API service calling method, API service providing system and electronic equipment

Abstract

The invention discloses an API service calling method, an API service providing system and electronic equipment, and belongs to the technical field of information security. The method comprises the following steps: receiving an API service calling request from a service demander, wherein the calling request carries a path and a request mode of an API service; obtaining configuration information of the API service from a mapping relation of the API service according to the path and the request mode; obtaining response data returned by the API service according to the calling request and the configuration information; according to a return type in the configuration information and whether a watermark field is added, determining whether the response data needs to be added with a digital watermark; if the response data needs to be added with a digital watermark, executing watermark adding logic based on the response data, provider information of the API service and a quantum key corresponding to a service demander, and obtaining API service return data; and sending the return data to the service demand side. According to the method, the digital watermark is added to the API service return data, whether the data are tampered or not can be reflected, and the source of the API service return data can also be determined.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and in particular relates to an API service calling method, an API service providing system and an electronic device. Background Art

[0002] Application Programming Interface (API) service is one of the important ways to share and exchange government data and provide public service data. As business application scenarios become more and more diverse, the number of API service interfaces is also increasing. After being provided to third parties such as service demanders, the flow of data has become more complicated. There is a risk of data tampering and the integrity and authenticity of the content cannot be guaranteed. Summary of the invention

[0003] The present application aims to solve at least one of the technical problems existing in the related art. To this end, the present application proposes an API service calling method, an API service providing system and an electronic device, which add a digital watermark to the API service return data to reflect whether the data has been tampered with. The digital watermark contains the information of the provider of the API service, which can be used to determine the source of the data returned by the API service.

[0004] In a first aspect, the present application provides an API service calling method, the method comprising:

[0005] Receive an API service call request from a service demander, wherein the API service call request carries a path and a request method for the API service;

[0006] According to the path and request method of the API service, obtain configuration information of the API service from the mapping relationship of the API service;

[0007] Obtaining response data returned by the API service according to the API service call request and the configuration information of the API service;

[0008] Determine whether to add a digital watermark to the response data returned by the API service according to the return type and whether to add a watermark field in the configuration information of the API service;

[0009] If the response data returned by the API service needs to be digitally watermarked, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander to obtain the API service return data;

[0010] The API service return data is sent to the service demander.

[0011] In the above technical scheme, an API service call request (carrying the path and request method of the API service) is received from the service demander, the configuration information of the API service is obtained according to the mapping relationship, and the response data returned by the API service is obtained according to the API service call request and the configuration information of the API service. Then, according to the return type in the configuration information and whether to add a watermark field, it is determined whether it is necessary to add a digital watermark to the response data returned by the API service. If necessary, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander, and the API service return data with a watermark is generated. If not necessary, the response data returned by the API service is used as the API service return data, thereby realizing the call of the API service. It is dynamically determined whether to add a digital watermark according to the configuration information. The digital watermark can reflect whether the data has been tampered with, thereby improving the security of the data returned by the API service. The digital watermark contains the provider information of the API service, which can be used to determine the source of the data returned by the API service.

[0012] According to one embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, including:

[0013] For each line of response data returned by the API service, the following watermark adding logic is executed:

[0014] Generate a first character string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander;

[0015] According to the private key of the national secret encryption algorithm corresponding to the service demander, the first character string is encrypted using the national secret encryption algorithm to obtain the signature value of the first character string;

[0016] The first character string is concatenated with the signature value to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0017] In the above technical scheme, by processing the response data returned by the API service line by line, combining the provider information of the API service and the quantum key corresponding to the service demander, a watermark value is generated and added, and a first character string is generated according to each line of data, the service provider information and the quantum key corresponding to the service demander, and the first character string is encrypted in combination with the national secret encryption algorithm private key corresponding to the service demander to obtain the signature value of the first character string, and the first character string and its signature value are concatenated to form a watermark value, which is added to the response data, and a watermark is added to each line of the response data returned by the API service. In the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, thereby improving the robustness of the digital watermark, and combining the national secret encryption algorithm and the quantum key to generate the digital watermark, thereby improving the security of the data returned by the API service, and being able to effectively determine whether the data returned by the API service has been tampered with. The digital watermark contains information about the service provider, which can be used to determine the source of the data.

[0018] According to an embodiment of the present application, before receiving the API service call request from the service demander, the method further includes:

[0019] Reviewing the service interface resource application from the service demander;

[0020] If the review is passed, a public key and private key pair of the national secret encryption algorithm corresponding to the service demander will be generated, the corresponding public key of the national secret encryption algorithm will be returned to the service demander, and the service demander will be negotiated with to determine the quantum key corresponding to the service demander.

[0021] In the above technical solution, before receiving the API service call request from the service demander, the service interface resource application of the service demander is first reviewed. If the review is passed, the public key and private key pair of the national secret encryption algorithm are generated, and the public key is returned to the service demander and the quantum key is negotiated to determine, so as to implement the review of the service demander who calls the API service, thereby improving the security of the API service call, and determining the public key and private key pair and quantum key of the national secret encryption algorithm with the service demander, and using them for the digital watermark of the data returned by the API service, thereby improving the security of the data returned by the API service.

[0022] According to one embodiment of the present application, the method further includes:

[0023] Determine the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request method, return type, whether to add a watermark;

[0024] Bind the publishing environment and publishing node of the API service, and publish the API service;

[0025] Using the path and request method of the API service as the key and the configuration information of the API service as the value, a mapping relationship of the API service is constructed;

[0026] List the API services mentioned above.

[0027] In the above technical solution, after determining the configuration information of the API service (including path, request method, return type, and whether a watermark needs to be added, etc.), the publishing environment and node are bound, the API service is published, and a mapping relationship is constructed with the path and request method as the key and the configuration information as the value. The API service is put on the shelf for use, thereby realizing the configuration and release of the API service, so that the API service can be called by the service demander. Whether the API service return data needs to be watermarked is determined in the configuration information, and the data can be protected according to actual needs, thereby improving the security and flexibility of the API calling method.

[0028] According to one embodiment of the present application, the method further includes:

[0029] Receive the API service return data uploaded by the service demander;

[0030] Verify the signature of the data returned by the API service;

[0031] If the signature verification is successful, the provider information of the API service in the data returned by the API service is obtained, and the provider information of the API service is returned to the service demander; or, if the signature verification fails, the data returned by the API service is discarded.

[0032] In the above technical scheme, the API service return data uploaded by the service demander is received and the signature is verified. The signature verification process is performed row by row. If the signature verification passes, the provider information of the API service is obtained and returned. The information of the API service provider can be calculated based on the watermark value and signature value in the specific column of each row of data (such as the last column), combined with the quantum key value corresponding to the service demander and the specific field value of the API service return data, thereby realizing the signature verification of the API service return data, which can be used to determine whether the data has been tampered with or forged, and the information of the API service provider can be further obtained to determine the source of the API service return data.

[0033] In a second aspect, the present application provides an API service calling method, the method comprising:

[0034] Send an API service call request, where the API service call request carries the path and request method of the API service;

[0035] Receive data returned by the API service, where the data returned by the API service is data with a digital watermark, and the digital watermark is obtained based on the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

[0036] In the above technical solution, an API service call request (carrying the path and request method of the API service) is sent, and the API service return data is received, wherein the API service return data may be data carrying a digital watermark. Through the above steps, the API service call is realized, and the API service return data can be added with a digital watermark, which can reflect whether the data has been tampered with, thereby improving the security of the API service return data.

[0037] According to one embodiment of the present application, the method further includes:

[0038] Send service interface resource request;

[0039] Receive the public key of the corresponding national secret encryption algorithm;

[0040] Negotiate quantum keys with the API service provider.

[0041] In the above technical solution, a service interface resource application is sent, the public key of the national secret encryption algorithm is received, and the quantum key is determined through negotiation with the provider of the API service, so that the API service can be called only after the service interface resource application, which effectively improves the security of the API service call. The public key of the national secret encryption algorithm and the quantum key are received, which can be used to verify the signature of the data returned by the API service, thereby improving the security of the subsequent data returned by the API service.

[0042] According to one embodiment of the present application, the method further includes:

[0043] Uploading the API service return data to the watermark extraction module, so that the watermark extraction module verifies the signature of the API service return data, and returns the provider information of the API service if the signature verification passes;

[0044] Receive the signature verification result of the API service return data returned by the watermark extraction module, where the signature verification result includes: provider information of the API service, or signature verification failure.

[0045] In the above technical solution, the data returned by the API service is uploaded to the watermark extraction module. If the signature verification passes, the provider information of the API service will be received, which can be used to determine the source of the data. If the signature verification fails, the result of signature verification failure will be returned, thereby realizing the detection of the authenticity of the data returned by the API service.

[0046] According to one embodiment of the present application, the method further includes:

[0047] Verify the signature of the data returned by the API service according to the public key of the corresponding national secret encryption algorithm;

[0048] After the signature verification is passed, the provider information of the API service in the data returned by the API service is obtained.

[0049] In the above technical solution, the data returned by the API service is verified according to the public key of the corresponding national secret encryption algorithm. If the verification is passed, the provider information of the API service can be further obtained, thereby realizing the verification of the data returned by the API service. It can be used to determine whether the data has been tampered with or forged, and the information of the provider of the API service can be further obtained to determine the source of the data.

[0050] In a third aspect, the present application provides an API service providing system, the system comprising:

[0051] An API external call module is used to receive an API service call request from a service demander, wherein the API service call request includes a request path and a request method of the API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request method of the API service, obtain response data returned by the API service according to the API service call request and the configuration information of the API service, determine whether a digital watermark needs to be added to the response data returned by the API service according to a return type and a field for adding a watermark in the configuration information of the API service, and if a digital watermark needs to be added to the response data returned by the API service, execute a watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, obtain API service return data, and send the API service return data to the service demander;

[0052] Service data supermarket, used to review the service interface resource application from the service demander;

[0053] An API generation and publishing module is used to determine the configuration information of the API service, bind the publishing environment and publishing node of the API service, and publish the API service;

[0054] The watermark extraction module is used to receive the API service return data uploaded by the service demander and verify the signature of the API service return data.

[0055] In the above technical scheme, the API external call module is used to receive an API service call request (carrying the path and request method of the API service) from the service demander, obtain the configuration information of the API service according to the mapping relationship, obtain the response data returned by the API service according to the API service call request and the configuration information of the API service, and then determine whether it is necessary to add a digital watermark to the response data returned by the API service according to the return type in the configuration information and whether to add a watermark field. If necessary, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander to generate API service return data with a watermark. If not, the response data returned by the API service is used as the API service return data, thereby realizing the call of the API service and dynamically determining whether to add a digital watermark according to the configuration information. The digital watermark can reflect whether the data has been tampered with, thereby improving the security of the data returned by the API service. The digital watermark contains the provider information of the API service, which can be used to determine the source of the data returned by the API service. It also realizes the review of the service demander who calls the API service, the release of the API service and the verification of the signature of the data returned by the API service.

[0056] According to one embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, including:

[0057] For each line of response data returned by the API service, the following watermark adding logic is executed:

[0058] Generate a first character string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander;

[0059] According to the private key of the national secret encryption algorithm corresponding to the service demander, the first character string is encrypted using the national secret encryption algorithm to obtain the signature value of the first character string;

[0060] The first character string is concatenated with the signature value to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0061] In the above technical scheme, by processing the response data returned by the API service line by line, combining the provider information of the API service and the quantum key corresponding to the service demander, a digital watermark is generated and added, and a first character string is generated according to each line of data, the service provider information and the quantum key corresponding to the service demander, and the first character string is encrypted in combination with the private key of the national secret encryption algorithm corresponding to the service demander to obtain the signature value of the first character string, and the first character string and its signature value are concatenated to form a watermark value, which is added to the response data, and a watermark is added to each line of the response data returned by the API service. In the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, thereby improving the robustness of the digital watermark, and combining the national secret encryption algorithm and the quantum key to generate the digital watermark, thereby improving the security of the data returned by the API service, and being able to effectively determine whether the data returned by the API service has been tampered with. The digital watermark contains information about the service provider, which can be used to determine the source of the data.

[0062] According to one embodiment of the present application, the system further includes:

[0063] The service data supermarket is used to review the service interface resource application from the service demander. If the review is passed, it generates a public key and a private key pair of the national secret encryption algorithm corresponding to the service demander, and returns the public key of the corresponding national secret encryption algorithm to the service demander;

[0064] The API external calling module is also used to negotiate with the service demander to determine the quantum key corresponding to the service demander.

[0065] In the above technical solution, before receiving the API service call request from the service demander, the service data supermarket is used to review the service interface resource application of the service demander. If the review is passed, a public key and private key pair of the national secret encryption algorithm is generated, and the public key is returned to the service demander. The API external call module is used to negotiate and determine the quantum key, and to review the service demander who calls the API service, thereby improving the security of the API service call, determining the national secret encryption algorithm and quantum key with the service demander, and using them for the digital watermark of the data returned by the API service, thereby improving the security of the data returned by the API service.

[0066] According to one embodiment of the present application, the system further includes: an API generation and publishing module, which is used to determine the configuration information of the API service, wherein the configuration information of the API service includes at least the following fields: path, request method, return type, whether a watermark needs to be added, bind the publishing environment and publishing node of the API service, and publish the API service;

[0067] The API external calling module is also used to build a mapping relationship of the API service with the path and request method of the API service as the key and the configuration information of the API service as the value, and put the API service on the shelves through the service data supermarket.

[0068] In the above technical solution, the API generation and publishing module is used to determine the configuration information of the API service (including path, request method, return type and whether to add a watermark, etc.), bind the publishing environment and node, and publish the API service. The API external call module is used to build a mapping relationship with the path and request method as the key and the configuration information as the value, and put the API service on the shelf for use, thereby realizing the effective configuration and release of the API service, enabling the API service to be called by the service demander, and determining whether the API service return data needs to be watermarked in the configuration information. Sensitive data can be protected according to actual needs, thereby improving the security and flexibility of the API calling method.

[0069] According to one embodiment of the present application, the system also includes: a watermark extraction module, which is used to receive the API service return data uploaded by the service demander, verify the signature of the API service return data, and if the signature verification passes, obtain the provider information of the API service in the API service return data, and return the provider information of the API service to the service demander; or, if the signature verification fails, discard the API service return data.

[0070] In the above technical scheme, the watermark extraction module is used to receive the API service return data uploaded by the service demander and perform signature verification. The signature verification process is performed row by row. If the signature verification passes, the provider information of the API service is obtained and returned. The information of the API service provider can be calculated based on the watermark value and signature value in the specific column of each row of data (such as the last column), combined with the quantum key value corresponding to the service demander and the specific field value of the API service return data, thereby realizing the signature verification of the API service return data, which can be used to determine whether the data has been tampered with or forged, and the information of the API service provider can be further obtained to determine the source of the API service return data.

[0071] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the processor implements the API service calling method as described in the first aspect above, or implements the API service calling method as described in the second aspect above.

[0072] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the API service calling method as described in the first aspect above, or implements the API service calling method as described in the second aspect above.

[0073] In a fifth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the API service calling method described in the first aspect above, or to implement the API service calling method described in the second aspect above.

[0074] In a sixth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the API service calling method as described in the first aspect above, or implements the API service calling method as described in the second aspect above.

[0075] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0077] Figure 1 This is one of the flowcharts of the API service calling method provided in some embodiments of the present application;

[0078] Figure 2 It is a flowchart of watermark adding logic provided by some embodiments of the present application;

[0079] Figure 3 It is a structural diagram of an API service providing system provided in some embodiments of the present application;

[0080] Figure 4 It is a timing diagram of the operation of the API service providing system provided in some embodiments of the present application;

[0081] Figure 5 This is the second flowchart of the API service calling method provided in some embodiments of the present application;

[0082] Figure 6 It is a schematic diagram of the structure of an electronic device provided in some embodiments of the present application.

[0083] Description of reference numerals:

[0084] 300: API service provision system;

[0085] 301: API external call module; 302: service data supermarket;

[0086] 303: API generation and release module; 304: watermark extraction module;

[0087] 600: electronic device; 601: processor; 602: memory. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0089] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0090] The following, in combination with the accompanying drawings, describes in detail the API service calling method, API service providing system and electronic device provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0091] The API service calling method provided in the embodiment of the present application may be executed by an electronic device or a functional module or functional entity in the electronic device that can implement the API service calling method. The API service calling method provided in the embodiment of the present application is described below using a server as an example of the execution subject.

[0092] Figure 1 This is one of the flowcharts of the API service calling method provided in some embodiments of the present application. Figure 1 As shown, the API service calling method includes: step 110, step 120, step 130, step 140, step 150 and step 160.

[0093] Step 110: Receive an API service call request from a service demander, where the API service call request carries a path and a request method for the API service.

[0094] It can be understood that the service demander refers to the entity that sends the API service call request, which can be a client application, a website or service, etc., which needs to access or operate the data or functions managed by the API service provider.

[0095] The API service call request carries the path and request method of the API service. The path of the API service describes the target address requested by the service demander, while the request method describes the type of request, such as GET and POST. The API service call request may also carry other information, such as query parameters, request body, header information, etc.

[0096] Step 120: According to the path and request method of the API service, obtain the configuration information of the API service from the mapping relationship of the API service.

[0097] According to the path and request method of the API service, the corresponding configuration information is obtained from the preset mapping relationship of the API service. The mapping relationship of the API service can be stored in a database or a configuration file, which stores the configuration information of the API service corresponding to the paths and request methods of different API services. The configuration information may include permission settings, data processing rules, response formats, etc., which can be used to correctly handle API service call requests.

[0098] In some embodiments, the mapping relationship of the API service uses the path and request method of the API service as the key (Key) and the configuration information of the API service as the value (Value).

[0099] Step 130: Obtain response data returned by the API service according to the API service call request and the configuration information of the API service;

[0100] In some embodiments, the configuration information of the API service includes at least the following fields: path, request method, return type, and whether to add a watermark. According to the return type and whether to add a watermark field, it is determined whether the response data returned by the API service needs to be added with a digital watermark, and the corresponding processing logic is executed to obtain the API service return data.

[0101] It is understandable that according to the API service call request of the service demander and the configuration information of the API service, the response data returned by the API service is obtained, and the corresponding operations may include querying the database, performing calculations or calling other services.

[0102] It can be understood that the data returned by the API service is data carrying a digital watermark, which is obtained based on the response data returned by the API service, the information of the provider of the API service, and the quantum key corresponding to the service demander.

[0103] Among them, the response data returned by the API service is directly returned as the API service return data without adding a digital watermark. If a watermark needs to be added, the response data returned by the API service participates in the generation of the digital watermark; the provider information of the API service is the information of the user who configures and publishes the API service (such as user ID), which can be used to determine the source of the data returned by the API service, and can also be used for the copyright protection of the data returned by the API service; the quantum key corresponding to the service demander is obtained through negotiation between the service demander and the provider of the API service. Using the quantum key in the process of digital watermark generation can improve the security of the data returned by the API service.

[0104] Step 140: Determine whether a digital watermark needs to be added to the response data returned by the API service according to the return type and whether to add a watermark field in the configuration information of the API service.

[0105] After obtaining the response data returned by the API service, determine whether to add a digital watermark to the response data returned by the API service based on the return type and whether to add a watermark field in the configuration information of the API service. If the value of the whether to add a watermark field is no, the watermark adding logic is not executed, and the response data returned by the API service is directly returned; if the value of the whether to add a watermark field is yes and the return type is an Excel file, the watermark adding logic is executed.

[0106] If the configuration information of the API service indicates that the response data returned by the API service needs to be digitally watermarked, the response data returned by the API service is used as the basis, combined with the provider information of the API service and the quantum key corresponding to the service demander, the watermark adding logic is executed, and the digital watermark is added to the response data. After the digital watermark adding is completed, the API service return data is obtained; if the configuration information of the API service indicates that the response data returned by the API service does not need to be digitally watermarked, the response data returned by the API service can be directly used as the API service return data.

[0107] Step 150: If the response data returned by the API service needs to be digitally watermarked, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander to obtain the API service return data.

[0108] The provider information of the API service refers to the information of the user who configures and publishes the API service (such as the user ID). The user configures and publishes the API service through the API generation and publishing module in the API service providing system. After the API service is published and put on the shelves, the service demander can request to call the API service. The provider information of the API service is stored in the entity that executes the API service calling method of the embodiment of the present application. During the process of executing the watermark adding logic, the provider information corresponding to the API service can be obtained from the entity or the storage device of the entity. In some embodiments, the provider information of the API service is stored in the memory of the server where the API service is deployed and operated.

[0109] Step 160: Send the API service return data to the service requester.

[0110] The API service return data is sent to the service demander. The sending of the API service return data may involve data encapsulation, data formatting, etc., so that the service demander can receive the API service return data of the called API service.

[0111] In the above technical scheme, an API service call request (carrying the path and request method of the API service) is received from the service demander, the configuration information of the API service is obtained according to the mapping relationship, and the response data returned by the API service is obtained according to the API service call request and the configuration information of the API service. Then, according to the return type in the configuration information and whether to add a watermark field, it is determined whether it is necessary to add a digital watermark to the response data returned by the API service. If necessary, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander, and the API service return data with a watermark is generated. If not necessary, the response data returned by the API service is used as the API service return data, thereby realizing the call of the API service. It is dynamically determined whether to add a digital watermark according to the configuration information. The digital watermark can reflect whether the data has been tampered with, thereby improving the security of the data returned by the API service. The digital watermark contains the provider information of the API service, which can be used to determine the source of the data returned by the API service.

[0112] In one embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, including:

[0113] For each row of response data returned by the API service, watermark adding logic is executed.

[0114] It is understandable that when the data returned by the API service is in Excel format, the data is organized in a table, which may contain multiple rows and columns. Each row represents a record, and each column represents a specific field or attribute in the record. Adding a watermark to each row of the response data returned by the API service enables more refined data management. When data verification is performed or data errors occur, it is easier to determine the specific data row, which improves the efficiency and accuracy of managing the data returned by the API service.

[0115] Figure 2 is a flow chart of watermark adding logic provided in some embodiments of the present application. In some embodiments, such as Figure 2 As shown, the watermark adding logic executed line by line includes: step 210, step 220 and step 230.

[0116] Step 210: Generate a first character string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

[0117] It can be understood that the watermark adding logic is executed line by line, and each line of the response data returned by the API service is traversed. Taking the i-th line of the response data returned by the API service as an example, the steps for generating the first string are as follows:

[0118] 1) Get the data of the i-th row of the response data returned by the API service, and perform MD5 hashing on the field value of the first column (i.e., the content of the first column of the i-th row) (MD5 is a widely used hash function that can generate a 128-bit (16-byte) hash value, usually expressed as a 32-bit hexadecimal number) to obtain the MD5 value;

[0119] 2) Convert the MD5 value obtained in 1) from hexadecimal to decimal, and add the decimal value to the user ID value of the provider of the API service (i.e., the provider information of the API service) to obtain the addition result;

[0120] 3) Convert the addition result obtained in 2) from decimal back to hexadecimal, and convert it to uppercase to obtain the uppercase hexadecimal value of the addition result;

[0121] 4) Add the hexadecimal uppercase value of the addition result obtained in 3) to the quantum key corresponding to the service demander to obtain a first character string M.

[0122] Step 220: Encrypt the first character string using the national secret encryption algorithm corresponding to the service demander according to the private key of the national secret encryption algorithm to obtain the signature value of the first character string.

[0123] Taking the national secret encryption algorithm SM2 as an example, the first character string M is encrypted according to the private key privateKey of the national secret encryption algorithm SM2 corresponding to the service demander to obtain the signature value (r, s) of the first character string M.

[0124] The specific process of encryption using the national encryption algorithm SM2 includes:

[0125] 1) Use the cryptographic hash algorithm to obtain a hash value ZA=H256(ENTLA||IDA||a||b||xG||yG||xA||yA);

[0126] 2) Set M*=ZA||M and calculate e=H(M*);

[0127] 3) Generate a random number k∈[1,n-1];

[0128] 4) Calculate the elliptic curve point [k]G = (x1, y1);

[0129] 5) Calculate r = (e + x1) mod n, if r = 0 or r + k = n, return to step 3);

[0130] 6) Calculate s = (1 + dA) - 1·(kr·dA) mod n, if s = 0, return to step 3);

[0131] 7) Get (r, s) as the signature of message M.

[0132] Among them, H256 is a hash function used to map input data (usually a message of arbitrary length) to a hash value of fixed length; ENTLA is the private key; IDA is part of the public key, that is, a point on the elliptic curve, usually expressed as (xG, yG); IDA is the coordinates of the base point G of the elliptic curve; a and b are the coefficients of the elliptic curve equation, in the form of y^2=x^3+ax+b; xG and yG are the coordinates of the base point G of the elliptic curve, which is a pre-selected point on the elliptic curve used to generate the public key and signature; xA and yA are the coordinates of the signer's public key; ZA is the hash value obtained by the hash algorithm.

[0133] M is the message to be signed, corresponding to the first string in the embodiment of the present application; M* is the result of connecting the hash value ZA with the message M; e is the value obtained by hashing M, expressed as e=H(M); k is a random number selected in the range of [1, n-1], where n is the order of the elliptic curve; [k]G is the result of elliptic curve multiplication of point G on the elliptic curve and the random number k, expressed as (x1, y1); r is an intermediate result in the algorithm, calculated as r=(e+x1)mod n; s is another intermediate result in the signature algorithm; (r, s) is the final generated signature value, which can be verified using the public key.

[0134] Step 230: Concatenate the first character string with the signature value to obtain a watermark value for the i-th row of data, and fill the watermark value in the response data returned by the API service.

[0135] Optionally, the first string M obtained in step 210 and the signature value (r, s) of the first string M obtained in step 220 are concatenated to obtain the watermark value of the i-th row of data, and a new serial_number column is added to the last column of the response data returned by the API service, and the watermark value of the i-th row of data is filled in the serial_number column of the i-th row.

[0136] It can be understood that the watermark adding logic is executed line by line, so that each line of data returned by the API service has a corresponding watermark value, and the watermark value of each line contains the provider information of the API service. In this way, even if part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, thereby improving the robustness of the digital watermark.

[0137] In the above technical scheme, by processing the response data returned by the API service line by line, combining the provider information of the API service and the quantum key corresponding to the service demander, a digital watermark is generated and added, and a first character string is generated according to each line of data, the service provider information and the quantum key corresponding to the service demander, and the first character string is encrypted in combination with the private key of the national secret encryption algorithm corresponding to the service demander to obtain the signature value of the first character string, and the first character string and its signature value are concatenated to form a watermark value, which is added to the response data, and a watermark is added to each line of the response data returned by the API service. In the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, thereby improving the robustness of the digital watermark, and combining the national secret encryption algorithm and the quantum key to generate the digital watermark, thereby improving the security of the data returned by the API service, and being able to effectively determine whether the data returned by the API service has been tampered with. The digital watermark contains information about the service provider, which can be used to determine the source of the data.

[0138] According to an embodiment of the present application, before receiving the API service call request from the service demander, the method further includes:

[0139] Reviewing the service interface resource application from the service demander;

[0140] If the review is passed, a public key and private key pair of the national secret encryption algorithm corresponding to the service demander will be generated, the corresponding public key of the national secret encryption algorithm will be returned to the service demander, and the service demander will be negotiated with to determine the quantum key corresponding to the service demander.

[0141] It is understandable that before the service demander sends an API service call request, the service demander will first send a service interface resource application. Only when the service interface resource application is reviewed and approved can the service demander call the API service by sending an API service call request. The review process may include a review of the service demander's qualifications, an inspection of the expected data processing method, etc.

[0142] If the service interface resource application of the service demander is approved, a pair of public and private keys of the national secret encryption algorithm will be generated for the service demander, and the public key will be returned to the service demander. The national secret encryption algorithm is an encryption algorithm of China's national standard, including SM2, SM4, etc., which is designed to provide high-security data encryption and digital signatures. The public key is returned to the service demander, so that the service demander can verify the signature of the API service return data locally through the data watermark in the API service return data.

[0143] Taking the national secret encryption algorithm SM2 as an example, the process of generating the public key and private key pair of SM2 is as follows:

[0144] The input is a valid set of elliptic system parameters on Fq (a finite field containing q elements, q = p and p is a prime number greater than 3 or q = 2^m), where the cryptographic system based on elliptic curves has 7 main field parameters T = (q, a, b, FR, G, n, h),

[0145] Among them, q represents the number of elements in the finite field Fq, q is p or 2m (p is a prime number), and the corresponding finite fields are prime field and binary field respectively; a and b are elements in Fq, coefficients of the elliptic curve equation, defining an elliptic curve E on Fq; FR is the equation of the curve, such as the curve equation on the prime field GF(q) is y^2=x^3+ax+b, and the curve equation on the binary field GF(2^m) is y^2+xy=x^3+a^2x+b; G is a base point of the elliptic curve, and its order is a prime number; n is a large prime number and is equal to the order of the base point G 6. The most important parameter in the elliptic curve system is n, so the key length of the elliptic curve is defined as the length of n; h is the cofactor of n, which is a small integer and h=#E(Fq) / n, where n is the order of the base point G, #E(Fq) is the number of points on E(Fq), called the order of the elliptic curve E(Fq).

[0146] The specific generation steps are:

[0147] 1) Initialize the elliptical system;

[0148] 2) Generate a random integer d∈[1,n-2];

[0149] 3) Taking G as the base point, calculate P(Xp, Yp) = [d]G (the d-times point G on the elliptic curve), optionally by addition and subtraction, sliding window method, etc.;

[0150] 4) Output (d, P), where d is the private key and P is the public key.

[0151] After returning the public key of the national secret encryption algorithm, the quantum key will be determined through negotiation with the service demander. The quantum key can be used as soon as it is made. By utilizing the characteristics of quantum mechanics, the negotiating parties can generate a string of random numbers at the same time, and can ensure that the random number sequences of both parties are exactly the same.

[0152] In some embodiments, a pair of secure keys is generated from a quantum key system based on quantum key distribution (QKD) provided by a third party. The key is a 0 / 1 bit string obtained through quantum communication through negotiation. The service demander will negotiate the quantum key each time before sending an API service call request.

[0153] In the above technical solution, before receiving the API service call request from the service demander, the service interface resource application of the service demander is first reviewed. If the review is passed, the public key and private key pair of the national secret encryption algorithm are generated, and the public key is returned to the service demander and the quantum key is negotiated to determine, so as to implement the review of the service demander who calls the API service, thereby improving the security of the API service call, and determining the public key and private key pair and quantum key of the national secret encryption algorithm with the service demander, and using them for the digital watermark of the data returned by the API service, thereby improving the security of the data returned by the API service.

[0154] According to one embodiment of the present application, the method further includes:

[0155] Determine the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request method, return type, whether to add a watermark;

[0156] Bind the publishing environment and publishing node of the API service, and publish the API service;

[0157] Using the path and request method of the API service as the key and the configuration information of the API service as the value, a mapping relationship of the API service is constructed;

[0158] List the API services mentioned above.

[0159] Before the API service is officially released, its configuration information needs to be determined. The configuration information includes at least the following fields: path, request method, return type, and whether a watermark needs to be added. The path is the unique identifier of the API service, which can be a URL, used to specify the location of the API service; the request method specifies the allowed request types, such as GET and POST, which determines how the service demander can call the API service; the return type defines the format of the response data returned by the API service, and common return types include JSON, XML, etc.; whether a watermark needs to be added is a flag field used to indicate whether the response data returned by the current API service needs to be digitally watermarked to improve data security and determine the source of the data.

[0160] The configuration information of the API service also includes the information of the data source and data table. The data source refers to the source from which the API service obtains data, usually a database connection, which may be a database such as MySQL or Oracle. The data table is a specific table in the database, which contains structured data. The API service can operate one or more data tables to provide the required data.

[0161] API services need to be published in specific environments and nodes, that is, servers or clusters where API services are deployed and run to process API service call requests.

[0162] After determining the configuration information of the API service and binding the publishing environment and publishing node, you can publish the API service, that is, the API service can receive call requests and process these requests according to the configuration information.

[0163] The mapping relationship can be used to efficiently process API service call requests, using the API service path and request method as the key and the configuration information as the value. The mapping relationship can be stored in a database or in-memory data structure, allowing fast search and matching of received API requests and processing based on the configuration information.

[0164] Listing an API service means making the API service accessible to the public or authorized users, which usually involves notifying users of the availability of the API service and listing the API service in an API market or directory (for example, listing the API service in a service data supermarket).

[0165] In the above technical solution, after determining the configuration information of the API service (including path, request method, return type, and whether a watermark needs to be added, etc.), the publishing environment and node are bound, the API service is published, and a mapping relationship is constructed with the path and request method as the key and the configuration information as the value. The API service is put on the shelf for use, thereby realizing the configuration and release of the API service, so that the API service can be called by the service demander. Whether the API service return data needs to be watermarked is determined in the configuration information, and the data can be protected according to actual needs, thereby improving the security and flexibility of the API calling method.

[0166] According to one embodiment of the present application, the method further includes:

[0167] Receive the API service return data uploaded by the service demander;

[0168] Verify the signature of the data returned by the API service;

[0169] If the signature verification is successful, the provider information of the API service in the data returned by the API service is obtained, and the provider information of the API service is returned to the service demander; or, if the signature verification fails, the data returned by the API service is discarded.

[0170] It is understandable that signature verification is to verify the digital signature. After the service demander calls the API service and receives the data returned by the API service, there may be a need to verify the signature of the data returned by the API service or obtain the information of the provider of the API service, so it is necessary to receive the API service return data uploaded by the service demander. It is understandable that the signature verification of the data returned by the API service requires that the data returned by the API service has been digitally watermarked.

[0171] In some embodiments, the signature of the data returned by the API service is verified, including:

[0172] For the data returned by the API service, verify the signature line by line.

[0173] In some embodiments, the signature verification is performed line by line, including:

[0174] Taking the i-th row of the data returned by the API service as an example, obtain the watermark value of the last column of the i-th row of the data returned by the API service and split it to obtain the second string M′ and the signature value (r′, s′), and use the decryption algorithm corresponding to the encryption algorithm to verify the signature.

[0175] When using the national encryption algorithm SM2 for encryption, the corresponding signature verification process is as follows:

[0176] 1) Check whether r′∈[1, n-1] holds. If not, the verification fails.

[0177] 2) Check whether s′∈[1, n-1] holds. If not, the verification fails.

[0178] 3) Set M* = ZA||M′

[0179] 4) Calculate e′=H(M*)

[0180] 5) Calculate t = (r' + s') mod n. If t = 0, the verification fails.

[0181] 6) Calculate the elliptic curve point (x1′, y1′) = s′·G+t·PA

[0182] 7) Calculate v = (e' + x1') mod n, and check whether v = r' holds. If so, the verification passes; otherwise, the verification fails.

[0183] Among them, r′ and s′ are two integers generated by the signature algorithm; n is the order of the elliptic curve, that is, the total number of all points on the elliptic curve; ZA is the hash value obtained by the hash algorithm; M* is the result of connecting the hash value ZA with the message M′; e′ is the value obtained after hashing M; t is an intermediate result in the verification process; G is the base point of the elliptic curve; PA is the public key of the signer; (x1′, y1′) is a point on the elliptic curve; v is an intermediate result in the verification process; r′ is part of the signature value.

[0184] If the signature verification is successful, you can continue to obtain the provider information of the API service in the data returned by the API service. Taking the second string M' and the signature value (r', s') of the i-th row of the data returned by the API service as an example, the steps for obtaining the provider information of the API service are as follows:

[0185] 1) Subtract the second character string M′ from the quantum key value corresponding to the service demander to obtain a subtraction result v1;

[0186] 2) Get the data of the i-th row of the response data returned by the API service, and perform MD5 hashing on the field value of the first column (i.e., the content of the first column of the i-th row) to obtain the MD5 value, and then convert the MD5 value into a decimal number v2;

[0187] 3) Calculate v2-v1 to obtain the user ID of the provider of the API service.

[0188] The user ID of the provider of the API service obtained through the above steps can be further used to obtain detailed information of the provider of the API service.

[0189] In the above technical scheme, the API service return data uploaded by the service demander is received and the signature is verified. The signature verification process is performed row by row. If the signature verification passes, the provider information of the API service is obtained and returned. The information of the API service provider can be calculated based on the watermark value and signature value in the specific column of each row of data (such as the last column), combined with the quantum key value corresponding to the service demander and the specific field value of the API service return data, thereby realizing the signature verification of the API service return data, which can be used to determine whether the data has been tampered with or forged, and the information of the API service provider can be further obtained to determine the source of the API service return data.

[0190] The API service calling method provided in the embodiment of the present application can be executed by an API service providing system. The API service providing system provided in the embodiment of the present application is described by taking the API service calling method executed by the API service providing system as an example.

[0191] Figure 3 Schematic diagram of the structure of the API service providing system provided by some embodiments of the present application. Figure 3 As shown, the API service providing system 300 includes:

[0192] The API external call module 301 is used to receive an API service call request from a service demander, wherein the API service call request includes a request path and a request method of the API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request method of the API service, obtain API service return data according to the API service call request and the configuration information of the API service, wherein the API service return data is data with a digital watermark, and the digital watermark is obtained according to the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, and return the API service return data to the service demander;

[0193] Service data supermarket 302, used to review the service interface resource application from the service demander;

[0194] An API generation and publishing module 303 is used to determine the configuration information of the API service, bind the publishing environment and publishing node of the API service, and publish the API service;

[0195] The watermark extraction module 304 is used to receive the API service return data uploaded by the service demander and verify the signature of the API service return data.

[0196] In the above technical scheme, the API external call module is used to receive an API service call request (carrying the path and request method of the API service) from the service demander, obtain the configuration information of the API service according to the mapping relationship, obtain the response data returned by the API service according to the API service call request and the configuration information of the API service, and then determine whether it is necessary to add a digital watermark to the response data returned by the API service according to the return type in the configuration information and whether to add a watermark field. If necessary, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander to generate API service return data with a watermark. If not, the response data returned by the API service is used as the API service return data, thereby realizing the call of the API service and dynamically determining whether to add a digital watermark according to the configuration information. The digital watermark can reflect whether the data has been tampered with, thereby improving the security of the data returned by the API service. The digital watermark contains the provider information of the API service, which can be used to determine the source of the data returned by the API service. It also realizes the review of the service demander who calls the API service, the release of the API service and the verification of the signature of the data returned by the API service.

[0197] Optionally, obtaining API service return data according to the API service call request and configuration information of the API service includes:

[0198] Obtaining response data returned by the API service according to the API service call request and the configuration information of the API service;

[0199] Determine whether to add a digital watermark to the response data returned by the API service according to the return type and whether to add a watermark field in the configuration information of the API service;

[0200] If the response data returned by the API service needs to be digitally watermarked, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander to obtain the API service return data.

[0201] In the above technical scheme, according to the API service call request and the configuration information of the API service, the response data returned by the API service is obtained, and then according to the return type in the configuration information and whether to add the watermark field, it is determined whether it is necessary to add a digital watermark to the response data returned by the API service. If necessary, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander, and the API service return data with a watermark is generated. If not necessary, the response data returned by the API service is used as the API service return data, so that the configuration information dynamically determines whether to add a digital watermark, thereby improving the flexibility of the API return data. The digital watermark can be used to determine whether the API service return data has been tampered with, thereby improving the security of the API service return data. The digital watermark contains the provider information of the API service, which can be used to determine the source of the API service return data.

[0202] Optionally, executing watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander includes:

[0203] For each line of response data returned by the API service, the following watermark adding logic is executed:

[0204] Generate a first character string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander;

[0205] According to the private key of the national secret encryption algorithm corresponding to the service demander, the first character string is encrypted using the national secret encryption algorithm to obtain the signature value of the first character string;

[0206] The first character string is concatenated with the signature value to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0207] In the above technical scheme, by processing the response data returned by the API service line by line, combining the provider information of the API service and the quantum key corresponding to the service demander, a digital watermark is generated and added, and a first character string is generated according to each line of data, the service provider information and the quantum key corresponding to the service demander, and the first character string is encrypted in combination with the private key of the national secret encryption algorithm corresponding to the service demander to obtain the signature value of the first character string, and the first character string and its signature value are concatenated to form a watermark value, which is added to the response data, and a watermark is added to each line of the response data returned by the API service. In the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, thereby improving the robustness of the digital watermark, and combining the national secret encryption algorithm and the quantum key to generate the digital watermark, thereby improving the security of the data returned by the API service, and being able to effectively determine whether the data returned by the API service has been tampered with. The digital watermark contains information about the service provider, which can be used to determine the source of the data.

[0208] Optionally, the API service providing system 300 further includes:

[0209] The service data supermarket 302 is used to review the service interface resource application from the service demander. If the review is passed, a public key and a private key pair of the national secret encryption algorithm corresponding to the service demander are generated, and the public key of the national secret encryption algorithm corresponding to the service demander is returned to the service demander;

[0210] The API external calling module 301 is also used to negotiate with the service demander to determine the quantum key corresponding to the service demander.

[0211] In the above technical solution, before receiving the API service call request from the service demander, the service data supermarket is used to review the service interface resource application of the service demander. If the review is passed, a public key and private key pair of the national secret encryption algorithm is generated, and the public key is returned to the service demander. The API external call module is used to negotiate and determine the quantum key, and to review the service demander who calls the API service, thereby improving the security of the API service call, determining the national secret encryption algorithm and quantum key with the service demander, and using them for the digital watermark of the data returned by the API service, thereby improving the security of the data returned by the API service.

[0212] Optionally, the API service providing system 300 further includes:

[0213] The API generation and publishing module 303 is used to determine the configuration information of the API service, where the configuration information of the API service includes at least the following fields: path, request method, return type, whether to add a watermark, bind the publishing environment and publishing node of the API service, and publish the API service;

[0214] The API external calling module 301 is also used to construct a mapping relationship of the API service with the path and request method of the API service as the key and the configuration information of the API service as the value, and put the API service on the shelves through the service data supermarket.

[0215] In the above technical solution, the API generation and publishing module is used to determine the configuration information of the API service (including path, request method, return type and whether to add a watermark, etc.), bind the publishing environment and node, and publish the API service. The API external call module is used to build a mapping relationship with the path and request method as the key and the configuration information as the value, and put the API service on the shelf for use, thereby realizing the effective configuration and release of the API service, enabling the API service to be called by the service demander, and determining whether the API service return data needs to be watermarked in the configuration information. Sensitive data can be protected according to actual needs, thereby improving the security and flexibility of the API calling method.

[0216] Optionally, the API service providing system 300 further includes:

[0217] The watermark extraction module 304 is used to receive the API service return data uploaded by the service demander, verify the signature of the API service return data, and if the signature verification passes, obtain the API service provider information in the API service return data, and return the API service provider information to the service demander; or, if the signature verification fails, discard the API service return data.

[0218] In the above technical scheme, the watermark extraction module is used to receive the API service return data uploaded by the service demander and perform signature verification. The signature verification process is performed row by row. If the signature verification passes, the provider information of the API service is obtained and returned. The information of the API service provider can be calculated based on the watermark value and signature value in the specific column of each row of data (such as the last column), combined with the quantum key value corresponding to the service demander and the specific field value of the API service return data, thereby realizing the signature verification of the API service return data, which can be used to determine whether the data has been tampered with or forged, and the information of the API service provider can be further obtained to determine the source of the API service return data.

[0219] Figure 4 is a timing diagram of the operation of the API service providing system provided by some embodiments of the present application, such as Figure 4 As shown, the API service calling method is executed through the API service providing system.

[0220] The API service providing system in the embodiment of the present application may be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip, which is not specifically limited in the embodiment of the present application.

[0221] The API service providing system in the embodiment of the present application may be a system having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android (Android) operating system, an IOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0222] The API service providing system provided in the embodiment of the present application can implement each process implemented in the API service calling method embodiment. To avoid repetition, it will not be repeated here.

[0223] Figure 5 This is the second flow chart of the API service calling method provided by some embodiments of the present application. Figure 5 As shown, the API service calling method includes step 510 and step 520.

[0224] Step 510: Send an API service call request, where the API service call request carries the path and request method of the API service.

[0225] The API service call request carries the path and request method of the API service. The path of the API service describes the target resource requested by the service demander, while the request method describes the type of request, such as GET and POST. The API service call request may also carry other information, such as query parameters, request body, header information, etc.

[0226] Step 520: Receive data returned by the API service. The data returned by the API service is data with a digital watermark. The digital watermark is obtained based on the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

[0227] It can be understood that the data returned by the API service is data carrying a digital watermark, which is obtained based on the response data returned by the API service, the information of the provider of the API service, and the quantum key corresponding to the service demander.

[0228] Among them, the response data returned by the API service is directly returned as the API service return data without adding a digital watermark. If a watermark needs to be added, the response data returned by the API service participates in the generation of the digital watermark; the provider information of the API service is the information of the user who configures and publishes the API service (such as user ID), which can be used to determine the source of the data returned by the API service; the quantum key corresponding to the service demander is obtained through negotiation between the service demander and the provider of the API service. Using the quantum key in the process of digital watermark generation can improve the security of the data returned by the API service.

[0229] In the above technical solution, an API service call request is sent (carrying the path and request method of the API service), and the API service return data is received. The API service return data is data with a digital watermark. The digital watermark is obtained based on the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander. The call of the API service is realized. The API service return data carries a digital watermark, which can reflect whether the data has been tampered with, thereby improving the security of the API service return data. The digital watermark contains the provider information of the API service, which can be used to determine the source of the data returned by the API service.

[0230] According to one embodiment of the present application, the method further includes:

[0231] Send service interface resource request;

[0232] Receive the public key of the corresponding national secret encryption algorithm;

[0233] Negotiate quantum keys with the API service provider.

[0234] It is understandable that before sending an API service call request, you need to first send a service interface resource application. Only when the service interface resource application is approved can you call the API service by sending an API service call request.

[0235] If the service interface resource application is approved, the public key of the service's national secret encryption algorithm will be received. The national secret encryption algorithm is an encryption algorithm of China's national standard, including SM2, SM4, etc., which is designed to provide high-security data encryption and digital signatures. The public key can be used to verify the data returned by the API service locally through the data watermark in the API service return data.

[0236] After receiving the public key of the corresponding national secret encryption algorithm, we will negotiate with the provider of the API service to determine the quantum key. The quantum key can be used as soon as it is made. By utilizing the characteristics of quantum mechanics, the negotiating parties can generate a string of random numbers at the same time, and can ensure that the random number sequences of both parties are exactly the same.

[0237] In some embodiments, a pair of secure keys is generated from a QKD-based quantum key system provided by a third party. The key is a 0 / 1 bit string obtained through quantum communication through negotiation. Before each API service call request is sent, the quantum key is negotiated with the provider of the API service.

[0238] In the above technical solution, a service interface resource application is sent, the public key of the national secret encryption algorithm is received, and the quantum key is determined through negotiation with the provider of the API service, so that the service demander who calls the API service can be reviewed, thereby improving the security of the API service call. The public key and quantum key of the national secret encryption algorithm are received, which can be used to verify the signature of the data returned by the API service, thereby improving the security of the data returned by the API service.

[0239] According to one embodiment of the present application, the method further includes:

[0240] Uploading the API service return data to the watermark extraction module, so that the watermark extraction module verifies the signature of the API service return data, and returns the provider information of the API service if the signature verification passes;

[0241] Receive the signature verification result of the API service return data returned by the watermark extraction module, where the signature verification result includes: provider information of the API service, or signature verification failure.

[0242] The API service return data is uploaded to the watermark extraction module. It can be understood that the signature verification of the API service return data requires that the API service return data has been added with a digital watermark.

[0243] After the watermark extraction module completes the signature verification on the data returned by the API service, if the signature verification fails, it will directly return the result of signature verification failure. If the signature verification passes, it will further obtain the provider information of the API service and return it.

[0244] In the above technical solution, the data returned by the API service is uploaded to the watermark extraction module. If the signature verification passes, the provider information of the API service will be received, which can be used to determine the source of the data. If the signature verification fails, the result of failed signature verification will be returned, thereby realizing the signature verification of the data returned by the API service, which can be used to determine whether the data has been tampered with or forged. The information of the provider of the API service can be further obtained to determine the source of the data returned by the API service.

[0245] According to one embodiment of the present application, the method further includes:

[0246] Verify the signature of the data returned by the API service according to the public key of the corresponding national secret encryption algorithm;

[0247] After the signature verification is passed, the provider information of the API service in the data returned by the API service is obtained.

[0248] It is understandable that the provider of the API service will generate a pair of public and private keys of the national secret encryption algorithm, and can receive the public key returned by it. In the process of negotiating the quantum key with the provider of the API service, through the characteristics of quantum mechanics, the negotiating parties will simultaneously generate a string of random numbers, and can ensure that the random number sequences of both parties are exactly the same.

[0249] When the data returned by the API service carries a digital watermark, the signature of the data returned by the API service can be verified based on the public key of the corresponding national secret encryption algorithm to determine the authenticity of the data returned by the API service.

[0250] In some embodiments, the signature of the data returned by the API service is verified, including:

[0251] For the data returned by the API service, verify the signature line by line.

[0252] In some embodiments, the signature of the data returned by the API service is verified, including:

[0253] The watermark value in the last column of the ith row of the data returned by the API service is obtained and split to obtain the second string M′ and the signature value (r′, s′), and the decryption algorithm corresponding to the encryption algorithm is used to verify the signature.

[0254] If the signature verification is successful, you can continue to obtain the provider information of the API service in the data returned by the API service. Taking the second string M' and the signature value (r', s') of the i-th row of the data returned by the API service as an example, the steps for obtaining the provider information of the API service are as follows:

[0255] 1) Subtract the second character string M′ from the quantum key value corresponding to the service demander to obtain a subtraction result v1;

[0256] 2) Get the data of the i-th row of the response data returned by the API service, and perform MD5 hashing on the field value of the first column (i.e., the content of the first column of the i-th row) to obtain the MD5 value, and then convert the MD5 value into a decimal number v2;

[0257] 3) Calculate v2-v1 to obtain the user ID of the provider of the API service.

[0258] The above steps can be used to obtain the user ID of the API service provider, which can be used to obtain detailed information about the API service provider and determine the source of the data returned by the API service.

[0259] In the above technical solution, the data returned by the API service is verified according to the public key of the corresponding national secret encryption algorithm. If the verification is passed, the provider information of the API service can be further obtained, thereby realizing the verification of the data returned by the API service. It can be used to determine whether the data has been tampered with or forged. The information of the provider of the API service can also be further obtained to determine the source of the data returned by the API service.

[0260] In some embodiments, Figure 6 As shown, an embodiment of the present application also provides an electronic device 600, including a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the program is executed by the processor 601, each process of the above-mentioned API service calling method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0261] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0262] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned API service calling method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0263] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0264] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned API service calling method when executed by a processor.

[0265] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0266] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned API service calling method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0267] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0268] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0269] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0270] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0271] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0272] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. An API service calling method, characterized in that: include: Receive an API service call request from a service demander, wherein the API service call request carries a path and a request method for the API service; According to the path and request method of the API service, obtain configuration information of the API service from the mapping relationship of the API service; Obtaining response data returned by the API service according to the API service call request and the configuration information of the API service; Determine whether to add a digital watermark to the response data returned by the API service according to the return type and whether to add a watermark field in the configuration information of the API service; If the response data returned by the API service needs to be digitally watermarked, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander to obtain the API service return data; The API service return data is sent to the service demander.

2. The API service calling method according to claim 1, characterized in that: The watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, including: For each line of response data returned by the API service, the following watermark adding logic is executed: Generate a first character string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander; According to the private key of the national secret encryption algorithm corresponding to the service demander, the first character string is encrypted using the national secret encryption algorithm to obtain the signature value of the first character string; The first character string is concatenated with the signature value to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

3. The API service calling method according to claim 1 or 2, characterized in that: Before receiving the API service call request from the service demander, the method further includes: Reviewing the service interface resource application from the service demander; If the review is passed, a public key and private key pair of the national secret encryption algorithm corresponding to the service demander will be generated, the corresponding public key of the national secret encryption algorithm will be returned to the service demander, and the service demander will be negotiated with to determine the quantum key corresponding to the service demander.

4. The API service calling method according to claim 1, characterized in that: The method further comprises: Determine the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request method, return type, whether to add a watermark; Bind the publishing environment and publishing node of the API service, and publish the API service; Using the path and request method of the API service as the key and the configuration information of the API service as the value, a mapping relationship of the API service is constructed; List the API services mentioned above.

5. The API service calling method according to any one of claims 1-2 and 4, characterized in that: The method further comprises: Receive the API service return data uploaded by the service demander; Verify the signature of the data returned by the API service; If the signature verification is successful, the provider information of the API service in the data returned by the API service is obtained, and the provider information of the API service is returned to the service demander; or, if the signature verification fails, the data returned by the API service is discarded.

6. An API service calling method, characterized in that: include: Send an API service call request, where the API service call request carries the path and request method of the API service; Receive data returned by the API service, where the data returned by the API service is data with a digital watermark, and the digital watermark is obtained based on the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

7. The API service calling method according to claim 6, characterized in that: The method further comprises: Send service interface resource request; Receive the public key of the corresponding national secret encryption algorithm; Negotiate quantum keys with the API service provider.

8. The API service calling method according to claim 6 or 7, characterized in that: The method further comprises: Uploading the API service return data to the watermark extraction module, so that the watermark extraction module verifies the signature of the API service return data, and returns the provider information of the API service if the signature verification passes; Receive the signature verification result of the API service return data returned by the watermark extraction module, where the signature verification result includes: provider information of the API service, or signature verification failure.

9. The API service calling method according to claim 7, characterized in that: The method further comprises: Verify the signature of the data returned by the API service according to the public key of the corresponding national secret encryption algorithm; After the signature verification is passed, the provider information of the API service in the data returned by the API service is obtained.

10. An API service providing system, characterized in that: include: An API external call module is used to receive an API service call request from a service demander, wherein the API service call request includes a request path and a request method of the API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request method of the API service, obtain response data returned by the API service according to the API service call request and the configuration information of the API service, determine whether a digital watermark needs to be added to the response data returned by the API service according to a return type and a field for adding a watermark in the configuration information of the API service, and if a digital watermark needs to be added to the response data returned by the API service, execute a watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, obtain API service return data, and send the API service return data to the service demander; Service data supermarket, used to review the service interface resource application from the service demander; An API generation and publishing module is used to determine the configuration information of the API service, bind the publishing environment and publishing node of the API service, and publish the API service; The watermark extraction module is used to receive the API service return data uploaded by the service demander and verify the signature of the API service return data.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the API service calling method as described in any one of claims 1-5 is implemented, or the API service calling method as described in any one of claims 6-9 is implemented.

Images