Api service calling method, api service providing system, and electronic device

Abstract

The application discloses an API service calling method, an API service providing system and electronic equipment, and belongs to the technical field of information security. The method comprises the following steps: receiving an API service calling request from a service demander, wherein the calling request carries the path and request mode of the API service; acquiring the configuration information of the API service from the mapping relationship of the API service according to the path and request mode; acquiring the response data returned by the API service according to the calling request and the configuration information; determining whether the response data needs to add digital watermark according to the return type in the configuration information and whether a watermark field is added; if the response data needs to add digital watermark, executing watermark adding logic based on the response data, the provider information of the API service and the quantum key corresponding to the service demander, and obtaining the API service return data; and sending the return data to the service demander. The application adds digital watermark to the API service return data, can reflect whether the data is tampered with, and can also determine the source of the API service return data.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to an API service calling method, an API service providing system and an electronic device. BACKGROUND

[0002] An application programming interface (API) service is one of important ways for sharing and exchanging government data and providing public service data. With more and more rich business application scenarios, the number of API service interfaces is also increasing. After being provided to a third party such as a service demander, the data flow becomes more complex, and there is a risk that the data is tampered with, and the content integrity and authenticity cannot be guaranteed. SUMMARY

[0003] The present application aims to at least solve one of the technical problems in the related art. To this end, the present application provides an API service calling method, an API service providing system and an electronic device, adds a digital watermark to API service return data, can reflect whether the data has been tampered with, and the provider information of the API service is contained in the digital watermark, which can be used to determine the source of the API service return data.

[0004] In a first aspect, the present application provides an API service calling method, which comprises:

[0005] receiving an API service calling request from a service demander, the API service calling request carrying a path and a request mode of an API service;

[0006] obtaining configuration information of the API service from a mapping relationship of the API service according to the path and the request mode of the API service;

[0007] obtaining response data returned by the API service according to the API service calling request and the configuration information of the API service;

[0008] determining whether the response data returned by the API service needs to be added with a digital watermark according to a return type and a watermark field in the configuration information of the API service;

[0009] if the response data returned by the API service needs to be added with a digital watermark, performing watermark adding logic based on the response data returned by the API service, provider information of the API service and a quantum key corresponding to the service demander, to obtain API service return data;

[0010] sending the API service return data to the service demander.

[0011] In the technical solution, an API service calling request (carrying a path and a request mode of the API service) from a service demander is received, configuration information of the API service is obtained according to a mapping relationship, response data returned by the API service is obtained according to the API service calling request and the configuration information of the API service, then whether the response data returned by the API service needs to be added with a digital watermark is determined according to a return type in the configuration information and whether a watermark field is added, if yes, watermark adding logic is executed in combination with provider information of the API service and a quantum key corresponding to the service demander to generate API service return data with the watermark, and if no, the response data returned by the API service is taken as the API service return data, thus realizing API service calling, dynamically determining whether to add a digital watermark according to configuration information, reflecting whether data is tampered with by the digital watermark, improving the security of API service return data, and containing provider information of the API service in the digital watermark, which can be used to determine the source of the API service return data.

[0012] According to an embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, and includes:

[0013] For each row of data of the response data returned by the API service, the following watermark adding logic is executed:

[0014] A first string is generated according to an i-th row of data of the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander;

[0015] The first string is encrypted using a national secret encryption algorithm according to a private key of the national secret encryption algorithm corresponding to the service demander to obtain a signature value of the first string;

[0016] The first string and the signature value are spliced to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0017] In the technical solution, the response data returned by the API service is processed row by row, and a watermark value is generated and added in combination with the service provider information of the API service and the quantum key corresponding to the service demander, a first string is generated according to each row of data, the service provider information and the quantum key corresponding to the service demander, the first string is encrypted in combination with the quantum key corresponding to the service demander to obtain a signature value of the first string, the first string and the signature value are spliced to form the watermark value, and the watermark value is added to the response data, so that the watermark is added to each row of the response data returned by the API service. In the case of partial data or digital watermark damage or tampering, the service provider information of the API service can still be obtained, the robustness of the digital watermark is improved, the digital watermark is generated in combination with the quantum key and the quantum key, the security of the API service return data is improved, whether the API service return data is tampered with can be effectively judged, the information of the service provider is included in the digital watermark, and the source of the data can be determined.

[0018] According to an embodiment of the present application, before the API service calling request from the service demander is received, the method further comprises:

[0019] auditing the service interface resource application from the service demander;

[0020] if the auditing is passed, generating a public key and a private key pair of the quantum key encryption algorithm corresponding to the service demander, returning the public key of the quantum key encryption algorithm corresponding to the service demander to the service demander, and negotiating with the service demander to determine the quantum key corresponding to the service demander.

[0021] In the technical solution, before the API service calling request from the service demander is received, the service interface resource application of the service demander is audited, and if the auditing is passed, the public key and the private key pair of the quantum key encryption algorithm are generated, the public key is returned to the service demander, and the quantum key is negotiated to determine the quantum key corresponding to the service demander. The service demander calling the API service is audited, and the security of the API service calling is improved. The public key and the private key pair of the quantum key encryption algorithm and the quantum key are determined with the service demander, and are used for the digital watermark of the API service return data, and the security of the API service return data is improved.

[0022] According to an embodiment of the present application, the method further comprises:

[0023] determining the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request mode, return type, and whether the watermark needs to be added;

[0024] binding the publishing environment and the publishing node of the API service, and publishing the API service;

[0025] mapping relationship of the API service is constructed, taking the path and request mode of the API service as Key and the configuration information of the API service as value;

[0026] The API service is put on the shelf.

[0027] In the above technical solution, after determining the configuration information (including path, request mode, return type, and whether to add watermark, etc.) of the API service, the publishing environment and the node are bound, the API service is published, and the mapping relationship is constructed taking the path and request mode as Key and the configuration information as Value. The API service is put on the shelf for use, realizing the configuration and publishing of the API service, so that the API service can be called by the service demand side. It is determined in the configuration information whether the API service return data needs to add watermark, the data can be protected according to the actual demand, and the security and flexibility of the API calling method are improved.

[0028] According to an embodiment of the present application, the method further comprises:

[0029] receiving API service return data uploaded by the service demand side;

[0030] verifying the API service return data;

[0031] if the verification is passed, obtaining the provider information of the API service in the API service return data, and returning the provider information of the API service to the service demand side; or if the verification fails, discarding the API service return data.

[0032] In the above technical solution, the API service return data uploaded by the service demand side is received and verified. The verification process is performed line by line. If the verification is passed, the provider information of the API service is obtained and returned. Based on the watermark value and the signature value in a specific column (such as the last column) of each row of data, combined with the quantum key value corresponding to the service demand side and the specific field value of the API service return data, the information of the API service provider can be calculated. The verification of the API service return data is realized, which can be used to determine whether the data is tampered or forged. Further, the information of the API service provider can be obtained to determine the source of the API service return data.

[0033] In a second aspect, the present application provides an API service calling method, which comprises:

[0034] sending an API service calling request, the API service calling request carrying the path and request mode of the API service;

[0035] Receiving API service return data, the API service return data being data with a digital watermark, the digital watermark being obtained according to response data returned by the API service, provider information of the API service, and a quantum key corresponding to a service demander.

[0036] In the technical solution, the API service calling request (carrying the path and request mode of the API service) is sent, and the API service return data is received, wherein the API service return data can be data carrying the digital watermark. Through the above steps, the API service is called, the API service return data can be added with the digital watermark, whether the data is tampered with can be reflected, and the security of the API service return data is improved.

[0037] According to an embodiment of the present application, the method further comprises:

[0038] Sending a service interface resource application;

[0039] Receiving a public key of a national encryption algorithm corresponding to the API service;

[0040] Negotiating a quantum key with a provider of the API service.

[0041] In the technical solution, the service interface resource application is sent, the public key of the national encryption algorithm is received, and the quantum key is negotiated and determined with the provider of the API service, so that only the API service can be called after the service interface resource application, the security of the API service calling is effectively improved, the public key of the national encryption algorithm and the quantum key are received, and the API service return data can be verified, and the security of the subsequent API service return data is improved.

[0042] According to an embodiment of the present application, the method further comprises:

[0043] Uploading the API service return data to a watermark extraction module, so that the watermark extraction module verifies the API service return data, and returns the provider information of the API service if the verification is passed;

[0044] Receiving a verification result of the API service return data returned by the watermark extraction module, the verification result including the provider information of the API service, or the verification being failed.

[0045] In the technical solution, the API service return data is uploaded to the watermark extraction module, if the verification is passed, the provider information of the API service is received, which can be used to determine the data source, and if the verification is failed, the result of the verification being failed is returned, so that the authenticity of the API service return data is detected.

[0046] According to an embodiment of the present application, the method further comprises:

[0047] According to the public key of the corresponding national encryption algorithm, the API service return data is verified;

[0048] After the verification passes, the provider information of the API service in the API service return data is obtained.

[0049] In the above technical solution, according to the public key of the corresponding national encryption algorithm, the API service return data is verified, and if the verification passes, the provider information of the API service can be further obtained, which realizes the verification of the API service return data, can be used to determine whether the data is tampered or forged, and can further obtain the information of the provider of the API service to determine the data source.

[0050] In a third aspect, the application provides an API service providing system, which comprises:

[0051] The API external calling module is configured to receive an API service calling request from a service demander, the API service calling request comprising a request path and a request mode of the API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request mode of the API service, obtain response data returned by the API service according to the API service calling request and the configuration information of the API service, determine whether the response data returned by the API service needs to add digital watermark according to a return type in the configuration information of the API service and whether a watermark field is added, if the response data returned by the API service needs to add digital watermark, execute watermark adding logic based on the response data returned by the API service, provider information of the API service and a quantum key corresponding to the service demander, obtain API service return data, and send the API service return data to the service demander.

[0052] The service data supermarket is configured to audit service interface resource application from the service demander.

[0053] The API generation and publishing module is configured to determine the configuration information of the API service, bind a publishing environment and a publishing node of the API service, and publish the API service.

[0054] The watermark extraction module is configured to receive API service return data uploaded by the service demander and verify the API service return data.

[0055] In the technical solution, the API external calling module is configured to receive an API service calling request (carrying a path and a request mode of the API service) from a service demander, obtain configuration information of the API service according to a mapping relationship, obtain response data returned by the API service according to the API service calling request and the configuration information of the API service, and then determine whether to add a digital watermark to the response data returned by the API service according to a return type in the configuration information and whether to add a watermark field, if yes, execute watermark adding logic in combination with provider information of the API service and a quantum key corresponding to the service demander to generate API service return data with the watermark, and if no, take the response data returned by the API service as the API service return data, thereby realizing API service calling, dynamically determining whether to add a digital watermark according to the configuration information, reflecting whether the data is tampered with by the digital watermark, improving the security of the API service return data, containing the provider information of the API service in the digital watermark, and determining the source of the API service return data, and further realizing auditing of the service demander calling the API service, publishing the API service, and verifying the API service return data.

[0056] According to an embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander, and includes:

[0057] For each row of data of the response data returned by the API service, the following watermark adding logic is executed:

[0058] A first string is generated according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

[0059] The first string is encrypted by using a national secret encryption algorithm according to a private key of the national secret encryption algorithm corresponding to the service demander to obtain a signature value of the first string.

[0060] The first string and the signature value are spliced to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0061] In the technical solution, the response data returned by the API service is processed row by row, and a digital watermark is generated and added in combination with the provider information of the API service and the quantum key corresponding to the service demander, a first string is generated according to each row of data, the provider information of the service and the quantum key corresponding to the service demander, the first string is encrypted in combination with the quantum key corresponding to the service demander according to the quantum key corresponding to the service demander, a signature value of the first string is obtained, the first string and the signature value thereof are spliced to form a watermark value, and the watermark value is added to the response data, the watermark is added to each row of the response data returned by the API service, and in the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, the robustness of the digital watermark is improved, the digital watermark is generated in combination with the quantum key and the quantum key, the security of the data returned by the API service is improved, whether the data returned by the API service is tampered with can be effectively judged, the information of the service provider is included in the digital watermark, and the source of the data can be determined.

[0062] According to an embodiment of the present application, the system further comprises:

[0063] The service data supermarket is configured to audit the service interface resource application from the service demander, and if the audit is passed, generate a public key and a private key pair of the quantum key encryption algorithm corresponding to the service demander, and return the public key of the quantum key encryption algorithm corresponding to the service demander to the service demander.

[0064] The API external calling module is further configured to negotiate with the service demander to determine the quantum key corresponding to the service demander.

[0065] In the technical solution, before receiving the API service calling request from the service demander, the service data supermarket is configured to audit the service interface resource application of the service demander, and if the audit is passed, generate a public key and a private key pair of the quantum key encryption algorithm, and return the public key to the service demander, the API external calling module is configured to negotiate to determine the quantum key, the service demander calling the API service is audited, and the security of the API service calling is improved, the quantum key and the quantum key encryption algorithm are determined with the service demander, and are used for the digital watermark of the data returned by the API service, and the security of the data returned by the API service is improved.

[0066] According to an embodiment of the present application, the system further comprises an API generation and publishing module configured to determine the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request mode, return type, whether the watermark needs to be added, binding the publishing environment and the publishing node of the API service, and publishing the API service.

[0067] The API external calling module is further configured to build a mapping relationship of the API service by taking a path and a request mode of the API service as a Key and taking configuration information of the API service as a value, and to put the API service on the service data supermarket.

[0068] In the above technical solution, the API generation and publishing module is configured to determine the configuration information (including a path, a request mode, a return type, and whether to add a watermark) of the API service, bind a publishing environment and a node, publish the API service, and the API external calling module is configured to build a mapping relationship taking the path and the request mode as the Key and taking the configuration information as the Value, and put the API service on the market for use, thereby realizing effective configuration and publishing of the API service, enabling the API service to be called by a service demander, determining in the configuration information whether the API service return data needs to add a watermark, and protecting sensitive data according to actual needs, thereby improving the security and flexibility of the API calling method.

[0069] According to an embodiment of the present application, the system further comprises a watermark extraction module configured to receive API service return data uploaded by the service demander, perform signature verification on the API service return data, acquire provider information of the API service in the API service return data if the signature verification is passed, and return the provider information of the API service to the service demander, or discard the API service return data if the signature verification fails.

[0070] In the above technical solution, the watermark extraction module is configured to receive API service return data uploaded by the service demander and perform signature verification, and the signature verification is performed line by line, and if the signature verification is passed, the provider information of the API service is acquired and returned, and the information of the API service provider can be calculated based on a watermark value and a signature value in a specific column (such as the last column) of each line of data, in combination with a quantum key value corresponding to the service demander and a specific field value of the API service return data, thereby realizing signature verification on the API service return data, determining whether the data is tampered with or forged, and further acquiring the information of the API service provider to determine the source of the API service return data.

[0071] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the API service calling method of the first aspect or the API service calling method of the second aspect when executing the computer program.

[0072] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implements the API service calling method according to the first aspect above, or implements the API service calling method according to the second aspect above.

[0073] In a fifth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface being coupled to the processor, the processor being configured to execute a program or an instruction, and implement the API service calling method according to the first aspect above, or implement the API service calling method according to the second aspect above.

[0074] In a sixth aspect, the present application provides a computer program product comprising a computer program, the computer program, when executed by a processor, implements the API service calling method according to the first aspect above, or implements the API service calling method according to the second aspect above.

[0075] Additional aspects and advantages of the present application will be in part apparent and in part pointed out below. BRIEF DESCRIPTION OF DRAWINGS

[0076] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the appended drawings.

[0077] Figure 1 is one of the flow diagrams of the API service calling method provided by some embodiments of the present application;

[0078] Figure 2 is a flow diagram of the watermark adding logic provided by some embodiments of the present application;

[0079] Figure 3 is a structural diagram of the API service providing system provided by some embodiments of the present application;

[0080] Figure 4 is a timing diagram of the working of the API service providing system provided by some embodiments of the present application;

[0081] Figure 5 is another flow diagram of the API service calling method provided by some embodiments of the present application;

[0082] Figure 6 is a structural diagram of the electronic device provided by some embodiments of the present application.

[0083] BRIEF DESCRIPTION OF DRAWINGS

[0084] 300: API service providing system;

[0085] 301: API external calling module; 302: service data supermarket;

[0086] 303: API generation and publishing module; 304: watermark extraction module;

[0087] 600: electronic device; 601: processor; 602: memory. DETAILED DESCRIPTION

[0088] The technical solutions in the embodiments of the present application will be clearly described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art belong to the scope of protection of the present application.

[0089] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually a class, not limited to the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the objects before and after are in a "or" relationship.

[0090] The API service calling method, API service providing system and electronic device provided by the embodiments of the present application will be described in detail below with reference to the drawings, specific embodiments and application scenarios.

[0091] The API service calling method provided by the embodiments of the present application, the execution subject of the API service calling method can be an electronic device or a functional module or functional entity in the electronic device capable of implementing the API service calling method. The API service calling method provided by the embodiments of the present application will be described below with the server as an execution subject.

[0092] Figure 1 is one of the flowcharts of the API service calling method provided by some embodiments of the present application. As shown in the figure, the API service calling method includes steps 110, 120, 130, 140, 150 and 160. Figure 1

[0093] Step 110, receiving an API service calling request from a service demander, the API service calling request carrying a path and a request mode of the API service. ​

[0094] It can be understood that the service demander refers to an entity sending an API service call request, which can be a client application, a website or a service, etc., and needs to access or operate data or functions managed by the provider of the API service.

[0095] The API service call request carries the path and request method of the API service. The path of the API service indicates the target address requested by the service demander, and the request method indicates the type of the request, such as GET and POST, etc. The API service call request can also carry other information, such as query parameters, request body, header information, etc.

[0096] Step 120, according to the path and request method of the API service, obtaining the configuration information of the API service from the mapping relationship of the API service.

[0097] According to the path and request method of the API service, the corresponding configuration information is obtained from the preset mapping relationship of the API service. The mapping relationship of the API service can be stored in a database or a configuration file. The configuration information corresponding to the path and request method of different API services is stored. The configuration information can include permission settings, data processing rules, response formats, etc., which can be used to correctly process the API service call request.

[0098] In some embodiments, the mapping relationship of the API service takes the path and request method of the API service as the key (Key), and takes the configuration information of the API service as the value (Value).

[0099] Step 130, according to the API service call request and the configuration information of the API service, obtaining the response data returned by the API service;

[0100] In some embodiments, the configuration information of the API service includes at least the following fields: path, request method, return type, and whether to add watermark. According to the return type and whether to add watermark field, it is determined whether the response data returned by the API service needs to add digital watermark, and the corresponding processing logic is executed, so as to obtain the API service return data.

[0101] It can be understood that according to the API service call request of the service demander and the configuration information of the API service, the response data returned by the API service is obtained, and the corresponding operation can include querying the database, executing the calculation or calling other services, etc.

[0102] It can be understood that the API service return data is data carrying digital watermark, which is obtained according to the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander,

[0103] The response data returned by the API service is directly returned as the API service return data without adding a digital watermark, and the response data returned by the API service participates in generating a digital watermark in the case of needing to add a watermark; the provider information of the API service is information (such as a user ID) of a user who configures and publishes the API service, and can be used to determine the source of the API service return data and also can be used for copyright protection of the API service return data; the quantum key corresponding to the service demander is obtained through negotiation between the service demander and the provider of the API service, and the quantum key is used in the process of generating a digital watermark, which can improve the security of the API service return data.

[0104] Step 140, determining whether the response data returned by the API service needs to add a digital watermark according to the return type and the whether-to-add-watermark field in the configuration information of the API service.

[0105] After obtaining the response data returned by the API service, it is determined whether the response data returned by the API service needs to add a digital watermark according to the return type and the whether-to-add-watermark field in the configuration information of the API service, if the value of the whether-to-add-watermark field is no, the watermark adding logic is not executed, and the response data returned by the API service is directly returned; if the value of the whether-to-add-watermark field is yes and the return type is an Excel file, the watermark adding logic is executed.

[0106] If the configuration information of the API service indicates that the response data returned by the API service needs to add a digital watermark, the response data returned by the API service is used as a basis, the provider information of the API service and the quantum key corresponding to the service demander are combined, the watermark adding logic is executed, the digital watermark is added to the response data, and the API service return data is obtained after the digital watermark adding is completed; if the configuration information of the API service indicates that the response data returned by the API service does not need to add a digital watermark, the response data returned by the API service can be directly used as the API service return data.

[0107] Step 150, if the response data returned by the API service needs to add a digital watermark, executing the watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, to obtain the API service return data.

[0108] The provider information of the API service refers to information (such as a user ID) of a user who configures and publishes the API service, and the user configures and publishes the API service through an API generation and publishing module in an API service providing system. After the API service is published and put on the shelf, a service demander can request to call the API service. The provider information of the API service is stored in an entity that executes an API service calling method of an embodiment of the present application, and in a process of executing watermark adding logic, the provider information corresponding to the API service can be obtained from the entity or a storage device of the entity. In some embodiments, the provider information of the API service is stored in a memory of a server where the API service is deployed and run.

[0109] Step 160, sending the API service return data to the service demander.

[0110] The API service return data is sent to the service demander, and the sending of the API service return data can involve data encapsulation, data formatting and the like, so that the service demander can receive the API service return data of the called API service.

[0111] In the above technical solution, the API service calling request (carrying the path and the request mode of the API service) from the service demander is received, the configuration information of the API service is obtained according to the mapping relationship, the response data returned by the API service is obtained according to the API service calling request and the configuration information of the API service, and then whether the response data returned by the API service needs to be added with a digital watermark is determined according to the return type in the configuration information and whether the watermark field is added. If yes, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander, the API service return data with the watermark is generated, and if no, the response data returned by the API service is taken as the API service return data, the calling of the API service is implemented, whether the digital watermark is added is determined dynamically according to the configuration information, the digital watermark can reflect whether the data is tampered with, the security of the API service return data is improved, and the provider information of the API service is contained in the digital watermark, which can be used to determine the source of the API service return data.

[0112] In an embodiment of the present application, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, and the watermark adding logic includes:

[0113] The watermark adding logic is executed for each row of data of the response data returned by the API service.

[0114] It can be understood that in the case that the data returned by the API service is in Excel format, the data is organized in a table, which can contain multiple rows and multiple columns. Each row represents a record, and each column represents a specific field or attribute in the record. Adding a watermark to each row of the response data returned by the API service achieves more refined data management, which can more easily determine the specific data row when data verification or data error occurs, thereby improving the efficiency and accuracy of managing the data returned by the API service.

[0115] Figure 2 is a flowchart of the watermark adding logic provided by some embodiments of the present application. As shown in Figure 2 some embodiments, the step of executing the watermark adding logic row by row includes steps 210, 220 and 230.

[0116] Step 210: generating a first string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander.

[0117] It can be understood that the watermark adding logic is executed row by row, and each row of the response data returned by the API service is traversed. Taking the i-th row of data of the response data returned by the API service as an example, the first string generation step is as follows:

[0118] 1) Obtain the i-th row of data of the response data returned by the API service, and perform MD5 hash processing on the field value of the first column (i.e., the content of the first column of the i-th row), to obtain an MD5 value (MD5 is a widely used hash function that can generate a 128-bit (16-byte) hash value, usually represented as a 32-bit hexadecimal number);

[0119] 2) Convert the MD5 value obtained in 1) from hexadecimal to decimal, and add the decimal value to the user ID value of the provider of the API service (i.e., the provider information of the API service), to obtain an addition result;

[0120] 3) Convert the addition result obtained in 2) from decimal to hexadecimal, and convert it to uppercase form, to obtain an addition result hexadecimal uppercase value;

[0121] 4) Add the addition result hexadecimal uppercase value obtained in 3) to the quantum key corresponding to the service demander, to obtain a first string M.

[0122] Step 220: encrypting the first string using a national cryptographic encryption algorithm according to the private key of the national cryptographic encryption algorithm corresponding to the service demander, to obtain a signature value of the first string.

[0123] Taking the SM2 national encryption algorithm as an example, the first string M is encrypted according to the private key privateKey of the SM2 national encryption algorithm corresponding to the service demand party to obtain the signature value (r, s) of the first string M.

[0124] The specific process of using the SM2 national encryption algorithm for encryption includes:

[0125] 1) obtaining a hash value ZA=H256(ENTLA||IDA||a||b||xG||yG||xA||yA) using a cryptographic hash algorithm;

[0126] 2) setting M*=ZA||M and calculating e=H(M*);

[0127] 3) generating a random number k∈[1, n-1];

[0128] 4) calculating an elliptic curve point [k]G=(x1, y1);

[0129] 5) calculating r=(e+x1)mod n, if r=0 or r+k=n, return to step 3);

[0130] 6) calculating s=(1+dA)-1·(k-r·dA)mod n, if s=0, return to step 3);

[0131] 7) obtaining (r, s) as the signature of the message M.

[0132] Wherein, H256 is a hash function, which is used to map input data (usually a message of arbitrary length) to a fixed length hash value; ENTLA is a private key; IDA is a part of the public key, that is, a point on the elliptic curve, usually represented as (xG, yG); IDA is the coordinate of the elliptic curve base point G; a and b are the coefficients of the elliptic curve equation, in the form of y^2=x^3+ax+b; xG and yG are the coordinates of the base point G of the elliptic curve, and the base point G is a pre-selected point on the elliptic curve, which is used to generate the public key and the signature; xA and yA are the coordinates of the signer's public key; ZA is the hash value obtained by the hash algorithm.

[0133] M is a message that needs to be signed, corresponding to the first string in the embodiment of the application; M* is the result of connecting the hash value ZA with the message M; e is a value obtained by performing a hash operation on M, expressed as e=H(M); k is a random number selected from the range [1, n-1], where n is the order of the elliptic curve; [k]G is the result of performing an elliptic curve multiplication operation on the point G on the elliptic curve and the random number k, expressed as (x1, y1); r is an intermediate result in the algorithm, calculated as r=(e+x1)mod n; s is another intermediate result in the signature algorithm; and (r, s) is the final generated signature value, which can be verified using the public key.

[0134] Step 230: concatenating the first string and the signature value to obtain a watermark value of the ith row of data, and filling the watermark value in the response data returned by the API service.

[0135] Optionally, the first string M obtained in step 210 and the signature value (r, s) of the first string M obtained in step 220 are concatenated to obtain a watermark value of the ith row of data, a serial_number column is added to the last column of the response data returned by the API service, and the watermark value of the ith row of data is filled in the serial_number column of the ith row.

[0136] It can be understood that the watermark adding logic is executed row by row, so that each row of the data returned by the API service has a corresponding watermark value, and the watermark value of each row contains the provider information of the API service, so that the provider information of the API service can be obtained in the case that part of the data or the digital watermark is damaged or tampered with, and the robustness of the digital watermark is improved.

[0137] In the above technical solution, the response data returned by the API service is processed row by row, the digital watermark is generated and added in combination with the provider information of the API service and the quantum key corresponding to the service demander, the first string is generated according to each row of data, the service provider information and the quantum key corresponding to the service demander, the first string is encrypted in combination with the private key of the quantum key corresponding to the service demander to obtain the signature value of the first string, the first string and its signature value are concatenated to form a watermark value, and the watermark value is added to the response data, the watermark is added to each row of the response data returned by the API service, the provider information of the API service can be obtained in the case that part of the data or the digital watermark is damaged or tampered with, the robustness of the digital watermark is improved, the digital watermark is generated in combination with the quantum key and the quantum key, the security of the data returned by the API service is improved, whether the data returned by the API service is tampered with can be effectively judged, the information of the service provider is contained in the digital watermark, and the source of the data can be determined.

[0138] According to one embodiment of the present application, before receiving the API service call request from the service demander, the method further comprises:

[0139] auditing the service interface resource application from the service demander;

[0140] if the auditing is passed, generating a public key and a private key pair of the corresponding national encryption algorithm of the service demander, returning the public key of the corresponding national encryption algorithm to the service demander, and negotiating with the service demander to determine the quantum key corresponding to the service demander.

[0141] It can be understood that before the service demander sends the API service call request, the service demander will first send the service interface resource application. In the case that the service interface resource application is audited, the service demander can call the API service by sending the API service call request, and the auditing process can include the qualification auditing of the service demander, the expected data processing method inspection, etc.

[0142] If the service interface resource application of the service demander is audited, a public key and a private key pair of the national encryption algorithm will be generated for the service demander, and the public key will be returned to the service demander. The national encryption algorithm is a Chinese national standard encryption algorithm, including SM2, SM4, etc., which is designed to provide high security data encryption and digital signature. Returning the public key to the service demander enables the service demander to verify the API service return data by the data watermark in the API service return data locally.

[0143] Taking the national encryption algorithm SM2 as an example, the process of generating the public key and the private key pair of SM2 is as follows:

[0144] The input is a set of valid Fq (a finite field containing q elements, q=p and p is a prime number greater than 3 or q=2^m) elliptic system parameters, where there are 7 main domain parameters T=(q, a, b, FR, G, n, h) in the elliptic curve-based cryptography system,

[0145] Wherein, q represents the number of elements in the finite field Fq, q is p or 2m (p is a prime number), and the corresponding finite field is a prime field and a binary field respectively; a and b are elements in Fq, coefficients of the elliptic curve equation, defining an elliptic curve E on Fq; FR is the equation of the curve, for example, the curve equation on the prime field GF(q) is y^2=x^3+ax+b, and the curve equation on the binary field GF(2^m) is y^2+xy=x^3+a^2x+b; G is a base point of the elliptic curve, and the order of G is a prime number; n is a large prime number and equal to the order of the base point G, 6, the most important parameter in the elliptic curve system is n, therefore the key length of the elliptic curve is defined as the length of n; h is the cofactor of n, which is a small integer and h=#E(Fq) / n, wherein n is the order of the base point G, and #E(Fq) is the number of points on E(Fq), which is called the order of the elliptic curve E(Fq).

[0146] The specific generation steps are as follows:

[0147] 1) Initialize the elliptic system;

[0148] 2) Generate a random integer d∈[1,n-2];

[0149] 3) Calculate P(Xp,Yp)=[d]G (d times point of the base point G on the elliptic curve) with G as the base point, which can be calculated by addition and subtraction method, sliding window method, etc.

[0150] 4) Output (d, P), d is the private key, and P is the public key.

[0151] After returning the public key of the national encryption algorithm, the quantum key is determined by negotiation with the service demander, the quantum key is used as needed, and the characteristics of quantum mechanics can make both parties generate a string of random numbers at the same time, and can ensure that the random number sequences of both parties are exactly the same.

[0152] In some embodiments, a pair of secure keys is generated from a quantum key distribution (QKD) based quantum key system provided by a third party, the key is a 0 / 1 bit string obtained through quantum communication negotiation, and the service demander will negotiate the quantum key before each API service call request.

[0153] In the technical solution, before receiving the API service calling request from the service demander, the service interface resource application of the service demander is audited first, and if the audit is passed, a public key and a private key pair of the national encryption algorithm are generated, the public key is returned to the service demander, and the quantum key is determined by negotiation, so that the service demander calling the API service is audited, and the security of the API service calling is improved. The public key and the private key pair of the national encryption algorithm and the quantum key are determined with the service demander, and are used for digital watermarking of API service return data, and the security of API service return data is improved.

[0154] According to an embodiment of the present application, the method further comprises:

[0155] determining the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request mode, return type, and whether to add watermark;

[0156] binding the publishing environment and the publishing node of the API service, and publishing the API service;

[0157] taking the path and the request mode of the API service as the Key, and taking the configuration information of the API service as the value, a mapping relationship of the API service is constructed;

[0158] putting the API service on the shelf.

[0159] Before the API service is officially published, its configuration information needs to be determined, and the configuration information at least includes the following fields: path, request mode, return type, and whether to add watermark. The path is a unique identifier of the API service, which can be a URL, used to specify the location of the API service; the request mode specifies the allowed request types, such as GET and POST, which determines how the service demander can call the API service; the return type defines the format of the response data returned by the API service, and common return types include JSON, XML, etc.; whether to add watermark is a flag field, which indicates whether the response data returned by the current API service needs to add digital watermark to improve the security of the data and determine the data source.

[0160] The configuration information of the API service also includes the information of the data source and the data table. The data source refers to the source of the data obtained by the API service, which is usually a database connection, which can be a MySQL or Oracle database, and the data table is a specific table in the database, which contains structured data. The API service can operate one or more data tables to provide the required data.

[0161] The API service needs to be published on a specific environment and node, that is, the server or cluster where the API service is deployed and runs, which is used to process API service calling requests.

[0162] After determining the configuration information of the API service, and binding the publishing environment and the publishing node, the API service can be published, that is, the API service can already receive the calling request and process these requests according to the configuration information.

[0163] The mapping relationship can be used to efficiently process the calling request of the API service, taking the path and the request mode of the API service as the key (Key) and taking the configuration information as the value (Value). The mapping relationship can be stored in a database or an in-memory data structure, allowing the received API request to be quickly found and matched, and processed according to the configuration information.

[0164] Listing the API service means putting the API service in a state accessible to the public or authorized users, which usually involves notifying the user of the availability of the API service and listing the API service in the API market or directory (for example, listing the API service on the service data supermarket).

[0165] In the above technical solution, after determining the configuration information (including the path, the request mode, the return type, and whether the watermark needs to be added) of the API service, the publishing environment and the node are bound, the API service is published, and the mapping relationship taking the path and the request mode as the Key and the configuration information as the Value is constructed, the API service is listed for use, the configuration and publishing of the API service are realized, the API service can be called by the service demand side, and whether the data returned by the API service needs to be added with a watermark is determined in the configuration information, the data can be protected according to the actual demand, and the security and flexibility of the API calling method are improved.

[0166] According to an embodiment of the present application, the method further comprises:

[0167] receiving the API service return data uploaded by the service demand side;

[0168] verifying the API service return data;

[0169] in the case of passing the verification, obtaining the provider information of the API service in the API service return data, and returning the provider information of the API service to the service demand side; or in the case of failing the verification, discarding the API service return data.

[0170] It can be understood that the verification is to verify the digital signature, after the service demand side calls the API service and receives the API service return data, there can be a demand for verifying the API service return data or obtaining the provider information of the API service, so the API service return data uploaded by the service demand side needs to be received. It can be understood that the API service return data needs to be added with a digital watermark for verifying the API service return data.

[0171] In some embodiments, the API service return data is signed, including:

[0172] The API service return data is signed line by line.

[0173] In some embodiments, the line-by-line signature verification includes:

[0174] Taking the i-th row of the API service return data as an example, the watermark value of the last column of the i-th row of the API service return data is obtained and divided to obtain a second string M' and a signature value (r', s'), and the signature is verified using the corresponding decryption algorithm of the encryption algorithm.

[0175] In the case of using the national encryption algorithm SM2 encryption, the corresponding signature verification process is as follows:

[0176] 1) Verify whether r' ∈ [1, n-1] is true, if not, the verification fails

[0177] 2) Verify whether s' ∈ [1, n-1] is true, if not, the verification fails

[0178] 3) Set M* = ZA||M'

[0179] 4) Calculate e' = H(M*)

[0180] 5) Calculate t = (r' + s') mod n, if t = 0, the verification fails

[0181] 6) Calculate the elliptic curve point (x1', y1') = s'·G + t·PA

[0182] 7) Calculate v = (e' + x1') mod n, verify whether v = r' is true, if true, the verification passes; otherwise, the verification fails.

[0183] Wherein, r' and s' are two integers generated by the signature algorithm; n is the order of the elliptic curve, that is, the total number of all points on the elliptic curve; ZA is a hash value obtained by a hash algorithm; M* is the result of connecting the hash value ZA and the message M'; e' is the value obtained by hashing M; t is an intermediate result in the signature verification process; G is the base point of the elliptic curve; PA is the public key of the signer; (x1', y1') is a point on the elliptic curve; v is an intermediate result in the signature verification process; r' is part of the signature value.

[0184] In case of signature verification passing, the provider information of the API service in the API service return data can be obtained, taking the second string M' and the signature value (r', s') of the second string of the i-th row of the API service return data as an example, the steps of obtaining the provider information of the API service are as follows:

[0185] 1) subtract the second string M' from the quantum key value corresponding to the service demand party to obtain a subtraction result v1;

[0186] 2) obtain the i-th row data of the response data returned by the API service, and perform MD5 hash processing on the field value in the first column (i.e. the content in the first column of the i-th row) to obtain an MD5 value, and then convert the MD5 value into a decimal number v2;

[0187] 3) calculate v2-v1 to obtain the user ID of the provider of the API service.

[0188] The user ID of the provider of the API service obtained through the above steps can be further used to obtain the detailed information of the provider of the API service.

[0189] In the above technical solution, the API service return data uploaded by the service demand party is received and signature verification is performed, the signature verification process is performed row by row, if the signature verification passes, the provider information of the API service is obtained and returned, the information of the provider of the API service can be calculated based on the watermark value and the signature value in a specific column (such as the last column) of each row of data, combined with the quantum key value corresponding to the service demand party and the specific field value of the API service return data, the signature verification of the API service return data is realized, which can be used to determine whether the data is tampered or forged, and the information of the provider of the API service can be further obtained to determine the source of the API service return data.

[0190] The API service calling method provided by the embodiments of the present application can be executed by the API service providing system. In the embodiments of the present application, the API service calling method executed by the API service providing system is taken as an example to illustrate the API service providing system provided by the embodiments of the present application.

[0191] Figure 3 is a structural schematic diagram of the API service providing system provided by some embodiments of the present application. As shown in Figure 3 , the API service providing system 300 includes:

[0192] The API external calling module 301 is configured to receive an API service calling request from a service demander, the API service calling request comprising a request path and a request mode of an API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request mode of the API service, obtain API service return data according to the API service calling request and the configuration information of the API service, the API service return data being data with a digital watermark, the digital watermark being obtained according to response data returned by the API service, provider information of the API service and a quantum key corresponding to the service demander, and return the API service return data to the service demander.

[0193] The service data supermarket 302 is configured to audit a service interface resource application from the service demander.

[0194] The API generation and publishing module 303 is configured to determine the configuration information of the API service, bind a publishing environment and a publishing node of the API service, and publish the API service.

[0195] The watermark extraction module 304 is configured to receive API service return data uploaded by the service demander and perform signature verification on the API service return data.

[0196] In the above technical solution, the API external calling module is configured to receive an API service calling request (carrying a path and a request mode of an API service) from a service demander, obtain configuration information of the API service according to a mapping relationship, obtain response data returned by the API service according to the API service calling request and the configuration information of the API service, and then determine whether to add a digital watermark to the response data returned by the API service according to a return type in the configuration information and whether to add a watermark field, if yes, execute watermark adding logic in combination with provider information of the API service and a quantum key corresponding to the service demander, generate API service return data with a watermark, and if no, take the response data returned by the API service as the API service return data, thereby realizing calling of the API service, dynamically determining whether to add a digital watermark according to configuration information, reflecting whether data has been tampered with by the digital watermark, improving security of API service return data, containing provider information of the API service in the digital watermark, determining a source of the API service return data, auditing the service demander calling the API service, publishing the API service and performing signature verification on the API service return data.

[0197] Optionally, the obtaining of the API service return data according to the API service calling request and the configuration information of the API service comprises:

[0198] According to the API service call request and the configuration information of the API service, response data returned by the API service is obtained;

[0199] According to the return type in the configuration information of the API service and whether to add a watermark field, it is determined whether the response data returned by the API service needs to add a digital watermark;

[0200] If the response data returned by the API service needs to add a digital watermark, based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, watermark adding logic is executed to obtain API service return data.

[0201] In the above technical solution, according to the API service call request and the configuration information of the API service, the response data returned by the API service is obtained, and then according to the return type in the configuration information and whether to add a watermark field, it is determined whether the response data returned by the API service needs to add a digital watermark, if needed, the watermark adding logic is executed in combination with the provider information of the API service and the quantum key corresponding to the service demander, to generate API service return data with watermark, if not needed, the response data returned by the API service is taken as the API service return data, which realizes that the configuration information dynamically determines whether to add a digital watermark, improves the flexibility of API return data, the digital watermark can be used to judge whether the API service return data is tampered, improves the security of the API service return data, and the provider information of the API service is contained in the digital watermark, which can be used to determine the source of the API service return data.

[0202] Optionally, the watermark adding logic is executed based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, and includes:

[0203] For each row of data of the response data returned by the API service, the following watermark adding logic is executed:

[0204] According to the i-th row of data of the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, a first string is generated;

[0205] According to the private key of the national encryption algorithm corresponding to the service demander, the first string is encrypted using the national encryption algorithm to obtain a signature value of the first string;

[0206] The first string and the signature value are spliced to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

[0207] In the technical solution, the response data returned by the API service is processed row by row, the digital watermark is generated and added in combination with the provider information of the API service and the quantum key corresponding to the service demander, the first string is generated according to each row of data, the service provider information and the quantum key corresponding to the service demander, the first string is encrypted in combination with the quantum key corresponding to the service demander according to the quantum key corresponding to the service demander, the signature value of the first string is obtained, the first string is spliced with the signature value to form the watermark value, and the watermark value is added to the response data, the watermark is added to each row of the response data returned by the API service, in the case that part of the data or the digital watermark is damaged or tampered with, the provider information of the API service can still be obtained, the robustness of the digital watermark is improved, the digital watermark is generated in combination with the quantum key and the quantum key, the security of the data returned by the API service is improved, whether the data returned by the API service is tampered with can be effectively judged, the information of the service provider is included in the digital watermark, and the source of the data can be determined.

[0208] Optionally, the API service providing system 300 further includes:

[0209] The service data supermarket 302 is configured to audit the service interface resource application from the service demander, and if the audit is passed, generate the public key and the private key pair of the quantum key encryption algorithm corresponding to the service demander, and return the public key of the quantum key encryption algorithm corresponding to the service demander to the service demander.

[0210] The API external calling module 301 is further configured to negotiate with the service demander to determine the quantum key corresponding to the service demander.

[0211] In the technical solution, before receiving the API service calling request from the service demander, the service data supermarket is configured to audit the service interface resource application of the service demander, and if the audit is passed, generate the public key and the private key pair of the quantum key encryption algorithm, and return the public key to the service demander, the API external calling module is configured to negotiate to determine the quantum key, the service demander calling the API service is audited, and the security of the API service calling is improved, the quantum key and the quantum key encryption algorithm are determined with the service demander, and are used for the digital watermark of the API service return data, and the security of the API service return data is improved.

[0212] Optionally, the API service providing system 300 further includes:

[0213] The API generation and publishing module 303 is configured to determine the configuration information of the API service, the configuration information of the API service at least including the following fields: path, request mode, return type, whether the watermark needs to be added, binding the publishing environment and the publishing node of the API service, and publishing the API service.

[0214] The API external calling module 301 is further configured to build a mapping relationship of the API service by taking the path and request mode of the API service as a Key and taking the configuration information of the API service as a value, and to put the API service on the service data supermarket.

[0215] In the technical solution, after the API generating and publishing module determines the configuration information (including the path, request mode, return type, and whether to add a watermark) of the API service, the API generating and publishing module binds a publishing environment and a node and publishes the API service. The API external calling module is configured to build a mapping relationship taking the path and request mode as a Key and taking the configuration information as a Value, and to put the API service on the market for use. The API service can be effectively configured and published, and the API service can be called by a service demander. Whether the API service return data needs to add a watermark is determined in the configuration information, and sensitive data can be protected according to actual needs, thereby improving the security and flexibility of the API calling method.

[0216] Optionally, the API service providing system 300 further includes:

[0217] The watermark extracting module 304 is configured to receive API service return data uploaded by the service demander, to verify the API service return data, to obtain the information of the provider of the API service in the API service return data if the verification is passed, and to return the information of the provider of the API service to the service demander, or to discard the API service return data if the verification fails.

[0218] In the technical solution, the watermark extracting module is configured to receive API service return data uploaded by the service demander and to verify the API service return data. The verification is performed line by line. If the verification is passed, the information of the provider of the API service is obtained and returned. The information of the provider of the API service can be calculated based on the watermark value and the signature value in a specific column (such as the last column) of each row of data, in combination with the quantum key value of the service demander and the specific field value of the API service return data. The verification of the API service return data is implemented, and the data can be determined to be tampered with or forged. The information of the provider of the API service can be further obtained, and the source of the API service return data can be determined.

[0219] Figure 4 is a timing diagram of the work of the API service providing system provided by some embodiments of the present application, as shown in Figure 4 The API service calling method is performed by the API service providing system.

[0220] The API service providing system in the embodiments of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The embodiments of the present application are not limited in this regard.

[0221] The API service providing system in the embodiments of the present application can be a system with an operating system. The operating system can be a Microsoft (Windows) operating system, an Android operating system, an IOS operating system, or other possible operating systems, and the embodiments of the present application are not limited in this regard.

[0222] The API service providing system provided in the embodiments of the present application can implement each process of the API service calling method embodiments, and thus details are not repeated here.

[0223] Figure 5 FIG. 2 is a flowchart of an API service calling method according to some embodiments of the present application. As shown in FIG. 2, the API service calling method includes steps 210 and 220. Figure 5

[0224] In step 210, an API service calling request is sent, and the API service calling request carries a path and a request mode of the API service.

[0225] The API service calling request carries the path and the request mode of the API service. The path of the API service indicates a target resource requested by a service demander, and the request mode indicates a type of the request, such as GET and POST, and the API service calling request can also carry other information, such as a query parameter, a request body, header information, and the like.

[0226] In step 220, API service return data is received, and the API service return data is data with a digital watermark, which is obtained according to response data returned by the API service, provider information of the API service, and a quantum key corresponding to the service demander.

[0227] It can be understood that the API service return data is data with a digital watermark, which is obtained according to response data returned by the API service, provider information of the API service, and a quantum key corresponding to the service demander,

[0228] ​The response data returned by the API service is directly returned as the API service return data without adding a digital watermark, and the response data returned by the API service participates in generating a digital watermark in the case of needing to add a watermark; the provider information of the API service is information (such as a user ID) of a user who configures and publishes the API service, and can be used to determine the source of the API service return data; the quantum key corresponding to the service demander is obtained through negotiation between the service demander and the provider of the API service, and the quantum key is used in the process of generating the digital watermark, which can improve the security of the API service return data.

[0229] In the above technical solution, the API service calling request (carrying the path and request method of the API service) is sent, and the API service return data is received, the API service return data is data with a digital watermark, the digital watermark is obtained according to the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander, the API service calling is realized, the API service return data has the digital watermark, which can reflect whether the data is tampered with, the security of the API service return data is improved, and the provider information of the API service is contained in the digital watermark, which can be used to determine the source of the API service return data.

[0230] According to an embodiment of the present application, the method further comprises:

[0231] sending a service interface resource application;

[0232] receiving a public key of a corresponding national encryption algorithm;

[0233] negotiating a quantum key with the provider of the API service.

[0234] It can be understood that before sending the API service calling request, the service interface resource application needs to be sent first. In the case that the service interface resource application is approved, the API service can be called by sending the API service calling request.

[0235] If the service interface resource application is approved, the public key of the service national encryption algorithm will be received. The national encryption algorithm is a Chinese national standard encryption algorithm, including SM2, SM4 and the like, which is designed to provide high security data encryption and digital signature. The public key can be used to verify the API service return data by the data watermark in the API service return data locally.

[0236] After receiving the public key of the corresponding national encryption algorithm, the quantum key will be negotiated and determined with the provider of the API service. The quantum key is used as it is, which can make both parties generate a string of random numbers at the same time by using the characteristics of quantum mechanics, and can ensure that the random number sequences of both parties are exactly the same.

[0237] In some embodiments, a pair of secure keys is generated from a QKD-based quantum key system provided by a third party, the key being a 0 / 1 bit string obtained through quantum communication negotiation, and before each API service call request is sent, quantum key negotiation is performed with the provider of the API service.

[0238] In the above technical solution, the service interface resource application is sent, the public key of the national encryption algorithm is received and the quantum key is negotiated and determined with the provider of the API service, the service demander calling the API service is audited, and the security of the API service call is improved. The public key of the national encryption algorithm and the quantum key can be used for verifying the API service return data, and the security of the API service return data is improved.

[0239] According to an embodiment of the present application, the method further comprises:

[0240] Uploading the API service return data to the watermark extraction module, so that the watermark extraction module verifies the API service return data, and returns the provider information of the API service if the verification is passed;

[0241] Receiving the verification result of the API service return data returned by the watermark extraction module, the verification result including: the provider information of the API service, or the verification is not passed.

[0242] Uploading the API service return data to the watermark extraction module, it can be understood that the API service return data needs to be added with digital watermark for verification.

[0243] After the watermark extraction module completes the verification of the API service return data, if the verification is not passed, it will directly return the result that the verification is not passed, and if the verification is passed, it will further obtain the provider information of the API service and return it.

[0244] In the above technical solution, the API service return data is uploaded to the watermark extraction module, if the verification is passed, the provider information of the API service is received, which can be used to determine the data source, and if the verification is not passed, the result that the verification is not passed is returned, the verification of the API service return data is realized, which can be used to determine whether the data is tampered or forged, and the information of the provider of the API service can be further obtained to determine the source of the API service return data.

[0245] According to an embodiment of the present application, the method further comprises:

[0246] Verifying the API service return data according to the public key of the corresponding national encryption algorithm;

[0247] After the signature verification passes, the provider information of the API service in the API service return data is obtained.

[0248] It can be understood that the provider of the API service generates a pair of public and private keys of the national encryption algorithm, and receives the returned public key. In the process of negotiating the quantum key with the provider of the API service, through the characteristics of quantum mechanics, both parties will generate a string of random numbers at the same time, and it can be ensured that the random number sequences of both parties are exactly the same.

[0249] In the case that the API service return data carries digital watermark, the API service return data can be verified according to the public key of the corresponding national encryption algorithm, so as to determine the authenticity of the API service return data.

[0250] In some embodiments, the API service return data is verified, including:

[0251] The API service return data is verified line by line.

[0252] In some embodiments, the API service return data is verified, including:

[0253] The watermark value of the last column of the i-th row of the API service return data is obtained and segmented to obtain a second string M' and a signature value (r', s'), and the verification is performed using the decryption algorithm corresponding to the encryption algorithm.

[0254] In the case that the signature verification passes, the provider information of the API service in the API service return data can be further obtained, taking the second string M' of the i-th row of the API service return data and the signature value (r', s') of the second string as an example, the steps of obtaining the provider information of the API service are as follows:

[0255] 1) The second string M' is subtracted from the quantum key value corresponding to the service demander to obtain a subtraction result v1;

[0256] 2) The i-th row data of the response data returned by the API service is obtained, and the field value of the first column (i.e. the content of the first column of the i-th row) is subjected to MD5 hash processing to obtain an MD5 value, and then the MD5 value is converted into a decimal number v2;

[0257] 3) v2-v1 is calculated to obtain the user ID of the provider of the API service.

[0258] Through the above steps, the user ID of the provider of the API service can be obtained, which can be further used to obtain the detailed information of the provider of the API service and determine the source of the API service return data.

[0259] In the technical solution, the API service return data is verified according to the public key of the corresponding national encryption algorithm, if the verification is passed, the provider information of the API service can be further obtained, the verification of the API service return data is realized, whether the data is tampered or forged can be determined, and the information of the provider of the API service can be further obtained to determine the source of the API service return data.

[0260] In some embodiments, as shown in FIG. 6, Figure 6 The electronic device 600 further includes a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. The computer program is executed by the processor 601 to implement the processes of the API service calling method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0261] It should be noted that the electronic device in the embodiments of the present application includes the mobile electronic device and the non-mobile electronic device described above.

[0262] The present application also provides a non-transitory computer readable storage medium having a computer program stored thereon. The computer program is executed by a processor to implement the processes of the API service calling method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0263] The processor is the processor of the electronic device described in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer readable memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0264] The present application also provides a computer program product including a computer program. The computer program is executed by a processor to implement the API service calling method.

[0265] The processor is the processor of the electronic device described in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer readable memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0266] The present application also provides a chip including a processor and a communication interface. The communication interface is coupled to the processor. The processor is configured to run a program or an instruction to implement the processes of the API service calling method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0267] It should be understood that the chip mentioned in the embodiments of the present application can also be referred to as a system-level chip, a system chip, a chip system, or a system-on-chip chip, etc.

[0268] It should be noted that in this document, the terms "comprise", "comprising", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices that comprise a list of elements not only include those elements, but also include other elements not explicitly listed, or further include elements inherent in such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, but can also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method can be performed in an order different from that described, and various steps can also be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0269] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc), and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, or network equipment, etc.) execute the methods described in various embodiments of the present application.

[0270] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above specific embodiments, and the above specific embodiments are only illustrative, not limiting, and those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the scope protected by the claims.

[0271] In the description of the application, reference has been made to descriptive terms such as "one embodiment", "some embodiments", "an embodiment", "example", "specific example" or "some examples" etc. It is emphasized that each of these terms refers to a specific feature, structure, material or characteristic described in connection with a particular embodiment or example. The descriptive terms are not necessarily referring to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0272] While embodiments of the application have been shown and described, it is to be understood that the application is not limited to the details of the embodiments described, since the scope of the application is defined with respect to the appended claims.

Claims

1. An API service calling method, characterized by, The API external calling module comprises: receiving an API service calling request from a service demander, the API service calling request carrying a path and a request mode of an API service; obtaining configuration information of the API service from a mapping relationship of the API service according to the path and the request mode of the API service; obtaining response data returned by the API service according to the API service calling request and the configuration information of the API service; determining whether the response data returned by the API service needs to be added with digital watermark according to a return type in the configuration information of the API service and whether a watermark field is added; if the response data returned by the API service needs to be added with digital watermark, performing watermark adding logic based on the response data returned by the API service, provider information of the API service and a quantum key corresponding to the service demander to obtain API service return data; sending the API service return data to the service demander; the performing of the watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander comprises: performing the following watermark adding logic for each row of data of the response data returned by the API service: generating a first string according to the i-th row of data of the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander; encrypting the first string by using a national encryption algorithm according to a private key of the national encryption algorithm corresponding to the service demander to obtain a signature value of the first string; splicing the first string and the signature value to obtain a watermark value of the i-th row of data, and filling the watermark value in the response data returned by the API service.

2. The API service calling method of claim 1, wherein, Before the receiving of the API service calling request from the service demander, the method further comprises: auditing a service interface resource application from the service demander; if the auditing is passed, generating a public key and a private key pair of a national encryption algorithm corresponding to the service demander, returning the public key of the national encryption algorithm corresponding to the service demander to the service demander, and negotiating with the service demander to determine a quantum key corresponding to the service demander.

3. The API service invocation method of claim 1, wherein, The method further comprises: determining configuration information of the API service, the configuration information of the API service at least comprising the following fields: path, request mode, return type, and whether the watermark needs to be added; binding a publishing environment and a publishing node of the API service, and publishing the API service; constructing a mapping relationship of the API service by taking the path and the request mode of the API service as a key and taking the configuration information of the API service as a value; putting the API service on the shelf.

4. The API service calling method according to any one of claims 1-3, characterized in that, The method further comprises: receiving API service return data uploaded by the service demander; verifying the API service return data; In case of signature passing, obtaining the provider information of the API service in the API service return data, and returning the provider information of the API service to the service demander; or in case of signature failure, discarding the API service return data.

5. An API service calling method, characterized by, Applied to a service demander, comprising: sending an API service calling request, the API service calling request carrying a path and a request mode of an API service; receiving API service return data, the API service return data being data with digital watermark, the digital watermark being obtained according to response data returned by the API service, provider information of the API service, and a quantum key corresponding to the service demander; the path and the request mode of the API service are used for the API external calling module to obtain configuration information of the API service from a mapping relationship of the API service; the configuration information of the API service is used for the API external calling module to obtain the response data returned by the API service, the configuration information of the API service including a return type and a watermark adding field, the return type and the watermark adding field being used for the API external calling module to determine whether the response data returned by the API service needs to be added with digital watermark; the digital watermark is obtained by the API external calling module in a case where it is determined that the response data returned by the API service needs to be added with digital watermark, by performing the following steps: for each row of data of the response data returned by the API service, the following watermark adding logic is performed: generating a first string according to the i-th row of data of the response data returned by the API service, the provider information of the API service, and the quantum key corresponding to the service demander; encrypting the first string using a national encryption algorithm according to a private key of the national encryption algorithm corresponding to the service demander, to obtain a signature value of the first string; splicing the first string and the signature value to obtain a watermark value of the i-th row of data, and filling the watermark value in the response data returned by the API service.

6. The API service calling method of claim 5, wherein, The method further comprises: sending a service interface resource application; receiving a public key of a corresponding national encryption algorithm; negotiating a quantum key with a provider of an API service.

7. The API service calling method according to claim 5 or 6, characterized in that, The method further comprises: uploading the API service return data to a watermark extraction module, so that the watermark extraction module verifies the API service return data, and returns the provider information of the API service in case of signature passing; receiving a signature verification result of the API service return data returned by the watermark extraction module, the signature verification result including the provider information of the API service, or signature failure.

8. The API service invocation method of claim 6, wherein, The method further comprises: verifying the API service return data according to the public key of the corresponding national encryption algorithm; obtaining the provider information of the API service in the API service return data after signature passing.

9. An API service providing system characterized by comprising: comprising: An API calling module is configured to receive an API service calling request from a service demander, the API service calling request including a request path and a request mode of an API service, obtain configuration information of the API service from a mapping relationship of the API service according to the request path and the request mode of the API service, obtain response data returned by the API service according to the API service calling request and the configuration information of the API service, determine whether the response data returned by the API service needs to be added with digital watermark according to a return type in the configuration information of the API service and whether a watermark field is added, if the response data returned by the API service needs to be added with digital watermark, execute watermark adding logic based on the response data returned by the API service, provider information of the API service and a quantum key corresponding to the service demander, and obtain API service return data, and send the API service return data to the service demander; A service data supermarket is configured to audit service interface resource application from the service demander; An API generation and publishing module is configured to determine configuration information of the API service, bind a publishing environment and a publishing node of the API service, and publish the API service; A watermark extraction module is configured to receive API service return data uploaded by the service demander, and verify the API service return data; The watermark adding logic based on the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander includes: For each row of data of the response data returned by the API service, the following watermark adding logic is executed: A first string is generated according to the i-th row of data of the response data returned by the API service, the provider information of the API service and the quantum key corresponding to the service demander; A signature value of the first string is obtained by encrypting the first string using a national encryption algorithm according to a private key of the national encryption algorithm corresponding to the service demander; The first string and the signature value are spliced to obtain a watermark value of the i-th row of data, and the watermark value is filled in the response data returned by the API service.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the API service calling method in any one of claims 1-4, or implement the API service calling method in any one of claims 5-8.

Images