different security protection levels for specific fields, including API caller registration and API subscription, and refines the minimum authorization unit of API access from developers to applications or services, ensuring that the API access process is controlled and preventing confidential information leakage. The specific steps are as follows:

[0062] Step 101: Receive the IP address and security protection level of the API caller provided by the developer, and allow the API caller to register. This is because before accessing the API control system, the API caller needs to register his or her information to the API call control system to obtain access credentials that identify his or her information and the encryption key used to request signatures.

[0063] Step 102: The API call control system receives the registration information of the API caller, and generates a unique identifier as an access credential based on the caller's IP address, security protection level and other necessary information through a hash signature algorithm. At the same time, the API call control system creates an encryption key that uniquely corresponds to the access credential, which is used to encrypt the client API request content and the API call control system to compare the signature of the request content.

[0064] Step 103: After creating the access credentials and encryption key, the API call management system sends the access credentials and encryption key to the API caller and records their information so that when an API access request is received, the legitimacy of the request can be verified through the access credentials and encryption key.

[0065] Step 104: The API display center module receives developer access, allowing the developer to select the required API from the accessible API range, so that the developer can initiate a subscription application based on the API caller's access credentials to obtain the corresponding API calling authority.

[0066] Step 105: After receiving the subscription application, the API call control system determines the IP address, security protection level attributes, developer and other information of the API caller based on the access credentials, and compares the security protection level of the API caller with that of the subscribed API. To prevent unauthorized access to confidential data, the system strictly limits subscription permissions based on the security protection level: when the API caller's security protection level is lower than the subscribed API's security protection level, the subscription is rejected, otherwise it is allowed. The API call control system maintains an access whitelist for each API. After the subscription is successful, the API caller's credentials are added to the API's whitelist.

[0067] Embodiment 3

[0068] This embodiment describes in detail the multi-level call authentication process for implementing API request access based on the API management and control system.

[0069] Based on the API management system of the first embodiment, and in combination with the API caller registration and subscription process in the second embodiment, the present invention is as follows Figure 4 The process shown implements multi-level IP address call authentication for API access. The specific steps are as follows:

[0070] Step 201: The developer constructs an access request to the subscription API, which usually includes the following:

[0071] a. HTTP request method: such as GET, POST, DELETE, etc.;

[0072] b. Request URI: the requested resource path, such as / api / v1 / resource;

[0073] c. Request parameters: including URL query parameters and parameters in the request body, which usually need to be sorted in alphabetical order;

[0074] d. Request header information: including Host, Date, custom header information, etc.;

[0075] e. Request Body: If it is a POST or PUT request, you may need to perform a hash calculation on the content of the request body.

[0076] Step 202: Combine the API request method (GET, POST, etc.), request URI, request header and request parameters, and request subject in a specific order and format into a string to be signed to generate a signature. The sample format is as follows:

[0077] Use the encryption key and HMAC-SHA256 algorithm to encrypt the constructed string with a hash message authentication code to generate a signature string (Signature), which is used to identify the uniqueness and integrity of the current access request. The encryption key generation process is as follows: the API call control system generates a unique identifier as an access credential based on the IP address and security protection level of the API caller through a hash signature algorithm, and the API call control system creates an encryption key that uniquely corresponds to the access credential.

[0078] Step 203: The client sends an API call request, carrying the following information:

[0079] (1) Access credentials: passed as a request header or URL parameter, indicating the identity of the API caller.

[0080] (2) Signature: used to prove that the request was initiated by an API caller who has registered in the API call control system and has a legitimate key. The signature is usually included in the API call request in the form of a request header or as a URL parameter.

[0081] (3) Key verification information: including the IP address and security protection level attributes of the API caller, which is used in the subsequent verification and authentication process.

[0082] (4) Timestamp: To prevent re-entry attacks, a timestamp is usually added to ensure that the signature of each request is unique and has a short validity period.

[0083] The client is the smart device that hosts the API caller.

[0084] Step 204: After receiving the API call request, the API call control system performs multi-level authentication on the call request, including:

[0085] (1) Credential verification: Verify whether the API caller is registered in the API call management system based on the API caller’s credential information. If the credential does not exist or is invalid, the request will be rejected.

[0086] (2) IP address verification: The IP address provided during registration is queried based on the API caller's credentials and compared with the IP address sent by the client. If they do not match, the request is rejected.

[0087] (3) Security protection level verification: The security protection level information provided by the API caller during registration is queried based on the API caller's credentials, and compared with the security protection level information of the called API. If the API caller's security protection level is higher than or equal to the security protection level of the called API, access is allowed; otherwise, the request is rejected.

[0088] (4) Signature verification: Reconstruct the string to be signed according to step 202 based on the access request data (including request method, URI, request parameters, header information, etc.). Query the corresponding encryption key through the API caller's access credentials, and use the encryption key and the HMAC-SHA256 algorithm to encrypt the reconstructed string to generate the signature of the API call control system. Compare the signature sent by the client with the generated signature. If they do not match, reject the request.

[0089] Step 205: If the above checks are all passed, the API caller's access credential information is matched in the whitelist of API access. If it matches, it means that the API caller has subscribed to the API and has access rights to the API. The access is performed, otherwise the request is rejected.

[0090] Step 206: The API call management system issues a temporary Token with time validity to the API caller for access.

[0091] Step 207: When the API caller accesses the corresponding API, he carries a temporary Token in the request, and no longer needs to perform the above authentication steps. After the API call management system verifies that the Token is valid and has not expired, it forwards the request to the backend API service and returns the response data.

[0092] According to the method of the implementation mode of the present invention, the registration and subscription mechanism of API callers requires that before initiating an API access request, the caller must first register its own IP address, security protection level attributes and other information in the API management and control system, and the management and control system will issue access credentials and encryption keys. API callers subscribe to APIs within their authority range and with a security protection level lower than their own based on the access credentials. This mechanism refines the minimum authorization unit for API access to API callers (applications or services created or defined by developers), ensuring that the access process is controlled and preventing the leakage of confidential information.

[0093] The multi-level API call authentication method performs multi-level verification on the access credentials, IP address, security protection level attributes and request content signature carried in the request when the API caller initiates the access request for the first time, and issues a temporary Token for accessing the corresponding API. In subsequent accesses, the API caller uses the temporary Token within the validity period to access the corresponding API and obtain the response data.

Claims

1. An API call control system with different security protection levels for specific fields, characterized by: include: API Gateway Control Module: It is used to uniformly manage API gateways with different security protection levels that are deployed in isolation, and is used as the unified entry point for the API call control system. API callers initiate access requests through this entry point. API caller registration module: used by developers to register the IP address and security protection level of API callers to the API call management and control system. The API caller registration module generates access credentials and a key for requesting hash encryption for API callers, and collaborates with the API authentication module to perform content and permission verification when the API caller initiates an API access request. API subscription module: performs subscription verification based on developer permissions and API caller security protection level. If the verification passes, the caller credentials are added to the API access whitelist. When the API caller initiates an access request, the API authentication module will verify the access rights again. API authentication module: used to verify the legitimacy of the API caller's access request, including: based on the API caller's registration and subscription information, the access request is sequentially verified for credentials, IP address, security protection level, request content signature, and API access permission. After all verifications are passed, the API authentication module issues a temporary access token to the API caller for subsequent access; API Display Center Module: As the portal module of the API call management system, it displays the APIs within the scope of the developer's authority based on the developer's identity information.

2. According to claim 1, the API call control system with different security protection levels for specific fields is characterized in that: The verification performed by the API authentication module includes: Credential verification: Verify whether the API caller is registered in the API call management system based on the API caller's access credential information. If the credential does not exist or is invalid, the access request is rejected. IP address verification: The IP address provided during registration is queried based on the API caller's access credentials, and compared with the IP address sent by the client. If they do not match, the access request is rejected; Security protection level verification: query the security protection level information provided by the API caller during registration based on the API caller's access credentials, and compare it with the security protection level information of the called API. If the API caller's security protection level is higher than or equal to the security protection level of the called API, access is allowed; otherwise, the access request is rejected. Signature verification: Combine the data of the access request into a string to be signed in a specific order and format, query the corresponding encryption key through the API caller's access credentials, and use the encryption key and the HMAC-SHA256 algorithm to encrypt the string to be signed, generate the signature of the API call control system, compare the signature sent by the client with the generated signature, and reject the access request if they do not match; API access permission verification: The API caller's access credential information is matched in the whitelist of access APIs. If a match is found, it means that the API caller has subscribed to the API and has access rights to the API. Access is performed. Otherwise, the access request is denied.

3. A method for API call authentication with different security protection levels for a specific field, characterized in that: The method is executed by the API call control system with different security protection levels for specific fields according to claim 1, and includes: Step 101: Receive the IP address and security protection level of the API caller provided by the developer, and allow the API caller to register; Step 102: The API call control system receives the registration information of the API caller, and generates a unique identifier as an access credential based on the caller's IP address and security protection level through a hash signature algorithm. At the same time, the API call control system creates an encryption key that uniquely corresponds to the access credential. Step 103: After creating the access credentials and encryption key, the API call management system sends the access credentials and encryption key to the API caller and records their information; Step 104: The API display center module receives developer access, allows the developer to select a desired API from the accessible API range, and initiates a subscription application based on the API caller's access credentials to obtain the corresponding API call permission; Step 105: After receiving the subscription application, the API call management system determines the IP address, security protection level attributes, and developer of the API caller based on the access credentials, and compares the security protection level of the API caller with that of the subscribed API: when the API caller's security protection level is lower than the subscribed API's security protection level, the subscription is rejected; otherwise, it is allowed.

4. A method for API call authentication with different security protection levels for a specific field, characterized in that: Based on the API call control system with different security protection levels for specific fields according to claim 1, the method comprises: Step 201: The developer constructs an access request to the subscription API, including the following: a. HTTP request method; b. Request URI; c. Request parameters: including URL query parameters and parameters in the request body; d. Request header information; e. The subject of the request; Step 202: Combine the HTTP request method, request URI, request parameters, request header information, and request subject into a string to be signed in a specific order and format to generate a signature, and use the encryption key and HMAC-SHA256 algorithm to perform a hash message authentication code encryption on the constructed string to generate a signature string for identifying the uniqueness and integrity of the current access request; wherein, the encryption key generation process is as follows: the API call control system generates a unique identifier as an access credential based on the IP address and security protection level of the API caller through a hash signature algorithm, and at the same time, the API call control system creates an encryption key that uniquely corresponds to the access credential; Step 203: The client sends an API access request, carrying the following information: Access credentials; Signature: used to prove that the API access request is initiated by an API caller who has registered in the API call control system and has a legitimate key; Key verification information: including the IP address and security protection level attributes of the API caller, which is used for subsequent verification and authentication process; Timestamp; Step 204: After receiving the API access request, the API call management and control system performs multi-level authentication on the API access request; Step 205: If the authentication is successful, the API caller's access credential information is matched in the whitelist of API access. If a match is found, it means that the API caller has subscribed to the API and has access rights to the API. The access is performed. Otherwise, the request is rejected. Step 206: The API call management system issues a temporary token with time validity to the API caller for access; Step 207: When the API caller accesses the corresponding API, the temporary Token is carried in the request. After the API call management system verifies that the Token is valid and has not expired, it forwards the request to the backend API service and returns the response data.

5. The method for API call authentication with different security protection levels for specific fields according to claim 4 is characterized in that: Step 204 includes: Credential verification: Verify whether the API caller is registered in the API call management system based on the API caller's credential information. If the credential does not exist or is invalid, the request will be rejected. IP address verification: The IP address provided during registration is queried based on the API caller's credentials, and compared with the IP address sent by the client. If they do not match, the request is rejected; Security protection level verification: query the security protection level information provided by the API caller when registering based on the API caller's credentials, and compare it with the security protection level information of the called API. If the API caller's security protection level is higher than or equal to the security protection level of the called API, access is allowed, otherwise the request is rejected; Signature verification: Reconstruct the string to be signed according to step 202 based on the data of the API access request, query the corresponding encryption key through the API caller's access credentials, and use the encryption key and HMAC-SHA256 algorithm to encrypt the reconstructed string, generate the signature of the API call control system, compare the signature sent by the client with the generated signature, and reject the request if they do not match.

Images