Interface calling method and device

Abstract

Embodiments of the present application provide an interface calling method and device. The interface calling method comprises: obtaining interaction data output by a target interface; the target interface is used for adding watermark data in response data generated by a server to obtain the interaction data; extracting the watermark data in the interaction data; determining whether to send the interaction data to a calling party based on the watermark data and the calling party of the interaction data. The matching condition of the watermark added in the data output by the interface and the calling party is determined, the security of the calling interface behavior is authenticated, when the watermark and the calling party do not match, it is considered that the calling party is not authorized, and the data can be prohibited from being sent to the calling party, thereby improving the security of the interface calling.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an interface calling method and device. Background Art

[0002] With the continuous development of Application Programming Interface (API) technology and the rapid growth of interactive data, interface call security faces huge challenges.

[0003] When calling an interface, identity authentication is usually required. This authentication and authorization are achieved using a key assigned to the caller. However, using identity authentication doesn't address issues like theft through secondary packaging and abuse of the interface after key leakage, resulting in poor interface security. Summary of the Invention

[0004] The interface calling method and device provided in the embodiments of the present application implement authorization authentication of the interface call by matching the watermark added to the data transmitted by the interface with the caller, thereby improving the security of the interface call.

[0005] In a first aspect, an embodiment of the present application provides an interface calling method, comprising: obtaining interaction data output by a target interface; the target interface is used to add watermark data to response data generated by a server to obtain the interaction data; extracting the watermark data from the interaction data; and determining whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0006] In a second aspect, an embodiment of the present application provides another interface calling method, comprising: responding to a call request of a target interface initiated by a client, determining response data corresponding to the call request; adding watermark data to the response data through the target interface to obtain interaction data, and sending the interaction data to the client.

[0007] In a third aspect, an embodiment of the present application provides an interface calling device, comprising: an interaction data acquisition module for acquiring interaction data output by a target interface; the target interface is used to add watermark data to response data generated by a server to obtain the interaction data; a watermark extraction module for extracting watermark data from the interaction data; and a calling determination module for determining whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0008] In a fourth aspect, an embodiment of the present application provides another interface calling device, comprising: a response data determination module configured to determine response data corresponding to a calling request of a target interface initiated by a client in response to the calling request; and a watermark adding module configured to add watermark data to the response data through the target interface to obtain interaction data, and send the interaction data to the client.

[0009] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor; the memory stores computer execution instructions; and the processor executes the computer execution instructions stored in the memory, so that the processor executes various possible implementations of the first aspect and / or the second aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by a processor to implement various possible implementations of the first aspect and / or the second aspect.

[0011] In a seventh aspect, an embodiment of the present application provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement various possible implementations of the first aspect and / or the second aspect.

[0012] The interface calling method and device provided by the embodiments of the present application are for the calling scenario of a target interface. When the target interface outputs response data generated by a server, the target interface adds watermark data to the response data to obtain interaction data, so that a watermark checking link is added before a calling party obtains the interaction data transmitted by the target interface. Specifically, whether the interaction data is forwarded to the calling party for use by the calling party is determined by matching the watermark data in the interaction data output by the target interface with the calling party. Specifically, if the watermark data matches the calling party, the interaction data is sent to the calling party, otherwise the interaction data is prohibited from being sent to the calling party. By adding watermark in the interface output data, when other calling parties intercept or forward the data output by the interface through secondary encapsulation, diversified channels or other ways, the misuse or theft of the interface is discovered in time by matching the watermark added in the data with the identity of the calling party, so that the data is prevented from being used by unauthorized parties, and the security of the interface calling and the data is improved. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings, which are incorporated into and form a part of the specification, illustrate an embodiment consistent with the present application and, together with the specification, serve to explain the principles of the application.

[0014] Figure 1 The schematic diagram of several situations in which the API calling provided by the embodiments of the present application is at risk.

[0015] Figure 2 Schematic diagram of the interface calling method provided in this application embodiment Figure 1 ;

[0016] Figure 3 A schematic diagram of the watermark adding process provided in an embodiment of the present application;

[0017] Figure 4 A schematic diagram of the watermark insertion and checking process provided in an embodiment of the present application;

[0018] Figure 5 For this application Figure 2 A schematic flow chart of step S203 in the illustrated embodiment;

[0019] Figure 6 Schematic diagram of several interface call scenarios provided in the embodiments of the present application;

[0020] Figure 7 Schematic diagram of the interface calling method provided in this application embodiment Figure 2 ;

[0021] Figure 8 Schematic diagram of the interface calling method provided in this application embodiment Figure 3 ;

[0022] Figure 9 A schematic diagram of the structure of the interface calling device provided in an embodiment of the present application;

[0023] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0024] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0025] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0026] It should be noted that the user information (including but not limited to user device information, user attribute information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances must be provided for users to choose to authorize or refuse.

[0027] To ensure the security of API data sharing within business systems, a series of security policies must be developed for API calls, such as identity authentication and limiting request frequency. However, these security policies are unable to identify illegal calls such as abuse by authorized parties and secondary packaging and misappropriation of interfaces, resulting in poor interface call security and the risk of data leakage. Abuse by authorized parties refers to the authorizer exposing the authorized interface to unauthorized third parties or other modules of the authorized party; secondary packaging and misappropriation of interfaces refers to the unauthorized secondary packaging and modification of interfaces, and the provision of the secondary packaged interface to other unauthorized users or nodes.

[0028] Figure 1 The following is a schematic diagram of several situations where API calls are risky, as provided in the embodiments of this application. Figure 1 As shown, service system 110 authorizes module 121 of application system 120 in network domain 1 to use interface API1. Application system 130 is an application system under network domain 1, that is, it is in the same network domain as application system 120. Application system 140 is an application system under network domain 2, that is, it is across the network domain of application system 120.

[0029] A network domain refers to a local area network, such as a metropolitan area network. A network domain can include one or more network segments.

[0030] Under normal access conditions, module 121 of application system 120 can initiate an API1 call request to service system 110 through application system 120 or the terminal where it is located. Service system 110 responds to the call request and returns response data, such as vehicle trajectory data, traffic flow data, pedestrian flow data, etc. in a certain area.

[0031] If the module 122 (unauthorized module) of the application system 120 calls the interface API1, it is a case of interface abuse, that is, the authorized application system accesses the interface through the unauthorized module.

[0032] If application system 130 calls API1, that is, an unauthorized application system in the same network domain accesses the interface, it is a case of interface theft. Another more serious case of interface theft is that an unauthorized application system across network domains accesses the interface, such as application system 140 in network domain 2 calling API1.

[0033] The aforementioned application system can be a system composed of one or more terminals, which is the system where the interface caller is located. The module in the application system can be a terminal in the application system, or it can be software installed on the terminal or a functional module of the software such as a control.

[0034] In the face of the aforementioned interface abuse or theft, the existing interface identity authentication method cannot effectively identify it, resulting in security risks in interface calls.

[0035] In order to improve the security of interface calls, an embodiment of the present application provides an interface calling method. For an interface provided by any service system to any application system, by pre-modifying the interface definition file or communication protocol, the interface is enabled to add a watermark to the output data. Therefore, when the interactive data output by the interface is detected and before the interactive data is sent to the caller, the watermark data in the interactive data is extracted, and the match between the watermark data and the caller of the interactive data is determined. Based on the matching result, it is determined whether to send the interactive data to the caller. Through the matching judgment between the watermark and the caller, the aforementioned abuse or theft is effectively identified, avoiding the use of data transmitted by the interface by unauthorized modules of the authorized application system or unauthorized application systems, thereby improving the security of interface calls and data.

[0036] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 2 Schematic diagram of the interface calling method provided in this application embodiment Figure 1 , the interface calling method can be executed by any device with corresponding data processing capabilities, such as the terminal or system where the caller is located, or a module or service in the terminal or system, such as Figure 2 As shown, the interface calling method includes the following steps:

[0038] Step S201, obtaining interaction data output by a target interface; the target interface is used to add watermark data to response data generated by a server to obtain the interaction data.

[0039] The target interface can be any application programming interface, such as the interface provided by an application system (the server system of the application software) to one or more business systems (systems that use the application software). The provider of the target interface, also known as the owner of the target interface, is the entity or system that provides the definition, implementation, and deployment of the target interface.

[0040] When an authorized caller calls the target interface, it sends the target interface call request to the target interface's server. The server responds to the call request and returns the generated response data through the target interface. Before outputting the response data, the target interface adds watermark data to the response data. The target interface can be enabled to add watermark data to the output data by encapsulating the target interface's communication protocol or modifying the target interface's definition file.

[0041] For example, the target interface definition file can be modified to include watermarking logic in the target interface output data section. This allows the target interface to add watermark data to the response data before outputting it, following certain rules. Alternatively, the target interface's communication protocol can be repackaged to add a new field to store the watermark data.

[0042] In order to distinguish the response data before and after the watermark data is added, the response data after the watermark data is added is called interactive data.

[0043] Figure 3 A schematic diagram of the watermark adding process provided in the embodiment of the present application is shown as follows: Figure 3 As shown, when an authorized caller, such as software a installed on a terminal in City A, wishes to obtain the trajectory data of taxis 30 in City A through the server's target interface API 3, they can initiate a call request to API 3 by clicking a control in the software interface opened by software a. The server responds to this call request by packaging the trajectory data of taxis 30 and sending the packaged trajectory data (response data) via API 3. Before sending the response data, API 3 adds watermark data to the response data and returns the watermarked response data, i.e., the interaction data, to the terminal. Subsequently, the interaction data watermark check can be performed, and based on the check results, a decision can be made as to whether to send the interaction data to software a installed on the terminal.

[0044] When the target interface adds watermark data to the response data, the content and / or adding position of the watermark data may be determined based on the caller of the response data.

[0045] The target interface may pre-store watermark data associated with the provider identity feature of the target interface, so as to add the stored watermark data to the response data before outputting the response data.

[0046] Exemplarily, the watermark data may include the provider's name, number, logo, and other identity characteristics.

[0047] For example, if the provider of the target interface is "XX Company", the watermark data can be "owned by XX Company", or data obtained by "XX Company" through mathematical calculation, data mapping, etc., such as a hash value.

[0048] The watermark data can be invisible watermark data or implicit watermark data, that is, watermark data that cannot be identified by the caller.

[0049] For example, the watermark data added to the response data is zero-width characters. Zero-width characters are special characters that are invisible in text and do not occupy space when displayed, thus hiding the watermark data and achieving a traceless watermark.

[0050] Using a traceless watermark reduces the probability of the caller knowing the watermark data, prevents the watermark data from being tampered with or forged, improves the security of the watermark data, and thus improves the security of the interface call. Using zero-width characters to achieve a traceless watermark is easy to implement and highly concealed.

[0051] When adding watermark data, the adding position of the watermark data may be fixed, such as adding it to a preset field of the response data.

[0052] When adding watermark data, the content of the watermark data can be determined based on the caller and the target interface called, or the content of the watermark data and the addition location, that is, the field in the response data, can be determined; thereby, the determined content of the watermark data is added to a fixed field of the response data, or a determined field.

[0053] After receiving the response data from the server, the target interface can determine the field to add the watermark data based on the caller of the response data before outputting the response data. The target interface can then add the stored watermark data, such as watermark data associated with the identity characteristics of the provider of the target interface, to the corresponding field in the response data to obtain the interaction data. Alternatively, the originally stored watermark data can be adjusted based on the caller, such as by adding the caller's information to the watermark data, or by calculating the caller's information and the watermark data to obtain the adjusted watermark data. The adjusted watermark data is then added to the response data to obtain the interaction data.

[0054] For example, taking the original watermark data as abcd, and the caller's identifier as 1345, the adjusted watermark data may be abcd1345, a1b3c4d5, begi, and so on.

[0055] The term "caller" as used in this application refers to the target end of the interactive data. The source of the interactive data is the target interface, and the target end is the end that receives the interactive data output by the target interface. The caller can be a terminal, software installed in the terminal, or a functional module of the software.

[0056] Step S202: extracting watermark data from the interactive data.

[0057] Specifically, the target interface can transmit the interactive data to the terminal where the caller who initiates the call request is located. In some scenarios, the terminal where the caller who initiates the call request is located can forward the interactive data to the terminals where other callers are located. The watermark detection modules deployed on these terminals, such as the security proxy plug-in, detect the data input terminal. When the security proxy plug-in detects the data input terminal, it extracts the watermark data from the interactive data of the input terminal to determine whether to send the interactive data to the caller based on the extracted watermark data.

[0058] In the case of an unauthorized call, the interactive data output from the first target interface of the first terminal initiating the call request is forwarded to the second caller of the second terminal. This second caller is a terminal authorized to access the second target interface. The first and second target interfaces are different target interfaces of the same service system. When the security proxy plug-in deployed on the second terminal detects data input into the second terminal, it extracts watermark data from the interactive data output from the first target interface of the second terminal. Because the extracted watermark data is the watermark data of the first caller (deployed on the first terminal) and does not match the watermark data of the second caller, the interactive data is prohibited from being sent to the second caller.

[0059] For terminals equipped with a watermark detection module, when data is input to the terminal, the module extracts the watermark data from the input data. To conserve computing resources, the module can also first determine whether the input terminal data is output from any target interface. If so, the module extracts the watermark data from the input terminal data; otherwise, the module directly forwards the input data to its target terminal. The module can use information such as the input data format and key fields to determine whether the input data is output from any target interface.

[0060] In some embodiments, watermark data in the interaction data can be extracted by scanning fields in the interaction data.

[0061] When inserting watermark data into response data for multiple target interfaces and multiple authorized callers, the insertion position of the watermark data may vary for different target interfaces or different callers. Therefore, multiple fields in the response data where watermark data can be added can be recorded. When extracting watermark data, these multiple fields in the interaction data are scanned and, based on their contents, the watermark data in the interaction data is extracted.

[0062] Optionally, extracting the watermark data from the interaction data includes: extracting data from multiple fields in the interaction data; and determining the watermark data from the interaction data based on the extracted data from the multiple fields.

[0063] The interaction data output by the target interface can be pre-stored and synchronously updated, and a plurality of fields of the interaction data to which the watermark data is added can be used, so that after the interaction data is received, data of the plurality of fields in the interaction data is extracted, and based on the extracted data of the plurality of fields, the watermark data in the interaction data is obtained.

[0064] If the data of the plurality of fields are all empty, the watermark data does not exist in the interaction data. The watermark data can be obtained based on the data extracted from the field in which the data is not empty. The watermark data can be obtained by the data of one or more fields, such as being calculated by the data of a plurality of fields.

[0065] For example, the fields to which the watermark data can be added in the response data include field 1, field 2 and field 3, wherein the data of field 1 and field 2 needs to be obtained by a certain operation to obtain a watermark data. After the interaction data, i.e., the response data to which the watermark data is added, is obtained, field 1, field 2 and field 3 of the interaction data can be scanned, if the data of field 1 and field 2 is empty and the data of field 3 is not empty, the data of field 3 is extracted to obtain the watermark data; if the data of field 3 is empty and the data of field 1 and field 2 is not empty, the data of field 1 and field 2 is extracted, and the extracted data of field 1 and field 2 is operated to obtain the watermark data, such as splicing the data of field 1 and field 2 to obtain the watermark data.

[0066] By scanning the plurality of fields of the interaction data, the extraction of the watermark data is realized, all the fields to which the watermark data can be added are traversed, and the watermark extraction is not comprehensive due to the omission of the fields, thereby affecting the accuracy of the subsequent matching result of the watermark data and the calling party.

[0067] In some embodiments, based on at least one of the target interface and the calling party corresponding to the interaction data, the field to which the watermark data is added, such as the target field, can be determined, the data of the target field of the interaction data is directly extracted, and the watermark data added in the interaction data can be obtained.

[0068] In step S203, it is determined whether the interaction data is sent to the calling party based on the watermark data and the calling party of the interaction data.

[0069] Specifically, it can be determined whether the content of the extracted watermark data is consistent with the content of the watermark data agreed by the calling party of the interaction data; if yes, the interaction data is sent to the calling party; if no, the interaction data is prohibited from being sent to the calling party. Alternatively, the calling party corresponding to the extracted watermark data can be found from the pre-stored correspondence between the watermark and the calling party, and it is determined whether the calling party is consistent with the calling party of the interaction data; if yes, the interaction data is sent to the calling party; if no, the interaction data is prohibited from being sent to the calling party.

[0070] Optionally, determining whether to send the interaction data to the calling party based on the watermark data and the calling party includes: if the calling party is a preset calling party, determining whether to send the interaction data to the calling party based on the content and / or the field of the watermark data.

[0071] The preset calling party can be a calling party authorized by a service system of the target interface, and the preset calling party can be one or more. The target interface of the service system can be one or more.

[0072] If the calling party of the interaction data is one of the preset calling parties, it indicates that the calling party is an authorized calling party. Further determination is made on whether the calling party matches the watermark data. In determining whether the calling party matches the watermark data, in addition to considering the content of the watermark data, the field in which the watermark data appears in the interaction data, i.e., the field of the watermark data, can also be considered.

[0073] One service system can correspond to multiple preset calling parties, and each preset calling party can correspond to one or more target interfaces authorized for calling, i.e., the calling party authorized to call any target interface is a preset calling party. In order to avoid the abuse of the target interface by the preset calling party, the content and the field of the watermark data are further considered to determine whether the target interface called by the preset calling party is the target interface authorized for calling by the preset calling party.

[0074] For example, a service system provides a function of querying traffic flow. Terminals authorized to use the function in different regions can view the traffic flow in the authorized region, such as the traffic flow of a road or the traffic flow in a geographical range in a region, through a traffic flow query control in the installed business software (calling party). In order to realize the foregoing function, the service system provides different target interfaces to terminals in different regions to access the traffic flow in different regions through different target interfaces. An example of the abuse of the target interface by the preset calling party is that interaction data 1 output by interface I1 (responsible for issuing traffic flow data in region A1) is forwarded to terminal T2 authorized to call interface I2 (responsible for issuing traffic flow data in region A2). Since the adding modes (determined by the content and the field) of the watermark data of interface I1 and interface I2 are different, the content and the field of the watermark data in the extracted interaction data 1 can be used to discover in time that the data output by interface I1 is used non-authorized, i.e., the abuse of interface I1.

[0075] Specifically, when the caller of the interactive data is a preset caller, watermark data is extracted from the interactive data output by the first target interface. Based on the content and field of the extracted watermark data, it is determined whether the watermark data matches the caller of the interactive data. If so, the interactive data is sent to the caller. If not, it indicates that the caller is a caller authorized by the service system, such as a caller authorized to call the second target interface, but not an authorized caller of the first target interface. Therefore, the interactive data is prohibited from being sent to the caller. The first target interface and the second target interface are different target interfaces.

[0076] The fields for adding watermark data to response data obtained from call requests to the target interface for authorized calls initiated by different pre-set callers, as well as the content of the added watermark data, can be pre-agreed upon. During the watermark checking phase, after obtaining interaction data with the pre-set caller as the target, a determination is made as to whether the fields in the interaction data where the watermark data appears, as well as the extracted watermark data content, are consistent with the fields and content agreed upon by the pre-set caller. If so, the watermark data is considered to match the caller of the interaction data; otherwise, it is considered to be mismatched.

[0077] By combining the fields and content of the watermark data, the matching judgment between the watermark data and the caller is realized, the matching logic is deepened, and the accuracy of the matching judgment structure is improved; by matching different fields and watermark content for different authorized callers, the flexibility of adding watermark content is improved, the probability of the watermark data being known is reduced, and the security of the watermark data is improved.

[0078] Specifically, the determination of whether to send the interaction data to the caller can be based on the matching result between the extracted watermark data in the interaction data and the caller of the interaction data. If the extracted watermark data matches the caller of the interaction data, the interaction data is sent to the caller; conversely, if the extracted watermark data does not match the caller of the interaction data, the interaction data is not allowed or prohibited from being sent to the caller, and the interaction data can be specifically blocked.

[0079] Specifically, the watermark data may be matched with the caller, such as preset watermark data. Based on the content of the watermark data, it may be determined whether the watermark data is the preset watermark data; if so, the interactive data may be sent to the caller; if not, the interactive data may be blocked.

[0080] Optionally, the determining whether to send the interactive data to the caller based on the watermark data and the caller of the interactive data includes: determining a target watermark consistent with the watermark data from the preset watermark corresponding to the stored target interface; if the preset caller corresponding to the target watermark is inconsistent with the caller, then prohibiting the interactive data from being sent to the caller.

[0081] The preset watermark corresponding to the target interface is the watermark data corresponding to the caller who is authorized to call the target interface.

[0082] When determining whether the extracted watermark data matches the caller, a preset watermark that is consistent with the watermark data extracted from the interactive data can be determined from the pre-stored preset watermarks of the target interface. If the caller corresponding to the preset watermark is consistent with the caller of the interactive data, then it is determined that the extracted watermark data matches the caller of the interactive data; if the caller corresponding to the preset watermark data is inconsistent with the caller of the interactive data, or there is no preset watermark data that is consistent with the extracted watermark data among the multiple preset watermark data of the target interface, then it is determined that the extracted watermark data does not match the caller of the interactive data.

[0083] Furthermore, the correspondence between the content of the watermark data and the added fields describing the target interface under each authorized caller can be pre-stored, so that after extracting the watermark data from the interactive data, based on the content and the field where the watermark data is located, a preset watermark that is consistent with the content and the field where the extracted watermark data is located is searched from the correspondence. If the caller corresponding to the preset watermark in the correspondence is consistent with the caller of the interactive data, the interactive data is allowed to be sent to the caller of the interactive data; if they are inconsistent, or the preset watermark that is consistent with the content and the field where the extracted watermark data is located is not found from the correspondence, the interactive data is prohibited from being sent to the caller of the interactive data.

[0084] Taking the case that there are two authorized callers of the target interface, namely caller 1 and caller 2, as an example, assuming that in the correspondence, the watermark content and the fields of the preset watermarks corresponding to caller 1 and caller 2 are: (watermark 1, field 1) and (watermark 2, field 2) respectively; the caller of the interaction data is caller 3, the watermark data extracted from the interaction data is watermark 1, and the field is 1. Then, through this correspondence, it is determined that the caller corresponding to the watermark data should be caller 2, not caller 3. It is then recognized that caller 3 is using the data of the target interface without authorization, and the interaction data is blocked in time to avoid sending the interaction data to caller 3.

[0085] By giving each authorized caller of a given target interface a standard watermark, i.e., a preset watermark, and by checking whether the authorized caller corresponding to the standard watermark is consistent with the caller of the interactive data, the identification of unauthorized callers is achieved with high recognition efficiency and accuracy.

[0086] For example, Figure 4 A schematic diagram of the watermark insertion and checking process provided in the embodiment of the present application is shown in FIG. Figure 4As shown, relevant personnel of the business system can generate a call request for the target interface through the application installed in the terminal 410 of the business system (the authorized access area is area R41), such as the relevant controls in the bus management software, such as the trajectory query button, such as a call request to view the trajectory data of buses B40 to B45 in area R41; after receiving the call request, the server of the target interface generates response data for the call request, that is, the trajectory data of buses B40 to B45 in area R41. Before sending the response data through the target interface, the target interface adds watermark data to the response data based on the caller of the response data, i.e., terminal 410, or the bus management software installed on terminal 410, and sends the response data with the watermark data added to it to terminal 410; the security proxy plug-in of the target interface deployed on terminal 410 checks the watermark data, and if the watermark check passes, sends the response data with the watermark data added; specifically, the security proxy plug-in extracts the watermark data from the response data with the watermark data added, and the security proxy plug-in determines that the caller corresponding to the extracted watermark data is consistent with the caller of the target interface, and then sends the response data with the watermark data added, i.e., the trajectory data of buses B40 to B45 in area R41 with the watermark data added, to the bus management software deployed on terminal 410. If the response data after adding the watermark data is sent to the terminal 410 at the target interface, the terminal 410 forwards the response data after adding the watermark data to the bus management software of the terminal 420 whose authorized access area is area R42, that is, sends the data to the unauthorized caller. Then the result of the watermark check of the security proxy plug-in of the target interface deployed in the terminal 420 fails, that is, the caller corresponding to the extracted watermark data is inconsistent with the caller corresponding to the terminal 420 (that is, the caller of the input data). Then, the data is prohibited from being sent, that is, the trajectory data of buses B40 to B45 in area R41 after adding the watermark data is prohibited from being sent to the bus management software deployed by the terminal 420.

[0087] The security agent plug-in enters the working state when it detects that there is data input in the deployed terminal, extracts the watermark data in the data, and when the extracted watermark data is not empty, determines whether the watermark data matches the caller of the input data; if it matches, the input data is allowed to continue to be sent; if it does not match, the input data is prohibited from being sent.

[0088] The interface calling method provided by the embodiment of the present application is aimed at the calling scenario of the target interface. Before the target interface outputs the response data generated by the server, it will add watermark data to the response data, so that before the caller obtains the interactive data transmitted by the target interface, a watermark check strategy is added. Specifically, by matching the watermark data in the interactive data output by the extracted target interface with the caller of the interactive data, it is determined whether to forward the interactive data to the caller for the caller's use. Specifically, if the watermark data matches the caller, the interactive data is sent to the caller, otherwise it is prohibited to send the interactive data to the caller. By adding a watermark to the interface output data, when other callers intercept or forward the data output by the interface through secondary packaging, diversified channels, etc., the abuse or theft of the target interface can be discovered in time through the matching of the watermark added in the data with the identity of the caller, thereby preventing the data from being used by unauthorized parties and improving the security of interface calls and data.

[0089] Figure 5 For this application Figure 2 The flow chart of step S203 in the embodiment shown is as follows: Figure 5 As shown, after extracting the watermark data from the interactive data, it can be determined whether the interactive data is allowed to be sent to the caller of the interactive data by the following steps:

[0090] Step S501: If the caller of the interactive data is a preset caller, the preset content and preset fields of the watermark corresponding to the caller are obtained.

[0091] When the caller of the interactive data is an authorized caller, the preset content and preset fields of the watermark corresponding to the caller are obtained. The preset content and preset fields are respectively the content and the fields that appear of the watermark data added to the response data agreed by the caller.

[0092] The correspondence between each preset caller and its corresponding preset watermark content and preset fields can be pre-stored. When the caller of the interactive data is one of the preset callers, the preset watermark content and preset fields corresponding to the caller are obtained from the correspondence.

[0093] Step S502: If the content of the watermark data is the preset content, and the field where the watermark data is located is the preset field, the interaction data is sent to the caller.

[0094] If the content and field of the watermark data extracted from the interactive data are consistent with the preset content and preset field of the caller corresponding to the interactive data, the interactive data is allowed to be sent to the caller.

[0095] Step S503, if the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field, the interactive data is prohibited from being sent to the calling party.

[0096] If the content of the watermark data extracted from the interactive data does not match the preset content, or the field where the watermark data in the interactive data is located does not match the preset field, it indicates that the calling party is an authorized user of the service system of the target interface, but is not an authorized user of the target interface, and the target interface is abused. Therefore, the interactive data is prohibited from being sent to the calling party, for example, the interactive data can be blocked to prevent the authorized user from abusing the target interface.

[0097] Step S504, if the watermark data is not empty and the calling party of the interactive data is not a preset calling party, the interactive data is prohibited from being sent to the calling party.

[0098] If the calling party of the interactive data is not one of the preset calling parties, it indicates that the calling party is not an authorized calling party. In an optional manner, the interactive data can be directly prohibited from being sent to the calling party.

[0099] When the calling party of the interactive data is not a preset calling party, it can be further determined whether the watermark data is empty, that is, if the calling party of the interactive data is not a preset calling party and no watermark data is extracted from the interactive data, it indicates that the target interface has a low requirement for security, for example, the interactive data does not involve privacy. Therefore, the interactive data can be allowed to be sent to the calling party.

[0100] In another embodiment, if no watermark data is extracted from the interactive data, it indicates that the addition of the watermark data in the interactive data fails, or the watermark data is tampered with or removed. Therefore, the interactive data is prohibited from being sent to the calling party of the interactive data.

[0101] In another embodiment, some interfaces do not need to add watermark data to the received response data. Such interfaces do not involve privacy data and are public service interfaces. When the calling party of the interactive data is not a preset calling party, it is further determined whether watermark data is added to the interactive data, that is, whether the extracted watermark data in the interactive data is empty. If not, the interactive data is prohibited from being sent to the calling party. If the extracted watermark data in the interactive data is empty, that is, no watermark data is added to the interactive data, it indicates that the target interface is a public service interface and can be accessed by a non-preset calling party. Therefore, the interactive data is allowed to be sent to the calling party.

[0102] An exemplary, Figure 6 A schematic diagram of several interface calling conditions provided by the embodiments of the present application is shown in FIG. 1. Figure 6As shown, the application service system provides three target interfaces, namely interfaces 611 to 613, and one public interface, namely interface 614. The callers authorized by interface 611 include modules 621 and 622 of application system 620 in domain D61, and application system 630 in domain D62. The callers authorized by interface 612 include module 621. The callers authorized by interface 613 include application system 640 in domain D62. Interface 614 is authorized for use by any caller. Figure 6 In the example, a solid line connects the caller that authorizes access to the interface and the interface.

[0103] For the response data of the call request of each interface, the fields for adding watermark data include fields F1 to F4. It is assumed that the field where the added watermark data is located is determined by the called target interface, and the content of the added watermark data is determined by the caller. Figure 6 The watermarking configurations corresponding to the callers and interfaces shown are:

[0104] The preset watermark corresponding to module 621 is watermark W1, the preset watermark corresponding to module 622 is watermark W2, the preset watermark corresponding to application system 630 is W3, and the preset watermark corresponding to application system 640 is W4; when interface 611 is called, the preset field for adding watermark data to the response data is field F1, and when interface 612 is called, the preset field for adding watermark data to the response data is field F2; when interface 613 is called, the preset fields for adding watermark data to the response data include fields F3 and F4.

[0105] Then, in the case where module 621 calls interface 613, interface 613 adds watermark W1 in fields F3 and F4 of the response data. The response data after adding the watermark data passes through a watermark detection module such as a security agent plug-in of the service system. The extracted watermark data is watermark W1, and the fields where the watermark data is located are fields F3 and F4. Since the preset field corresponding to module 621 is field F2, the field where it is located does not match the preset field, and the response data is prohibited from being sent to module 621.

[0106] When the application system 630 calls the interface 612, the interface 612 adds the watermark W3 in the field F2 of the response data. The response data after adding the watermark data passes through the watermark detection module, and the watermark data is extracted as the watermark W3 and the field where the watermark data is located is the field F2. Since the preset field corresponding to the application system 630 is the field F1, and the field where the watermark data is located does not match the preset field, it is prohibited to send the response data to the application system 630.

[0107] When the application system 640 calls the interface 613, the interface 613 adds the watermark W4 to the fields F3 and F4 of the response data. The response data after adding the watermark data passes through the watermark detection module, and the watermark data is extracted as the watermark W4, and the fields where the watermark data is located include fields F3 and F4. They are consistent with the preset content and preset fields of the watermark corresponding to the application system 640. Then the response data is sent to the application system 640.

[0108] When application system 640 calls interface 614, since interface 614 is not a target interface, watermark data cannot be added to the response data. The watermark detection module scans fields F1 to F4 of the response data and, if no watermark data is extracted from the response data, it can further determine whether the called interface is the target interface. Since interface 614 is not the target interface, the response data is allowed to be sent to application system 640. If no watermark data is extracted from the data output by interface 614 and the called interface is the target interface, the data output by interface 614 is prohibited from being sent to the caller.

[0109] In this embodiment, when the caller is an authorized caller, that is, a preset caller, the content and field of the watermark data are still used to determine whether the interface call is authorized, thereby determining whether to send the data output by the interface to the caller, thereby avoiding the abuse of the interface by the authorized caller and improving the security and compliance of the interface call; by flexibly customizing the content and added fields of the watermark for different authorized callers, the probability of the watermark addition method being known is reduced, the security of the watermark is improved, and the accuracy of the watermark-based call behavior judgment is further improved; when the caller is not an authorized caller, whether the call behavior is authorized is directly determined by the judgment result of whether the watermark data is empty. On the one hand, it avoids the unauthorized caller from stealing the interface, and on the other hand, it simplifies the judgment logic of the call behavior and improves the recognition speed of unauthorized call behavior. This embodiment implements different call behavior judgment logics through the different identities of the caller, effectively identifies various illegal calls of the interface, and improves the security of the interface call.

[0110] Figure 7 Schematic diagram of the interface calling method provided in this application embodiment Figure 2 , this embodiment is in Figure 2 Based on the embodiment shown, the watermark data extraction step is further limited, and the relevant steps determined by the caller are added, such as Figure 7 As shown, the interface calling method provided in this embodiment may specifically include the following steps:

[0111] Step S701: After the terminal successfully deploys the proxy service of the target interface and passes the terminal identity authentication, obtain authorization information for the terminal to call the application module of the target interface.

[0112] The application module is used to initiate a call request to the target interface and can be a software control. The terminal can be a terminal in any business system. The terminal can access the interface corresponding to the target interface through a website or installed software, and send the call request to the target interface server through the control provided by the interface.

[0113] The proxy service is a service provided by the target interface or the service system of the target interface, which can be a plug-in. The proxy service is responsible for extracting and checking the watermark of the data input to the deployed terminal. Specifically, it extracts the watermark data from the data input to the terminal and determines whether to allow the input data to be sent to its caller based on the extracted watermark data and the caller of the input data.

[0114] Terminal identity authentication can be performed by a dedicated authentication server, which stores the identity information of authorized terminals for each target interface, such as a whitelist. Terminal identity authentication is performed by determining whether the terminal's identity matches one on the whitelist. Only terminals that pass identity authentication can initiate calls to the target interface.

[0115] If the terminal does not deploy the software corresponding to the proxy service, or the terminal fails the identity authentication, the terminal will not be allowed to initiate a call request to the target interface.

[0116] Specifically, if it is detected that the proxy service of the target interface has not been successfully deployed on the terminal, the authentication server will perform identity authentication on the terminal after the proxy service of the target interface is successfully deployed on the terminal; if the identity authentication of the terminal fails, the step of authenticating the terminal by the authentication server will be repeated until the identity authentication of the terminal passes.

[0117] In some embodiments, when it is detected that the terminal fails to successfully deploy the proxy service of the target interface or the terminal fails identity authentication, corresponding prompt information may be generated, such as please install the proxy service plug-in or identity authentication fails.

[0118] After the terminal successfully deploys the proxy service for the target interface and passes the terminal identity authentication, the terminal is allowed to initiate a call request for the target interface. To facilitate the subsequent confirmation of the caller of the interactive data, the proxy service deployed by the terminal needs to obtain the authorization information of the application module of the terminal to access the target interface from the authentication server, and then determine the caller based on the authorization information.

[0119] Step S702: Acquire the interaction data output by the target interface.

[0120] The target interface is used to add watermark data to the response data obtained by the output server in response to the call request of the target interface to obtain interactive data.

[0121] Step S703: Determine the caller of the interactive data based on the authorization information.

[0122] After receiving the interactive data output by the target interface, the proxy service determines the caller of the interactive data, such as the aforementioned application module, based on the pre-acquired authorization information of the deployed terminal.

[0123] In some embodiments, there can be multiple target interfaces and multiple application modules. A terminal is authorized to access one application module of a target interface, and the same application module can be the authorized caller of multiple target interfaces, that is, one application module can be authorized to access multiple target interfaces.

[0124] The authorization information can record the application modules that the terminal uses to access each target interface, such as the correspondence between the target interface and the application module authorized to access the target interface. This allows, upon detecting data (including interactive data) input into the terminal, to determine the caller of the input data based on this correspondence and the target interface invoked by the input data.

[0125] Step S704: Determine the target field based on the target interface and / or the caller of the interaction data.

[0126] After determining the caller of the interactive data, the proxy service determines the location of the watermark data in the interactive data, ie, the target field, based on at least one of the target interface outputting the interactive data and the caller of the interactive data.

[0127] The correspondence between the target field and at least one of the target interface and the caller can be pre-stored, so that the target field for adding watermark data in the interactive data can be determined based on the correspondence and the caller and / or the called target interface of the interactive data.

[0128] Step S705: obtaining the watermark data based on the data of the target field in the interaction data.

[0129] After the proxy service determines the target field, it extracts the data of the target field in the interaction data to obtain the watermark data in the interaction data.

[0130] Step S706: Based on the watermark data and the caller of the interactive data, determine whether to send the interactive data to the caller.

[0131] After extracting the watermark data from the interaction data, the proxy service can determine whether the watermark data matches the caller; if so, the interaction data is allowed to be sent to the caller; if not, the interaction data is blocked.

[0132] In this embodiment, a proxy service of a target interface deployed on a terminal is utilized to extract watermarks from the data output by the target interface and determine interface call behavior. This can block the transmission of interface output data under unauthorized call behavior on the terminal side, thereby improving the security of interface calls and reducing the risk of data leakage. For terminals that have successfully deployed the proxy service, identity authentication of the terminal and acquisition of authorization information are achieved through an identity authentication step, further improving the security of interface calls. Acquisition of authorization information can reliably confirm the caller of the interface output data, thereby providing a basis for subsequent watermark data detection steps. During watermark extraction, to avoid scanning multiple fields, the target interface and the caller are utilized to directly lock the field where the watermark data should appear, namely the target field, so that only the data in the target field is extracted as watermark data for matching with the caller, and then, based on the matching result, it is determined whether the data is allowed to be sent. Since the correct field of the watermark data is directly locked, the efficiency of watermark data extraction is improved compared to the method of scanning multiple fields. At the same time, when matching the watermark data with the caller, there is no need to consider the field, only the content is compared, which improves the matching efficiency and, in turn, improves the efficiency of determining whether the call behavior is authorized.

[0133] Furthermore, after prohibiting the interactive data output by the target interface from being sent to the caller, a call alarm log may be generated to inform the service system or provider of the target interface that there is a risk of unauthorized access to the target interface.

[0134] Specifically, after prohibiting the sending of interaction data to the caller, a call alarm log can be generated based on the caller of the interaction data to inform the service system or provider of the target interface of the caller's unauthorized call to the target interface. The call alarm log also includes the target interface called or other information.

[0135] The present application also provides another interface calling method, applied to a target interface server, comprising: responding to a target interface call request initiated by a client, determining response data corresponding to the call request; adding watermark data to the response data, via the target interface, to obtain interaction data, and sending the interaction data to the client. The target interface may add watermark data associated with the identity characteristics of the provider of the target interface to the response data.

[0136] The watermark data may be invisible watermark data, such as zero-width characters.

[0137] After the terminal generates a call request for the target interface, the server of the target interface responds to the call request and sends the response data to the target interface; the target interface adds watermark data to the response data based on the caller of the response data, and obtains the response data after the watermark data is added, which is recorded as interaction data.

[0138] Optionally, adding watermark data to the response data through the target interface to obtain interactive data includes: adding watermark data to the response data through the target interface based on the caller of the response data to obtain interactive data.

[0139] For example, the caller information of the response data can be superimposed on the watermark data stored by the target interface (e.g., watermark data associated with the identity of the provider of the target interface), and the watermark data superimposed with the caller information can be added to the response data to be output. Alternatively, the watermark data addition location, i.e., the field where it should be located, can be determined based on the caller of the response data (or call request), and the watermark data can be added to the corresponding field in the response data.

[0140] In other embodiments, the location where the watermark data is added may be determined based on the caller of the response data and the target interface called.

[0141] After the watermark data is added, the target interface returns the response data with the watermark data added to the terminal, such as sending it to the watermark detection module deployed on the terminal or the proxy service of the target interface, so that the watermark detection module or the proxy service of the target interface extracts the watermark data from the received data, and determines to send the received data to the corresponding caller based on the extracted watermark data and the caller of the received data.

[0142] Optionally, based on the caller of the response data, watermark data is added to the response data to obtain interaction data, including: obtaining watermark data associated with the provider identity of the target interface; for the response data to be output by the target interface, based on the caller of the response data, or based on the caller of the response data and the target interface, determining the adding field of the watermark data; adding the watermark data to the adding field of the response data to obtain the interaction data.

[0143] The field for adding watermark data can be established in advance, and the correspondence between the field and the caller, or the caller and the target interface can be established. After the target interface receives the response data to be output, it can first be determined whether the interface called by the response data is one of the target interfaces; if so, the field corresponding to the caller of the response data, or the caller of the response data and the called target interface can be found from the correspondence; thereby, the watermark data associated with the identity of the provider of the target interface can be added to the corresponding field of the response data.

[0144] If the caller of the response data is not the target interface, the response data can be sent directly to the caller, or other authentication methods can be used, such as key authentication, identity authentication, etc. If the authentication is successful, the response data is allowed to be sent to the caller, and if the authentication fails, the response data is prohibited from being sent to the caller.

[0145] Figure 8 Schematic diagram of the interface calling method provided in this application embodiment Figure 3 ,This embodiment is triggered from the full link, covering steps such as proxy service deployment, identity authentication, interface call, watermark insertion, watermark checking, call blocking, and alarm log generation. Figure 8 As shown, the interface calling method includes:

[0146] Step S801, security proxy plug-in deployment, deploying the security proxy plug-in of the target interface at the terminal of the target interface service domain, and detecting whether the security proxy plug-in is deployed successfully; if so, executing step S802; if not, continuing to detect whether the security proxy plug-in is deployed successfully.

[0147] The service network domain of the target interface is one or more network domains provided with services by the target interface, and the service network domain may include one or more terminals.

[0148] The security proxy plug-in is aware of the methods for adding various watermark data to the interactive data output by the target interface, and is used to extract the watermark data from the data after detecting the data input to the terminal, so as to determine whether to allow the data to be sent to its caller based on the watermark data and the caller of the data.

[0149] Step S802: Apply identity authentication, perform zero-trust identity authentication on the terminal of the target interface service domain, and detect whether the identity authentication passes; if passed, execute step S803; if not, continue to detect whether the identity authentication passes.

[0150] A dedicated identity authentication service or server can authenticate the identities of all terminals within the service domain. When a new terminal is added to the service domain, it can be registered with the identity authentication server. Based on the registered information, zero-trust identity authentication is performed on the terminal. Once the authentication is successful, the terminal can be added to the whitelist of the identity authentication server as a trusted terminal.

[0151] Step S803: target interface calling. The terminal, after passing identity authentication, initiates a call request of the target interface, and the server of the target interface returns response data of the call request.

[0152] Step S804: inserting the invisible watermark data. The target interface inserts the invisible watermark data related to the identity characteristics of the provider of the target interface into the response data to obtain the response data after the watermark is inserted.

[0153] The provider of the target interface may be the owner of the response data returned in response to the call request.

[0154] Step S805, traceless watermark detection, the security agent plug-in deployed by the terminal detects all fields where traceless watermark data appears in the input data, and extracts the watermark data in the input data.

[0155] The input data of the security proxy plug-in includes the response data output by the target interface after the watermark is inserted, that is, the interactive data output by the target interface.

[0156] The watermark insertion service or server can synchronize the fields where the invisible watermark data appears in the response data to the security proxy plug-in, so that the security proxy plug-in scans all fields in the input data where the invisible watermark data may be inserted, thereby realizing the extraction of the invisible watermark data in the input data.

[0157] Step S806, interface usage determination, based on the extracted seamless watermark data and the caller of the input data, determines whether the target interface has unauthorized use; if so, execute step S807; if not, execute step S809.

[0158] Specifically, if the field where the traceless watermark data appears or the content of the traceless watermark data in the interactive data output by the received target interface is inconsistent with the field where the traceless watermark data corresponding to the caller of the recorded interactive data or the content of the traceless watermark data, or the caller corresponding to the recorded traceless watermark data is inconsistent with the caller of the interactive data, then it is determined that the target interface has been used without authorization, such as being called by an unauthorized application module, or there is unauthorized external service, etc.

[0159] Step S807: prohibit the input data from being sent to its caller.

[0160] Step S808: Generate a call alarm log.

[0161] Step S809: Allow the input data to be sent to its caller. When no unauthorized use of the target interface is detected, the security proxy plug-in forwards the input data to the caller of the input data for the caller to use or view the input data.

[0162] Figure 9 A schematic diagram of the structure of the interface calling device provided in the embodiment of the present application is shown as follows: Figure 9 As shown, the interface calling device provided by this embodiment includes: an interactive data acquisition module 910, a watermark extraction module 920 and a calling determination module 930.

[0163] Among them, the interaction data acquisition module 910 is used to obtain the interaction data output by the target interface; the target interface is used to add watermark data to the response data generated by the server to obtain the interaction data; the watermark extraction module 920 is used to extract the watermark data in the interaction data; the call determination module 930 is used to determine whether to send the interaction data to the caller based on the watermark data and the caller of the interaction data.

[0164] In a possible implementation, the calling determination module 930 is specifically configured to: if the caller is a preset caller, determine whether to send the interactive data to the caller based on the content and / or field of the watermark data.

[0165] In one possible implementation, the determination module 930 is called to specifically:

[0166] If the caller of the interactive data is the preset caller, the preset content and preset field of the watermark corresponding to the caller are obtained; if the content of the watermark data is the preset content, and the field where the watermark data is located is the preset field, the interactive data is sent to the caller.

[0167] In a possible implementation, the calling determination module 930 is further configured to prohibit sending the interactive data to the caller if the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field.

[0168] In a possible implementation, the calling determination module 930 is further configured to: if the watermark data is not empty and the caller of the calling request is not a preset caller, prohibit sending the interaction data to the caller.

[0169] In one possible implementation, the calling determination module 930 is specifically used to: determine a target watermark that is consistent with the watermark data from the preset watermarks corresponding to the stored target interface; if the preset caller corresponding to the target watermark is inconsistent with the caller, prohibit the interaction data from being sent to the caller; if the preset caller corresponding to the target watermark is consistent with the caller, send the interaction data to the caller.

[0170] In a possible implementation, the watermark extraction module 920 is specifically configured to: extract data of multiple fields in the interaction data; and determine the watermark data in the interaction data based on the extracted data of the multiple fields.

[0171] In a possible implementation, the watermark extraction module 920 is specifically configured to: determine a target field based on the target interface and / or the caller of the interaction data; and obtain the watermark data based on data of the target field in the interaction data.

[0172] In one possible implementation, the interface calling device is applied to the proxy service of the target interface deployed by the terminal, and the interface calling device also includes a caller determination module, which is used to: obtain the authorization information of the application module of the terminal calling the target interface after the terminal successfully deploys the proxy service of the target interface and the terminal identity authentication is passed; after receiving the interaction data output by the target interface, determine the caller of the interaction data based on the authorization information.

[0173] In a possible implementation, the watermark data added to the response data is a zero-width character.

[0174] The interface calling device provided in this embodiment can execute the interface calling method provided in the above method embodiment for the terminal for calling the interface or the watermark detection module deployed in the terminal. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0175] An embodiment of the present application also provides another interface calling device, which is applied to the service segment of the target interface. The interface calling device includes: a response data determination module, which is used to respond to the call request of the target interface initiated by the client and determine the response data corresponding to the call request; a watermark adding module, which is used to add watermark data to the response data through the target interface to obtain interaction data, and send the interaction data to the client.

[0176] In one possible implementation, the watermark adding module is specifically used to: obtain watermark data associated with the provider identity of the target interface; determine the adding field of the watermark data based on the caller of the response data, or based on the caller of the response data and the target interface; add the watermark data to the adding field of the response data to obtain the interaction data.

[0177] The interface calling device provided in this embodiment can execute the interface calling method provided in the above method embodiment and applied to the server side of the target interface. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0178] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 10As shown, the electronic device provided by this embodiment includes: at least one processor 1001 and a memory 1002. Optionally, the electronic device further includes a communication component 1003. The processor 1001, the memory 1002 and the communication component 1003 are connected via a bus 1004.

[0179] During the specific implementation process, at least one processor 1001 executes the computer-executable instructions stored in the memory 1002, so that the at least one processor 1001 performs the above method.

[0180] The specific implementation process of the processor 1001 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0181] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules in the processor.

[0182] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0183] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0184] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0185] The application further provides a computer readable storage medium, wherein computer execution instructions are stored in the computer readable storage medium, and when a processor executes the computer execution instructions, the above method is realized.

[0186] The readable storage medium can be realized by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0187] An exemplary readable storage medium is coupled to the processor, so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0188] The division of units is only a logical function division, and in actual implementation, there can be another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0189] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment.

[0190] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0191] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories, random access memories (RAM), magnetic disks, or optical disks.

[0192] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0193] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. An interface calling method, characterized in that: The method is applied to a proxy service of a target interface deployed by a second terminal, and the method includes: When data is input into the second terminal, identifying whether the input data is interactive data output by any target interface based on the format of the input data and information on key fields; the interactive data input by any target interface includes interactive data output by the target interface forwarded by the first terminal; the target interface is configured to add watermark data to response data generated by the server to obtain the interactive data; If yes, extracting watermark data from the interactive data; If the caller of the interactive data is a preset caller, whether to send the interactive data to the caller is determined based on the content and / or field of the watermark data; wherein the preset caller is an authorized caller of any target interface.

2. The method according to claim 1, characterized in that The determining whether to send the interaction data to the caller based on the content and / or field of the watermark data includes: Obtaining the preset content and preset fields of the watermark corresponding to the caller; If the content of the watermark data is the preset content, and the field where the watermark data is located is the preset field, sending the interaction data to the caller; If the content of the watermark data is not the preset content, or the field where the watermark data is located is not the preset field, the interactive data is prohibited from being sent to the caller.

3. The method according to claim 1, characterized in that The method further comprises: If the watermark data is not empty and the caller of the interactive data is not a preset caller, it is prohibited to send the interactive data to the caller.

4. The method according to any one of claims 1 to 3, characterized in that The extracting of watermark data from the interactive data includes: Extracting data of multiple fields in the interaction data; Based on the extracted data of the multiple fields, watermark data in the interaction data is determined.

5. The method according to any one of claims 1 to 3, characterized in that The extracting of watermark data from the interactive data includes: Determining a target field based on the target interface and / or the caller of the interaction data; The watermark data is obtained based on the data of the target field in the interaction data.

6. The method according to any one of claims 1 to 3, characterized in that The method further comprises: After the second terminal successfully deploys the proxy service of the target interface and passes the identity authentication of the second terminal, obtaining authorization information for the second terminal to call the application module of the target interface; After receiving the interactive data output by the target interface, the caller of the interactive data is determined based on the authorization information.

7. An interface calling device, characterized in that: The device is applied to a proxy service of a target interface deployed by a second terminal, and the device includes: a data identification module configured to identify, when data is input into the second terminal, whether the input data is interactive data output by any target interface based on the format of the input data and information on key fields; the interactive data input by any target interface includes interactive data output by the target interface forwarded by the first terminal; the target interface is configured to add watermark data to response data generated by the server to obtain the interactive data; a watermark extraction module, configured to extract watermark data from the interactive data if the input data is interactive data output by the target interface; A calling determination module is used to determine whether to send the interactive data to the caller if the caller of the interactive data is a preset caller based on the content and / or field of the watermark data; wherein the preset caller is an authorized caller of any target interface.

Images