API data privacy analysis method, device and medium based on trusted execution environment

Abstract

The present invention discloses an API data privacy analysis method based on a trusted execution environment, comprising the following steps: registering an API, a data provider registers the API using a FAPI Proxy and provides registration information, the FAPI Proxy sends the registration information to a FAPI Dispatcher, and the FAPI Dispatcher records the information locally; calling the API, and completing the API registration; in the process of implementing data analysis using a data API, the analysis program of the present invention does not expose the plaintext information and calculation results of the data provided by the data API to a platform or a user during the whole process, and the platform will not obtain the encryption private key of the data provider; this prevents the platform from stealing private data including requests and results, and the user cannot obtain the plaintext data of the requested data API while obtaining the calculation results, thereby effectively protecting data privacy.

Description

Technical Field

[0001] The present invention relates to the field of software engineering technology, and in particular to an API data privacy analysis method, device and medium based on a trusted execution environment. Background Art

[0002] With the rapid development of Internet technology, data privacy protection has become a highly concerned issue. As an important tool for data transmission and interaction, the security of API (application programming interface) is directly related to the protection of data privacy. Although traditional data privacy protection methods, such as encryption and access control, can protect data privacy to a certain extent, their protection effect is limited when facing complex and changeable attack methods.

[0003] As an emerging system security and privacy protection technology, the Trusted Execution Environment (TEE) implements secure computing based on memory isolation based on hardware-secure CPUs, and can complete privacy-protected computing while ensuring computing efficiency. TEE places sensitive data and code in a secure and isolated area to prevent unauthorized access and tampering, thereby ensuring the confidentiality and integrity of the data.

[0004] However, in the existing technology, after the user sends a request to the platform, his or her own private data will be exposed to the platform, which has low security.

[0005] To this end, the present invention proposes an API data privacy analysis method based on a trusted execution environment. Summary of the invention

[0006] In view of the defects in the prior art, the present invention provides an API data privacy analysis method based on a trusted execution environment, which includes the following steps:

[0007] S1: Register API. The data provider uses FAPI Proxy to register API.

[0008] S2: Calling the API. After completing the API registration, the computing node can call the corresponding data API based on the user's computing request.

[0009] Preferably: the step S1 specifically comprises the following steps:

[0010] S11: The data provider uses FAPI Proxy to register the API and provide registration information;

[0011] S12: FAPI Proxy sends the registration information to FAPI Dispatcher, and FAPI Dispatcher records the information locally.

[0012] Preferably: in the step S11, the registration information includes the hub public key, API URL and other description information.

[0013] Preferably: the other description information includes API parameter description and return result description.

[0014] Preferably: In the step S12, any API is recorded as After the registration process is completed, the corresponding APIMeta will be recorded in FAPI Dispatcher, that is, .

[0015] Preferably, the step S2 comprises the following steps:

[0016] S21: User initiates a request;

[0017] S22: Generate the corresponding API request in EAnalyzer. When generating the API request, EAnalyzer needs to obtain the corresponding APIMeta from FAPI Dispatcher, and use the hub public key in APIMeta to encrypt the corresponding parameters and form an encrypted API request, which is recorded as ,in For the corresponding API, is the parameter plain text, is a unique identifier used to distinguish different API calls, 𝑈 is the API URL, is the encrypted parameter, It is the internal public key of EAnalyzer;

[0018] S23: Encrypt the API request. , transferred to the FAPI Dispatcher, which searches for the corresponding FAPI Proxy and sends it to the specific FAPI Proxy;

[0019] S24: FAPI Proxy receives the encrypted API request and decrypts it using the corresponding pivot private key in APIMeta to obtain the plaintext API request;

[0020] S25: FAPI Proxy sends a request;

[0021] S26: FAPI Proxy obtains the request result , and encrypt the result using the internal public key in the encryption request. , and the result is recorded as ,in is the encryption result, that is ;

[0022] S27: Send To FAPI Dispatcher, the corresponding hub private key forwarding information needs to be sent to FAPI Dispatcher at the same time;

[0023] S28: forward to the corresponding EAnalyzer, and forward the hub private key;

[0024] S29: Decryption, Obtain the plain text of the request result and perform corresponding processing, such as encrypting it using the user's hub public key;

[0025] S210: Return the result to the user.

[0026] Preferably: in step S21, the user's request is a direct API request or a computing request.

[0027] Preferably: in step S21, the user request is encrypted or unencrypted.

[0028] Preferably: in the step S22, , The pivot public key of the data provider.

[0029] Preferably: in the steps S21 to S210, FAPI Proxy is deployed on the data provider side for registering API, decrypting API requests and encrypting API results, and communicating with FAPI Dispatcher. FAPI Dispatcher is deployed on the Analyzer side for managing various APIs and communicating with FAPI Proxy. FAPI Proxy is an independent process or service that can be deployed on different nodes from HTTP API Service. FAPI Dispatcher is a module deployed in the Analyzer process. Data providers, Analyzers, and users communicate using blockchain or other third parties.

[0030] Based on the same inventive concept, an embodiment of the present invention provides an API data privacy analysis device based on a trusted execution environment, which is used to implement the aforementioned method.

[0031] The embodiment of the present invention further provides a storage medium, which is used to store, read and write the aforementioned method.

[0032] The beneficial effects of the present invention are embodied in:

[0033] In the process of implementing data analysis using a data API, the analysis program of the present invention does not expose the plaintext information and calculation results of the data provided by the data API to the platform or the user throughout the entire process, and the platform will not obtain the encryption private key of the data provider; this prevents the platform from stealing private data including requests and results, and users cannot obtain the plaintext data of the requested data API while obtaining the calculation results, thereby effectively protecting data privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0035] Figure 1 is a logic diagram of the present invention;

[0036] Figure 2 It is the overall flow chart of the present invention;

[0037] Figure 3 This is a flowchart of calling API of the present invention. DETAILED DESCRIPTION

[0038] The following embodiments of the technical solution of the present invention are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and cannot be used to limit the protection scope of the present invention.

[0039] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0040] Please refer to Figures 1 to 3 The API data privacy analysis method based on a trusted execution environment provided by an embodiment of the present invention comprises the following steps:

[0041] S1: Register API. The data provider uses FAPI Proxy to register API.

[0042] S2: Calling the API. After completing the API registration, the computing node can call the corresponding data API based on the user's computing request.

[0043] The step S1 specifically includes the following steps:

[0044] S11: The data provider uses FAPI Proxy to register the API and provide registration information;

[0045] S12: FAPI Proxy sends the registration information to FAPI Dispatcher, and FAPI Dispatcher records the information locally.

[0046] In the step S11, the registration information includes the hub public key, API URL and other description information.

[0047] The other description information includes API parameter description and return result description.

[0048] In the step S12, any API is recorded as After the registration process is completed, the corresponding APIMeta will be recorded in FAPI Dispatcher, that is, .

[0049] The step S2 comprises the following steps:

[0050] S21: User initiates a request;

[0051] S22: Generate the corresponding API request in EAnalyzer. When generating the API request, EAnalyzer needs to obtain the corresponding APIMeta from FAPI Dispatcher, and use the hub public key in APIMeta to encrypt the corresponding parameters and form an encrypted API request, which is recorded as ,in For the corresponding API, is the parameter plain text, It is a unique identifier used to distinguish different API calls. is the URL of the API, is the encrypted parameter, It is the internal public key of EAnalyzer;

[0052] S23: Encrypt the API request. , transferred to the FAPI Dispatcher, which searches for the corresponding FAPI Proxy and sends it to the specific FAPI Proxy;

[0053] S24: FAPI Proxy receives the encrypted API request and decrypts it using the corresponding pivot private key in APIMeta to obtain the plaintext API request;

[0054] S25: FAPI Proxy sends a request;

[0055] S26: FAPI Proxy obtains the request result , and encrypt the result using the internal public key in the encryption request. , and the result is recorded as ,in is the encryption result, that is ;

[0056] S27: Send To FAPI Dispatcher, the corresponding hub private key forwarding information needs to be sent to FAPI Dispatcher at the same time;

[0057] S28: forward to the corresponding EAnalyzer, and forward the hub private key;

[0058] S29: Decryption, Obtain the plain text of the request result and perform corresponding processing, such as encrypting it using the user's hub public key;

[0059] S210: Return the result to the user.

[0060] In the step S21, the user's request is a direct API request or a computing request.

[0061] In the step S21, the user request is encrypted or unencrypted.

[0062] In the step S22, , The pivot public key of the data provider.

[0063] In the steps S21 to S210, FAPI Proxy is deployed on the data provider side to register API, decrypt API requests, encrypt API results, and communicate with FAPI Dispatcher. FAPI Dispatcher is deployed on the Analyzer side to manage various APIs and communicate with FAPI Proxy. FAPI Proxy is an independent process or service that can be deployed on different nodes from HTTP API Service. FAPI Dispatcher is a module deployed in the Analyzer process. Data providers, Analyzers, and users communicate using blockchain or other third parties.

[0064] From the above description, we can know that in the process of implementing data analysis using the data API, the analysis program does not expose the plaintext information and calculation results of the data provided by the data API to the platform or users, and the platform will not obtain the encryption private key of the data provider; this prevents the platform from stealing private data including requests and results, and users cannot obtain the plaintext data of the requested data API while obtaining the calculation results, which effectively protects data privacy.

[0065] Based on the same inventive concept, an embodiment of the present invention provides an API data privacy analysis device based on a trusted execution environment, which is used to implement the aforementioned method.

[0066] The embodiment of the present invention further provides a storage medium, which is used to store, read and write the aforementioned method.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for analyzing API data privacy based on a trusted execution environment, characterized by: The following steps are involved: S1: Register API. The data provider uses FAPI Proxy to register API. S2: Calling the API. After completing the API registration, the computing node calls the corresponding data API for the user's computing request; The step S1 specifically includes the following steps: S11: The data provider uses FAPI Proxy to register the API and provide registration information; S12: FAPI Proxy sends the registration information to FAPI Dispatcher and records the information locally; The step S2 comprises the following steps: S21: User initiates a request; S22: Generate an API request in EAnalyzer. When generating the API request, EAnalyzer obtains the corresponding APIMeta from FAPI Dispatcher, and encrypts the corresponding parameters using the hub public key in APIMeta to form an encrypted API request. S23: forwarding the encrypted API request to the FAPI Dispatcher, which searches for the FAPI Proxy and sends it to the FAPIProxy; S24: FAPI Proxy receives the encrypted API request and decrypts it using the APIMeta hub private key to obtain the plaintext API request; S25: FAPI Proxy sends a request; S26: FAPI Proxy obtains the request result r and encrypts the result using the internal public key in the encryption request; S27: Send the encryption result to FAPI Dispatcher, and send the hub private key forwarding information to FAPI Dispatcher; S28: forward to the corresponding EAnalyzer, and forward the hub private key; S29: decrypt, obtain the plain text of the request result, and perform corresponding processing; S210: Return the result to the user.

2. The API data privacy analysis method based on a trusted execution environment according to claim 1, characterized in that: In the step S11, the registration information includes the hub public key, API URL and other description information.

3. The API data privacy analysis method based on a trusted execution environment according to claim 2, characterized in that: The other description information includes API parameter description and return result description.

4. The API data privacy analysis method based on a trusted execution environment according to claim 3, characterized in that: In the step S12, any API is recorded as h. After the registration process is completed, the corresponding APIMeta, ie, M(h), will be recorded in the FAPI Dispatcher.

5. The API data privacy analysis method based on a trusted execution environment according to claim 1, characterized in that: In the step S21, the user's request is a direct API request or a computing request.

6. The API data privacy analysis method based on a trusted execution environment according to claim 5, characterized in that: In the step S21, the user request is encrypted or unencrypted.

7. The API data privacy analysis method based on a trusted execution environment according to claim 6, characterized in that: In the step S22, M=Enc(Pkp,m), Pkp is the central public key of the data provider, m is the parameter plaintext, and M is the encrypted parameter.

8. The API data privacy analysis method based on a trusted execution environment according to claim 7, characterized in that: In the steps S21 to S210, FAPI Proxy is deployed on the data provider side to register API, decrypt API requests, encrypt API results, and communicate with FAPI Dispatcher. FAPI Dispatcher is deployed on the Analyzer side to manage API and communicate with FAPI Proxy. FAPI Proxy is an independent process or service, which is deployed on a different node from HTTP APIService. FAPI Dispatcher is deployed in the Analyzer process. Blockchain or other third parties are used to communicate between data providers, Analyzers, and users.

9. An API data privacy analysis device based on a trusted execution environment, characterized in that: It is used to implement an API data privacy analysis method based on a trusted execution environment as described in any one of claims 1-8.

10. A storage medium, characterized in that: It is used to store, read and write data in an API data privacy analysis method based on a trusted execution environment as described in any one of claims 1-8.

Images