Interface request security verification method, device and system, and electronic equipment

Abstract

The invention discloses an interface request security verification method, device and system, and electronic equipment, and belongs to the technical field of network security. The method comprises the following steps: acquiring a key pair comprising a first key and a second key from a preset key manager; generating a random factor, and obtaining a timestamp in real time; based on the timestamp, the first secret key and the random factor, sampling verification processing is carried out on a byte stream message body requested to be transmitted by the application programming interface, and a verification sum is obtained; an application programming interface request is sent to a preset server side, the application programming interface request carries the byte stream message body, the checksum, the second secret key, the random factor and the timestamp, and the preset server side conducts safety check on the application programming interface request. According to the method, the data sampling length is fixed and does not depend on the length of the byte stream message body, the time complexity is reduced, the time consumption of interface request security verification is shortened, and the resource consumption caused by risk identification is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an interface request security verification method, an interface request security verification device, an interface request security verification system, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the application architecture where the client requests an API (Application Programming Interface) from the server, in order to protect the API from malicious attacks and tampering, the server will perform authorization management on the use of the API. In the prior art, by setting a pair of keys and secret keys for different clients, when the client requests the API, a signature value is calculated using the key, the byte stream message body transmitted by the API request, the request timestamp, and a random factor using a hash algorithm (such as sha256, md5, etc.), and the signature value, key, random factor, and request timestamp are sent to the server at the same time. After receiving the request, the server uses the same algorithm as the client to calculate a signature value, and performs security verification on the request sent by the client based on the received signature value and the calculated signature value.

[0003] However, the existing security verification scheme for API interface access has at least the following defects: when the byte stream message body of the API request is too large, the server takes a long time to perform signature verification and consumes a lot of computing resources. When encountering malicious traffic attacks, it is easy to cause server resources to be exhausted under intensive and massive byte stream message attacks.

[0004] It can be seen that the interface request security verification method in the prior art still needs to be improved. Summary of the invention

[0005] The embodiments of the present application provide a method and device for interface request security verification, which helps to shorten the time consumption of interface request security verification and reduce the resource consumption caused by risk identification, and can quickly identify risky traffic.

[0006] In a first aspect, an embodiment of the present application provides an interface request security verification method, which is applied to a client, and the method includes:

[0007] Acquire a key pair from a preset key manager, the key pair comprising: a first key and a second key;

[0008] Generate random factors and obtain timestamps in real time;

[0009] Based on the timestamp, the first key and the random factor, a sampling check is performed on the byte stream message body transmitted by the application programming interface request to obtain a checksum;

[0010] Sending an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security check on the application programming interface request.

[0011] In a second aspect, an embodiment of the present application provides an interface request security verification method, which is applied to a server, and the method includes:

[0012] In response to the application programming interface request, the application programming interface request is parsed to obtain a byte stream message body, a first checksum, a second key, a random factor and a timestamp of the application programming interface request sent by the client;

[0013] Acquire a first key paired with the second key from a preset key manager;

[0014] Based on the timestamp, the first key and the random factor, verify the byte stream message body to obtain a second checksum;

[0015] In response to the first checksum being equal to the second checksum, determining that the application programming interface request passes verification;

[0016] In response to the first checksum being unequal to the second checksum, it is determined that the application programming interface request fails verification.

[0017] In a third aspect, an embodiment of the present application provides an interface request security verification device, which is applied to a client, and the device includes:

[0018] A key pair acquisition module, used to acquire a key pair from a preset key manager, the key pair comprising: a first key and a second key;

[0019] The verification factor acquisition module is used to generate random factors and obtain timestamps in real time;

[0020] A checksum acquisition module, configured to perform sampling check processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor, and obtain a checksum;

[0021] A verification module is used to send an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security verification on the application programming interface request.

[0022] In a fourth aspect, an embodiment of the present application provides an interface request security verification device, which is applied to a server, and the device includes:

[0023] A request parsing module, used to respond to an application programming interface request, parse the application programming interface request, and obtain a byte stream message body, a first checksum, a second key, a random factor, and a timestamp of the application programming interface request sent by the client;

[0024] A key acquisition module, used to acquire a first key paired with the second key from a preset key manager;

[0025] A checksum acquisition module, configured to perform a checksum process on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum;

[0026] a verification module, configured to determine that the application programming interface request verification passes in response to the first checksum being equal to the second checksum;

[0027] The verification module is further configured to determine that verification of the application programming interface request fails in response to the first checksum being unequal to the second checksum.

[0028] In a fifth aspect, an embodiment of the present application provides an interface request security verification system, including: a client, a server, and a key manager, wherein:

[0029] The client is used to obtain a key pair from the key manager, the key pair comprising: a first key and a second key; and generate a random factor and obtain a timestamp in real time;

[0030] The client is further configured to perform sampling verification processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor to obtain a checksum;

[0031] The client is further used to send an application programming interface request to the server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp;

[0032] The server is used to respond to the application programming interface request, parse the application programming interface request, and obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client;

[0033] The server is further configured to obtain a first key paired with the second key from the key manager;

[0034] The server is further configured to perform verification processing on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum;

[0035] The server is further configured to obtain a verification result of the application programming interface request based on a comparison result of the first checksum and the second checksum.

[0036] In a sixth aspect, an embodiment of the present application further discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the interface request security verification method described in the embodiment of the present application when executing the computer program.

[0037] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the interface request security verification method disclosed in the embodiment of the present application are implemented.

[0038] The interface request security verification method disclosed in the embodiment of the present application obtains a key pair from a preset key manager, wherein the key pair includes: a first key and a second key, and generates a random factor, and obtains a timestamp in real time; then, based on the timestamp, the first key and the random factor, a sampling verification process is performed on the byte stream message body transmitted by the application programming interface request to obtain a checksum; an application programming interface request is sent to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security verification on the application programming interface request. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity is reduced, and it helps to shorten the time consumption of the interface request security verification and reduce the resource consumption caused by risk identification, so that risk traffic can be quickly identified and potential attacks on the server can be blocked in time.

[0039] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] Figure 1 It is one of the flow charts of the interface request security verification method disclosed in the embodiment of the present application;

[0042] Figure 2 It is a schematic diagram of the principle of the verification and acquisition method in the interface request security verification method disclosed in the embodiment of the present application;

[0043] Figure 3 This is the second flowchart of the interface request security verification method disclosed in the embodiment of the present application;

[0044] Figure 4 It is an interactive schematic diagram of the interface request security verification method disclosed in the embodiment of the present application;

[0045] Figure 5 It is a schematic diagram of the principle of the interface request security verification method disclosed in the embodiment of the present application;

[0046] Figure 6 It is one of the structural schematic diagrams of the interface request security verification device disclosed in the embodiment of the present application;

[0047] Figure 7 This is the second structural diagram of the interface request security verification device disclosed in the embodiment of the present application;

[0048] Figure 8 A block diagram schematically shows an electronic device for executing the method according to the present application; and

[0049] Fig. 9 A storage unit for holding or carrying a program code for implementing the method according to the present application is schematically shown. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] Reference Figure 1, an interface request security verification method disclosed in an embodiment of the present application includes: steps 110 to 140.

[0052] Step 110: Obtain a key pair from a preset key manager, where the key pair includes: a first key and a second key.

[0053] The key pair is generated by the preset key manager in response to a registration request from the client, and sent to the client.

[0054] For example, the client can obtain the key pair bound to the client by registering the key service with the preset key manager. In the embodiment of the present application, there is no limitation on the method of generating and obtaining the key pair.

[0055] In an embodiment of the present application, before the client and the server communicate, the client first applies for a key pair from a preset key manager. The key pair is bound to the client, and the key pair includes: a first key and a second key (i.e., Key). The preset key manager retains the mapping relationship between the first key and the second key. Among them, the first key is used to sign the data to be transmitted, and the signed data signed with the first key is sent to the recipient together with the second key. After receiving the signed data, the recipient of the signed data parses the signed data to obtain the second key, and then obtains the first key that matches the second key according to the mapping relationship stored on the server, and then uses the first key to perform signature verification on the signed data.

[0056] Step 120, generate a random factor and obtain a timestamp in real time.

[0057] The timestamp is the current timestamp of the client system. In the embodiment of the present application, the specific method for obtaining the timestamp in real time is not limited.

[0058] In the embodiments of the present application, there is no limitation on the specific method of generating the random factor. For example, a Hash algorithm such as sha256, md5, etc. may be used to generate the random factor.

[0059] Step 130: Based on the timestamp, the first key and the random factor, a sampling check is performed on the byte stream message body transmitted by the application programming interface request to obtain a checksum.

[0060] In an embodiment of the present application, when calculating the checksum, it is first necessary to initialize an index table, which is recorded as the "first index table" in the embodiment of the present application. The length of the first index table is equal to the number of sampled bytes of the byte stream message body, which is determined according to the algorithm requirements for calculating the checksum. Optionally, the first index table is initialized to a list of different prime numbers. For example, when the algorithm for calculating the checksum requires extracting N bytes of content from the byte stream message body, the length of the first index table can be set to N, where N is an integer greater than 1. Taking the value of N as 8 as an example, the first index table is 8 bytes in length, and the first index table can be initialized to store the following prime numbers in sequence: 1, 3, 7, 11, 19, 13, 31, 17.

[0061] In an embodiment of the present application, the first index table prime number table is generated and stored in a system including a client and a server for use by the client and the server.

[0062] In some optional embodiments, the sampling check processing of the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor to obtain the checksum includes: calculating a result value based on the timestamp, the first key and the random factor using a preset function; obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: the table length of the first index table initialized in advance; reading the first index table based on the first index value to obtain a specified number of second index values; respectively obtaining the byte content corresponding to each second index value in the byte stream message body transmitted by the application programming interface request; performing a preset operation on the obtained byte content to obtain the checksum. The size of the specified number is determined according to application requirements.

[0063] When the client sends an API request, it first obtains the timestamp in real time and generates a random factor. Then, it samples the request payload (i.e., the byte stream message body transmitted by the API request) according to the preset verification algorithm, and then uses the verification algorithm to calculate a verification sum of the sampling results. Figure 2 The principle schematic diagram shown in FIG. 1 illustrates the checksum generation scheme.

[0064] In specific implementation, the timestamp, the first key and the random factor can be used as input parameters of a preset function, and the preset function is executed to calculate a result value. In the embodiments of the present application, there is no limitation on the specific implementation of the preset function.

[0065] Next, the calculated result value is modulo the length of the first index table to obtain a first index value. The first index value is used to index the table item content stored in the first index table. In some optional embodiments, taking the calculated result value as M as an example, M is a positive integer, and the first index value i can be obtained by the formula M%N=i, wherein "%" represents the modulo operation symbol, and the first index value obtained by the modulo operation is an integer greater than or equal to 0 and less than N. Taking the first index table as an array with subscripts from 0 to N-1 as an example, the first index value can be used to index the 1st to Nth table item content in the first index table. When the generated values ​​are different, different first index values ​​will be obtained after taking the length of the first index table modulo. According to different first index values, different table item contents in the first index table can be read.

[0066] Then, the first index table is read based on the first index value to obtain a specified number of second index values. In some embodiments of the present application, taking the first index table represented by an array of length N as an example, the first index value i is used as the subscript of the array element, then the i-th array element in the array represents the content of the i+1-th table item in the first index table, and the content of the i+1-th table item will be used as the second index value.

[0067] In an embodiment of the present application, the first index table is read based on the first index value to obtain a specified number of second index values. The second index value is used to sample the byte content in the byte stream message body to obtain byte stream message body data for calculating the checksum.

[0068] In the embodiment of the present application, in order to ensure the security and accuracy of the verification and save computing resources and time costs during the verification, it is necessary to extract part of the byte content in the byte stream message body for calculating the checksum. That is, it is necessary to first obtain multiple second index values ​​from the first index table, and then extract the byte content in the byte stream message body based on each obtained second index value for calculating the checksum.

[0069] In some optional embodiments, the first index table is read based on the first index value to obtain a specified number of second index values: taking the index table position corresponding to the first index value as the starting position, reading the specified number of table item contents continuously stored in the first index table from the starting position to obtain the specified number of second index values.

[0070] Taking the sampling length of the byte stream message body as 5 (the specified number is 5), the following prime numbers are stored in the first index table in sequence: 1, 3, 7, 11, 19, 13, 31, 17 as an example. If the calculated first index value is equal to 1, the table entries 3, 7, 11, 19, 13 at the 2nd, 3rd, 4th, 5th, and 6th index positions in the first index table are read respectively as the second index values ​​for subsequent calculation and checksum use.

[0071] Next, the second index value is used as a sampling index to perform data sampling on the byte stream message body transmitted by the acquisition application programming interface request.

[0072] In some optional embodiments, the step of respectively obtaining the byte contents at the position corresponding to each second index value in the byte stream message body transmitted by the application programming interface request includes: taking the byte stream message body transmitted by the application programming interface request as a logical ring, and determining the starting index position of the logical ring; obtaining the current index position of the logical ring according to the starting index position and the second index value; and obtaining the byte contents in the byte stream message body corresponding to the current index position in the logical ring. The preset data reading direction may be clockwise or counterclockwise.

[0073] The starting index position of the logical ring may be the position corresponding to the first byte in the byte stream message body.

[0074] In some optional embodiments, obtaining the current index position of the logical ring based on the starting index position and the second index value includes: when the logical ring is a clockwise reading logical ring, offsetting the starting index position by the second index value byte positions in the clockwise direction to obtain the current index position of the logical ring; when the logical ring is a counterclockwise reading logical ring, offsetting the starting index position by the second index value byte positions in the counterclockwise direction to obtain the current index position of the logical ring.

[0075] Taking the example of a byte stream message body including K bytes of data, the byte stream message body can be virtualized as a counterclockwise logical ring, which includes K bytes of data, and the starting index position of the logical ring is set. In this way, starting from the starting index position, any integer index value can be used to read the data at the corresponding position in the logical ring, thereby realizing sampling of the byte stream message body.

[0076] To virtualize the byte stream message body as follows Figure 2Taking the counterclockwise logical ring described in as an example, the logical ring position marked by the number "0" is the starting index position. When the second index value is 3, you can move 3 index positions counterclockwise from the starting index position to obtain the logical ring position corresponding to the number "3" as the current index position; when the second index value is 7, you can move 7 index positions counterclockwise from the starting index position to obtain the logical ring position corresponding to the number "7" as the current index position.

[0077] In some optional embodiments, obtaining the current index position of the logical ring based on the starting index position and the second index value includes: when the logical ring is a clockwise reading logical ring, offsetting the starting index position in a clockwise direction by the second index value minus one byte position to obtain the current index position of the logical ring; when the logical ring is a counterclockwise reading logical ring, offsetting the starting index position in a counterclockwise direction by the second index value minus one byte position to obtain the current index position of the logical ring.

[0078] In some other optional embodiments, other methods may be used to obtain the current index position of the logical ring according to the starting index position and the second index value, which are not listed one by one in the embodiments of the present application.

[0079] According to the above method, one byte of content in the byte stream message body can be extracted based on each second index value, and a specified number of bytes of content in the byte stream message body can be extracted based on a specified number of second index values.

[0080] Next, a checksum is calculated over the specified number of extracted bytes.

[0081] In some optional embodiments, the preset operation is performed on the acquired byte content to obtain a checksum, including: adding the original code of the acquired byte content to obtain a first binary value; in response to the first value being greater than 16 bits, truncating the high bits of the first value exceeding 16 bits and adding them to the low bits of the first value to obtain a second value; and bitwise inverting the second value to obtain a checksum.

[0082] In some other optional embodiments, performing a preset operation on the acquired byte content to obtain a checksum includes: adding the original code of the acquired byte content to obtain a checksum.

[0083] For example, the byte stream message body is: "This is a test", the corresponding byte stream message body is [84104 105 115 32 105 115 32 97 32 116 101 115 116], with a length of 14; the first key is: "TestKey001"; the random factor is: 531497; the timestamp is: 1731400361; the first index table is: [1 3 7 11 1913 31 17], with a length of 8; assuming that the preset function is: accumulate each byte of the random factor, timestamp, and first key, and the sum is the result value, that is, sum=531497+1731400361+84+101+115+116+75+101+121+48+48+49=1731932716. The length of the first index table is 8, so the sampling length is 8 bytes. The first index sampled is: 1731932716%8=4, and the second index values ​​sampled sequentially are: 19, 13, 31, 17, 1, 3, 7, 11.

[0084] Taking the data stored in the byte stream message body as [84 101 115 116 75 101 121 48 48 49] as an example, the byte stream message body is virtualized as a logical ring read in a counterclockwise direction, and the first byte in the byte stream message body (that is, byte content 84) is used as the starting index position. When the byte stream message body is sampled in a counterclockwise direction, the corresponding relationship between the index position and the byte content of each byte content in the byte stream message body is determined as shown in Table 1 below:

[0085] Table 1: Schematic diagram of the correspondence between data and index positions in byte stream message body

[0086]

[0087]

[0088] Finally, a specified number of bytes extracted from the byte stream message body is used as sample data for the byte stream message body to calculate the checksum.

[0089] Taking the method of calculating the checksum as calculating the cumulative sum of the extracted sample data and then performing the inversion operation as an example, the cumulative sum of the 8 sample data in Table 1 above is equal to 803, and the corresponding binary number original code is: 1100100011, and the result of the inversion operation is: 1111110011011100, and the corresponding decimal number is: 64732, then 64732 is the checksum of the final result.

[0090] In other optional embodiments, assuming that during the checksum calculation process, the cumulative sum is equal to 131292, and the corresponding binary number original code is: 10 00000000 11011100, then the "10" on the left is a high bit that exceeds 16 bits, and the high bit "10" is superimposed on the low bit 00000000 11011100, that is, 00000000 11011100+10=00000000 11011110, and the result of the inversion operation is: 1111111100100001, and the corresponding decimal number is: 65313, then 65313 is the checksum of the final result.

[0091] In some optional embodiments, when the accumulated sum exceeds a 16-bit binary number, the operation of adding the overflowed high bits to the low bits may be repeated until the accumulated sum is less than or equal to a 16-bit binary number.

[0092] The interface request security verification method disclosed in the embodiment of the present application samples the byte stream message body by virtualizing the byte stream message body as a logical ring for data sampling, and performing two-stage index generation based on random numbers, and then using the index generated in the second stage to sample the logical ring, thereby sampling the byte stream message body, further improving the security of the verification and reducing the probability of the algorithm being brute-force cracked.

[0093] Step 140, sending an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security check on the application programming interface request.

[0094] In some optional embodiments, optionally, sending an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, includes: generating an application programming interface request to be sent based on the byte stream message body; setting the checksum, the second key, the random factor and the timestamp in the communication protocol request header of the application programming interface request to be sent to obtain the application programming interface request; and sending the application programming interface request to the preset server. For example, setting the checksum, the second key, the random factor and the timestamp in the http header field of the application programming interface request and sending it to the preset server.

[0095] In some optional embodiments, the preset server performs security verification on the client based on the application programming interface request, including: in response to the application programming interface request, parsing the application programming interface request to obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client; obtaining the first key paired with the second key from the preset key manager; based on the timestamp, the first key and the random factor, verifying the byte stream message body to obtain the second checksum; in response to the first checksum being equal to the second checksum, determining that the application programming interface request verification has passed; in response to the first checksum being unequal to the second checksum, determining that the application programming interface request verification has failed.

[0096] After receiving the application programming interface request sent by the client, the preset server, in addition to parsing the application programming interface request to obtain the byte stream message body, further parses the random factor, the second key, the timestamp, and the checksum sum1 from the http header of the application programming interface request, and then samples data in the byte stream message body of the request according to the verification algorithm, and then uses the verification algorithm to calculate a checksum sum2; finally, the server verifies the application programming interface request based on the comparison result of the checksum calculated locally and the received checksum.

[0097] The specific implementation of each step of the preset server performing security verification on the client based on the application programming interface request is shown in the relevant description in the following embodiment, which will not be repeated here.

[0098] In summary, the interface request security verification method disclosed in the embodiment of the present application obtains a key pair from a preset key manager, wherein the key pair includes: a first key and a second key, and generates a random factor, and obtains a timestamp in real time; then, based on the timestamp, the first key and the random factor, the byte stream message body transmitted by the application programming interface request is sampled and verified to obtain a checksum; an application programming interface request is sent to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security check on the application programming interface request. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity is reduced, and it helps to shorten the time consumption of the interface request security verification and reduce the resource consumption caused by risk identification, so that risk traffic can be quickly identified and potential attacks on the server can be blocked in time. At the same time, by combining the random factor for sampling and verification, the verification result is more discrete, which helps to reduce the probability of the algorithm being cracked by brute force, thereby improving the verification security.

[0099] Based on the above embodiments, the present application also discloses an interface request security verification method, which is applied to the server. Figure 3 As shown, the method includes: step 310 to step 350.

[0100] Step 310, in response to the application programming interface request, parse the application programming interface request to obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client.

[0101] In some optional embodiments, the client and the server communicate according to a preset communication protocol. After receiving the application programming interface request, the server parses the application programming interface request according to the preset protocol to obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client.

[0102] Step 320: Acquire a first key paired with the second key from a preset key manager.

[0103] The server obtains the first key paired with the second key through a preset key manager.

[0104] Step 330: Based on the timestamp, the first key and the random factor, the byte stream message body is verified to obtain a second checksum.

[0105] In some optional embodiments, the byte stream message body is verified based on the timestamp, the first key and the random factor to obtain a second checksum, including: based on the timestamp, the first key and the random factor, using a preset function to calculate a result value; obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: the table length of a first index table initialized in advance; reading the first index table based on the first index value to obtain a specified number of second index values; respectively obtaining the byte content at the position corresponding to each of the second index values ​​in the byte stream message body; performing preset operation processing on the obtained byte content to obtain a checksum.

[0106] The specific implementation method of using a preset function to calculate a result value based on the timestamp, the first key and the random factor is the same as the method in the aforementioned embodiment in which the client uses a preset function to calculate a result value based on the timestamp, the first key and the random factor, and will not be repeated here.

[0107] The method for initializing the first index table is as described above and will not be repeated here.

[0108] In some optional embodiments, the byte content of the position corresponding to each of the second index values ​​in the byte stream message body is obtained respectively, including: taking the byte stream message body as a logical ring, and determining the starting index position of the logical ring; obtaining the current index position of the logical ring according to the starting index position and the second index value; and obtaining the byte content in the byte stream message body corresponding to the current index position in the logical ring.

[0109] The specific implementation methods of each step in obtaining the byte content at the position corresponding to each second index value in the byte stream message body can be found in the specific implementation methods of sampling the byte stream message body in the previous embodiment, which will not be repeated here.

[0110] The specific implementation method of performing a preset operation on the obtained byte content to obtain the checksum refers to the specific implementation method of calculating the checksum by the client in the previous embodiment, which will not be repeated here.

[0111] Step 340: In response to the first checksum being equal to the second checksum, determine that the application programming interface request has passed verification.

[0112] Step 350: In response to the first checksum being unequal to the second checksum, determining that the application programming interface request verification has failed.

[0113] Taking the first checksum obtained by the server analysis as sum1 and the second checksum obtained by the server sampling and calculating the byte stream message body as sum2 as an example, the server compares whether sum1 and sum2 are equal. If the first checksum sum1 is equal to the second checksum sum2, the check passes and the subsequent business processing continues; if the first checksum sum1 is not equal to the second checksum sum2, the check fails and the subsequent business processing is terminated.

[0114] In summary, the interface request security verification method disclosed in the embodiment of the present application is that the server responds to the application programming interface request, parses the application programming interface request, obtains the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client; obtains the first key paired with the second key from the preset key manager; based on the timestamp, the first key and the random factor, the byte stream message body is verified and processed to obtain the second checksum; in response to the first checksum being equal to the second checksum, it is determined that the application programming interface request verification is passed; in response to the first checksum being unequal to the second checksum, it is determined that the application programming interface request verification fails. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity of this method is reduced, and it helps to shorten the time consumption of the interface request security verification and reduce the resource consumption caused by risk identification, so that risk traffic can be quickly identified and potential attacks on the server can be blocked in time. At the same time, by combining the random factor for sampling checksum, the verification result is more discrete, which helps to reduce the probability of the algorithm being cracked by brute force, thereby improving the verification security.

[0115] Based on the aforementioned embodiments, the present application also discloses an interface request security verification system, which includes: a client, a server, and a key manager.

[0116] Combine the following Figure 4 The interaction diagram shown and Figure 5 The schematic diagram of the safety verification principle shown in the figure specifically illustrates the specific implementation of the interface request safety verification system.

[0117] like Figure 5 As shown, the client and the server apply for a key pair from the key manager respectively, the key pair comprising: a first key and a second key. Optionally, the first key is used as a private key for data signing, and the second key is used as a public key for querying the first key.

[0118] like Figure 4 As shown, optionally, in the interface request security verification system,

[0119] The key manager is used to generate and manage key pairs according to the request of the client or the server;

[0120] The client is used to obtain a key pair from the key manager, the key pair comprising: a first key and a second key; and generate a random factor and obtain a timestamp in real time;

[0121] The client is further configured to perform sampling verification processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor to obtain a checksum;

[0122] The client is further used to send an application programming interface request to the server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp;

[0123] The server is used to respond to the application programming interface request, parse the application programming interface request, and obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client;

[0124] The server is further configured to obtain a first key paired with the second key from the key manager;

[0125] The server is further configured to perform verification processing on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum;

[0126] The server is further configured to obtain a verification result of the application programming interface request based on a comparison result of the first checksum and the second checksum.

[0127] Afterwards, the server sends the application programming interface request verification result to the server.

[0128] Optionally, based on the comparison result of the first checksum and the second checksum, a verification result of the application programming interface request is obtained, including: in response to the first checksum being equal to the second checksum, determining that the application programming interface request verification has passed; in response to the first checksum being unequal to the second checksum, determining that the application programming interface request verification has failed.

[0129] The specific implementation methods of each step in the interaction process between the client and the server can be found in the specific implementation methods of the relevant operations in the previous embodiments, which will not be repeated here.

[0130] In summary, the interface request security verification system disclosed in the implementation of this application is used to sample and calculate the checksum of the byte stream message body of the application programming interface request by calculating the two-stage index value based on random numbers. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity is reduced, and it helps to shorten the time consumption of interface request security verification and reduce the resource consumption caused by risk identification. It can quickly identify risky traffic and block potential attacks on the server in time. At the same time, by combining random factors for sampling and verification, the verification result is more discrete, which helps to reduce the probability of the algorithm being brute-force cracked, thereby improving the verification security.

[0131] Based on the above embodiments, the present application also discloses an interface request security verification device, which is applied to a client, such as Figure 6 As shown, the device comprises:

[0132] The key pair acquisition module 610 is used to acquire a key pair from a preset key manager, wherein the key pair includes: a first key and a second key;

[0133] The check factor acquisition module 620 is used to generate a random factor and obtain a timestamp in real time;

[0134] A checksum acquisition module 630, configured to perform sampling check processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor, and obtain a checksum;

[0135] The verification module 640 is used to send an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security verification on the application programming interface request.

[0136] Optionally, the verification and acquisition module 630 is further used to:

[0137] Calculate a result value using a preset function based on the timestamp, the first key and the random factor;

[0138] Obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: a table length of a first index table obtained by initialization in advance;

[0139] Read the first index table based on the first index value to obtain a specified number of second index values;

[0140] Respectively obtain the byte content at the position corresponding to each second index value in the byte stream message body transmitted by the application programming interface request;

[0141] A preset operation is performed on the acquired byte content to obtain a checksum.

[0142] Optionally, the step of respectively obtaining the byte content at a position corresponding to each second index value in the byte stream message body transmitted by the application programming interface request includes:

[0143] Taking the byte stream message body transmitted by the application programming interface request as a logical ring, and determining the starting index position of the logical ring;

[0144] Acquire a current index position of the logical ring according to the starting index position and the second index value;

[0145] Obtain the byte content in the byte stream message body corresponding to the current index position in the logical ring.

[0146] The interface request security verification device disclosed in the embodiment of the present application is used to implement the interface request security verification method described in the embodiment of the present application. The specific implementation methods of each module of the device will not be repeated here, and reference can be made to the specific implementation methods of the corresponding steps in the method embodiment.

[0147] The interface request security verification device disclosed in the embodiment of the present application is applied to the client, and obtains a key pair from a preset key manager, wherein the key pair includes: a first key and a second key, and generates a random factor, and obtains a timestamp in real time; then, based on the timestamp, the first key and the random factor, the byte stream message body transmitted by the application programming interface request is sampled and verified to obtain a checksum; and an application programming interface request is sent to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security check on the application programming interface request. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity is reduced, and it helps to shorten the time consumption of the interface request security verification and reduce the resource consumption caused by risk identification, so that risk traffic can be quickly identified and potential attacks on the server can be blocked in time. At the same time, by combining the random factor for sampling and verification, the verification result is more discrete, which helps to reduce the probability of the algorithm being cracked by brute force, thereby improving the verification security.

[0148] Based on the above embodiments, the present application also discloses an interface request security verification device, which is applied to the server, such as Figure 7 As shown, the device comprises:

[0149] The request parsing module 710 is used to parse the application programming interface request in response to the application programming interface request to obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client;

[0150] A key acquisition module 720, configured to acquire a first key paired with the second key from a preset key manager;

[0151] A checksum acquisition module 730, configured to perform a checksum process on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum;

[0152] A verification module 740, configured to determine that the application programming interface request verification passes in response to the first checksum being equal to the second checksum;

[0153] The verification module 740 is further configured to determine that the application programming interface request verification fails in response to the first checksum being unequal to the second checksum.

[0154] Optionally, the verification and acquisition module 730 is further used to:

[0155] Calculate a result value using a preset function based on the timestamp, the first key and the random factor;

[0156] Obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: a table length of a first index table obtained by initialization in advance;

[0157] Read the first index table based on the first index value to obtain a specified number of second index values;

[0158] Respectively obtain the byte content at the position corresponding to each second index value in the byte stream message body;

[0159] A preset operation is performed on the acquired byte content to obtain a checksum.

[0160] The interface request security verification device disclosed in the embodiment of the present application is used to implement the interface request security verification method described in the embodiment of the present application. The specific implementation methods of each module of the device will not be repeated here, and reference can be made to the specific implementation methods of the corresponding steps in the method embodiment.

[0161] The interface request security verification device disclosed in the embodiment of the present application is, through the server side, by responding to the application programming interface request, parsing the application programming interface request, obtaining the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client; obtaining the first key paired with the second key from the preset key manager; based on the timestamp, the first key and the random factor, the byte stream message body is verified and processed to obtain the second checksum; in response to the first checksum being equal to the second checksum, it is determined that the application programming interface request verification is passed; in response to the first checksum being unequal to the second checksum, it is determined that the application programming interface request verification fails. Since the data sampling length for calculating the checksum is fixed and does not depend on the length of the byte stream message body, the time complexity of this method is reduced, and it helps to shorten the time consumption of the interface request security verification and reduce the resource consumption caused by risk identification, so that risk traffic can be quickly identified and potential attacks on the server can be blocked in time. At the same time, by combining the random factor for sampling checksum, the verification result is more discrete, which helps to reduce the probability of the algorithm being cracked by brute force, thereby improving the verification security.

[0162] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0163] The above is a detailed introduction to an interface request security verification method and device provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0164] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0165] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the electronic device according to the embodiment of the present application. The present application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0166] For example, Figure 8 An electronic device that can implement the method according to the present application is shown. The electronic device can be a PC, a mobile terminal, a personal digital assistant, a tablet computer, etc. The electronic device traditionally includes a processor 810 and a memory 820 and a program code 830 stored on the memory 820 and can be run on the processor 810, and the processor 810 implements the method described in the above embodiment when executing the program code 830. The memory 820 can be a computer program product or a computer-readable medium. The memory 820 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 820 has a storage space 8201 for the program code 830 of the computer program for executing any method step in the above method. For example, the storage space 8201 for the program code 830 can include various computer programs for implementing the various steps in the above method respectively. The program code 830 is a computer-readable code. These computer programs can be read from one or more computer program products or written into the one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. The computer program includes a computer readable code, and when the computer readable code is executed on an electronic device, the electronic device is caused to execute the method according to the above embodiment.

[0167] The embodiment of the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the interface request security verification method described in the embodiment of the present application are implemented.

[0168] Such a computer program product may be a computer-readable storage medium, which may have a computer-readable storage medium having a Figure 8The memory 820 in the electronic device shown in the figure is similar to the storage segment, storage space, etc. The program code can be compressed and stored in the computer-readable storage medium in an appropriate form. The computer-readable storage medium is generally as shown in the reference Fig. 9 The portable or fixed storage unit. Generally, the storage unit includes computer readable code 830', which is a code read by a processor. When the code is executed by the processor, each step in the method described above is implemented.

[0169] The term "one embodiment", "embodiment" or "one or more embodiments" herein means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. In addition, please note that the examples of the term "in one embodiment" here do not necessarily all refer to the same embodiment.

[0170] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0171] In the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An interface request security verification method, applied to a client, characterized in that: The method comprises: Acquire a key pair from a preset key manager, the key pair comprising: a first key and a second key; Generate random factors and obtain timestamps in real time; Based on the timestamp, the first key and the random factor, a sampling check is performed on the byte stream message body transmitted by the application programming interface request to obtain a checksum; Sending an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security check on the application programming interface request.

2. The method according to claim 1, characterized in that The step of performing sampling verification processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor to obtain a checksum includes: Calculate a result value using a preset function based on the timestamp, the first key and the random factor; Obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: a table length of a first index table obtained by initialization in advance; Read the first index table based on the first index value to obtain a specified number of second index values; Respectively obtain the byte content at the position corresponding to each second index value in the byte stream message body transmitted by the application programming interface request; A preset operation is performed on the acquired byte content to obtain a checksum.

3. The method according to claim 2, characterized in that The step of respectively obtaining the byte content at the position corresponding to each second index value in the byte stream message body transmitted by the application programming interface request includes: Taking the byte stream message body transmitted by the application programming interface request as a logical ring, and determining the starting index position of the logical ring; Acquire a current index position of the logical ring according to the starting index position and the second index value; Obtain the byte content in the byte stream message body corresponding to the current index position in the logical ring.

4. An interface request security verification method, applied to a server, characterized in that: The method comprises: In response to the application programming interface request, the application programming interface request is parsed to obtain a byte stream message body, a first checksum, a second key, a random factor and a timestamp of the application programming interface request sent by the client; Acquire a first key paired with the second key from a preset key manager; Based on the timestamp, the first key and the random factor, verify the byte stream message body to obtain a second checksum; In response to the first checksum being equal to the second checksum, determining that the application programming interface request passes verification; In response to the first checksum being unequal to the second checksum, it is determined that the application programming interface request fails verification.

5. The method according to claim 4, characterized in that The performing verification processing on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum includes: Calculate a result value using a preset function based on the timestamp, the first key and the random factor; Obtaining a first index value obtained by taking the result value modulo a target length, wherein the target length is: a table length of a first index table obtained by initialization in advance; Read the first index table based on the first index value to obtain a specified number of second index values; Respectively obtain the byte content at the position corresponding to each second index value in the byte stream message body; A preset operation is performed on the acquired byte content to obtain a checksum.

6. An interface request security verification device, characterized in that: Applied to a client, the device comprises: A key pair acquisition module, used to acquire a key pair from a preset key manager, the key pair comprising: a first key and a second key; The verification factor acquisition module is used to generate random factors and obtain timestamps in real time; A checksum acquisition module, configured to perform sampling check processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor, and obtain a checksum; A verification module is used to send an application programming interface request to a preset server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp, so that the preset server performs a security verification on the application programming interface request.

7. An interface request security verification device, characterized in that: Applied to the server, the device comprises: A request parsing module, used to respond to an application programming interface request, parse the application programming interface request, and obtain a byte stream message body, a first checksum, a second key, a random factor, and a timestamp of the application programming interface request sent by the client; A key acquisition module, used to acquire a first key paired with the second key from a preset key manager; A checksum acquisition module, configured to perform a checksum process on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum; a verification module, configured to determine that the application programming interface request verification passes in response to the first checksum being equal to the second checksum; The verification module is further configured to determine that verification of the application programming interface request fails in response to the first checksum being unequal to the second checksum.

8. An interface request security verification system, characterized in that: The system includes: a client, a server, and a key manager, wherein: The client is used to obtain a key pair from the key manager, the key pair comprising: a first key and a second key; and generate a random factor and obtain a timestamp in real time; The client is further configured to perform sampling verification processing on the byte stream message body transmitted by the application programming interface request based on the timestamp, the first key and the random factor to obtain a checksum; The client is further used to send an application programming interface request to the server, wherein the application programming interface request carries the byte stream message body, the checksum, the second key, the random factor and the timestamp; The server is used to respond to the application programming interface request, parse the application programming interface request, and obtain the byte stream message body, the first checksum, the second key, the random factor and the timestamp of the application programming interface request sent by the client; The server is further configured to obtain a first key paired with the second key from the key manager; The server is further configured to perform verification processing on the byte stream message body based on the timestamp, the first key and the random factor to obtain a second checksum; The server is further configured to obtain a verification result of the application programming interface request based on a comparison result of the first checksum and the second checksum.

9. An electronic device comprising a memory, a processor, and a program code stored in the memory and executable on the processor, characterized in that: When the processor executes the program code, the method according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium having program code stored thereon, characterized in that: When the program code is executed by a processor, the steps of the method described in any one of claims 1 to 5 are implemented.

Images