Method and device for verifying interface forwarding timeliness

Abstract

The invention discloses an interface forwarding timeliness verification method, which is applied to electronic equipment, the electronic equipment comprises a first system and a second system, and the second system provides access information for the first system. A second system can dynamically set effective access time corresponding to each piece of access information. The method comprises the following steps: a first system sends a first call request to the second system according to target access information; the second system receives the first calling request and generates authorization time, and the authorization time and the target access information are assembled into an access address response to the first system; the access address is the address of the third system; the first system receives the response and sends a second calling request according to the access address; and the second system receives the second calling request, obtains the target effective access time corresponding to the access information, obtains the current system time in real time, obtains the time difference according to the current system time and the authorization time, and allows the first system to access if the time difference is smaller than the target effective access time, so that the security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of interface request, and in particular to a method and device for verifying the timeliness of interface forwarding. Background Art

[0002] Existing systems use distribution services to access interfaces, such as system A accessing the interface of system C through system B. Often, the interface call to access system C has characteristics such as identity authority verification, access timeliness, and a fixed access address. Among them, identity authentication and access validity are generally implemented as follows: 1) Identity authentication is achieved through the JWT-TOKEN credential issued by system B, and system A carries the JWT-TOKEN when calling. If the JWT-TOKEN expires, system A needs to re-initiate a refresh of the JWT-TOKEN to obtain a new valid JWT-TOKEN. 2) The validity period of the JWT-TOKEN issued by system B is the time that the interface is allowed to access. 3) After obtaining the JWT-TOKEN, system A carries the JWT-TOKEN and calls a fixed address from system B to system C, or system A directly calls system C, and then system C uses the JWT-TOKEN to verify with system B. If the verification passes, access to the interface is allowed. However, the above method has the following disadvantages: 1. The validity period of JWT-TOKEN is fixed when it is issued, and the validity period cannot be changed during the process unless a new JWT-TOKEN is obtained.

[0003] 2. The address provided to system A to access system B and transfer to system C is fixed. It is usually set by system B after system B and system C are connected, and has low security. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method and device for verifying the timeliness of interface forwarding, which can dynamically change the access timeliness.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for verifying the timeliness of interface forwarding includes a first system and a second system, wherein the second system provides access information for the first system; the second system can dynamically set the effective access time corresponding to each access information, and the method includes: The first system sends a first call request to the second system according to the target access information; The second system receives the first call request and generates an authorization time, assembles the authorization time and the target access information into an access address and responds to the first system; The first system receives the response and sends a second call request according to the access address; The second system receives the second call request, obtains the target effective access time corresponding to the access information, obtains the current system time in real time, obtains the time difference based on the current system time and the authorization time, and if the time difference is less than the target effective access time, allows the first system to access.

[0006] The beneficial effects of the present invention are: by having the second system store the effective access time corresponding to each access information, the length of the effective access time can be dynamically adjusted according to actual access requirements; at the same time, since the effective access time can be dynamically adjusted, the number of requested interfaces is reduced compared with the existing method of obtaining JWT-TOKEN; and the access address is generated by the authorization time, that is, the access address will change with the change of the authorization time, thereby improving the security of the request. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A flowchart of a method for verifying the timeliness of interface forwarding in an embodiment of the present invention; Figure 2 Another step flow chart of a method for verifying the timeliness of interface forwarding in an embodiment of the present invention; Figure 3 The present invention is a schematic diagram of the structure of a device for verifying the timeliness of interface forwarding in an embodiment of the present invention. DETAILED DESCRIPTION

[0008] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0009] A method for verifying the timeliness of interface forwarding is applied to an electronic device, wherein the electronic device includes a first system and a second system, wherein the second system provides access information for the first system; and the second system can dynamically set the effective access time corresponding to each access information. The method includes: The first system sends a first call request to the second system according to the target access information; The second system receives the first call request and generates an authorization time, assembles the authorization time and the target access information into an access address and responds to the first system; the access address is the address of the third system; The first system receives the response and sends a second call request according to the access address; The second system receives the second call request, obtains the target effective access time corresponding to the access information, obtains the current system time in real time, obtains the time difference based on the current system time and the authorization time, and if the time difference is less than the target effective access time, allows the first system to access.

[0010] From the above description, it can be seen that the beneficial effects of the present invention are: by having the second system store the effective access time corresponding to each access information, the length of the effective access time can be dynamically adjusted according to actual access requirements; at the same time, since the effective access time can be dynamically adjusted, the number of requested interfaces is reduced compared with the existing method of obtaining JWT-TOKEN; and the access address is generated by the authorization time, that is, the access address will change with the change of the authorization time, thereby improving the security of the request.

[0011] Further, the access information includes a system identifier and an interface identifier; The effective access time includes the system effective time and the interface effective time; If the time difference is less than the target effective access time, allowing the first system to access includes: If the time difference is smaller than the system effective time, and the time difference is smaller than the interface effective time, the first system is allowed to access.

[0012] From the above description, it can be seen that by setting the system effective time and the interface effective time respectively, the first system is allowed to access only when the time difference is less than both the system effective time and the interface effective time, thereby improving access security.

[0013] Further, the second system generates a unique pair of non-docked encrypted public key and private key by using a first encryption algorithm, and provides the public key to the first system; The first system sending a first call request to the second system according to the target access information includes: The first system encrypts the target access information by using the public key to obtain the first call request; The second system receiving the first call request and generating the authorization time includes: The second system decrypts the first call request using the private key, and generates the authorization time if the decryption is successful.

[0014] It can be seen from the above description that a public key and a private key are obtained based on the first encryption algorithm, and the target access information is encrypted and decrypted by the public key and the private key, thereby improving the security of the access information.

[0015] Further, assembling the authorization time and the target access information into an access address response to the first system includes: Encrypting the authorization time and target access information by using a private key to obtain a first ciphertext; Encrypting the authorization time by a second encryption algorithm to obtain a second ciphertext; The first ciphertext and the second ciphertext are assembled into an access address response to the first system.

[0016] It can be seen from the above description that the authorization time is encrypted by the second encryption algorithm, so that a variable address can be generated based on the authorization time and the security of the access address can be improved.

[0017] Further, the first system receives the response, and sends a second call request according to the access address, including: The first system decrypts the first ciphertext by using the public key to obtain the target access information and generate a calling time; The calling time and the target access information are encrypted by using the public key to obtain a third ciphertext; A second call request is generated according to the third ciphertext and the target access information, and sent.

[0018] From the above description, it can be seen that the third ciphertext containing the calling time is used as the second calling request, so that the access time of the first system can be adjusted based on the calling time later; wherein, the calling time refers to the system time when the first system decrypts the first ciphertext, and it is considered that the first system is ready to start accessing the third system at this time.

[0019] Furthermore, the obtaining of the target effective access time corresponding to the access information includes: Determining whether the third ciphertext can be decrypted by the private key, and if not, not allowing the first system to access; If so, determine whether the target access information in the third ciphertext is consistent with the target access information in the second call request. If not, the first system is not allowed to access; if consistent, obtain the target effective access time corresponding to the access information.

[0020] From the above description, it can be seen that when the second system cannot decrypt the third ciphertext, it means that the transmitted target access information is incorrect, and when the decrypted target access information is inconsistent with the target access information in the second call request, it means that the transmitted target access information is incorrect, so that the first system is not allowed to access, so as to improve access security.

[0021] Furthermore, after obtaining the current system time in real time, the step further includes: A time difference is obtained according to the current system time and the calling time. If the time difference is less than the target effective access time, the first system is allowed to access.

[0022] It can be seen from the above description that by calculating the time difference by the calling time or the authorization time, the access time calculation requirements of different application processes can be met.

[0023] Furthermore, the obtaining of the target effective access time corresponding to the access information includes: The second system intercepts the first ciphertext in the path, and obtains the authorization time and target access information in the first ciphertext; Encrypting the authorization time and target access information by using the private key to obtain a fourth ciphertext; It is determined whether the fourth ciphertext is the same as the first ciphertext; if not, the first system is not allowed to access.

[0024] From the above description, it can be seen that by intercepting the first ciphertext in the path, decrypting the first ciphertext and then encrypting it again to determine whether the two encryption results are consistent. If they are inconsistent, it means that the transmitted target access information is incorrect, and the first system is not allowed to access, so as to improve access security.

[0025] Furthermore, the real-time acquisition of the current system time includes: It is determined whether the target effective access time is a positive number; if not, the first system is not allowed to access.

[0026] From the above description, it can be seen that when the target effective access time is a negative value, it means that the current system state is access prohibited, and the subsequent judgment steps are not performed, thereby reducing system energy consumption.

[0027] Another embodiment of the present invention provides a device for verifying the timeliness of interface forwarding, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, each step in a method for verifying the timeliness of interface forwarding is implemented as described above.

[0028] The method and device for verifying the timeliness of interface forwarding provided by the present invention can be applied to the scenario of inter-system interface access through distribution service, and the following is an explanation through specific implementation methods: Embodiment 1 Please refer to Figure 1 as well as Figure 2A method for verifying the timeliness of interface forwarding is applied to an electronic device. The electronic device includes a first system and a second system. The second system provides access information for the first system. For example, the first system is system A and the second system is system B. The second system generates a unique pair of non-docking encrypted public keys, private keys and system identifiers for the calling system through a first encryption algorithm, such as SM2, generates a unique interface identifier for the interface provided by system C, and provides the public key, system identifier and interface identifier to the first system. At the same time, the second system can dynamically set the effective access time corresponding to each access information. For example, system B sets the effective access time E1 and E2 for each system identifier and interface identifier respectively. The units can be years, months, days, hours, minutes and seconds, and the effective access time is stored in a database or REDIS (Remote Dictionary) Server, remote dictionary service), where a negative integer of the effective access time indicates that the interface is prohibited from access, and a positive integer indicates that the interface is allowed to access; since the effective access time is stored in system B, changing this value can control the access delay, shorten or disable of the interface in real time; specifically: delay: increase the effective access time; shorten: reduce the effective access time; disable: set the effective access time to a negative value, thereby solving the problem in the prior art that the validity period of JWT-TOKEN is fixed when it is issued and the validity period cannot be changed during the process unless a new JWT-TOKEN is obtained.

[0029] The verification method includes the following steps: S1. The first system sends a first call request to the second system according to the target access information. Specifically: the first system encrypts the target access information through the public key to obtain the first call request; for example, system A encrypts the "system identifier & interface identifier" format through the public key in SM2 to obtain entryS3, puts the encrypted result entryS3 and the system identifier in plain text into the request header to obtain the first call request and sends the request to system B.

[0030] S2. The second system receives the first call request and generates an authorization time, assembles the authorization time and the target access information into an access address and responds to the first system; the access address is the address of the third system, specifically: S21. The second system decrypts the first call request through the private key. If the decryption is successful, the authorization time is generated; that is, after system B receives the request to use the system identifier, it obtains the private key in SM2 to decrypt entryS3. If the decryption fails, the system cannot be accessed; if the decryption is successful, the authorization time is obtained; wherein the authorization time is the current system time after the decryption is successful.

[0031] S22. Encrypt the authorization time and target access information with a private key to obtain a first ciphertext; that is, system B performs SM2 encryption on "authorization time & system identifier & interface identifier" with a private key to obtain a first ciphertext entry S4.

[0032] S23. Encrypt the authorization time by a second encryption algorithm to obtain a second ciphertext; for example, encrypt the authorization time by SM3 to obtain a second ciphertext entry S4-2, which is used to generate a variable address and assemble it into an access address.

[0033] S24, assemble the first ciphertext and the second ciphertext into an access address and respond to the first system; for example, use entryS4-2 as the first segment address of the URI (Uniform Resource Identifier), "IP:PORT / entryS4-2 / xxxx" to respond to system A.

[0034] S3. The first system receives the response and sends a second call request according to the access address. Specifically: S31. The first system decrypts the first ciphertext through the public key to obtain the target access information and generate the calling time. For example, after receiving the response, system A uses the public key to decrypt entryS4 to obtain the authorization time, system ID and interface table ID. At the same time, the current system time after the successful decryption of entryS4 is used as the calling time.

[0035] S32. Encrypt the call time and target access information by using the public key to obtain a third ciphertext; that is, encrypt “call time & system identifier & interface identifier” by using the public key to generate a third ciphertext entry S5.

[0036] S33. Generate a second call request according to the third ciphertext and the target access information, and send it; that is, add entryS5 to the request header, put the authorization time, system identifier and interface identifier decrypted from entryS4 into the request header, and initiate the interface request according to the response address (IP:PORT / entryS4-2 / xxxx) of step S2.

[0037] S4, the second system receives the second call request, obtains the target effective access time corresponding to the access information, obtains the current system time in real time, obtains the time difference according to the current system time and the authorization time, and allows the first system to access if the time difference is less than the target effective access time; Among them, multiple verification steps are also included before making a judgment based on the time difference, as follows: S41, determining whether the third ciphertext (entry S5) can be decrypted by the private key, if not, the first system is not allowed to access; if yes, it indicates that the transmitted system identifier is correct, and executing step S42.

[0038] S42, determine whether the target access information in the third ciphertext is consistent with the target access information in the second call request, if not, the first system is not allowed to access; if consistent, execute step S43. Specifically: determine whether the interface identifier obtained by decrypting the third ciphertext entryS5 matches the interface identifier in the request header, if they match, it means that the transmitted interface identifier is correct, execute step S43; otherwise, access is not allowed.

[0039] S43, intercept the first ciphertext (entryS4) in the path, and obtain the authorization time and target access information in the first ciphertext; that is, obtain the authorization time, system identifier, and interface identifier in the request header; then, encrypt the authorization time and target access information with a private key to obtain a fourth ciphertext entryS6-3; determine whether the fourth ciphertext entryS6-3 is the same as the first ciphertext entryS4, if not, the first system is not allowed to access; if so, it means that the interface is authorized, and execute step S44.

[0040] S44. Obtain the effective access time through the system identifier and the interface identifier, and determine whether the target effective access time is a positive number. If not, the first system is not allowed to access; that is, determine whether the effective times E1 and E2 corresponding to the system identifier and the interface identifier are both positive numbers. If not, access is not allowed; if so, execute step S45.

[0041] S45, obtaining the current system time, and obtaining the time difference D1 according to the current system time and the authorization time, and if the time difference D1 is less than the system effective access time E1, the first system is allowed to access, otherwise the access is not allowed. Meanwhile, if the time difference D1 is less than the interface effective access time E2, the first system is allowed to access, otherwise the access is not allowed.

[0042] S5. If the access is denied, the first system repeats steps S1-S4.

[0043] Among them, in an optional implementation, in the application process, the access validity may be calculated from the time of authorization or from the time of call, so it is necessary to subtract the authorization time or the call time according to the actual application situation; that is, in step S45, the time difference can also be obtained according to the current system time and the call time. If the time difference is less than the target effective access time, the first system is allowed to access; otherwise, access is not allowed.

[0044] Embodiment 2 Please refer to Figure 3 , a device for verifying the timeliness of interface forwarding, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of a method for verifying the timeliness of interface forwarding as described in Example 1 is implemented.

[0045] In summary, the interface forwarding timeliness verification and device provided by the present invention has the following effects: 1. You can set the effective time for each caller to access the system or interface, control the delay, shorten or disable the interface access, and it will take effect immediately: 2. In the prior art, once a JWT-TOKEN is issued, it cannot be modified unless a new JWT-TOKEN is regenerated. For example, if the validity period in a JWT-TOKEN is 3 minutes, then the validity period of the same JWT-TOKEN after issuance will always be 3 minutes, and it cannot be adjusted to 2 minutes, 4 minutes, or the JWT-TOKEN will become invalid. Therefore, the validity period can only be updated if the request is re-invoked and a new JWT-TOKEN is obtained. In this application, based on the modifiable validity period, the caller system does not need to obtain additional credentials again, thereby reducing the number of requested interfaces and eliminating the need to store additional JWT-TOKENs.

[0046] 3. In the prior art, the address provided to system A for accessing system B and transferring to system C is fixed, and is generally set by system B after system B and system C are connected. As a distribution system, system B should not expose the real request address of system C. System A will only access system B, and will not directly access system C. In this application, the dynamic interface is obtained by calling system B, and this address is an encrypted string. The address changes because the authorization time is added to it, and as long as the verification address is the response of system B to system A, it means that the address is compliant; that is, the interface is dynamically obtained and changed, making the interface request more secure, variable, and confidential.

[0047] 4. Anti-fraud verification is performed on the called systems, interfaces, and interface authorizations to confirm the legitimacy of the identity and improve access security.

[0048] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for verifying the timeliness of interface forwarding, characterized in that: Applied to an electronic device, the electronic device comprises a first system and a second system, the second system provides access information for the first system; The second system can dynamically set the effective access time corresponding to each access information, and the method includes: The first system sends a first call request to the second system according to the target access information; The second system receives the first call request and generates an authorization time, assembles the authorization time and the target access information into an access address and responds to the first system; the access address is the address of the third system; The first system receives the response and sends a second call request according to the access address; The second system receives the second call request, obtains the target effective access time corresponding to the access information, obtains the current system time in real time, obtains the time difference based on the current system time and the authorization time, and if the time difference is less than the target effective access time, allows the first system to access.

2. A method for verifying the timeliness of interface forwarding according to claim 1, characterized in that: The access information includes a system identifier and an interface identifier; The effective access time includes the system effective time and the interface effective time; If the time difference is less than the target effective access time, allowing the first system to access includes: If the time difference is smaller than the system effective time, and the time difference is smaller than the interface effective time, the first system is allowed to access.

3. A method for verifying the timeliness of interface forwarding according to claim 1, characterized in that: The second system generates a unique pair of non-docked encrypted public key and private key by using a first encryption algorithm, and provides the public key to the first system; The first system sending a first call request to the second system according to the target access information includes: The first system encrypts the target access information by using the public key to obtain the first call request; The second system receiving the first call request and generating the authorization time includes: The second system decrypts the first call request using the private key, and generates the authorization time if the decryption is successful.

4. A method for verifying the timeliness of interface forwarding according to claim 3, characterized in that: The step of assembling the authorization time and the target access information into an access address response to the first system comprises: Encrypting the authorization time and target access information by using a private key to obtain a first ciphertext; Encrypting the authorization time by a second encryption algorithm to obtain a second ciphertext; The first ciphertext and the second ciphertext are assembled into an access address response to the first system.

5. A method for verifying the timeliness of interface forwarding according to claim 4, characterized in that: The first system receives the response, and sends a second call request according to the access address, including: The first system decrypts the first ciphertext by using the public key to obtain the target access information and generate a calling time; The calling time and the target access information are encrypted by using the public key to obtain a third ciphertext; A second call request is generated according to the third ciphertext and the target access information, and sent.

6. A method for verifying the timeliness of interface forwarding according to claim 5, characterized in that: The obtaining of the target effective access time corresponding to the access information comprises: Determining whether the third ciphertext can be decrypted by the private key, and if not, not allowing the first system to access; If so, determine whether the target access information in the third ciphertext is consistent with the target access information in the second call request. If not, the first system is not allowed to access; if consistent, obtain the target effective access time corresponding to the access information.

7. A method for verifying the timeliness of interface forwarding according to claim 4, characterized in that: The real-time acquisition of the current system time also includes: A time difference is obtained according to the current system time and the calling time. If the time difference is less than the target effective access time, the first system is allowed to access.

8. A method for verifying the timeliness of interface forwarding according to claim 4, characterized in that: The obtaining of the target effective access time corresponding to the access information comprises: The second system intercepts the first ciphertext in the path, and obtains the authorization time and target access information in the first ciphertext; Encrypting the authorization time and target access information by using the private key to obtain a fourth ciphertext; It is determined whether the fourth ciphertext is the same as the first ciphertext; if not, the first system is not allowed to access.

9. A method for verifying the timeliness of interface forwarding according to claim 1, characterized in that: The real-time acquisition of the current system time includes: It is determined whether the target effective access time is a positive number; if not, the first system is not allowed to access.

10. A device for verifying the timeliness of interface forwarding, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, each step of the method for verifying the timeliness of interface forwarding as described in any one of claims 1 to 9 is implemented.

Images