Interface verification method and device, computer equipment and storage medium

Abstract

The invention relates to an interface verification method, which comprises the following steps: receiving an access request sent by a client, and if the access request does not comprise a signature key, obtaining a client configuration parameter; calculating a unique recognizable signature value according to the client configuration parameters; encrypting the signature value according to a preset encryption algorithm to generate a signature key; storing the signature key in the client, and returning the signature key and the effective timestamp to the client; if a signature key application sent by the client within a preset time period before the expiration of the effective timestamp is received, recalculating the signature key; matching the signature key with a preset security verification condition; if the signature key is successfully matched, starting a preset security protection mechanism; and if the matching fails, matching the signature key with a preset service processing rule, processing the access request according to a matched preset service logic, and returning a service response to the client. And the security in the current interface verification method is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Internet technology, and in particular to a method, device, computer equipment and storage medium for interface verification. Background Art

[0002] With the development of Internet technology, WEB applications have become an indispensable part of people's daily work and life. However, as a bridge for interaction between systems, the security of the WEB interface is directly related to the data security and business continuity of the entire system.

[0003] In the existing technology, the most commonly used method is to use access tokens and API keys. In addition, all incoming interface requests are strictly validated to prevent SQL injection, XML external entity attack (XXE) and XSS attack. However, the above methods have problems such as poor scalability, key leakage risk and lack of visualization.

[0004] Therefore, based on the above problems, there is an urgent need for an interface verification method that is secure, visual, and scalable. Summary of the invention

[0005] The embodiments of the present invention provide a method, device, computer equipment and storage medium for interface verification to solve the problems of poor scalability and key leakage risk in the current interface verification method.

[0006] In a first aspect, an embodiment of the present invention provides a method for interface verification, the method comprising:

[0007] Receive access requests sent by clients;

[0008] detecting a signature key in the access request;

[0009] If the access request does not include the signature key, obtaining the client configuration parameters in the access request;

[0010] Calculating a uniquely identifiable signature value according to the client configuration parameters;

[0011] Encrypt the signature value according to a preset encryption algorithm to generate a signature key;

[0012] Returning the signature key and the valid timestamp of the signature key to the client for storage;

[0013] If a signing key application is received from the client within a preset time period before the expiration of the valid timestamp, the client configuration parameters are obtained, a new signing key is generated, and the new signing key and its valid timestamp are returned to the client;

[0014] Matching the signature key with a preset security verification condition;

[0015] If the signature key matches the preset security verification condition, the preset security protection mechanism is activated;

[0016] If the signature key does not match the preset security verification condition, the signature key is matched with the preset business processing rule to obtain a matching preset business logic;

[0017] The access request is processed according to the preset business logic, and a business response is returned to the client.

[0018] In a second aspect, an embodiment of the present invention further provides an interface verification device, the device comprising:

[0019] An access request receiving module, used for receiving an access request sent by a client;

[0020] A signature key detection module, used to detect the signature key in the access request;

[0021] A client configuration parameter acquisition module, configured to acquire the client configuration parameters in the access request if the access request does not include the signature key;

[0022] A signature value acquisition module, used to calculate a uniquely identifiable signature value according to the client configuration parameters;

[0023] A signature key acquisition module, used to encrypt the signature value according to a preset encryption algorithm to generate a signature key;

[0024] A signature key returning module, used to return the signature key and the valid timestamp of the signature key to the client for storage;

[0025] a signing key application receiving module, configured to obtain client configuration parameters, generate a new signing key, and return the new signing key and its valid timestamp to the client if a signing key application sent by the client within a preset time period before the valid timestamp expires;

[0026] A security verification condition matching module, used to match the signature key with a preset security verification condition;

[0027] A security protection module, configured to activate a preset security protection mechanism if the signature key matches the preset security verification condition;

[0028] A business logic acquisition module, used for matching the signature key with a preset business processing rule to obtain a matching preset business logic if the signature key does not match the preset security verification condition;

[0029] The business response module is used to process the access request according to the preset business logic and return a business response to the client.

[0030] In a third aspect, an embodiment of the present invention further provides a computer device, the computer device comprising:

[0031] one or more processors;

[0032] a memory for storing one or more programs,

[0033] When the one or more programs are executed by the one or more processors, the one or more processors implement the interface verification method as described in any one of the first aspects.

[0034] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for interface verification as described in any one of the first aspects is implemented.

[0035] In this embodiment, by receiving an access request sent by a client; detecting the signature key in the access request; if the access request does not include the signature key, obtaining the client configuration parameters in the access request; calculating a uniquely identifiable signature value according to the client configuration parameters; encrypting the signature value according to a preset encryption algorithm to generate a signature key; returning the signature key and the valid timestamp of the signature key to the client for storage; if receiving a signature key application sent by the client within a preset time period before the expiration of the valid timestamp, obtaining the client configuration parameters, generating a new signature key, and returning the new signature key and its valid timestamp to the client; matching the signature key with a preset security verification condition; if the signature key matches the preset security verification condition, starting a preset security protection mechanism; if the signature key does not match the preset security verification condition, matching the signature key with a preset business processing rule to obtain a matching preset business logic; processing the access request according to the preset business logic, and returning a business response to the client. This solves the problem of high risk of key leakage in the current interface verification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of a method for interface verification provided in Embodiment 1 of the present invention;

[0037] Figure 2 This is a timing diagram of obtaining a signature key according to the first embodiment of the present invention;

[0038] Figure 3An example diagram of the signature and verification process provided in the first embodiment of the present invention;

[0039] Figure 4 This is a diagram showing an example of a WEB security component interaction architecture provided in the first embodiment of the present invention;

[0040] Figure 5 This is an example diagram of a request verification processing sequence provided in the first embodiment of the present invention;

[0041] Figure 6 A schematic diagram of the structure of an interface verification device provided in Embodiment 2 of the present invention;

[0042] Figure 7 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0043] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0044] Embodiment 1

[0045] Figure 1 A flowchart of a method for interface verification provided in the first embodiment of the present invention specifically includes the following steps:

[0046] Step 101: Receive an access request sent by a client.

[0047] In the embodiment of the present invention, in the network application, the server is configured with a WEB server instance that monitors a specific port, and is used to receive HTTP / HTTPS requests from the client, that is, access requests sent by the client or the front end.

[0048] Step 102: Detect the signature key in the access request.

[0049] In the embodiment of the present invention, when the server receives an HTTP / HTTPS request from a client, in order to reduce unnecessary network requests, the request header and request body are first parsed to determine whether the access request carries a signature key stored locally on the client.

[0050] Step 103: If the access request does not include the signature key, obtain the client configuration parameters in the access request.

[0051] In the embodiment of the present invention, Figure 2 As shown, if the signing key is not included in the access request, you need to re-apply for the signing key from the server.

[0052] Usually, to apply for a signing key, you first need to obtain the client's configuration parameters, which include the request method (GET, POST, etc.), URI, protocol version, header fields, and payload data initiated by the client, and send these configuration parameters to the server to request the signing key.

[0053] Step 104: Calculate a uniquely identifiable signature value according to the client configuration parameters.

[0054] In the embodiment of the present invention, Figure 2 As shown, after receiving the request, the server will calculate a uniquely identifiable signature value based on the client configuration parameters. This signature value can be used to uniquely identify the client.

[0055] Step 105: Encrypt the signature value according to a preset encryption algorithm to generate a signature key.

[0056] In the embodiment of the present invention, Figure 2 As shown, in order to ensure the security of the above uniquely identifiable signature value during transmission, it is usually encrypted using a certain encryption algorithm to obtain the signature key of the client.

[0057] Specifically, Figure 3 As shown, the signature process is explained in detail in the form of an example:

[0058] First, the client request is transmitted to the server system through the network, and the server collects key information in the request, such as parameters, timestamps, etc. Secondly, the server uses the signature key to encrypt or hash this information to generate a signature. Among them, the signature key is the key used to generate and verify the signature. The signature key is stored on both the client and the server to ensure the consistency of the signing and verification process. The server system contains a "unified signature verification" module to verify the signature sent by the client.

[0059] Among them, the unified signature verification module is responsible for verifying the signature of the request. The verification process usually requires the server to extract the signature and original request information in the request, re-sign the request information using the signature key stored on the server, and compare the regenerated signature with the signature carried in the request to verify the integrity and authenticity of the request.

[0060] Understandably, the signing key plays a key role in both the signing and verification processes, ensuring the security of data during transmission.

[0061] Step 106: Return the signature key and the valid timestamp of the signature key to the client for storage.

[0062] In the embodiment of the present invention, the server returns the encrypted signature key and the timestamp of the next request for the signature key (ie, the valid timestamp of the signature key) to the client.

[0063] The timestamp is used to guide the client when to request a new signing key again to maintain the timeliness of the signing key. After the client receives the signing key returned by the server, it stores it in the local storage for use in subsequent requests.

[0064] Step 107: If a signature key application is received from the client within a preset time period before the valid timestamp expires, the client configuration parameters are obtained, a new signature key is generated, and the new signature key and its valid timestamp are returned to the client.

[0065] In the embodiment of the present invention, a scheduled task is set in the client to check the ciphertext of the signature key within a fixed time period before the timestamp expires, and reissue the signature key application to the server within 5 minutes before the signature key expires, so as to ensure the timeliness of the signature key and prevent the request failure caused by the expiration of the signature key. It can be understood that the preset time for re-applying for the signature key is set by relevant technicians according to actual conditions, and the embodiment of the present invention does not limit this.

[0066] Specifically, the server returns the encrypted signature key and the timestamp of the next request again, and the client updates the locally stored signature key accordingly.

[0067] In practical applications, such as Figure 2 As shown in the figure, after the client sends a request, the server first determines whether the access request has a signature key. If not, it requests the server to obtain a signature key once, and the interface returns the time to obtain the key next time. In addition, if the server returns an rCode of a signature error when the client requests the interface (refer to the public error code table), it obtains the signature key again and initiates the request again to ensure that the user does not feel the entire process.

[0068] Furthermore, according to the signature key generation algorithm, each key is valid for one hour. In order to avoid the user experience problem of the client not updating the key in time in certain scenarios, the server needs to "smoothly expire" when verifying the signature. For example, the previous key remains valid for at least 3 minutes in the next cycle. Both keys are guaranteed to be valid during the 3-minute transition period. It can be understood that the "smooth expiration" time period is set by relevant technical personnel according to actual applications, and the embodiments of the present invention do not limit this.

[0069] In actual applications, in order to avoid the problem of large differences between the client user time and the server time when the client performs parameter signing (users adjust the time themselves or time zone issues in different regions), the server time is uniformly used as the benchmark for signing.

[0070] Step 108: Match the signature key with a preset security verification condition.

[0071] In the embodiment of the present invention, the server matches the acquired signature key with the pre-set security verification conditions, and can further perform security verification on the user's access request according to the pre-set security verification conditions. For example, all requests are intercepted and security checks are performed, or interaction with the monitoring system and configuration center is performed to obtain the latest security policies and monitor security events.

[0072] Preferably, in another embodiment of the present invention, step 108 may include:

[0073] Sub-step 81: decrypt the signature key according to a preset decryption algorithm to obtain the parameters to be signed.

[0074] Specifically, after receiving the signature key, the server first decrypts it according to a preset decryption algorithm to obtain the parameters to be signed.

[0075] Sub-step 82: concatenate the parameters to be signed to obtain a signature string.

[0076] Sub-step 83: Sign the signature string to obtain a signature value.

[0077] Sub-step 84: Match the signature value with a preset security verification parameter to obtain a key verification value.

[0078] Specifically, when verifying the signature, the server first decrypts the signature key, and splices the parameters to be signed into a signature string, then signs the signature string to obtain the signature value, matches the signature value with the preset security verification parameters, and obtains the key verification value.

[0079] Among them, the preset security verification parameters are set in advance by the server according to actual security verification requirements, and are regularly updated on the server, and are set by relevant technical personnel, and the embodiments of the present invention are not limited to this.

[0080] Sub-step 85: Match the key verification value with a preset security verification condition.

[0081] Specifically, the preset security verification condition is a verification rule that is set in advance and stored in the server configuration center, such as Figure 4As shown, developers can issue grayscale policies in the configuration center background. The server requests the configuration center to obtain verification rules that match the key verification value. The "verification rules" include whether the service itself has verification enabled, user blacklists and whitelists, IP addresses, etc., so as to achieve the gradual expansion of security policies, ensure the stable operation of the service, and avoid accidental interception.

[0082] It is understandable that the server-side built-in security policy reserves a custom detection policy, which is implemented and expanded by relevant technical personnel according to actual needs, and the embodiment of the present invention does not limit this. For example, by using the expansion of SpringBoot's automatic configuration function, configuring the spring.factories file and completing the automatic configuration of the WEB security component, when the business layer is accessed, only the Jar package needs to be introduced, and no additional configuration is required to complete the access and use; if custom expansion is required, additional configuration is required.

[0083] In actual applications, several grayscale strategies are preset in the component, and the grayscale ratio is controlled by configuration, so as to achieve the effect of gradually enlarging the grayscale scale. After the data feedback reaches a certain expectation, the grayscale strategy can be turned off to complete the switch from grayscale to full volume. The following is a detailed description of the grayscale strategy dimensions by way of example.

[0084] Strategic Dimension:

[0085] 1. Global switch. The switch is divided into two levels: one is turned on and verified, and the other is turned on but not verified. The main function of turning on but not verifying is to run through the entire process and calculate the signature value without actually verifying the signature; turning on and verifying means it is fully turned on and the validity of the signature needs to be verified before it is released.

[0086] 2. User whitelist: through user whitelist configuration, specify a certain user to take effect, which can be used in the internal test environment.

[0087] 3.IP whitelist, enter the grayscale strategy by configuring the specified IP address.

[0088] 4. Users: By taking the modulus of the user ID, a certain proportion of users will enter the grayscale strategy.

[0089] 5. No grayscale, that is, full release. Before release, you can observe the grayscale data report and release it only after there are no abnormal problems.

[0090] The following is a detailed description of the extended design by way of example.

[0091] Expanded Design

[0092] The correct execution of security policies involves several roles: organizer, context, policy enumeration, and policy interface. The context and organizer are fixedly encapsulated in the WEB security component, but the policy interface is left for extension. The access party can extend a specific interface to enhance or replace a certain policy according to its own personalized needs. The access party only needs to implement the interface and inject it into the Spring container to replace the default implementation (subsequent planning will consider opening custom policies). The policy interface is as follows:

[0093]

[0094]

[0095] Specific URI exclusion: In actual application scenarios, there are scenarios such as third-party interface callbacks, such as Alipay callbacks, etc. In these third-party scenarios, there are independent security verification and signature methods, so they need to be excluded independently without going through the WEB security component. There are two ways to achieve exclusion:

[0096] If you annotate a specific interface with @WebSecurityRuleConfig and set the exclude attribute to true, the interface is considered not to pass through the component.

[0097] Set webSecurityExcludesPathPrefix in the configuration to indicate that the URI with a specific prefix does not pass through the component, which is used in some special scenarios;

[0098] In the component, many common scenarios where URIs need to be excluded are built in, mainly static resource classes, including: js, css, img, etc.

[0099] Preferably, in another embodiment of the present invention, the preset security verification parameter includes at least one of a Header verification value, a valid timestamp verification value, a unique declaration value, a unique signature verification value, an XSS injection detection value, and an SQL injection detection value, then sub-step 85 may include:

[0100] Sub-step 851, setting a preset security verification condition corresponding to each of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value and the SQL injection detection value.

[0101] Specifically, illegal header detection is mainly to prevent obvious illegal requests, mainly including common script requests, such as some headers of languages ​​such as Python, Go, and cURL. In addition, a blacklist extension mechanism is also added, so that illegal headers can be flexibly added during subsequent confrontation.

[0102] The parameter validity check is mainly to prevent replay, which is solved by two means: the first is the timestamp, and the second is the unique nonce. If the request exceeds the validity period or the nonce is repeated, it is considered that the request has been replayed and will be directly rejected without processing the request.

[0103] Parameter signature verification is the most core part, which is mainly to prevent parameters from being tampered with. During the verification process, the signature value of the parameter is recalculated through the signature algorithm and compared with the signature value of the client. If they are consistent, it is considered that the parameter has not been tampered with. If they are inconsistent, it is considered that the parameter has been tampered with and the request is rejected.

[0104] It is mainly used to prevent users from passing in HTML tags, which may cause exceptions when the browser loads data. Currently, some common HTML tag symbols are replaced, such as <, javascript, script, eval, etc., and then the source parameters are compared with the replaced parameters by md5. If they are inconsistent, it is considered that there is an XSS attack and the request will be rejected.

[0105] To prevent user SQL injection, the system will check whether the request content contains the sql keyword. If so, it will be replaced. Then, the source parameter will be compared with the replaced parameter by MD5. If they are inconsistent, SQL injection is considered to exist and the request will be rejected.

[0106] In actual applications, in addition to the detection content mentioned above, you can also customize the detection strategy according to the actual application. The customized detection strategy is an empty implementation in the component and returns a pass by default. The main purpose is to provide it to the access party for self-implementation and expansion. It is the last strategy in the processing chain.

[0107] It can be understood that each detection strategy corresponds to a preset security detection condition, namely, a grayscale strategy.

[0108] Sub-step 852: storing the correspondence between the preset security verification condition and the preset security verification parameter in a preset security condition list.

[0109] Specifically, the preset security verification conditions, ie, the corresponding relationship between the grayscale policy and the above preset security verification parameters are stored as a preset security condition list.

[0110] Sub-step 853: Match the key verification value with at least one of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value and the SQL injection detection value.

[0111] Specifically, when the server matches the key verification value with the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value and the SQL injection detection value, a matching value is obtained, and the matching value is put in the preset security condition list to obtain a preset security protection mechanism.

[0112] Step 109: If the signature key matches the preset security verification condition, the preset security protection mechanism is activated.

[0113] In the embodiment of the present invention, a preset security protection mechanism is obtained according to the matching, and security protection is started. Figure 4 As shown in the figure, the user actor initiates a web request through a browser or other client. The Nginx cluster acts as a reverse proxy server, receiving the user request and forwarding it to the web service on the server side.

[0114] Among them, Nginx can distribute requests to multiple WEB servers, play a role in load balancing, and improve the availability and performance of the system.

[0115] Furthermore, the WEB security component is an automatically configurable Jar package that is responsible for performing security checks on all incoming requests to achieve security protection. It works in the form of an interceptor and performs a series of security checks on requests, such as signature verification, XSS attack protection, SQL injection protection, etc.

[0116] Among them, after the WEB security component check is passed, the access request is passed to the business logic layer, where specific business needs are handled, such as database operations, data processing, etc.

[0117] Preferably, in another embodiment of the present invention, step 109 may include:

[0118] Sub-step 91, obtaining the preset security verification condition that matches successfully in the preset security condition list.

[0119] Specifically, Figure 4 The monitoring system shown is used to monitor the operating status and security events of the WEB security components. It can collect the operating data of the security components, such as intercepted requests, detected attacks, etc., for analysis and response. The configuration center is used to manage and issue security policy configurations.

[0120] Sub-step 92: starting a preset security protection mechanism according to the preset security condition.

[0121] Specifically, Figure 4As shown, the WEB security component will regularly obtain the latest security policies from the configuration center to ensure that the security protection measures are up to date. DC services (data center services) are used by WEB services to interact with DC services through interface calls. DC services may provide data storage, processing or other business support functions.

[0122] Step 110: If the signature key does not match the preset security verification condition, the signature key is matched with a preset business processing rule to obtain a matching preset business logic.

[0123] In the embodiment of the present invention, if the signature key matches the preset security verification condition, the grayscale process is triggered and the security protection mechanism is started. If the signature key does not match the preset security verification condition, the security protection is bypassed, the request is directly forwarded to the business logic processing, and the corresponding business response is returned.

[0124] Preferably, in another embodiment of the present invention, step 110 may include:

[0125] Sub-step 1101: If the preset security condition list does not contain the preset security verification condition corresponding to the key verification value, the key verification value is matched with the preset business processing rule table to obtain a matching preset business logic.

[0126] Specifically, the preset security conditions, that is, the core role of the grayscale strategy, is to gradually deploy security rules to prevent legitimate requests from being intercepted incorrectly due to configuration errors. Once the grayscale process is entered, the security component of the server will calculate the signature value on the server and compare it with the signature submitted by the front end for verification. After the verification is passed, the server security check will be further performed, including but not limited to security protection measures such as XSS attack and SQL injection protection. The specific settings are set by relevant technical personnel according to the specific application, and the embodiments of the present invention are not limited to this.

[0127] After the server passes the security verification, it will execute the specific business logic and asynchronously collect and report data. Developers can use custom configured reports to achieve visual management of interception events and grayscale status, and set up corresponding alarm mechanisms. At the same time, in-depth analysis can be performed based on the collected data to adjust and optimize the interception strategy.

[0128] Step 111: Process the access request according to the preset business logic, and return a business response to the client.

[0129] In the embodiment of the present invention, the access request is processed according to the preset business logic, and the business data of the access request is returned to the client.

[0130] Preferably, in another embodiment of the present invention, it may also include:

[0131] Step B1: record the client configuration parameters of the preset security protection mechanism that is activated and generate a monitoring report.

[0132] In the embodiment of the present invention, by embedding and marking points, and storing the client configuration parameters of the security protection mechanism on the monitoring platform, a monitoring report is generated. The report design is described in detail below by way of example.

[0133] Grayscale report

[0134] -Indicator name: web_security_shading

[0135] -Indicator value: times

[0136] -Tags: appId, appName, grayscale strategy, hit or miss

[0137] Intercept Report

[0138] -Indicator name: web_access_blocker

[0139] -Indicator value: times

[0140] -Tags: appId, appName, policy name

[0141] Step B2: If the preset security protection mechanism activated in the monitoring report exceeds the preset alarm threshold, an early warning message is sent.

[0142] In the embodiment of the present invention, the monitoring report can be customized and configured, and the indicator threshold alarm can be realized and early warning information can be sent through the alarm function provided by the monitoring system.

[0143] In actual applications, the alarm is designed so that the access party can set alarm thresholds based on various indicators. If the thresholds are exceeded, an early warning will be issued and the corresponding developers will be notified through enterprise communication tools.

[0144] It can be seen that the components in the figure interact with each other through different processes and interfaces, forming a complete anomaly detection system. The anomaly detection results are displayed on the monitoring platform. The interaction of the entire system components achieves real-time and automation, which can timely detect and respond to potential system anomalies and ensure the stability and reliability of the system.

[0145] In an embodiment of the present invention, by receiving an access request sent by a client, if the access request does not include the signature key, the client configuration parameters are obtained; a uniquely identifiable signature value is calculated according to the client configuration parameters; the signature value is encrypted according to a preset encryption algorithm to generate a signature key; the signature key and its valid timestamp are returned to the client; if a signature key application is received from the client within a preset time period before the valid timestamp expires, the signature key is regenerated; the signature key is matched with a preset security verification condition; if the signature key matches the preset security verification condition, the preset security protection mechanism is started; if it does not match, the signature key is matched with a preset business processing rule, the access request is processed according to the matching preset business logic, and a business response is returned to the client. The client configuration parameters of the preset security protection mechanism that is started are recorded, and a monitoring report is generated; if the preset security protection mechanism that is started in the monitoring report exceeds the preset alarm threshold, an early warning message is sent. The security of the interface verification is improved by encryption and decryption of the security key, and the visualization of the monitoring data is realized through the monitoring report.

[0146] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0147] Embodiment 2

[0148] Figure 6 The structure block diagram of an interface verification device provided in the second embodiment of the present invention may specifically include the following modules:

[0149] The access request receiving module 201 is used to receive the access request sent by the client;

[0150] A signature key detection module 202, used to detect the signature key in the access request;

[0151] The client configuration parameter acquisition module 203 is used to acquire the client configuration parameters in the access request if the access request does not include the signature key;

[0152] A signature value acquisition module 204, used to calculate a uniquely identifiable signature value according to the client configuration parameters;

[0153] The signature key acquisition module 205 is used to encrypt the signature value according to a preset encryption algorithm to generate a signature key;

[0154] The signature key returning module 206 is used to return the signature key and the valid timestamp of the signature key to the client for storage;

[0155] The signing key application receiving module 207 is used to obtain the client configuration parameters, generate a new signing key, and return the new signing key and its valid timestamp to the client if the signing key application sent by the client within a preset time period before the expiration of the valid timestamp is received;

[0156] A security verification condition matching module 208, used to match the signature key with a preset security verification condition;

[0157] A security protection module 209, configured to activate a preset security protection mechanism if the signature key matches the preset security verification condition;

[0158] The business logic acquisition module 210 is used to match the signature key with the preset business processing rule to obtain the matching preset business logic if the signature key does not match the preset security verification condition;

[0159] The business response module 211 is used to process the access request according to the preset business logic and return a business response to the client.

[0160] Preferably, in another embodiment of the present invention, it also includes:

[0161] A monitoring report generation module, used to record the client configuration parameters of the preset security protection mechanism that is activated and generate a monitoring report;

[0162] The warning information sending module is used to send a warning message if the preset security protection mechanism activated in the monitoring report exceeds a preset alarm threshold.

[0163] Preferably, in another embodiment of the present invention, the security verification condition matching module 208 is further used for:

[0164] Decrypting the signature key according to a preset decryption algorithm to obtain the parameters to be signed;

[0165] Concatenate the parameters to be signed to obtain a signature string;

[0166] Signing the signature string to obtain a signature value;

[0167] Matching the signature value with a preset security verification parameter to obtain a key verification value;

[0168] The key verification value is matched with a preset security verification condition.

[0169] Preferably, in another embodiment of the present invention, the preset security verification parameter includes at least one of a Header verification value, a valid timestamp verification value, a unique declaration value, a unique signature verification value, an XSS injection detection value, and an SQL injection detection value, then the security verification condition matching module 208 is further used to:

[0170] Setting a preset security verification condition corresponding to each of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value, and the SQL injection detection value;

[0171] Storing the corresponding relationship between the preset security verification condition and the preset security verification parameter in a preset security condition list;

[0172] The key verification value is matched with at least one of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value, and the SQL injection detection value.

[0173] Preferably, in another embodiment of the present invention, the security protection module 209 is further used for:

[0174] Obtaining the preset security verification condition that successfully matches in the preset security condition list;

[0175] The preset security protection mechanism is activated according to the preset security condition.

[0176] Preferably, in another embodiment of the present invention, the business logic acquisition module 210 is further used for:

[0177] If the preset security condition list does not contain the preset security verification condition corresponding to the key verification value, the key verification value is matched with the preset business processing rule table to obtain a matching preset business logic.

[0178] The interface verification device provided in the embodiment of the present invention can execute the interface verification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0179] Embodiment 3

[0180] Figure 7 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. Figure 7 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 7 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0181] like Figure 7 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0182] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0183] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0184] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0185] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0186] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the computer device 12, and / or may communicate with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the computer device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 12, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0187] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the interface verification method provided in the embodiment of the present invention.

[0188] Embodiment 4

[0189] Embodiment 4 of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned interface verification method are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0190] Among them, computer-readable storage media may include, for example, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or device.

[0191] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for interface verification, characterized in that: The method comprises: Receive access requests sent by clients; detecting a signature key in the access request; If the access request does not include the signature key, obtaining the client configuration parameters in the access request; Calculating a uniquely identifiable signature value according to the client configuration parameters; Encrypt the signature value according to a preset encryption algorithm to generate a signature key; Returning the signature key and the valid timestamp of the signature key to the client for storage; If a signing key application is received from the client within a preset time period before the expiration of the valid timestamp, the client configuration parameters are obtained, a new signing key is generated, and the new signing key and its valid timestamp are returned to the client; Matching the signature key with a preset security verification condition; If the signature key matches the preset security verification condition, the preset security protection mechanism is activated; If the signature key does not match the preset security verification condition, the signature key is matched with the preset business processing rule to obtain a matching preset business logic; The access request is processed according to the preset business logic, and a business response is returned to the client.

2. The method according to claim 1, characterized in that Also includes: Record the client configuration parameters of the preset security protection mechanism that is activated and generate a monitoring report; If the preset security protection mechanism activated in the monitoring report exceeds the preset alarm threshold, an early warning message is sent.

3. The method according to claim 1, characterized in that The step of matching the signing key with a preset security verification condition comprises: Decrypting the signature key according to a preset decryption algorithm to obtain the parameters to be signed; Concatenate the parameters to be signed to obtain a signature string; Signing the signature string to obtain a signature value; Matching the signature value with a preset security verification parameter to obtain a key verification value; The key verification value is matched with a preset security verification condition.

4. The method according to claim 3, characterized in that The preset security verification parameter includes at least one of a header verification value, a valid timestamp verification value, a unique declaration value, a unique signature verification value, an XSS injection detection value, and an SQL injection detection value, and the step of matching the key verification value with the preset security verification condition includes: Setting a preset security verification condition corresponding to each of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value, and the SQL injection detection value; Storing the corresponding relationship between the preset security verification condition and the preset security verification parameter in a preset security condition list; The key verification value is matched with at least one of the Header verification value, the valid timestamp verification value, the unique declaration value, the unique signature verification value, the XSS injection detection value, and the SQL injection detection value.

5. The method according to claim 4, characterized in that The step of starting a preset security protection mechanism if the signature key matches the preset security verification condition comprises: Obtaining the preset security verification condition that successfully matches in the preset security condition list; The preset security protection mechanism is activated according to the preset security condition.

6. The method according to claim 4, characterized in that If the signature key does not match the preset security verification condition, the step of matching the signature key with a preset business processing rule to obtain a matching preset business logic includes: If the preset security condition list does not contain the preset security verification condition corresponding to the key verification value, the key verification value is matched with the preset business processing rule table to obtain a matching preset business logic.

7. An interface verification device, characterized in that: The device comprises: An access request receiving module, used for receiving an access request sent by a client; A signature key detection module, used to detect the signature key in the access request; A client configuration parameter acquisition module, configured to acquire the client configuration parameters in the access request if the access request does not include the signature key; A signature value acquisition module, used to calculate a uniquely identifiable signature value according to the client configuration parameters; A signature key acquisition module, used to encrypt the signature value according to a preset encryption algorithm to generate a signature key; A signature key returning module, used to return the signature key and the valid timestamp of the signature key to the client for storage; a signing key application receiving module, configured to obtain client configuration parameters, generate a new signing key, and return the new signing key and its valid timestamp to the client if a signing key application sent by the client within a preset time period before the valid timestamp expires; A security verification condition matching module, used to match the signature key with a preset security verification condition; A security protection module, configured to activate a preset security protection mechanism if the signature key matches the preset security verification condition; A business logic acquisition module, used for matching the signature key with a preset business processing rule to obtain a matching preset business logic if the signature key does not match the preset security verification condition; The business response module is used to process the access request according to the preset business logic and return a business response to the client.

8. The device according to claim 7, characterized in that Also includes: A monitoring report generation module, used to record the client configuration parameters of the preset security protection mechanism that is activated and generate a monitoring report; The warning information sending module is used to send a warning message if the preset security protection mechanism activated in the monitoring report exceeds a preset alarm threshold.

9. A computer device, characterized in that: The computer device comprises: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the interface verification method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for interface verification according to any one of claims 1 to 6 is implemented.

Images