Method and device for verifying interface calling

Abstract

The invention discloses a verification method and device for interface calling, and relates to the technical field of information security. A specific embodiment of the method comprises the following steps: in response to a received interface calling request for a service system, determining a to-be-called target interface according to an interface identifier carried by the interface calling request; when it is judged that the target interface is a first type of interface pre-registered in a gateway, verifying an interface message carried by the interface calling request by using a pre-acquired interface verification rule of the target interface; and under the condition that the verification is passed, routing the interface calling request to the target interface according to a pre-acquired interface address of the target interface so as to execute calling. According to the embodiment, the data security risk in the service system interface calling process can be avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a verification method and device for interface calling. Background Art

[0002] In the current cross-network interaction scenarios, the gateway of the service system generally only performs request forwarding, and the security verification of the request data is handed over to the specific service for execution, or the gateway uses firewalls or network gates and other devices to perform unified security verification regardless of services and interfaces. The former method has a high data security risk due to the uneven data security protection capabilities of various service providers. The unified verification of the latter method cannot take into account both the false recognition rate and the rejection rate, and cannot form customized verification rules for specific services and specific interfaces. Therefore, there is also a certain data security risk. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a method and device for verifying interface calls, which can perform overall data security verification at the interface level at the gateway to avoid data security risks during service system interface calls.

[0004] To achieve the above objective, according to one aspect of the present invention, a method for verifying an interface call is provided.

[0005] The interface call verification method of the embodiment of the present invention is executed by the gateway of a preset service system; the method includes: in response to receiving an interface call request for the service system, determining the target interface to be called according to the interface identifier carried by the interface call request; when it is judged that the target interface is a first-class interface pre-registered in the gateway, using the pre-acquired interface verification rule of the target interface to verify the interface message carried by the interface call request; when the verification passes, routing the interface call request to the target interface according to the pre-acquired interface address of the target interface to execute the call.

[0006] Optionally, the method further includes: before receiving the interface call request, obtaining basic information of at least one first-class interface provided by the service system, and performing local registration of the first-class interface according to the basic information; wherein the basic information of the first-class interface includes: interface identifier, preset interface verification rules and interface address.

[0007] Optionally, the first type of interface is the original interface of the service system, and the service system further provides a second type of interface aggregated from the original interface; any interface belongs to a service; and the method further includes: for any service among the multiple services provided by the service system, judging whether the multiple original interfaces contained in the service meet the preset convergence conditions; if so, aggregating the multiple original interfaces into at least one second type of interface according to the correlation between the original interfaces; converting the original interface used for the aggregation into any second type of interface into the method contained in the second type of interface.

[0008] Optionally, determining that the target interface is a first-class interface includes: when it is detected that the pre-stored basic information of the target interface contains an identifier of the first-class interface, or when it is detected that the interface call request does not contain a method identifier, determining the target interface as a first-class interface.

[0009] Optionally, the method further includes: obtaining basic information of at least one second-class interface provided by the service system, and performing local registration of the second-class interface based on the basic information; wherein the basic information of any second-class interface includes: interface identifier, identifiers of multiple methods contained in the second-class interface, method verification rules and method addresses of the multiple methods.

[0010] Optionally, the method further includes: when it is detected that the pre-stored basic information of the target interface contains an identifier of a second-class interface, or when it is detected that the interface call request contains a method identifier, determining the target interface as a second-class interface; determining the target method from the methods contained in the target interface according to the method identifier in the interface call request, and verifying the interface message carried by the interface call request using the method verification rule of the target method; if the verification passes, routing the interface call request to the target method according to the method address of the target method to execute the call.

[0011] Optionally, local registration of the first type interface or the second type interface is performed according to the basic information, including: determining whether the verification rules of any interface to be registered provided by the service system meet the preset data security requirements; wherein, the interface to be registered is a first type interface or a second type interface; when the interface to be registered is a first type interface, the verification rule is an interface verification rule; when the interface to be registered is a second type interface, the verification rule is a method verification rule; if the requirements are met, the interface to be registered is registered locally and the basic information of the interface to be registered is stored; if the requirements are not met, the registration of the interface to be registered is rejected.

[0012] Optionally, the interface verification rule and the method verification rule are field-level verification rules for the interface message; the convergence condition is: the number of original interfaces included in the service to be judged is greater than a preset number threshold.

[0013] To achieve the above objective, according to another aspect of the present invention, a device for verifying an interface call is provided.

[0014] The interface call verification device of the embodiment of the present invention is set in the gateway of the preset service system; the device may include: a verification unit, which is used to: in response to receiving an interface call request for the service system, determine the target interface to be called according to the interface identifier carried by the interface call request; when it is judged that the target interface is a first-class interface pre-registered in the gateway, use the pre-acquired interface verification rule of the target interface to verify the interface message carried by the interface call request; a calling unit, which is used to: when the verification passes, route the interface call request to the target interface to execute the call according to the pre-acquired interface address of the target interface.

[0015] To achieve the above objective, according to another aspect of the present invention, an electronic device is provided.

[0016] An electronic device of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the interface call verification method provided by the present invention.

[0017] To achieve the above objective, according to yet another aspect of the present invention, a computer-readable storage medium is provided.

[0018] A computer-readable storage medium of the present invention stores a computer program, which, when executed by a processor, implements the interface call verification method provided by the present invention.

[0019] According to the technical solution of the present invention, the embodiments of the above invention have the following advantages or beneficial effects:

[0020] The registration of the first class interface (i.e., the original interface of the service system) is performed in the gateway of the service system to form a field-level verification logic for a specific interface. When the gateway receives an external interface call request, the interface verification rules of the corresponding interface are used to perform customized data security verification and request routing is performed after the verification is passed, thereby reducing or avoiding data security risks in the access process of the service system based on the unified interface-level data security verification mode at the gateway level. Considering that the gateway level may involve a large number of original interfaces, resulting in huge maintenance costs, the embodiment of the present invention performs interface convergence operations on specific services of the service system. For example, when it is determined that the number of original interfaces included in a specific service is large, these original interfaces are aggregated into a small number of second class interfaces according to the correlation between the original interfaces, and the original interfaces used for aggregation are converted into methods under the second class interface. After receiving an external request for the second class interface, the method identifier in the request is used to locate the corresponding method, and the data security verification of the interface message is performed according to the corresponding method verification rules, thereby greatly reducing the number of interfaces in the gateway, and converting the maintenance of a large number of interfaces into the maintenance of method data under the same interface, thereby solving the maintenance problem caused by the large number of interfaces at the gateway level.

[0021] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0023] Figure 1 It is a schematic diagram of the main steps of the verification method of interface call in an embodiment of the present invention;

[0024] Figure 2 It is a schematic diagram of specific execution steps of the verification method for interface call in an embodiment of the present invention;

[0025] Figure 3 is a schematic diagram of the system architecture of the first embodiment of the present invention;

[0026] Figure 4 It is a schematic diagram of the components of the verification device for interface call in an embodiment of the present invention;

[0027] Figure 5 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

[0028] Figure 6 The present invention is a schematic diagram of the structure of an electronic device used to implement the verification method of the interface call in the embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0030] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0031] Figure 1 It is a schematic diagram of the main steps of the verification method of interface call according to an embodiment of the present invention.

[0032] like Figure 1 As shown, the interface call verification method of the embodiment of the present invention can be executed by a preset service system gateway. In actual applications, the service system can provide multiple services to the outside world, each service can include one or more interfaces, and the above gateway is used to perform forwarding and security verification of external service call requests or interface call requests. The above method can be specifically executed according to the following steps:

[0033] Step S101: In response to receiving an interface call request for a service system, determine the target interface to be called according to the interface identifier carried in the interface call request; when it is determined that the target interface is a first-class interface, use the interface verification rules of the target interface to verify the interface message carried in the interface call request.

[0034] In actual application, before executing step S101, the first type interface may be registered in the gateway. Specifically, the gateway obtains basic information of at least one first type interface provided by the service system, and registers the first type interface locally according to the basic information.

[0035] In the embodiment of the present invention, the interface refers to the API (Application Program Interface). The first type of interface refers to the original interface of the service system involved in the gateway. The original interface refers to the interface that exists when the services of the service system are developed. In contrast, the second type of interface refers to the interface formed by repackaging and aggregating multiple original interfaces, which will be explained below. Generally, the basic information of the first type of interface may include: interface identifier, preset interface verification rules and interface address. In one embodiment, the basic information of the gateway involving the interface may also include the identifier of the first type of interface (used to indicate that the interface is a first type of interface) or the identifier of the second type of interface (used to indicate that the interface is a second type of interface).

[0036] It can be understood that the interface verification rules refer to the rules for overall verification of the input parameter data (i.e., interface messages) of the corresponding interface. Preferably, the interface verification rules can be field-level verification rules for interface messages, that is, verification of multiple functions is performed at the field granularity of the interface message. Exemplarily, the above interface verification rules can be Json Schema or Xml Schema consistent with the data type of the interface message, which can implement format verification, length control, enumeration range verification, regular expression verification, digital maximum value, multiple, range verification, field number, required or not, naming verification, parameter combination verification, and conditional judgment verification for each field of the interface message.

[0037] Exemplarily, the basic information of the first type of interface may also include one or more of the following data: service identifier, service name, service address, service provider identifier, and service return parameter format, to implement specific business requirements.

[0038] During the interface registration process, the gateway obtains the basic information of the first-class interface submitted by the service system, and performs local registration of the first-class interface based on this basic information. Before the successfully registered interface provides external services, the gateway can perform pre-set data security verification based on the verification rules in the basic information. In specific applications, after receiving the basic information of a certain interface to be registered as a first-class interface, the gateway can detect whether the interface verification rules therein meet the preset data security requirements, such as detecting whether the interface verification rules allow the presence of preset high-risk special characters in the interface message. If so, the gateway registers the interface to be registered locally and stores the basic information of the interface to be registered (which can be stored in a database or cache); if not, the registration of the interface to be registered is rejected.

[0039] Through the above interface registration steps, the gateway can provide unified customized and field-level data security verification for each interface of the service system, thereby reducing or avoiding data security risks during service system access.

[0040] In step S101, after receiving the interface call request for the service system, the gateway first parses the interface identifier from the interface call request, and locates the target interface to be called by the interface call request from the previously registered interfaces according to the interface identifier. Thereafter, when the gateway determines that the target interface is a first-class interface in the following manner, it obtains the interface verification rule of the target interface from the pre-stored basic information of the target interface, and uses the interface verification rule of the target interface to verify the interface message carried by the interface call request. In one embodiment, the gateway may determine the target interface as a first-class interface when it detects that the pre-stored basic information of the target interface contains the identifier of the first-class interface, or when it detects that the interface call request does not contain the method identifier. The above method identifier is specific data of the second-class interface, and the call request of the first-class interface generally does not contain the method identifier, so the above method can be used to implement the judgment of the first-class interface.

[0041] Step S102: When the verification is passed, the interface call request is routed to the target interface according to the interface address of the target interface to execute the call.

[0042] If the verification based on the interface verification rules fails, the gateway refuses to forward the interface call request to the service system and returns a call failure message to the service caller. If the verification succeeds, the gateway can route the interface call request to the target interface based on the interface address in the target interface basic information previously stored to execute the call.

[0043] In actual applications, the gateway layer may involve a large number of original interfaces, and interface maintenance in specific business scenarios requires updating data of a large number of fields, resulting in huge maintenance costs. The embodiment of the present invention solves this problem by the following.

[0044] Specifically, for any of the multiple services provided by the service system, first determine whether the multiple original interfaces contained in the service meet the preset convergence conditions. Exemplarily, the convergence condition can be: the number of original interfaces contained in the service to be determined is greater than the preset number threshold, that is, when it is determined that a service contains a large number of original interfaces, it is considered that it meets the convergence conditions and the subsequent process can be executed. Thereafter, the multiple original interfaces can be aggregated into at least one second-class interface according to the correlation between the original interfaces. For example, for multiple original interfaces of the same service, multiple original interfaces with correlations greater than the threshold between each other are encapsulated and aggregated into a second-class interface, and the remaining original interfaces in the service are encapsulated and aggregated into another second-class interface. Finally, the original interface used for the aggregation into any second-class interface can be converted into a method included in the second-class interface. In a specific scenario, in order to further reduce the number of interfaces involved in the gateway, the original interfaces in the service that meet the convergence conditions can be aggregated into one or two second-class interfaces.

[0045] For example, a service has five original interfaces, and the interface identifiers are api1, api2, api3, api4, and api5. After it is determined that the convergence conditions are met, these five original interfaces can be aggregated into the second-class interface api11, and these five original interfaces can be used as the five methods method1, method2, method3, method4, and method5 under api11. Through the above operations, the original interfaces involved in the gateway can be converted into methods under the second-class interface, thereby converting complex interface maintenance into method maintenance with simple string operations, thereby solving a large number of maintenance problems caused by gateway-related interfaces.

[0046] The following describes the registration, verification and calling steps of the second-class interface. When registering the interface, the gateway obtains the basic information of at least one second-class interface provided by the service system, and performs local registration of the second-class interface based on the basic information. Among them, the basic information of any second-class interface may include: interface identifier, identifiers of multiple methods contained in the second-class interface, method verification rules and method addresses of multiple methods. Preferably, the above method verification rules may be field-level verification rules for interface messages, such as Json Schema, Xml Schema, etc. Similarly, the basic information of the second-class interface may also include: the identifier of the second-class interface, the identifier of the service to which the interface belongs, the name of the service to which the interface belongs, the address of the service to which the interface belongs, the identifier of the service provider, the format of the service return parameter, etc.

[0047] In actual applications, after receiving the basic information of the interface to be registered as the second-class interface submitted by the service system, the gateway determines whether the method verification rules therein meet the preset data security requirements; if so, the interface to be registered is registered locally and the basic information of the interface to be registered is stored; if not, the registration of the interface to be registered is rejected.

[0048] After receiving the interface call request, the gateway also first parses out the interface identifier to determine the target interface. Thereafter, when the gateway detects that the pre-stored basic information of the target interface contains the identifier of the second-class interface, or when the gateway detects that the interface call request contains a method identifier, it can determine the target interface as a second-class interface. Thereafter, the gateway determines the target method from the methods contained in the target interface according to the method identifier in the interface call request, and verifies the interface message carried by the interface call request using the method verification rules of the target method. If the verification passes, the gateway routes the interface call request to the target method according to the method address of the target method to execute the call; if the verification fails, the gateway refuses to forward the interface call request to the service system, and returns a message of call failure to the service caller.

[0049] Through the above steps, the number of interfaces in the gateway can be greatly reduced, and the maintenance of a large number of interfaces can be converted into the maintenance of method data under the same interface, thereby solving the maintenance problem caused by the large number of interfaces at the gateway level.

[0050] Figure 2 is a schematic diagram of specific execution steps of the verification method for interface call in an embodiment of the present invention, see Figure 2 .

[0051] During the service registration phase, the service provider sends the basic information of the first and second type interfaces to the service system gateway to perform service registration and configuration. After receiving the information submitted by the service provider, the gateway performs an audit based on the preset data security requirements, and registers the interface after the audit passes. If the audit fails, the interface registration is rejected.

[0052] In the service call phase, the service caller first constructs an interface message and an interface call request, and sends the interface call request to the gateway. After receiving the interface call request, the gateway parses the interface identifier from the interface call request, and then determines the target interface from the pre-registered interfaces. After that, the gateway determines whether the target interface is a first-class interface or a second-class interface: if it is a first-class interface, the interface verification rules are obtained from the pre-stored interface basic information to perform the interface message verification; if it is a second-class interface, the method identifier parsed from the interface call request is used to determine the target method from the methods contained in the target interface, and the method verification rules are obtained from the pre-stored interface basic information to perform the message interface verification. Finally, if the verification passes, the gateway forwards the interface call request to the service provider to execute the interface or method call; if the verification fails, the gateway rejects the forwarding of the interface call request and returns a verification failure message to the service provider.

[0053] The first embodiment of the present invention is described below. Figure 3 .

[0054] With the increasing emphasis on information security, the server can divide the network into intranet (i.e. the aforementioned service system), DMZ area (demilitarized zone, isolated area), etc. according to the security level to support the access needs of different users. Among them, intranet applications can only be accessed through the intranet and are completely isolated from the public network (Internet). The DMZ area is used to deploy front-end services and provide services to users who access through the Internet. However, in some scenarios, external users must be allowed to access the data in the intranet in real time. Therefore, how to achieve secure interaction between the DMZ area and the intranet area data has become the focus and difficulty of ensuring information security. In the prior art, the service system gateway generally uses a firewall or a network gate to verify the overall content of the request data, but the verification granularity cannot reach the field level, the accuracy rate is low, and because it is impossible to achieve customized verification of each field, it is impossible to take into account both the false recognition rate and the rejection rate, which ultimately affects data security.

[0055] In response to the above problems, this embodiment provides a field-level verification and filtering solution set in the intranet gateway, which performs customized verification on each field of the interface message to filter out requests that do not meet the verification rules of the called interface, thereby improving the data security of intranet access. In addition, by performing interface convergence and aggregation operations on specific services, the interfaces involved in the gateway are converted into methods under the interface and provided for external calls, thereby reducing the interface maintenance workload at the gateway level.

[0056] The gateway in this embodiment is arranged between the service system (intranet) and the DMZ area, and includes a registration part, an access part, a rule checking part and a calling part.

[0057] The registration part is used to receive the basic information of each interface submitted by the service provider to realize the interface registration in the gateway. In actual application, the registration part allows the registration of the interface only after the verification rules in the basic information of the interface are reviewed and approved. After the registration is completed, the gateway publishes the relevant information of the interface. It can be understood that the above interfaces can include the aforementioned first-class interfaces and second-class interfaces. The basic information and other features of each type of interface have been described in the previous text and will not be repeated here.

[0058] The access part is used as a gateway entrance to receive interface call requests from the DMZ area. The access part can also perform permission control and reject requests that do not have access rights. The rule verification part first determines the target interface of the request call, and then determines whether the target interface is a first-class interface or a second-class interface. If it is a first-class interface, the corresponding interface verification rule is obtained for verification; if it is a second-class interface, the corresponding target method is further determined and verified according to the corresponding method verification rule. After the verification is successful, the calling part is used to call the interface or method. If the verification fails, the calling process ends and a verification failure message is returned. The calling part is used to execute the call on the interface call request that has passed the verification through multi-threading and thread pool.

[0059] It can be seen that the technical solution of the embodiment of the present invention uses a unified interface security control service, the software system is simple to implement and the cost is low, and it can shield the differences in data security capabilities of various service providers to achieve global security control; it can ensure the data security of intranet services through gateway interface configuration without modifying the original service provider system, thereby reducing the workload of system transformation; and solve the operation and maintenance problems caused by a large number of original interfaces deployed in the gateway of complex systems through the original interface convergence solution.

[0060] It should be noted that the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information that may be involved in the technical solution of the present invention are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0061] For the above-mentioned method embodiments, for the convenience of description, they are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the order of the actions described, and some steps can actually be performed in other orders or simultaneously. In addition, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily necessary to implement the present invention.

[0062] In order to better implement the above-mentioned solution of the embodiment of the present invention, relevant devices for implementing the above-mentioned solution are also provided below.

[0063] See also Figure 4 As shown, the interface call verification device 400 provided in the embodiment of the present invention is set in the gateway of the preset service system, and may include: a verification unit 401 and a calling unit 402.

[0064] Among them, the verification unit 401 is used for: in response to receiving an interface call request for the service system, determining the target interface to be called according to the interface identifier carried by the interface call request; when it is judged that the target interface is a first-class interface pre-registered in the gateway, using the pre-acquired interface verification rule of the target interface to verify the interface message carried by the interface call request; the calling unit 402 is used for: when the verification passes, routing the interface call request to the target interface to execute the call according to the pre-acquired interface address of the target interface.

[0065] Preferably, the device 400 may further include a registration unit for obtaining basic information of at least one first-class interface provided by the service system, and performing local registration of the first-class interface according to the basic information; wherein the basic information of the first-class interface includes: interface identifier, preset interface verification rules and interface address.

[0066] In an embodiment of the present invention, the first type of interface is the original interface of the service system, and the service system further provides a second type of interface aggregated from the original interface; any interface belongs to a service; and the device may further include: a convergence unit, used to: for any service among the multiple services provided by the service system, determine whether the multiple original interfaces included in the service meet the preset convergence conditions; if so, aggregate the multiple original interfaces into at least one second type of interface according to the correlation between the original interfaces; convert the original interface used for the aggregation into any second type of interface into a method included in the second type of interface.

[0067] In a specific application, the verification unit 401 can be further used to: determine the target interface as a first-class interface when it is detected that the pre-stored basic information of the target interface contains an identifier of a first-class interface, or when it is detected that the interface call request does not contain a method identifier.

[0068] In actual applications, the registration unit can be further used to: obtain basic information of at least one second-class interface provided by the service system, and perform local registration of the second-class interface based on the basic information; wherein the basic information of any second-class interface includes: interface identifier, identifiers of multiple methods contained in the second-class interface, method verification rules and method addresses of the multiple methods.

[0069] As a preferred scheme, the verification unit 401 can be further used to: when it is detected that the pre-stored basic information of the target interface contains the identifier of the second type of interface, or when it is detected that the interface call request contains a method identifier, determine the target interface as a second type of interface; determine the target method from the methods contained in the target interface according to the method identifier in the interface call request, and use the method verification rule of the target method to verify the interface message carried by the interface call request; the calling unit 402 is further used to: when the verification passes, route the interface call request to the target method according to the method address of the target method to execute the call.

[0070] Preferably, the registration unit can be further used to: determine whether the verification rules of any interface to be registered provided by the service system meet the preset data security requirements; wherein, the interface to be registered is a first-class interface or a second-class interface; when the interface to be registered is a first-class interface, the verification rule is an interface verification rule; when the interface to be registered is a second-class interface, the verification rule is a method verification rule; if satisfied, the interface to be registered is registered locally and the basic information of the interface to be registered is stored; if not satisfied, the registration of the interface to be registered is rejected.

[0071] In addition, in an embodiment of the present invention, the interface verification rule and the method verification rule are field-level verification rules for the interface message; the convergence condition is: the number of original interfaces included in the service to be judged is greater than a preset number threshold.

[0072] According to the technical solution of the embodiment of the present invention, the registration of the first type of interface is performed in the gateway of the service system to form a field-level verification logic for a specific interface. When the gateway receives an external interface call request, the interface verification rules of the corresponding interface are used to perform customized data security verification and request routing is performed after the verification is passed, thereby reducing or avoiding data security risks in the access process of the service system based on the unified interface-level data security verification mode at the gateway level. Considering that the gateway level may involve a large number of original interfaces, resulting in huge maintenance costs, the embodiment of the present invention performs interface convergence operations on specific services of the service system. For example, when it is determined that the number of original interfaces contained in a specific service is large, these original interfaces are aggregated into a small number of second-type interfaces according to the correlation between the original interfaces, and the original interfaces used for aggregation are converted into methods under the second-type interface. After receiving an external request for the second-type interface, the method identifier in the request is used to locate the corresponding method, and the data security verification of the interface message is performed according to the corresponding method verification rules, thereby greatly reducing the number of interfaces in the gateway, and converting the maintenance of a large number of interfaces into the maintenance of method data under the same interface, thereby solving the maintenance problem caused by the large number of interfaces at the gateway level.

[0073] Figure 5 An exemplary system architecture 500 is shown to which the interface call verification method or interface call verification device according to the embodiment of the present invention can be applied.

[0074] like Figure 5 As shown, the system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505 (this architecture is only an example, and the components included in the specific architecture may be adjusted according to the specific circumstances of the invention). The network 504 is used to provide a medium for communication links between the terminal devices 501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0075] The user can use the terminal devices 501, 502, 503 to interact with the server 505 through the network 504 to receive or send messages, etc. Various client applications can be installed on the terminal devices 501, 502, 503, such as a data security verification application (only an example).

[0076] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0077] The server 505 may be a server that provides various services, such as a background server (only for example) that supports data security verification applications operated by users using the terminal devices 501, 502, and 503. The background server may process the received verification request and feed back the processing result (such as whether the verification is passed - only for example) to the terminal devices 501, 502, and 503.

[0078] It should be noted that the interface call verification method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the interface call verification device is generally set in the server 505 .

[0079] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0080] The present invention also provides an electronic device. The electronic device of an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the interface call verification method provided by the present invention.

[0081] Reference below Figure 6, which shows a schematic diagram of the structure of a computer system 600 of an electronic device suitable for implementing an embodiment of the present invention. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0082] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0083] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 606 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0084] In particular, according to the embodiments disclosed in the present invention, the process described in the main step diagram above can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the main step diagram. In the above embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, the above functions defined in the system of the present invention are executed.

[0085] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0086] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0087] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes: a verification unit and a calling unit. The names of these units do not constitute a limitation on the units themselves in some cases, for example, the verification unit may also be described as "a unit that provides an interface call request to the calling unit".

[0088] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the device, the steps executed by the device include: in response to receiving an interface call request for a service system, determining the target interface to be called according to the interface identifier carried by the interface call request; in the case where it is determined that the target interface is a first-class interface pre-registered in the gateway, using the pre-acquired interface verification rule of the target interface to verify the interface message carried by the interface call request; in the case where the verification passes, routing the interface call request to the target interface according to the pre-acquired interface address of the target interface to execute the call.

[0089] The technical solution of the embodiment of the present invention uses a unified interface security control service. The software system is simple to implement and has low cost. It can shield the differences in data security capabilities of various service providers and achieve global security control. It can ensure the data security of intranet services through gateway interface configuration without modifying the original service provider system, thereby reducing the workload of system transformation. It can also solve the operation and maintenance problems caused by a large number of original interfaces deployed in the gateway of complex systems through the original interface convergence solution.

[0090] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A verification method for interface call, characterized in that: The method is executed by a gateway of a preset service system; the method comprises: In response to receiving an interface call request for the service system, determining a target interface to be called according to an interface identifier carried in the interface call request; and in the case where it is determined that the target interface is a first-class interface pre-registered in the gateway, verifying the interface message carried in the interface call request using a pre-acquired interface verification rule of the target interface; If the verification is passed, the interface call request is routed to the target interface according to the pre-acquired interface address of the target interface to execute the call.

2. The method for verifying an interface call according to claim 1, characterized in that: The method further comprises: Before receiving the interface call request, basic information of at least one first-class interface provided by the service system is obtained, and local registration of the first-class interface is performed according to the basic information; wherein the basic information of the first-class interface includes: interface identifier, preset interface verification rules and interface address.

3. The method for verifying an interface call according to claim 2, characterized in that: The first type of interface is the original interface of the service system, and the service system further provides a second type of interface aggregated from the original interface; Any interface belongs to a service; And, the method further comprises: For any service among the multiple services provided by the service system, determining whether multiple original interfaces included in the service meet a preset convergence condition; If satisfied, the multiple original interfaces are aggregated into at least one second-category interface according to the correlation between the original interfaces; Converts the original interface used by any second-class interface to the methods contained in the second-class interface.

4. The method for verifying an interface call according to claim 3, characterized in that: The determining that the target interface is a first-class interface includes: When it is detected that the pre-stored basic information of the target interface contains an identifier of the first type interface, or when it is detected that the interface call request does not contain a method identifier, the target interface is determined to be a first type interface.

5. The method for verifying interface calls according to claim 3, characterized in that: The method further comprises: Obtain basic information of at least one second-class interface provided by the service system, and perform local registration of the second-class interface based on the basic information; wherein the basic information of any second-class interface includes: interface identifier, identifiers of multiple methods contained in the second-class interface, method verification rules and method addresses of the multiple methods.

6. The method for verifying interface calls according to claim 5, characterized in that: The method further comprises: When it is detected that the pre-stored basic information of the target interface contains an identifier of the second type of interface, or when it is detected that the interface call request contains a method identifier, the target interface is determined to be a second type of interface; Determine a target method from the methods included in the target interface according to the method identifier in the interface call request, and verify the interface message carried by the interface call request using the method verification rule of the target method; If the verification is passed, the interface call request is routed to the target method according to the method address of the target method to execute the call.

7. The method for verifying interface calls according to claim 5, characterized in that: Performing local registration of the first type interface or the second type interface according to the basic information includes: Determine whether the verification rule of any interface to be registered provided by the service system meets the preset data security requirements; wherein the interface to be registered is a first-class interface or a second-class interface; when the interface to be registered is a first-class interface, the verification rule is an interface verification rule; when the interface to be registered is a second-class interface, the verification rule is a method verification rule; If the conditions are met, the interface to be registered is registered locally and the basic information of the interface to be registered is stored; if the conditions are not met, the registration of the interface to be registered is rejected.

8. The method for verifying an interface call according to any one of claims 5 to 7, characterized in that: The interface verification rule and the method verification rule are field-level verification rules for the interface message; The convergence condition is: the number of original interfaces included in the service to be determined is greater than a preset number threshold.

9. A verification device for interface call, characterized in that: The device is set at a gateway of a preset service system; the device comprises: A verification unit, configured to: in response to receiving an interface call request for the service system, determine a target interface to be called according to an interface identifier carried in the interface call request; and in the case where it is determined that the target interface is a first-class interface pre-registered in the gateway, verify the interface message carried in the interface call request using a pre-acquired interface verification rule of the target interface; The calling unit is used to: when the verification is passed, route the interface calling request to the target interface according to the pre-acquired interface address of the target interface to execute the calling.

10. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images