Interface calling method and device

Abstract

The embodiment of the invention provides an interface calling method and device. The interface calling method comprises the steps of obtaining interaction data output by a target interface; the target interface is used for adding watermark data in response data generated by a server to obtain the interaction data; extracting watermark data in the interaction data; and determining whether to send the interactive data to a calling party based on the watermark data and the calling party of the interactive data. According to the method and the device, the interface calling behavior is subjected to security authentication based on the matching condition of the watermark added in the data output by the interface and the calling party, and when the watermark is not matched with the calling party, the calling party is considered not to be authorized, and the data can be prohibited from being sent to the calling party, so that the security of interface calling is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an interface calling method and device. Background Art

[0002] With the continuous development of Application Programming Interface (API) technology and the rapid growth of interactive data, interface call security faces huge challenges.

[0003] When calling an interface, identity authentication is usually required first, and the identity authentication and authorization are achieved through the key assigned to the caller. The use of identity authentication cannot solve the problem of the interface being stolen after secondary packaging and the problem of the interface being abused after the key is leaked, resulting in poor security of interface calls. Summary of the invention

[0004] The interface calling method and device provided in the embodiment of the present application realize the authorization authentication of the interface calling through the matching of the watermark added in the data transmitted by the interface and the calling party, thereby improving the security of the interface calling.

[0005] In a first aspect, an embodiment of the present application provides an interface calling method, comprising: obtaining interaction data output by a target interface; the target interface is used to add watermark data to response data generated by a server to obtain the interaction data; extracting the watermark data from the interaction data; and determining whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0006] In a second aspect, an embodiment of the present application provides another interface calling method, comprising: responding to a calling request of a target interface initiated by a client, determining response data corresponding to the calling request; adding watermark data to the response data through the target interface to obtain interaction data, and sending the interaction data to the client.

[0007] In the third aspect, an embodiment of the present application provides an interface calling device, including: an interaction data acquisition module, used to obtain the interaction data output by the target interface; the target interface is used to add watermark data to the response data generated by the server to obtain the interaction data; a watermark extraction module, used to extract the watermark data in the interaction data; a calling determination module, used to determine whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0008] In a fourth aspect, an embodiment of the present application provides another interface calling device, including: a response data determination module, used to respond to a call request of a target interface initiated by a client, and determine response data corresponding to the call request; a watermark adding module, used to add watermark data to the response data through the target interface to obtain interaction data, and send the interaction data to the client.

[0009] In the fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, so that the processor executes various possible implementations of the first aspect and / or the second aspect above.

[0010] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-readable storage medium is stored computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement various possible implementations of the first aspect and / or the second aspect as described above.

[0011] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements various possible implementations of the first aspect and / or the second aspect as described above.

[0012] The interface calling method and device provided by the embodiment of the present application, for the calling scenario of the target interface, when the target interface outputs the response data generated by the service end, watermark data will be added to the response data to obtain the interactive data, so that before the caller obtains the interactive data transmitted by the target interface, a watermark check link can be added. Specifically, by matching the watermark data in the interactive data output by the extracted target interface with the caller of the interactive data, it is determined whether to forward the interactive data to the caller for use by the caller. Specifically, if the watermark data matches the caller, the interactive data is sent to the caller, otherwise it is prohibited to send the interactive data to the caller. By adding a watermark to the interface output data, when other callers intercept or forward the data output by the interface through secondary packaging, diversified channels, etc., the watermark added to the data matches the identity of the caller, and the situation of abuse or theft of the interface is discovered in time, thereby preventing the data from being used by unauthorized parties and improving the security of interface calls and data. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0014] Figure 1 Schematic diagram of several situations where API calls provided in the embodiments of the present application may have risks;

[0015] Figure 2 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 1 ;

[0016] Figure 3 A schematic diagram of a watermark adding process provided in an embodiment of the present application;

[0017] Figure 4 A schematic diagram of a watermark insertion and checking process provided in an embodiment of the present application;

[0018] Figure 5 For this application Figure 2 A schematic diagram of the process of step S203 in the illustrated embodiment;

[0019] Figure 6 Schematic diagram of several interface calling situations provided in the embodiments of the present application;

[0020] Figure 7 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 2 ;

[0021] Figure 8 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 3 ;

[0022] Fig. 9 A schematic diagram of the structure of an interface calling device provided in an embodiment of the present application;

[0023] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0024] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0026] It should be noted that the user information (including but not limited to user device information, user attribute information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0027] In order to ensure the security of API data sharing in business systems, a series of security policies need to be formulated for API calls, such as identity authentication and limiting request frequency. However, these security policies cannot identify illegal calls such as abuse by authorized parties and secondary packaging and misappropriation of interfaces, resulting in poor security of interface calls and the risk of data leakage. Abuse by authorized parties refers to the authorized party making the authorized access interface public to unauthorized third parties or other modules of the authorized party; secondary packaging and misappropriation of interfaces refers to the unauthorized secondary packaging and modification of interfaces, and providing the secondary packaged interface to other unauthorized users or nodes.

[0028] Figure 1 The following is a schematic diagram of several situations where API calls provided in the embodiments of the present application may be risky, such as Figure 1 As shown, service system 110 authorizes module 121 of application system 120 in network domain 1 to use interface API1. Application system 130 is an application system in network domain 1, that is, in the same network domain as application system 120. Application system 140 is an application system in network domain 2, that is, across network domains as application system 120.

[0029] A network domain refers to a local area network, such as a metropolitan area network. A network domain can include one or more network segments.

[0030] Under normal access conditions, module 121 of application system 120 can initiate an API1 call request to service system 110 through application system 120 or the terminal where it is located. Service system 110 responds to the call request and returns response data, such as vehicle trajectory data, vehicle flow data, pedestrian flow data, etc. in a certain area.

[0031] If the module 122 (unauthorized module) of the application system 120 calls the interface API1, it is a case of interface abuse, that is, the authorized application system accesses the interface through the unauthorized module.

[0032] If application system 130 calls API1, that is, an unauthorized application system in the same network domain accesses the interface, it is a case of interface theft. Another more serious case of interface theft is that an unauthorized application system across network domains accesses the interface, such as application system 140 in network domain 2 calling API1.

[0033] The aforementioned application system may be a system composed of one or more terminals, which is the system where the caller of the interface is located. The module in the application system may be a terminal in the application system, or may be software installed in the terminal or a functional module of the software such as a control.

[0034] In the face of the aforementioned interface abuse or theft, the existing interface identity authentication methods cannot effectively identify them, resulting in security risks in interface calls.

[0035] In order to improve the security of interface calls, an embodiment of the present application provides an interface calling method. For an interface provided by any service system to any application system, by pre-modifying the interface definition file or communication protocol, the interface has the ability to add a watermark to the output data, so that when the interactive data output by the interface is detected and before the interactive data is sent to the caller, the watermark data in the interactive data is extracted, and the match between the watermark data and the caller of the interactive data is determined, and based on the matching result, it is determined whether to send the interactive data to the caller. Through the matching judgment between the watermark and the caller, the aforementioned abuse or theft is effectively identified, avoiding the use of data transmitted by the interface by unauthorized modules of the authorized application system or unauthorized application systems, thereby improving the security of interface calls and data.

[0036] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 2 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 1 The interface calling method can be executed by any device with corresponding data processing capabilities, such as the terminal or system where the caller is located, or a module or service in the terminal or system, such as Figure 2 As shown, the interface calling method includes the following steps:

[0038] Step S201, obtaining the interactive data output by the target interface; the target interface is used to add watermark data to the response data generated by the server to obtain the interactive data.

[0039] The target interface can be any application programming interface, such as the interface provided by the application system (the service system of the application software) to one or more business systems (systems that use the application software). The provider of the target interface can also be called the owner of the target interface, which is the entity or system that provides the definition, implementation and deployment of the target interface.

[0040] When an authorized caller calls the target interface, the caller sends the target interface call request to the target interface server, which responds to the call request and returns the generated response data through the target interface. Before outputting the response data, the target interface adds watermark data to the response data. The target interface can be enabled to add watermark data to the output data by encapsulating the communication protocol of the target interface or modifying the definition file of the target interface.

[0041] For example, the target interface definition file may be modified to modify the logic part of the target interface output data, and watermark adding logic may be added to the part, so that the target interface adds watermark data to the response data according to certain rules before outputting the response data. Alternatively, the communication protocol of the target interface may be repackaged to add a new field to store the watermark data.

[0042] In order to distinguish the response data before and after the watermark data is added, the response data after the watermark data is added is called interactive data.

[0043] Figure 3 A schematic diagram of the watermark adding process provided in the embodiment of the present application is shown in FIG. Figure 3 As shown, when the authorized caller, such as software a installed on the terminal in city A, wants to obtain the trajectory data of taxi 30 in city A through the server target interface API3, the relevant personnel can initiate a call request of API3 to the server by clicking the control in the software interface opened by software a; the server responds to the call request, packages the trajectory data of taxi 30, and sends the packaged trajectory data of taxi 30 (response data) through API3. Before sending the response data, API3 will add watermark data to the response data, and return the response data with watermark data, i.e., interaction data, to the terminal. After that, you can refer to the subsequent steps to implement the watermark check of the interaction data, and determine whether to send the interaction data to software a installed on the terminal based on the check results.

[0044] When the target interface adds watermark data to the response data, the content and / or adding position of the watermark data may be determined based on the caller of the response data.

[0045] The target interface may pre-store watermark data associated with the provider identity feature of the target interface, so as to add the stored watermark data thereto before outputting the response data.

[0046] Exemplarily, the watermark data may include identity characteristics such as the name, number, and logo of the provider.

[0047] For example, if the provider of the target interface is "XX Company", the watermark data may be "owned by XX Company", or data obtained by "XX Company" through mathematical calculation, data mapping, etc., such as a hash value.

[0048] The watermark data may be invisible watermark data or implicit watermark data, that is, watermark data that cannot be discerned by the caller.

[0049] Exemplarily, the watermark data added to the response data is zero-width characters. Zero-width characters are a type of special characters that are invisible in the text and do not occupy space when displayed, thereby hiding the watermark data and achieving a traceless watermark.

[0050] Using a traceless watermark reduces the probability of the caller knowing the watermark data, prevents the watermark data from being tampered with or forged, improves the security of the watermark data, and thus improves the security of the interface call. Using zero-width characters to implement a traceless watermark is easy to implement and highly concealed.

[0051] When adding watermark data, the adding position of the watermark data may be fixed, such as adding it to a preset field of the response data.

[0052] When adding watermark data, the content of the watermark data can be determined based on the caller and the target interface called, or the content of the watermark data and the adding location, that is, the field in the response data, can be determined; thereby adding the determined content of the watermark data to a fixed field of the response data, or a determined field.

[0053] After receiving the response data from the server, the target interface can determine the field to add the watermark data based on the caller of the response data before outputting the response data, and then add the stored watermark data, such as the watermark data associated with the identity characteristics of the provider of the target interface, to the field corresponding to the response data to obtain the interaction data. Alternatively, the originally stored watermark data can be adjusted based on the caller, such as adding the caller's information to the watermark data, or obtaining the adjusted watermark data based on the caller's information and the calculation result of the watermark data; the adjusted watermark data is added to the response data to obtain the interaction data.

[0054] For example, taking the original watermark data as abcd, and the caller's identifier as 1345, the adjusted watermark data may be abcd1345, a1b3c4d5, begi, and the like.

[0055] The caller mentioned in this application refers to the target end of the interactive data, the source end of the interactive data is the target interface, and the target end refers to the end that obtains the interactive data output by the target interface. The caller can be a terminal, software installed in the terminal, a functional module of the software, etc.

[0056] Step S202: extracting watermark data from the interactive data.

[0057] Specifically, the target interface can transmit the interactive data to the terminal where the caller who initiates the call request is located. In some scenarios, the terminal where the caller who initiates the call request is located can forward the interactive data to the terminals where other callers are located. The watermark detection modules deployed on these terminals, such as the security proxy plug-in, detect the data input terminal. When the security proxy plug-in extracts the watermark data from the interactive data of the input terminal, it determines whether to send the interactive data to the caller based on the extracted watermark data.

[0058] In the case of unauthorized calls, the interactive data output by the first target interface of the first terminal that initiates the call request is forwarded to the second caller of the second terminal. The second caller is a terminal authorized to access the second target interface. The first target interface and the second target interface are different target interfaces of the same service system. When the security proxy plug-in deployed by the second terminal detects that data is input into the second terminal, it extracts the watermark data from the interactive data output by the first target interface of the second terminal. Since the extracted watermark data is the watermark data of the first caller (deployed on the first terminal) and does not match the second caller, it is prohibited to send the interactive data to the second caller.

[0059] For a terminal with a watermark detection module deployed, when data is input into the terminal, the watermark detection module will extract the watermark data from the input data. In order to save computing resources, the watermark detection module can also first identify whether the data input into the terminal is data output from any target interface; if so, extract the watermark data from the data input into the terminal; if not, directly forward the input data to its target end. The input data can be identified as data output from any target interface by the format of the input data, information on key fields, etc.

[0060] In some embodiments, watermark data in the interaction data may be extracted by scanning fields in the interaction data.

[0061] In the case of multiple target interfaces and multiple authorized callers, when inserting watermark data into the response data, the insertion positions of watermark data may be different for different target interfaces or different callers, and multiple fields in the response data where watermark data can be added can be recorded. Thus, when extracting watermark data, the multiple fields in the interactive data are scanned, and the watermark data in the interactive data is extracted based on the contents of the multiple fields.

[0062] Optionally, extracting the watermark data in the interactive data includes: extracting data of multiple fields in the interactive data; and determining the watermark data in the interactive data based on the extracted data of the multiple fields.

[0063] The interactive data output by the target interface can be pre-stored and synchronously updated to include multiple fields for adding watermark data, so that after receiving the interactive data, the data of the multiple fields in the interactive data are extracted, and the watermark data in the interactive data is obtained based on the extracted data of the multiple fields.

[0064] If the data of the multiple fields are all empty, then there is no watermark data in the interactive data. The watermark data can be obtained based on the data extracted from the fields whose data are not empty in the multiple fields. The watermark data can be obtained from the data of one or more fields, such as calculated from the data of multiple fields.

[0065] Exemplarily, the fields to which watermark data may be added in the response data include field 1, field 2, and field 3, wherein the data in field 1 and field 2 need to be processed by certain operations to obtain a watermark data. After obtaining the interactive data, i.e., the response data to which the watermark data is added, field 1, field 2, and field 3 of the interactive data may be scanned. If the data in field 1 and field 2 are empty, and the data in field 3 is not empty, the data in field 3 is extracted to obtain the watermark data; if the data in field 3 is empty, and the data in field 1 and field 2 are not empty, the data in field 1 and field 2 is extracted, and the extracted data in field 1 and field 2 are processed to obtain the watermark data, such as concatenating the data in field 1 and field 2 to obtain the watermark data.

[0066] By scanning multiple fields of the interactive data, watermark data is extracted, and all fields that may add watermark data are traversed, avoiding incomplete watermark extraction due to missing fields, thereby affecting the accuracy of subsequent watermark data and caller matching results.

[0067] In some embodiments, the field to which the watermark data is added, such as the target field, can be determined based on at least one of the target interface and the caller corresponding to the interactive data. The watermark data added to the interactive data can be obtained by directly extracting the data of the target field of the interactive data.

[0068] Step S203: Based on the watermark data and the caller of the interactive data, determine whether to send the interactive data to the caller.

[0069] Specifically, it can be determined whether the content of the extracted watermark data is consistent with the content of the watermark data agreed upon by the caller of the interactive data; if so, the interactive data is sent to the caller; if not, the interactive data is prohibited from being sent to the caller. Alternatively, the caller corresponding to the extracted watermark data can be found from the pre-stored correspondence between the watermark and the caller to determine whether the caller is consistent with the caller of the interactive data; if so, the interactive data is sent to the caller; if not, the interactive data is prohibited from being sent to the caller.

[0070] Optionally, based on the watermark data and the caller of the interactive data, determining whether to send the interactive data to the caller includes: if the caller is a preset caller, determining whether to send the interactive data to the caller based on the content and / or field of the watermark data.

[0071] The preset caller may be a caller authorized by the service system of the target interface, there may be one or more preset callers, and there may be one or more target interfaces of the service system.

[0072] If the caller of the interactive data is one of the preset callers, indicating that the caller is an authorized caller, it is further determined whether the caller matches the watermark data. When determining whether the caller matches the watermark data, in addition to considering the content of the watermark data, the field where the watermark data appears in the interactive data, that is, the field where the watermark data is located, can also be considered.

[0073] A service system can correspond to multiple preset callers, and each preset caller can correspond to one or more target interfaces authorized to call, that is, the caller authorized to call any target interface is the preset caller. In order to prevent the preset caller from abusing the target interface, it is also necessary to combine the content and field of the watermark data to further determine whether the target interface called by the preset caller is the target interface authorized to call by the preset caller.

[0074] Exemplarily, the service system provides a function of traffic flow query. Terminals in different regions that are authorized to use this function can view the traffic flow in the authorized area, such as the traffic flow of a certain road, the traffic flow of a certain geographical range in the area, etc., through the traffic flow query control in the installed business software (caller). In order to achieve the above functions, the service system provides different target interfaces to terminals in different areas to access the traffic flow in different areas through different target interfaces. An example of the abuse of the target interface by the preset caller is that the interactive data 1 output by the interface I1 (responsible for sending the traffic flow data of the A1 area) is forwarded to the terminal T2 authorized to call the I2 interface (responsible for sending the traffic flow data of the A2 area). Since the watermark data of interfaces I1 and I2 are added in different ways (determined by the content and the field where they are located), the data output by interface I1 can be found in time by the content and field where the watermark data in the extracted interactive data 1 is used without authorization, that is, the abuse of interface I1.

[0075] Specifically, when the caller of the interactive data is a preset caller, watermark data in the interactive data output by the first target interface is extracted, and based on the content and field of the extracted watermark data, it is determined whether the watermark data matches the caller of the interactive data; if they match, the interactive data is sent to the caller; if they do not match, it indicates that the caller is a caller authorized by the service system, such as a caller authorized to call the second target interface, but is not an authorized caller of the first target interface, and it is prohibited to send the interactive data to the caller. The first target interface and the second target interface are different target interfaces.

[0076] It is possible to pre-agreed on the fields of watermark data to be added to the response data obtained from the call request of the target interface for the authorized call initiated by different preset callers, as well as the content of the added watermark data. In the watermark checking stage, after obtaining the interactive data with the target end being the preset caller, determine whether the fields where the watermark data appears in the interactive data and the content of the extracted watermark data are consistent with the fields and content agreed upon by the preset caller; if so, it is considered that the watermark data matches the caller of the interactive data; otherwise, it does not match.

[0077] By combining the fields and content where the watermark data appears, the matching judgment between the watermark data and the caller is realized, the matching logic is deepened, and the accuracy of the matching judgment structure is improved; by matching different fields and watermark content for different authorized callers, the flexibility of adding watermark content is improved, the probability of the watermark data being known is reduced, and the security of the watermark data is improved.

[0078] Specifically, it can be determined whether to send the interactive data to the caller based on the matching result of the watermark data extracted from the interactive data and the caller of the interactive data. If the extracted watermark data matches the caller of the interactive data, the interactive data is sent to the caller; conversely, if the extracted watermark data does not match the caller of the interactive data, the interactive data is not allowed or prohibited to be sent to the caller, and the interactive data can be specifically blocked.

[0079] The watermark data and the caller are matched specifically, the watermark data is the watermark data corresponding to the caller, such as preset watermark data. Based on the content of the watermark data, it can be determined whether the watermark data is the preset watermark data; if so, the interactive data is sent to the caller; if not, the interactive data is blocked.

[0080] Optionally, the determining whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data includes: determining a target watermark consistent with the watermark data from the preset watermarks corresponding to the stored target interface; if the preset caller corresponding to the target watermark is inconsistent with the caller, then prohibiting the interactive data from being sent to the caller.

[0081] The preset watermark corresponding to the target interface is the watermark data corresponding to the caller authorized to call the target interface.

[0082] When determining whether the extracted watermark data matches the caller, specifically, a preset watermark that is consistent with the watermark data extracted from the interactive data can be determined from the preset watermarks of the target interface that are pre-stored. If the caller corresponding to the preset watermark is consistent with the caller of the interactive data, then it is determined that the extracted watermark data matches the caller of the interactive data; if the caller corresponding to the preset watermark data is inconsistent with the caller of the interactive data, or there is no preset watermark data that is consistent with the extracted watermark data among multiple preset watermark data of the target interface, then it is determined that the extracted watermark data does not match the caller of the interactive data.

[0083] Furthermore, the correspondence between the content of watermark data and the added fields that describe the target interface under each authorized caller can be pre-stored, so that after the watermark data in the interactive data is extracted, based on the content and the field where the watermark data is located, a preset watermark that is consistent with the content and the field where the extracted watermark data is located is searched from the correspondence. If the caller corresponding to the preset watermark in the correspondence is consistent with the caller of the interactive data, the interactive data is allowed to be sent to the caller of the interactive data; if they are inconsistent, or the preset watermark that is consistent with the content and the field where the extracted watermark data is located is not found from the correspondence, it is prohibited to send the interactive data to the caller of the interactive data.

[0084] Taking the case that there are two authorized callers of the target interface, namely caller 1 and caller 2, as an example, assuming that in the corresponding relationship, the watermark content and the fields of the preset watermarks corresponding to caller 1 and caller 2 are: (watermark 1, field 1) and (watermark 2, field 2) respectively; the caller of the interactive data is caller 3, and the watermark data extracted from the interactive data is watermark 1, and the field is 1. Then, through the corresponding relationship, it is determined that the caller corresponding to the watermark data should be caller 2, not caller 3. It is then recognized that caller 3 is using the data of the target interface without authorization, and the interactive data is blocked in time to avoid sending the interactive data to caller 3.

[0085] By giving each authorized caller of a given target interface a standard watermark, i.e., a preset watermark, and by checking whether the authorized caller corresponding to the standard watermark is consistent with the caller of the interactive data, the unauthorized caller is identified with high efficiency and accuracy.

[0086] For example, Figure 4 A schematic diagram of the watermark insertion and checking process provided in the embodiment of the present application is shown in FIG. Figure 4As shown, relevant personnel of the business system can generate a call request for the target interface through the application installed in the terminal 410 of the business system (the authorized access area is area R41), such as the relevant controls in the bus management software, such as the trajectory query button, such as a call request to view the trajectory data of buses B40 to B45 in area R41; after receiving the call request, the server of the target interface generates response data of the call request, that is, the trajectory data of buses B40 to B45 in area R41. Before sending the response data through the target interface, the target interface adds watermark data to the response data based on the caller of the response data, i.e., terminal 410 or the bus management software installed in terminal 410, and sends the response data with the watermark data added to terminal 410; the security proxy plug-in of the target interface deployed in terminal 410 checks the watermark data, and sends the response data with the watermark data added if the watermark check passes; specifically, the security proxy plug-in extracts the watermark data from the response data with the watermark data added, and the security proxy plug-in determines that the caller corresponding to the extracted watermark data is consistent with the caller of the target interface, and then sends the response data with the watermark data added, i.e., the trajectory data of buses B40 to B45 in area R41 after the watermark data is added, to the bus management software deployed in terminal 410. If, when the response data after adding the watermark data is sent to the terminal 410 at the target interface, the terminal 410 forwards the response data after adding the watermark data to the bus management software of the terminal 420 whose authorized access area is area R42, i.e., sends the data to the unauthorized caller, then the result of the watermark check of the security proxy plug-in of the target interface deployed in the terminal 420 is failure, i.e., the caller corresponding to the extracted watermark data is inconsistent with the caller corresponding to the terminal 420 (i.e., the caller of the input data), then it is prohibited to send the data, i.e., it is prohibited to send the trajectory data of buses B40 to B45 in area R41 after adding the watermark data to the bus management software deployed by the terminal 420.

[0087] The security proxy plug-in enters the working state when it detects that the deployed terminal has data input, extracts the watermark data in the data, and when the extracted watermark data is not empty, determines whether the watermark data matches the caller of the input data; if they match, the input data is allowed to continue to be sent; if they do not match, the input data is prohibited from being sent.

[0088] The interface calling method provided by the embodiment of the present application is aimed at the calling scenario of the target interface. Before the target interface outputs the response data generated by the service end, the response data will be added with watermark data, so that before the caller obtains the interactive data transmitted by the target interface, a watermark check strategy is added. Specifically, by matching the watermark data extracted from the interactive data output by the target interface with the caller of the interactive data, it is determined whether to forward the interactive data to the caller for use by the caller. Specifically, if the watermark data matches the caller, the interactive data is sent to the caller, otherwise it is prohibited to send the interactive data to the caller. By adding a watermark to the interface output data, when other callers intercept or forward the data output by the interface through secondary packaging, diversified channels, etc., the watermark added to the data matches the identity of the caller, and the abuse or theft of the target interface is discovered in time, thereby preventing the data from being used by unauthorized parties and improving the security of interface calls and data.

[0089] Figure 5 For this application Figure 2 The flowchart of step S203 in the embodiment shown is as follows: Figure 5 As shown, after extracting the watermark data from the interactive data, the following steps can be used to determine whether the interactive data is allowed to be sent to the caller of the interactive data:

[0090] Step S501: If the caller of the interactive data is a preset caller, the preset content and preset field of the watermark corresponding to the caller are obtained.

[0091] When the caller of the interactive data is an authorized caller, the preset content and preset fields of the watermark corresponding to the caller are obtained, and the preset content and preset fields are respectively the content and the appearing fields of the watermark data added in the response data agreed by the caller.

[0092] The correspondence between each preset caller and its corresponding preset content and preset field of the watermark can be pre-stored. When the caller of the interactive data is one of the preset callers, the preset content and preset field of the watermark corresponding to the caller are obtained from the correspondence.

[0093] Step S502: If the content of the watermark data is the preset content, and the field where the watermark data is located is the preset field, the interactive data is sent to the caller.

[0094] If the content and field of the watermark data extracted from the interactive data are consistent with the preset content and preset field of the caller corresponding to the interactive data, the interactive data is allowed to be sent to the caller.

[0095] Step S503: If the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field, it is prohibited to send the interactive data to the caller.

[0096] If the content of the watermark data extracted from the interaction data does not match the preset content, or the field where the watermark data is located in the interaction data does not match the preset field, it indicates that although the caller is an authorized user of the service system of the target interface, it is not an authorized user of the target interface, and the target interface is abused. In this case, it is prohibited to send the interaction data to the requesting caller. For example, the interaction data can be blocked to prevent the authorized user from abusing the target interface.

[0097] Step S504: If the watermark data is not empty and the caller of the interactive data is not the preset caller, it is prohibited to send the interactive data to the caller.

[0098] If the caller of the interactive data is not one of the preset callers, it indicates that the caller is not an authorized caller. An optional method is to directly prohibit the interactive data from being sent to the caller.

[0099] When the caller of the interactive data is not the preset caller, it is possible to further determine whether the watermark data is empty. That is, if the caller of the interactive data is not the preset caller and the watermark data is not extracted from the interactive data, it indicates that the target interface has low security requirements. For example, if the interactive data does not involve an interface that involves privacy, the interactive data can be allowed to be sent to the caller.

[0100] In other embodiments, if the watermark data is not extracted from the interaction data, it indicates that the watermark data in the interaction data has failed to be added, or the watermark data has been tampered with or removed, and the interaction data is prohibited from being sent to the caller of the interaction data.

[0101] In other embodiments, some interfaces do not need to add watermark data to the received response data. Such interfaces do not involve privacy data and are public service interfaces. When the caller of the interactive data does not belong to the preset caller, it is also necessary to determine whether watermark data is added to the interactive data, that is, whether the watermark data in the extracted interactive data is empty; if it is not empty, it is prohibited to send the interactive data to its caller; if the watermark data in the extracted interactive data is empty, that is, the interactive data is not added with watermark data, it indicates that the target interface is a public service interface and can be accessed by non-preset callers, and it is allowed to send the interactive data to its caller.

[0102] For example, Figure 6 Schematic diagram of several interface calling situations provided in the embodiments of the present application, such as Figure 6As shown, the service system of the application provides three target interfaces, namely interfaces 611 to 613, and one public interface, namely interface 614, wherein the callers authorized by interface 611 include modules 621 and 622 of application system 620 in domain D61, and application system 630 in domain D62, the callers authorized by interface 612 include module 621, the callers authorized by interface 613 include application system 640 in domain D62, and interface 614 authorizes any caller to use. Figure 6 In the example, a solid line connects the caller that authorizes access to the interface.

[0103] For the response data of the call request of each interface, the fields available for adding watermark data include fields F1 to F4. It is assumed that the field where the added watermark data is located is determined by the called target interface, and the content of the added watermark data is determined by the caller. Figure 6 The watermark adding configurations corresponding to the callers and interfaces shown are:

[0104] The preset watermark corresponding to module 621 is watermark W1, the preset watermark corresponding to module 622 is watermark W2, the preset watermark corresponding to application system 630 is W3, and the preset watermark corresponding to application system 640 is W4; when interface 611 is called, the preset field for adding watermark data to the response data is field F1, and when interface 612 is called, the preset field for adding watermark data to the response data is field F2; when interface 613 is called, the preset fields for adding watermark data to the response data include fields F3 and F4.

[0105] Then, in the case where module 621 calls interface 613, interface 613 adds watermark W1 in fields F3 and F4 of the response data. The response data after adding the watermark data passes through a watermark detection module such as a security proxy plug-in of the service system. The extracted watermark data is watermark W1, and the fields where the watermark data is located are fields F3 and F4. Since the preset field corresponding to module 621 is field F2, and the field where it is located does not match the preset field, it is prohibited to send the response data to module 621.

[0106] When the application system 630 calls the interface 612, the interface 612 adds the watermark W3 in the field F2 of the response data. The response data after adding the watermark data passes through the watermark detection module, and the watermark data is extracted as the watermark W3 and the field where the watermark data is located is the field F2. Since the preset field corresponding to the application system 630 is the field F1 and the field does not match the preset field, it is prohibited to send the response data to the application system 630.

[0107] When the application system 640 calls the interface 613, the interface 613 adds the watermark W4 to the fields F3 and F4 of the response data. The response data after adding the watermark data passes through the watermark detection module, and the watermark data is extracted as the watermark W4, and the fields where the watermark data is located include fields F3 and F4. They are consistent with the preset content and preset fields of the watermark corresponding to the application system 640. Then the response data is sent to the application system 640.

[0108] In the case where the application system 640 calls the interface 614, since the interface 614 is not a target interface, watermark data cannot be added to the response data; the watermark detection module scans the fields F1 to F4 of the response data and does not extract the watermark data in the response data, so it can further determine whether the called interface is the target interface. Since the interface 614 is not the target interface, the response data is allowed to be sent to the application system 640. If the watermark data is not extracted from the data output by the interface 614 and the called interface is the target interface, it is prohibited to send the data output by the interface 614 to the caller.

[0109] In this embodiment, when the caller is an authorized caller, that is, a preset caller, the content and field of the watermark data are still used to determine whether the interface call is authorized, thereby determining whether to send the data output by the interface to the caller, thereby avoiding the abuse of the interface by the authorized caller and improving the security and compliance of the interface call; by flexibly customizing the content and added fields of the watermark for different authorized callers, the probability of the watermark addition method being known is reduced, the security of the watermark is improved, and the accuracy of the watermark-based call behavior judgment is further improved; when the caller is not an authorized caller, whether the call behavior is authorized is directly determined by the judgment result of whether the watermark data is empty, which, on the one hand, avoids the unauthorized caller from stealing the interface, and on the other hand, simplifies the judgment logic of the call behavior and improves the recognition speed of the unauthorized call behavior. This embodiment implements different call behavior judgment logics through the different identities of the callers, effectively identifies various illegal calls of the interface, and improves the security of the interface call.

[0110] Figure 7 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 2 , this embodiment is in Figure 2 Based on the embodiment shown, the watermark data extraction step is further limited, and the relevant steps determined by the caller are added, such as Figure 7 As shown, the interface calling method provided in this embodiment may specifically include the following steps:

[0111] Step S701: after the terminal successfully deploys the proxy service of the target interface and the terminal passes identity authentication, obtaining authorization information for the terminal to call the application module of the target interface.

[0112] The application module is a module used to initiate a call request of the target interface, which can be a control of the software. The terminal can be a terminal in any business system, and the terminal can access the interface corresponding to the target interface through a website or installed software, and send the call request of the target interface to the server of the target interface through the control provided by the interface.

[0113] The proxy service is a service provided by the target interface or the service system of the target interface, which can be a plug-in. The proxy service is responsible for extracting and checking the watermark of the data input to the deployed terminal, specifically extracting the watermark data from the data input to the terminal, and based on the extracted watermark data and the caller of the input data, determining whether to allow the input data to be sent to its caller.

[0114] The terminal identity authentication step can be performed by a dedicated authentication server, which stores the identity information of the terminals authorized by each target interface, such as a white list, and implements the terminal identity authentication by determining whether the terminal identifier is an identifier in the white list. Only terminals that pass the identity authentication can initiate a call request for the target interface.

[0115] If the terminal does not deploy the software corresponding to the proxy service, or the terminal fails the identity authentication, the terminal is not allowed to initiate a call request to the target interface.

[0116] Specifically, if it is detected that the terminal has not successfully deployed the proxy service of the target interface, the authentication server will authenticate the terminal after the proxy service of the target interface is successfully deployed on the terminal; if the terminal's identity authentication fails, the step of authenticating the terminal by the authentication server is repeated until the terminal's identity authentication passes.

[0117] In some embodiments, when it is detected that the terminal fails to successfully deploy the proxy service of the target interface or the terminal fails identity authentication, corresponding prompt information may also be generated, such as please install a proxy service plug-in or identity authentication fails.

[0118] After the terminal has deployed the proxy service of the target interface and the terminal identity authentication is passed, the terminal is allowed to initiate a call request to the target interface. In order to facilitate the subsequent confirmation of the caller of the interactive data, the proxy service deployed by the terminal needs to obtain the authorization information of the application module of the terminal accessing the target interface from the authentication server, and then determine the caller based on the authorization information.

[0119] Step S702: Acquire the interaction data output by the target interface.

[0120] The target interface is used to add watermark data to the response data obtained by the output server in response to the call request of the target interface to obtain the interactive data.

[0121] Step S703: Determine the caller of the interactive data based on the authorization information.

[0122] After receiving the interactive data output by the target interface, the proxy service determines the caller of the interactive data, such as the aforementioned application module, based on the pre-acquired authorization information of the deployed terminal.

[0123] In some embodiments, there can be multiple target interfaces and multiple application modules. One terminal authorizes one application module to access one target interface, and the same application module can be the authorized caller of multiple target interfaces, that is, one application module can be authorized to access multiple target interfaces.

[0124] The authorization information may record the application modules of the terminal accessing each target interface, such as recording the correspondence between the target interface and the application module authorized to access the target interface. Thus, after detecting that data (including interactive data) is input into the terminal, the caller of the input data is determined based on the correspondence and the target interface called by the input data.

[0125] Step S704: determine the target field based on the target interface and / or the caller of the interaction data.

[0126] After determining the caller of the interactive data, the proxy service determines the location of the watermark data in the interactive data, ie, the target field, based on at least one of the target interface outputting the interactive data and the caller of the interactive data.

[0127] The correspondence between the target field and at least one of the target interface and the caller can be pre-stored, so that the target field for adding watermark data in the interactive data can be determined based on the correspondence and the caller of the interactive data and / or the called target interface.

[0128] Step S705: obtaining the watermark data based on the data of the target field in the interactive data.

[0129] After the proxy service determines the target field, it extracts the data of the target field in the interaction data to obtain the watermark data in the interaction data.

[0130] Step S706: Based on the watermark data and the caller of the interactive data, determine whether to send the interactive data to the caller.

[0131] After extracting the watermark data from the interactive data, the proxy service can determine whether the watermark data matches the caller; if so, the interactive data is allowed to be sent to the caller; if not, the interactive data is blocked.

[0132] In this embodiment, the proxy service of the target interface deployed by the terminal is used to extract the watermark in the data output by the target interface and determine the interface calling behavior, so that the transmission of the interface output data under the unauthorized calling behavior can be blocked on the terminal side, thereby improving the security of the interface calling and reducing the risk of data leakage. For the terminal that successfully deploys the proxy service, the identity authentication of the terminal and the acquisition of the authorization information are realized through the identity authentication step, and the security of the interface calling is further improved through the identity authentication. By acquiring the authorization information, the caller of the interface output data can be reliably confirmed, thereby providing a basis for the subsequent watermark data detection steps. When extracting the watermark, in order to avoid scanning multiple fields, the target interface and the caller are used to directly lock the field where the watermark data should appear, that is, the target field, so that only the data of the target field is extracted as the watermark data to match with the caller, so as to determine whether the data is allowed to be sent based on the matching result. Since the correct field of the watermark data is directly locked, the efficiency of watermark data extraction is improved compared with the method of scanning multiple fields. At the same time, when the watermark data matches the caller, there is no need to consider the field, only the content is compared, which improves the matching efficiency, thereby improving the efficiency of determining whether the calling behavior is authorized or not.

[0133] Furthermore, after prohibiting the interactive data output by the target interface from being sent to the caller, a call alarm log may be generated to inform the service system or provider of the target interface that there is a risk of unauthorized access to the target interface.

[0134] Specifically, after prohibiting the interactive data from being sent to the caller, a call alarm log can be generated based on the caller of the interactive data to inform the service system or provider of the target interface of the caller's information of the unauthorized call to the target interface. The call alarm log also includes the called target interface or other information.

[0135] The embodiment of the present application also provides another interface calling method, which is applied to the server of the target interface, and the method includes: responding to the calling request of the target interface initiated by the client, determining the response data corresponding to the calling request; adding watermark data to the response data through the target interface to obtain interaction data, and sending the interaction data to the client. The target interface can add watermark data associated with the identity characteristics of the provider of the target interface in the response data.

[0136] The watermark data may be invisible watermark data, such as zero-width characters.

[0137] After the terminal generates a call request for the target interface, the server of the target interface responds to the call request and sends response data to the target interface; the target interface adds watermark data to the response data based on the caller of the response data, obtains the response data after the watermark data is added, and records it as interaction data.

[0138] Optionally, adding watermark data to the response data through the target interface to obtain the interactive data includes: adding watermark data to the response data through the target interface based on the caller of the response data to obtain the interactive data.

[0139] For example, the information of the caller of the response data can be superimposed on the watermark data stored in the target interface (e.g., the watermark data associated with the identity characteristics of the provider of the target interface), and the watermark data superimposed with the caller information can be added to the response data to be output. Alternatively, the location where the watermark data is added, i.e., the field where it is located, can be determined based on the caller of the response data (or call request), so that the watermark data is added to the field corresponding to the response data.

[0140] In other embodiments, the location where the watermark data is added may be determined based on the caller of the response data and the target interface called.

[0141] After the watermark data is added, the target interface returns the response data with the watermark data added to the terminal, such as sending it to the watermark detection module deployed in the terminal or the proxy service of the target interface, so that the watermark detection module or the proxy service of the target interface extracts the watermark data from the received data, and determines to send the received data to the corresponding caller based on the extracted watermark data and the caller of the received data.

[0142] Optionally, based on the caller of the response data, watermark data is added to the response data to obtain interactive data, including: obtaining watermark data associated with the provider identity of the target interface; for response data to be output by the target interface, based on the caller of the response data, or based on the caller of the response data and the target interface, determining an adding field for the watermark data; and adding the watermark data to the adding field of the response data to obtain the interactive data.

[0143] The field for adding watermark data can be established in advance, and the correspondence between the caller, or the caller and the target interface can be established. After the target interface receives the response data to be output, it can be determined whether the interface called by the response data is one of the target interfaces; if so, the field corresponding to the caller of the response data, or the caller of the response data and the called target interface can be found from the correspondence; thereby, the watermark data associated with the identity of the provider of the target interface can be added to the corresponding field of the response data.

[0144] If the caller of the response data is not the target interface, the response data can be sent directly to the caller, or other authentication methods can be used, such as key authentication, identity authentication, etc. If the authentication is successful, the response data is allowed to be sent to the caller, and if the authentication fails, the response data is prohibited from being sent to the caller.

[0145] Figure 8 Schematic diagram of the process of the interface calling method provided in the embodiment of the present application Figure 3 ,This embodiment is triggered from the whole link, covering steps such as proxy service deployment, identity authentication, interface call, watermark insertion, watermark checking, call blocking, and alarm log generation, as follows Figure 8 As shown, the interface calling method includes:

[0146] Step S801, security proxy plug-in deployment, deploy the security proxy plug-in of the target interface on the terminal of the target interface service domain, and detect whether the security proxy plug-in is deployed successfully; if so, execute step S802; if not, continue to detect whether the security proxy plug-in is deployed successfully.

[0147] The service network domain of the target interface is one or more network domains provided with services by the target interface, and the service network domain may include one or more terminals.

[0148] The security proxy plug-in knows how to add various watermark data to the interactive data output by the target interface, and is used to extract the watermark data from the data after detecting the data input to the terminal, so as to determine whether to allow the data to be sent to its caller based on the watermark data and the caller of the data.

[0149] Step S802, apply identity authentication, perform zero-trust identity authentication on the terminal of the target interface service domain, and detect whether the identity authentication passes; if passed, execute step S803; if not, continue to detect whether the identity authentication passes.

[0150] A dedicated identity authentication service or server can perform identity authentication for each terminal in the service domain. When a new terminal is added to the service domain, the terminal can be registered with the identity authentication server to perform zero-trust identity authentication for the terminal based on the terminal registration information. After the authentication is passed, the terminal can be saved in the whitelist of the identity authentication server as a trusted terminal.

[0151] Step S803, target interface calling, the terminal after identity authentication initiates a call request of the target interface, and the server of the target interface returns response data of the call request.

[0152] Step S804, seamless watermark data insertion, the target interface inserts seamless watermark data related to the identity characteristics of the provider of the target interface into the response data to obtain the response data after the watermark is inserted.

[0153] The provider of the target interface may be the owner of the response data returned in response to the call request.

[0154] Step S805, traceless watermark detection, the security agent plug-in deployed by the terminal detects all fields where traceless watermark data appears in the input data, and extracts the watermark data in the input data.

[0155] The input data of the security proxy plug-in includes the response data output by the target interface after the watermark is inserted, that is, the interactive data output by the target interface.

[0156] The watermark insertion service or server can synchronize the fields where the invisible watermark data appears in the response data to the security proxy plug-in, so that the security proxy plug-in scans all fields in the input data where the invisible watermark data may be inserted, thereby extracting the invisible watermark data from the input data.

[0157] Step S806, interface usage determination, based on the extracted seamless watermark data and the caller of the input data, determines whether the target interface has unauthorized use; if so, execute step S807; if not, execute step S809.

[0158] Specifically, if the field where the traceless watermark data appears or the content of the traceless watermark data in the interactive data output by the received target interface is inconsistent with the field where the traceless watermark data is inserted or the content of the traceless watermark data corresponding to the caller of the recorded interactive data, or the caller corresponding to the recorded traceless watermark data is inconsistent with the caller of the interactive data, then it is determined that the target interface has been used without authorization, such as being called by an unauthorized application module, or there is unauthorized external service, etc.

[0159] Step S807, prohibiting the input data from being sent to its caller.

[0160] Step S808: Generate a call alarm log.

[0161] Step S809, allowing the input data to be sent to its caller. When no unauthorized use of the target interface is detected, the security proxy plug-in forwards the input data to the caller of the input data for the caller to use or view the input data.

[0162] Fig. 9 A schematic diagram of the structure of the interface calling device provided in the embodiment of the present application, such as Fig. 9 As shown, the interface calling device provided in this embodiment includes: an interactive data acquisition module 910, a watermark extraction module 920 and a calling determination module 930.

[0163] Among them, the interaction data acquisition module 910 is used to obtain the interaction data output by the target interface; the target interface is used to add watermark data to the response data generated by the server to obtain the interaction data; the watermark extraction module 920 is used to extract the watermark data in the interaction data; the call determination module 930 is used to determine whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0164] In a possible implementation, the calling determination module 930 is specifically configured to: if the caller is a preset caller, determine whether to send the interactive data to the caller based on the content and / or field of the watermark data.

[0165] In a possible implementation, the determination module 930 is called to specifically:

[0166] If the caller of the interactive data is a preset caller, the preset content and preset field of the watermark corresponding to the caller are obtained; if the content of the watermark data is the preset content and the field where the watermark data is located is the preset field, the interactive data is sent to the caller.

[0167] In a possible implementation, the calling determination module 930 is further used to: if the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field, prohibit the interactive data from being sent to the caller.

[0168] In a possible implementation, the calling determination module 930 is further configured to: if the watermark data is not empty and the caller of the calling request is not a preset caller, prohibit sending the interactive data to the caller.

[0169] In one possible implementation, the calling determination module 930 is specifically used to: determine a target watermark that is consistent with the watermark data from the preset watermarks corresponding to the stored target interface; if the preset caller corresponding to the target watermark is inconsistent with the caller, prohibiting the interaction data from being sent to the caller; if the preset caller corresponding to the target watermark is consistent with the caller, sending the interaction data to the caller.

[0170] In a possible implementation, the watermark extraction module 920 is specifically configured to: extract data of multiple fields in the interaction data; and determine the watermark data in the interaction data based on the extracted data of the multiple fields.

[0171] In a possible implementation, the watermark extraction module 920 is specifically used to: determine the target field based on the target interface and / or the caller of the interactive data; and obtain the watermark data based on the data of the target field in the interactive data.

[0172] In one possible implementation, the interface calling device is applied to the proxy service of the target interface deployed by the terminal, and the interface calling device also includes a caller determination module, which is used to: obtain the authorization information of the application module of the terminal calling the target interface after the terminal successfully deploys the proxy service of the target interface and the terminal identity authentication is passed; after receiving the interaction data output by the target interface, determine the caller of the interaction data based on the authorization information.

[0173] In a possible implementation manner, the watermark data added to the response data is a zero-width character.

[0174] The interface calling device provided in this embodiment can execute the interface calling method provided in the above method embodiment for the terminal for calling the interface or the watermark detection module deployed in the terminal. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0175] An embodiment of the present application also provides another interface calling device, which is applied to the service segment of the target interface. The interface calling device includes: a response data determination module, which is used to respond to the call request of the target interface initiated by the client, and determine the response data corresponding to the call request; a watermark adding module, which is used to add watermark data to the response data through the target interface to obtain interaction data, and send the interaction data to the client.

[0176] In one possible implementation, the watermark adding module is specifically used to: obtain watermark data associated with the provider identity of the target interface; determine the adding field of the watermark data based on the caller of the response data, or based on the caller of the response data and the target interface; add the watermark data to the adding field of the response data to obtain the interaction data.

[0177] The interface calling device provided in this embodiment can execute the interface calling method provided in the above method embodiment and applied to the server side of the target interface. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0178] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Fig.10As shown, the electronic device provided by this embodiment includes: at least one processor 1001 and a memory 1002. Optionally, the electronic device further includes a communication component 1003. The processor 1001, the memory 1002 and the communication component 1003 are connected via a bus 1004.

[0179] In a specific implementation process, at least one processor 1001 executes the computer-executable instructions stored in the memory 1002, so that at least one processor 1001 executes the above method.

[0180] The specific implementation process of the processor 1001 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0181] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0182] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0183] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0184] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0185] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0186] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0187] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0188] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0189] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0190] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0191] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory, random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0192] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0193] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. An interface calling method, characterized in that: include: Get the interactive data output by the target interface; The target interface is used to add watermark data to the response data generated by the server to obtain the interaction data; Extracting watermark data from the interactive data; Based on the watermark data and the caller of the interactive data, it is determined whether to send the interactive data to the caller.

2. The method according to claim 1, characterized in that The determining whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data includes: If the caller is a preset caller, it is determined whether to send the interactive data to the caller based on the content and / or field of the watermark data.

3. The method according to claim 2, characterized in that The determining whether to send the interactive data to the caller based on the content and / or field of the watermark data includes: Obtaining preset content and preset fields of the watermark corresponding to the caller; If the content of the watermark data is the preset content, and the field where the watermark data is located is the preset field, sending the interactive data to the caller; If the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field, sending the interactive data to the caller is prohibited.

4. The method according to claim 1, characterized in that: The determining whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data includes: If the watermark data is not empty and the caller of the interactive data is not a preset caller, sending the interactive data to the caller is prohibited.

5. The method according to claim 1, characterized in that The determining whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data includes: Determining a target watermark consistent with the watermark data from the stored preset watermarks corresponding to the target interface; If the preset caller corresponding to the target watermark is inconsistent with the caller, it is prohibited to send the interactive data to the caller.

6. The method according to any one of claims 1 to 5, characterized in that: The extracting the watermark data from the interactive data comprises: Extracting data of multiple fields in the interaction data; Based on the extracted data of the multiple fields, watermark data in the interactive data is determined.

7. The method according to any one of claims 1 to 5, characterized in that: The extracting the watermark data from the interactive data comprises: Determine a target field based on the target interface and / or the caller of the interaction data; The watermark data is obtained based on the data of the target field in the interactive data.

8. The method according to any one of claims 1 to 5, characterized in that: The method is applied to the proxy service of the target interface deployed by the terminal, and the method further comprises: After the terminal successfully deploys the proxy service of the target interface and the terminal passes identity authentication, obtaining authorization information for the terminal to call the application module of the target interface; After receiving the interactive data output by the target interface, the caller of the interactive data is determined based on the authorization information.

9. An interface calling method, characterized in that: include: In response to a call request of a target interface initiated by a client, determining response data corresponding to the call request; Through the target interface, watermark data is added to the response data to obtain interaction data, and the interaction data is sent to the client.

10. An interface calling device, characterized in that: include: An interactive data acquisition module, used to acquire interactive data output by the target interface; The target interface is used to add watermark data to the response data generated by the server to obtain the interaction data; A watermark extraction module, used to extract watermark data from the interactive data; A calling determination module is used to determine whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data.

Images