API auditing method, system and device, equipment, storage medium and product

Abstract

The invention provides an API auditing method, system and device, equipment, a storage medium and a product. The method comprises the following steps: acquiring API mirror image traffic; analyzing an application to which the API belongs from the API mirror image traffic; identifying an authentication mode of an application to which the API belongs; determining account information corresponding to the API based on an authentication mode of an application to which the API belongs; and determining a user associated with the account information according to the account information corresponding to the API and the application to which the API belongs. By associating the account information corresponding to the API, the application to which the API belongs and the user, the user associated with the account information can be quickly and accurately traced when a security event occurs, so that the security and compliance of API auditing are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to an API audit method, system, device, equipment, storage medium and product. Background Art

[0002] In the relevant API audit solution, the API traffic mirroring method is adopted to mirror the API access traffic to the API audit system through the switch for audit. The API audit system can locate the terminal device accessing the API to a certain extent, but the access terminal device and the account information and user information of the API access are difficult to accurately associate, resulting in difficulty in tracing the user associated with the account when a security incident occurs, thus affecting the security and compliance of the API audit. Summary of the invention

[0003] The present disclosure provides an API audit method, system, device, equipment, storage medium and product to solve problems in related technologies.

[0004] The first embodiment of the present disclosure provides an API audit method, the method comprising:

[0005] Get API mirror traffic;

[0006] Parsing the application to which the API belongs from the API mirror traffic;

[0007] Identify the authentication method of the application to which the API belongs;

[0008] Determine the account information corresponding to the API based on the authentication method of the application to which the API belongs;

[0009] According to the account information corresponding to the API and the application to which the API belongs, a user associated with the account information is determined.

[0010] In one embodiment, identifying the authentication method of the application to which the API belongs includes:

[0011] Obtaining authentication information of the API, wherein the authentication information includes at least Authorization header information and cookie header information;

[0012] According to the authentication information of the API, an authentication method of the application to which the API belongs is identified.

[0013] In one embodiment, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0014] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a first preset authentication method, obtaining first information carried by the API, where the first information at least includes account information;

[0015] The account information is extracted from the first information carried by the API.

[0016] In one embodiment, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0017] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying the authentication API traffic of the second preset authentication method;

[0018] Based on the authentication API flow of the second preset authentication method and a preset account extraction library, account information corresponding to the authentication API flow is determined.

[0019] In one embodiment, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0020] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is the second preset authentication method, identifying non-authentication API traffic of the second preset authentication method, the non-authentication API traffic carries an identity identifier;

[0021] Based on the identity identifier of the non-authentication API traffic, account information corresponding to the non-authentication API traffic is determined.

[0022] The second aspect of the present disclosure proposes an API audit system, which includes an API protocol parsing module, an API authentication method identification module, an authentication API identification module and an account information extraction module.

[0023] The third aspect of the present disclosure provides an API auditing device, the device comprising:

[0024] The acquisition unit is used to obtain API mirror traffic;

[0025] A parsing unit, used to parse the API mirror traffic to find out the application to which the API belongs;

[0026] An identification unit, used to identify the authentication method of the application to which the API belongs;

[0027] A first determining unit, configured to determine account information corresponding to the API based on an authentication method of an application to which the API belongs;

[0028] The second determining unit is used to determine a user associated with the account information according to the account information and the application to which the API belongs.

[0029] A fourth aspect of the present disclosure provides an electronic device, including:

[0030] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the embodiment of the first aspect of the present disclosure.

[0031] The fifth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the first aspect embodiment of the present disclosure.

[0032] The sixth aspect embodiment of the present disclosure proposes a computer program product, including a computer program, which implements the method described in the first aspect embodiment of the present disclosure when executed by a processor.

[0033] In summary, the present disclosure proposes an API auditing method, which includes: obtaining API mirror traffic; parsing the application to which the API belongs from the API mirror traffic; identifying the authentication method of the application to which the API belongs; based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API; and determining the user associated with the account information based on the account information corresponding to the API and the application to which the API belongs.

[0034] According to the solution provided by the present disclosure, by obtaining API mirror traffic; parsing the application to which the API belongs from the API mirror traffic; identifying the authentication method of the application to which the API belongs; determining the account information corresponding to the API based on the authentication method of the application to which the API belongs; and determining the user associated with the account information based on the account information corresponding to the API and the application to which the API belongs, it is possible to accurately record the identity of the user who accesses the API, thereby improving the accuracy of the identity of the user who accesses the API, and can quickly and accurately trace the user associated with the account information when a security incident occurs, thereby improving the security and compliance of API audits.

[0035] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0037] Figure 1 A flowchart of a related API audit method provided in an embodiment of the present disclosure;

[0038] Figure 2 A flowchart of an API audit method provided in an embodiment of the present disclosure;

[0039] Figure 3 A flowchart of a method for identifying an authentication method of an application provided in an embodiment of the present disclosure;

[0040] Figure 4 A flowchart of a method for determining account information corresponding to an API provided in an embodiment of the present disclosure;

[0041] Figure 5 A flowchart of a method for determining account information corresponding to an API provided in an embodiment of the present disclosure;

[0042] Figure 6 A flowchart of a method for determining account information corresponding to an API provided in an embodiment of the present disclosure;

[0043] Figure 7 A schematic diagram of the structure of the API audit system provided in the embodiment of the present disclosure;

[0044] Figure 8 A flowchart of an API audit method provided for an example application of the present disclosure;

[0045] Fig. 9 A schematic diagram of the structure of an API audit device provided in an embodiment of the present disclosure;

[0046] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] Embodiments of the present disclosure are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0048] API mirroring traffic: refers to sending copies of API requests and responses to one or more other destinations for analysis, monitoring, or recording without interfering with the original Application Programming Interface (API) request processing flow.

[0049] Enterprises use a large number of application systems, such as Customer Relationship Management (CRM) systems, Enterprise Resource Planning (ERP) systems, Customer Success Management (CSM) systems, etc., and provide a large number of API services to meet the needs of different departments and businesses. This architecture not only improves work efficiency, but also promotes information flow and data integration. As enterprises pay more attention to compliance and security, they can effectively identify and manage risks, ensure compliance, and optimize API management by auditing API interaction traffic. In the process of API auditing, it is particularly important to be able to audit the user information of API access.

[0050] like Figure 1 As shown in the figure, the currently commonly used API auditing solution is to use traffic mirroring to mirror the API access traffic to the API auditing system through a switch for auditing.

[0051] The above solution has the following defects:

[0052] The API audit system records access to the Internet Protocol (IP) information. The IP can locate the terminal device that accesses the API to a certain extent. However, it is difficult to accurately associate the terminal device with the account information and user information that accesses the API. In addition, due to the dynamic changes in the IP, inaccurate associations may occur, making it difficult to trace responsibility when a security incident occurs, thus affecting the security and compliance of the API audit.

[0053] In order to address the defects in the related technology, the present invention obtains API mirror traffic; parses the application to which the API belongs from the API mirror traffic; identifies the authentication method of the application to which the API belongs; determines the account information corresponding to the API based on the authentication method of the application to which the API belongs; determines the user associated with the account information according to the account information corresponding to the API and the application to which the API belongs, thereby accurately recording the user identity of API access, improving the accuracy of the user identity of API access, and can quickly and accurately trace the user associated with the account information when a security incident occurs, thereby improving the security and compliance of API audits.

[0054] The API audit method proposed in this disclosure can be applied to scenarios such as API traffic analysis, user behavior analysis, security audit, and compliance inspection. The executor of the API audit method can be an API audit system, a security analysis platform, or a custom-developed application or script.

[0055] Since most applications use APIs based on Hypertext Transfer Protocol (HTTP), this application uses HTTP protocol APIs for illustration.

[0056] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] like Figure 2 As shown, Figure 2 The following is a flow chart of the API audit method provided in the embodiment of the present disclosure. The API audit method provided in the embodiment of the present disclosure includes the following steps:

[0058] Step 201, obtaining API mirror traffic;

[0059] In one embodiment, the API mirroring traffic includes at least a request header, a request body, a response header, a response body, and the like.

[0060] In one embodiment, API mirror traffic can be used for logging, monitoring, troubleshooting, data analysis, security auditing, etc.

[0061] In one embodiment, API mirror traffic may be obtained through an API gateway.

[0062] In one embodiment, API mirror traffic may also be obtained through a load balancer or a reverse proxy, such as HAProxy.

[0063] In one embodiment, API mirror traffic may also be obtained through custom middleware.

[0064] Step 202, parsing the application to which the API belongs from the API mirror traffic;

[0065] In one embodiment, the aforementioned request header, request body, response header, response body and other information are also parsed from the API mirror traffic.

[0066] In one embodiment, a domain:port directive may be used to define an application to indicate the application to which the API belongs.

[0067] Step 203, identifying the authentication method of the application to which the API belongs;

[0068] In one embodiment, the authentication method of the application refers to a method by which a client (such as a user, device, or service) proves its identity to a server in order to obtain permission to access protected resources.

[0069] In one embodiment, the authentication method of the application to which the API belongs may be identified based on the API mirror traffic information.

[0070] Step 204, determining the account information corresponding to the API based on the authentication method of the application to which the API belongs;

[0071] In one embodiment, the authentication method of the application to which the API belongs can be basic authentication, jwt authentication, or session-cookie authentication. In basic authentication, the server will return a status code to inform the client that verification is required, and the client will then encode the user identity and password and send them to the server; jwt authentication includes a signed statement that can be used to verify the identity of the sender and pass information; in session-cookie authentication, the server sets a cookie after successful authentication, which contains a session identifier, and the browser will automatically attach this cookie in subsequent requests.

[0072] In one embodiment, based on the authentication method of the application to which the API belongs, it is necessary to determine whether the authentication method of the application to which the API belongs carries account information, and then based on this, determine the account information corresponding to the API.

[0073] Step 205: Determine a user associated with the account information based on the account information corresponding to the API and the application to which the API belongs.

[0074] In one embodiment, since the account information of the same user in different applications may be the same or different, it is also necessary to associate the account information, application and user identity corresponding to the API.

[0075] In one embodiment, an account user table is constructed by importing or configuring, and the account user table is queried based on the audited account information and applications to record the real user information of an API access, wherein the account information, applications, and corresponding users in the account user table can be historical records.

[0076] In one embodiment, if Figure 3 As shown, the authentication method for identifying the application to which the API belongs includes:

[0077] Step 301, obtaining authentication information of the API, wherein the authentication information includes at least Authorization header information and cookie header information;

[0078] In one embodiment, the Authorization header information is used to provide the server with authentication credentials required to access resources, including the authentication method used by the API and the authentication credentials required by the authentication method, such as user identity and password.

[0079] In one embodiment, the cookie header information is used to transfer status information between the client and the server. When the browser sends a request to the server, if cookies under the domain name exist, the browser will automatically attach these cookies to the request as part of the cookie header.

[0080] In one embodiment, the authentication information of the API may be obtained from the API mirror traffic. Specifically, the authentication information of the API may be obtained from information such as the request header and the response header parsed from the API mirror traffic.

[0081] Step 302: Identify the authentication method of the application to which the API belongs based on the authentication information of the API.

[0082] In one embodiment, according to the authentication information of the API, the authentication method of the application to which the API belongs can be identified from the Authorization header information in the authentication information of the API.

[0083] In one embodiment, as shown in Table 1, an API authentication method table may be constructed according to the application to which the API belongs and the authentication method of the application to which the API belongs.

[0084] Application Name Authentication www.erp.com:80 Basic Authentication www.crm.com:80 jwt authentication www.csm.com:80 session-cookie authentication

[0085] Table 1 API authentication method table

[0086] In one embodiment, if Figure 4As shown, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0087] Step 401, based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a first preset authentication method, obtaining first information carried by the API, where the first information at least includes account information;

[0088] In one embodiment, the first preset authentication method refers to basic authentication and jwt authentication.

[0089] In one embodiment, the first information refers to all the information carried by the API. For example, in basic authentication, the first information may be account number, password, timestamp and other information. In jwt authentication, the first information may be account number, token identifier, token validity period and other information.

[0090] Step 402: extract account information from the first information carried by the API.

[0091] In one embodiment, since each API access using basic authentication or jwt authentication will carry account information, the account information corresponding to the API can be directly obtained from the information carried by the API.

[0092] In one embodiment, if Figure 5 As shown, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0093] Step 501, based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying the authentication API traffic of the second preset authentication method;

[0094] In one embodiment, if the authentication method of the application to which the API belongs is the second preset authentication method, the authentication API traffic of the second preset authentication method can be identified through the recognition feature library built into the authentication API.

[0095] In one embodiment, an identity ticket is obtained after API authentication, and subsequent API accesses carry the identity ticket.

[0096] In one embodiment, the aforementioned built-in identification feature library may include an authentication API url, and its authentication API url will carry keyword features such as login. The aforementioned built-in identification feature library may also include authentication behavior. In the authentication behavior, the request header or request body will have features such as user name, and the response body will have set-cookie header, login success / fail and other features.

[0097] Step 502: Based on the authentication API flow of the second preset authentication method and a preset account extraction library, determine the account information corresponding to the authentication API flow.

[0098] In one embodiment, the account information is extracted from the request header and the request body through a preset account extraction library.

[0099] In one embodiment, by associating with set-cookie, an API account identification table as shown in Table 2 is constructed.

[0100] Identification Account Information 123e4567-e89b-12d3-a456-426614174000 zhangsan 550e8400-e29b-41d4-a716-446655440000 Lisi 3f8c8c68-c2d0-4e6f-bb9e-9f0b9a1c3f47 Wangwu

[0101] Table 2 Account identification table

[0102] In one embodiment, if Figure 6 As shown, based on the authentication method of the application to which the API belongs, determining the account information corresponding to the API includes:

[0103] Step 601, based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying non-authentication API traffic of the second preset authentication method, wherein the non-authentication API traffic carries an identity identifier;

[0104] In one embodiment, the second preset authentication method refers to session-cookie authentication.

[0105] In one embodiment, the session-cookie authenticated API includes authenticated API traffic and non-authenticated API traffic, wherein authenticated API traffic refers to requests that require verification of user identity or session validity, and non-authenticated API traffic refers to requests that can be accessed without user authentication. These APIs are usually public and provide services or information that do not require identity authentication.

[0106] Step 602: Determine the account information corresponding to the non-authentication API traffic based on the identity identifier of the non-authentication API traffic.

[0107] In one embodiment, based on the identity identifier of the non-authentication API traffic, the account information corresponding to the non-authentication API traffic can be determined by querying the account identifier table as shown in Table 2.

[0108] In one embodiment, the account user table may be constructed by importing known data or configuration, as shown in Table 3, which represents the account information of user Zhang San on ERP, CRM, and CSM.

[0109]

[0110] Table 3 Account User Table

[0111] In summary, the solution provided by the present disclosure is:

[0112] First, by obtaining API mirror traffic; parsing the application to which the API belongs from the API mirror traffic; identifying the authentication method of the application to which the API belongs; determining the account information corresponding to the API based on the authentication method of the application to which the API belongs; determining the user associated with the account information based on the account information corresponding to the API and the application to which the API belongs, it is possible to accurately record the identity of users who access the API, thereby improving the accuracy of the identity of users who access the API, and can quickly and accurately trace back to the user associated with the account information when a security incident occurs, thereby improving the security and compliance of API audits.

[0113] Secondly, by constructing the API authentication method table, account identification table and account user table, the efficiency of finding users associated with account information can be further improved.

[0114] The disclosed embodiment also provides an API audit system.

[0115] like Figure 7 As shown, Figure 7 This is a structural diagram of the API audit system provided for the application example of the present disclosure. The API audit system 700 provided in this application includes an API protocol parsing module 701, an API authentication method identification module 702, an authentication API identification module 703 and an account information extraction module 704.

[0116] The following is an application example to further illustrate the API audit method provided by the present disclosure:

[0117] like Figure 8 As shown, Figure 8 A flowchart of an API audit method provided for an example application of the present disclosure. The API audit method provided for an example application of the present disclosure includes the following steps:

[0118] Step 801, obtaining API mirror traffic;

[0119] Step 802, parsing the application to which the API belongs from the API mirror traffic;

[0120] Step 803, obtaining authentication information of the API, wherein the authentication information includes at least Authorization header information and cookie header information;

[0121] Step 804, identifying the authentication method of the application to which the API belongs according to the authentication information of the API;

[0122] Step 805: based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a first preset authentication method, obtaining first information carried by the API, where the first information at least includes account information;

[0123] Step 806, extracting account information from the first information carried by the API;

[0124] Step 807, based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying the authentication API traffic of the second preset authentication method;

[0125] Step 808, based on the authentication API flow of the second preset authentication method and a preset account extraction library, determining the account information corresponding to the authentication API flow;

[0126] Step 809, based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is the second preset authentication method, identifying non-authentication API traffic of the second preset authentication method, wherein the non-authentication API traffic carries an identity identifier;

[0127] Step 810: Determine the account information corresponding to the non-authentication API traffic based on the identity identifier of the non-authentication API traffic.

[0128] In order to implement the API audit method provided by the embodiment of the present disclosure, the embodiment of the present disclosure also provides an API audit device, such as Fig. 9 shown. Fig. 9 The API audit device 900 is a schematic diagram of the structure of the API audit device provided in the embodiment of the present disclosure, and includes:

[0129] An acquisition unit 901 is used to acquire API mirror traffic;

[0130] A parsing unit 902, configured to parse the API mirror traffic to obtain the application to which the API belongs;

[0131] An identification unit 903, used to identify the authentication method of the application to which the API belongs;

[0132] A first determining unit 904 is used to determine the account information corresponding to the API based on the authentication method of the application to which the API belongs;

[0133] The second determining unit 905 is configured to determine a user associated with the account information according to the account information and the application to which the API belongs.

[0134] In one embodiment, the identification unit 903 is specifically configured to:

[0135] Obtaining authentication information of the API, wherein the authentication information includes at least Authorization header information and cookie header information;

[0136] According to the authentication information of the API, an authentication method of the application to which the API belongs is identified.

[0137] In one embodiment, the first determining unit 904 is specifically configured to:

[0138] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a first preset authentication method, obtaining first information carried by the API, where the first information at least includes account information;

[0139] The account information is extracted from the first information carried by the API.

[0140] In one embodiment, the first determining unit 904 is specifically configured to:

[0141] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying the authentication API traffic of the second preset authentication method;

[0142] Based on the authentication API flow of the second preset authentication method and a preset account extraction library, account information corresponding to the authentication API flow is determined.

[0143] In one embodiment, the first determining unit 904 is specifically configured to:

[0144] Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is the second preset authentication method, identifying non-authentication API traffic of the second preset authentication method, the non-authentication API traffic carries an identity identifier;

[0145] Based on the identity identifier of the non-authentication API traffic, account information corresponding to the non-authentication API traffic is determined.

[0146] It should be noted that: when the API audit device provided in the above embodiment performs API audit, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the API audit device is divided into different program modules to complete all or part of the processing described above. In addition, the API audit device provided in the above embodiment and the API audit method embodiment provided in the embodiment of the present disclosure belong to the same concept. The specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0147] Fig.10A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure is shown in FIG. Fig.10 As shown, the electronic device 1000 includes at least one processor 1002; and a memory 1001 that is communicatively connected to the at least one processor 1002; wherein the memory 1001 stores instructions that can be executed by the at least one processor 1002, and the instructions are executed by the at least one processor 1002 to implement the steps of the API audit method of the embodiment of the present disclosure.

[0148] Optionally, the electronic device may specifically be the API audit device of the embodiment of the present application, and the electronic device may implement the corresponding processes implemented by the API audit device in each method of the embodiment of the present application, which will not be described in detail here for the sake of brevity.

[0149] It is understood that the electronic device also includes a communication interface 1003. The various components in the electronic device are coupled together through a bus system 1004. It is understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0150] It can be understood that the memory 1001 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 1001 described in the embodiment of the present invention is intended to include but is not limited to these and any other suitable types of memories.

[0151] The method disclosed in the above embodiment of the present disclosure can be applied to the processor 1002, or implemented by the processor 1002. The processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 1002 or the instruction in the form of software. The above processor 1002 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1002 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 1001. The processor 1002 reads the information in the memory 1001 and completes the steps of the above method in combination with its hardware.

[0152] In an exemplary embodiment, the electronic device may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general purpose processors, controllers, MCUs, microprocessors, or other electronic components to execute the aforementioned method.

[0153] The disclosed embodiment also provides a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to implement the steps of the API audit method of the embodiment of the present invention when executed by a computer.

[0154] Optionally, the computer-readable storage medium can be applied to the API auditing device in the embodiments of the present application, and the computer instructions enable the computer to execute the corresponding processes implemented by the API auditing device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0155] The embodiments of the present disclosure also provide a computer program product, including a computer program, which implements the steps of the API audit method provided by the embodiments of the present invention when executed by a processor.

[0156] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0157] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0158] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0159] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0160] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0161] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An application programming interface API audit method, characterized in that: include: Get API mirror traffic; Parsing the application to which the API belongs from the API mirror traffic; Identify the authentication method of the application to which the API belongs; Determine the account information corresponding to the API based on the authentication method of the application to which the API belongs; According to the account information corresponding to the API and the application to which the API belongs, a user associated with the account information is determined.

2. The method according to claim 1, characterized in that The authentication method for identifying the application to which the API belongs includes: Obtaining authentication information of the API, the authentication information including at least Authorization header information and cookie header information; According to the authentication information of the API, an authentication method of the application to which the API belongs is identified.

3. The method according to claim 1, characterized in that The determining the account information corresponding to the API based on the authentication method of the application to which the API belongs includes: Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a first preset authentication method, obtaining first information carried by the API, where the first information at least includes account information; The account information is extracted from the first information carried by the API.

4. The method according to claim 1, characterized in that The determining the account information corresponding to the API based on the authentication method of the application to which the API belongs includes: Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is a second preset authentication method, identifying the authentication API traffic of the second preset authentication method; Based on the authentication API flow of the second preset authentication method and a preset account extraction library, account information corresponding to the authentication API flow is determined.

5. The method according to claim 1, characterized in that: The determining the account information corresponding to the API based on the authentication method of the application to which the API belongs includes: Based on the authentication method of the application to which the API belongs, if the authentication method of the application to which the API belongs is the second preset authentication method, identifying non-authentication API traffic of the second preset authentication method, the non-authentication API traffic carries an identity identifier; Based on the identity identifier of the non-authentication API traffic, account information corresponding to the non-authentication API traffic is determined.

6. An application programming interface API audit system, characterized in that: The system includes an API protocol parsing module, an API authentication method identification module, an authentication API identification module and an account information extraction module.

7. An application programming interface API auditing device, characterized in that: include: The acquisition unit is used to obtain API mirror traffic; A parsing unit, used to parse the API mirror traffic to find out the application to which the API belongs; An identification unit, used to identify the authentication method of the application to which the API belongs; A first determining unit, configured to determine account information corresponding to the API based on an authentication method of an application to which the API belongs; The second determining unit is used to determine a user associated with the account information according to the account information and the application to which the API belongs.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, wherein the computer program implements the method according to any one of claims 1 to 5 when executed by a processor.

Images