API gateway device and API gateway implementation method

Abstract

The invention discloses an API (Application Program Interface) gateway device and an API gateway implementation method. The API gateway device comprises an access layer used for accessing a plurality of heterogeneous original APIs of a plurality of external data sources into the API gateway device and performing security verification on the original APIs; the standardization layer is used for carrying out standardization processing on the original API under the condition that the original API passes the security verification to obtain standard APIs meeting a preset standard, and message formats and encryption and decryption modes of the standard APIs are the same; and the service layer is used for performing user-level management and control on the API in the API gateway device and the standard API and then outputting the API and the standard API to a user side, so that a user calls the corresponding API and uses the corresponding API service. According to the embodiment of the invention, the API gateway is divided into three layers, and each layer performs its own functions and cooperates with each other, so that the API gateway can be converted into a consistent standard API, the docking cost and the operation and maintenance cost of a user side are reduced, abnormal use conditions can be timely and accurately controlled, and three-level security control of heterogeneous APIs is realized.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to an API gateway device and an API gateway implementation method. Background Art

[0002] In the field of data processing, many data products exist in the form of APIs. The message formats of these API services are diverse, the authentication methods are strange, and the access methods are also different. In the process of using API services, users need to do a lot of customized docking work, and the docking cost and maintenance cost are very high. Therefore, there is an urgent need for an independent API gateway product to complete the full life cycle management of various API products and reduce the difficulties and costs of users. Summary of the invention

[0003] The embodiments of the present application provide an API gateway device and an API gateway implementation method, which are used to at least solve the problem in the related art that heterogeneous APIs lead to high connection costs and maintenance costs for users.

[0004] In a first aspect, an embodiment of the present application provides an API gateway device, including:

[0005] The access layer is used to connect multiple heterogeneous original APIs from multiple external data sources to the API gateway device and perform security verification on the original APIs;

[0006] The standardization layer is used to standardize the original API if the original API passes the security verification, so as to obtain a standard API that meets the preset standard, and the message format and encryption and decryption method of each standard API are the same;

[0007] The service layer is used to perform user-level control on the internal API of the API gateway device and the standard API and then output them to the user side so that the user can call the corresponding API and use the corresponding API service;

[0008] Among them, the standardization layer includes: a request address conversion module, which is used to redefine the original URL address of the original API according to the preset standard; a request method conversion module, which is used to convert the original request method of the original API into a preset request method; a message format conversion module, which is used to convert the original message format of the original API into a preset message format; an input parameter position adjustment module, which is used to adjust the original parameter position of the original API according to the preset standard; an input parameter attribute adjustment module, which is used to modify the original input parameter attribute information of the original API according to the preset standard; an input parameter number adjustment module, which is used to add or delete the input parameters of the original API according to the preset standard; an output parameter format standardization module, which is used to standardize the output parameter message format of the original API according to the preset standard; an output parameter field clipping module, which is used to clip the output parameter field of the original API according to the preset standard; a return code standardization module, which is used to map the original return code of the original API to a preset return code.

[0009] In a second aspect, an embodiment of the present application provides an API gateway implementation method, the method being applied to the API gateway device as described in any embodiment of the first aspect, the method comprising:

[0010] Access multiple heterogeneous original APIs of multiple external data sources to the API gateway device through the access layer, and perform security verification on the original APIs;

[0011] When the original API passes the security verification, the original API is standardized through the standardization layer to obtain a standard API that meets the preset standard, and the message format and encryption and decryption method of each standard API are the same;

[0012] The internal API of the API gateway device and the standard API are controlled at the user level through the service layer and then output to the user side so that the user can call the corresponding API and use the corresponding API service.

[0013] The API gateway device and API gateway implementation method of the embodiment of the present application divide the API gateway into three layers, namely, the access layer, the standardization layer, and the service layer. Each layer performs its own functions and cooperates with each other. It accesses a variety of heterogeneous APIs, and after being regularized by the standardization layer, they can be converted into consistent standard APIs, which greatly reduces the docking cost and operation and maintenance cost on the user side. At the same time, user-level management and control are performed at the service layer, which can timely and accurately manage abnormal usage, improve user experience, and greatly protect data security and platform security, thereby realizing three-level security management and control of heterogeneous APIs. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0015] Figure 1 It is a structural diagram of an API gateway device provided in an embodiment of the present application;

[0016] Figure 2 It is a flow chart of an API gateway implementation method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0018] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0019] In the field of data processing, many data products exist in the form of APIs. The message formats of these API services are diverse, the authentication methods are strange, and the access methods are also different. In the process of using API services, users need to do a lot of customized docking work, and the docking cost and maintenance cost are very high. Therefore, there is an urgent need for an independent API gateway product to complete the full life cycle management of various API products and reduce the difficulties and costs of users.

[0020] In order to solve the problems of related technologies, the embodiments of the present application provide an API gateway device and an API gateway implementation method, which can achieve three-level security management and control for heterogeneous APIs.

[0021] The API gateway device provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0022] It should be noted that in the embodiment of the present application, the API gateway device can connect to an external data source and can be used by end users. Therefore, the API gateway device can realize the access of external APIs and expose the APIs inside the system to the outside, that is, realize two-way management and control.

[0023] refer to Figure 1 , is a schematic diagram of the structure of an API gateway device according to an embodiment of the present application. Figure 1 As shown, the API gateway device includes an access layer, a standardization layer, and a service layer that are connected in sequence. Each layer performs its own functions and cooperates with each other to jointly complete the access and management of heterogeneous APIs.

[0024] Among them, the access layer is used to connect multiple heterogeneous original APIs from multiple external data sources to the API gateway device and perform security verification on the original APIs; the standardization layer is used to standardize the original APIs when the original APIs pass the security verification, and obtain standard APIs that meet the preset standards. The message format and encryption and decryption methods of each standard API are the same; the service layer is used to perform user-level control on the internal APIs and standard APIs of the API gateway device and then output them to the user side so that the user can call the corresponding API and use the corresponding API service.

[0025] It can be understood that the external API is provided by multiple external data sources. Since the API specifications of each source are different, external APIs in various formats can be connected to the API gateway device.

[0026] In some embodiments, the access layer includes: an API registration module, a first SSL certificate management module, and a first authentication management module. Specifically, the API registration module is used to complete the registration of external API services; the first SSL certificate management module is used to encapsulate the SSL certificates corresponding to each of the multiple heterogeneous APIs to adjust the corresponding interfaces; the first authentication management module is used to dynamically obtain the authentication method information corresponding to each of the multiple external heterogeneous APIs accessed through the access layer, and supports multiple mainstream authentication methods, such as but not limited to fixed tokens, dynamically obtaining tokens from APIs, multiple tokens, AK / SK and other authentication methods, and encapsulates the authentication method information. This solves the problem that complex authentication methods in related technologies cannot be supported, such as: 2 authentication tokens are not supported, and dynamic authentication tokens are not supported.

[0027] In this way, after completing the authentication and SSL certificate encapsulation through the access layer, the platform does not need to consider these docking information when calling the API, but can directly use the services corresponding to the API, which greatly simplifies the docking work of API users.

[0028] In some embodiments, the standardization layer includes: a request address conversion module, a request method conversion module, a message format conversion module, an input parameter position adjustment module, an input parameter attribute adjustment module, an input parameter number adjustment module, an output parameter format standardization module, an output parameter field clipping module and a return code standardization module.

[0029] Specifically, the request address conversion module is used to redefine the original URL address of the original API according to the preset standard; the request method conversion module is used to convert the original request method of the original API into a preset request method, such as but not limited to GET, POST, PUT, DELETE and other request methods; the message format conversion module is used to convert the original message format of the original API into a preset message format, such as standardizing the API in XML and JSON format into the API in JSON format; the input parameter position adjustment module is used to adjust the original parameter position of the original API according to the preset standard, such as but not limited to adjusting the position of the parameter in the query, header and body, It also supports input parameters in multiple body formats; an input parameter attribute adjustment module, which is used to modify the original input parameter attribute information of the original API according to preset standards, such as but not limited to input parameter name, type, length, precision, description and other information; an input parameter number adjustment module, which is used to add or delete the input parameters of the original API according to preset standards; an output parameter format standardization module, which is used to standardize the output parameter message format of the original API according to preset standards; an output parameter field clipping module, which is used to clip the output parameter fields of the original API according to preset standards, so that the return field only includes necessary fields and the output parameter fields that do not need to be exposed are clipped; a return code standardization module, which is used to map the original return code of the original API to a preset return code.

[0030] Optionally, the input parameter number adjustment module is specifically used to: add or delete fixed value input parameters of the original API according to preset standards, and to trim the input parameters of the original API according to preset standards.

[0031] Optionally, the output parameter format standardization module is specifically used to determine the return information of the original API as return information in a preset format and named in a preset manner according to a preset standard.

[0032] For example, when external access includes 10 input parameters and 100 output parameters, but they are not used in internal system processing, for example, only 1 input parameter and 10 output parameters are needed. Therefore, the input and output parameters are trimmed through the input parameter number adjustment module and the output parameter field trimming module, so that the external complex API can be converted into a relatively simple API with single function inside the system. In this way, the business complexity can be reduced, and the learning cost for the user side can be reduced.

[0033] In this way, the original API information is regulated through the standardization layer to form a unified format, unified return code, unified naming style, and support flexible adjustment of input and output fields, etc. The following problems in related technologies are solved: API cannot be standardized, such as: return codes are not unified, message formats vary greatly; lack of customized tailoring of return information, too many sensitive fields of the original API interface are exposed; request methods cannot be flexibly converted, such as: POST interface cannot be converted to GET interface, etc.

[0034] In addition, in some optional embodiments, the standardization layer is also used to convert an original API into at least one standard API when the original API meets a preset condition. Specifically, it is implemented by an input parameter number adjustment module and an output parameter field clipping module, and the preset condition is that the function of the original API is greater than that of the standard API. In this way, an original API can be cut into 1 to N standardized APIs as needed.

[0035] In addition, in some embodiments, the service layer includes: an export address management module, a second authentication management module, a second SSL certificate management module, an on-shelf and off-shelf management module, a flow control management module and a monitoring module.

[0036] Optionally, the export address management module is used to control the export address, as well as temporarily freeze and unfreeze it; the second authentication management module is used to perform key management and real-time call authentication when providing API services to the outside world.

[0037] Optionally, the on-shelf and off-shelf management module is used to respond to the existence of an abnormality and remove the target interface of the target object corresponding to the abnormality. That is, for each user, the on-shelf and off-shelf management can be independently performed without affecting other users. When there is an emergency or abnormal situation, the specific interface provided to a specific user can be removed separately to achieve emergency management and precise control.

[0038] Optionally, the flow control management module is used to limit the access of the corresponding target object in response to the flow information of the target object meeting the flow control condition. That is, an independent flow control strategy is provided for each user, and when the flow control strategy is triggered, the access is controlled in time.

[0039] Optionally, a monitoring module is used to monitor whether there are any abnormalities in the internal operation information of the API gateway device and the external API call behavior information, and obtain real-time monitoring information to achieve multi-dimensional monitoring.

[0040] Optionally, the first SSL certificate management module is matched with the second SSL certificate management module, and they cooperate with each other to support complex scenarios such as HTTPS to HTTP and HTTP to HTTPS.

[0041] Optionally, the export address management module and the second authentication management module are used to provide each user with a separate access address and independent AK / SK to achieve user-level management and control.

[0042] In this way, standardized API services are provided to the outside world through the service layer, and refined management and control are provided to ensure data security, which solves the problem that export control in related technologies is too rough and cannot perform the smallest granularity control for individual users.

[0043] Therefore, by dividing the API gateway into three layers, namely the access layer, the standardization layer and the service layer, each layer performs its own functions and cooperates with each other; multiple heterogeneous APIs can be accessed and converted into consistent standard APIs after being regularized by the standardization layer, which greatly reduces the docking cost and operation and maintenance cost on the user side; at the same time, user-level management and control are carried out at the service layer, which can timely and accurately control abnormal usage, improve user experience, and greatly protect data security and platform security, thus realizing three-level security management and control of heterogeneous APIs.

[0044] It should be noted that, for the convenience of description, the above device or system is described as various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0045] Furthermore, the present application also provides an API gateway implementation method. It should be noted that the API gateway implementation method can be applied to the API gateway device of any of the above embodiments.

[0046] Figure 2 The following is a flow chart of the API gateway implementation method of the present application embodiment. Figure 2 As shown, the API gateway implementation method may specifically include the following steps:

[0047] S201, accessing multiple heterogeneous original APIs of multiple external data sources to the API gateway device through the access layer, and performing security verification on the original APIs;

[0048] S202, when the original API passes the security verification, the original API is standardized through the standardization layer to obtain a standard API that meets the preset standard, and the message format and encryption and decryption method of each standard API are the same;

[0049] S203, performing user-level control on the internal API of the API gateway device and the standard API through the service layer and outputting them to the user side so that the user can call the corresponding API and use the corresponding API service.

[0050] In some embodiments, in S201, the SSL certificates corresponding to each of the multiple heterogeneous APIs are encapsulated through the first SSL certificate management module to call up the corresponding interfaces; the authentication method information corresponding to each of the multiple external heterogeneous APIs accessed through the access layer is dynamically obtained through the first authentication management module, and the authentication method information is encapsulated.

[0051] In some embodiments, in S202, the original URL address of the original API is redefined according to the preset standard through the request address conversion module; the original request method of the original API is converted into the preset request method through the request method conversion module; the original message format of the original API is converted into the preset message format through the message format conversion module; the original parameter position of the original API is adjusted according to the preset standard through the input parameter position adjustment module; the original input parameter attribute information of the original API is modified according to the preset standard through the input parameter attribute adjustment module; the input parameter of the original API is added or deleted according to the preset standard through the input parameter number adjustment module; the output parameter message format of the original API is standardized according to the preset standard through the output parameter format standardization module; the output parameter field of the original API is trimmed according to the preset standard through the output parameter field trimming module; the original return code of the original API is mapped to the preset return code through the return code standardization module.

[0052] During specific implementation, the fixed value input parameters of the original API are added or deleted according to the preset standard through the input parameter number adjustment module, and the input parameters of the original API are trimmed according to the preset standard.

[0053] During specific implementation, the return information of the original API is determined as return information in a preset format and named in a preset manner according to the preset standard through the output parameter format standardization module.

[0054] In some embodiments, in S203, the on-shelf and off-shelf management module responds to the existence of an abnormality by removing the target interface of the target object corresponding to the abnormality; the flow control management module responds to the flow information of the target object satisfying the flow control conditions and restricts the access to the corresponding target object; the monitoring module monitors whether there are abnormalities in the internal operation information of the API gateway device and the external API call behavior information to obtain real-time monitoring information.

[0055] In some optional embodiments, the service layer includes a second SSL certificate management module, and the first SSL certificate management module matches the second SSL certificate management module.

[0056] As an optional embodiment, the method further includes: when the original API meets a preset condition, converting one of the original APIs into at least two standard APIs through a standardization layer.

[0057] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0058] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0059] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0060] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0061] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0062] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. An API gateway device, characterized in that: include: The access layer is used to connect multiple heterogeneous original APIs from multiple external data sources to the API gateway device and perform security verification on the original APIs; The standardization layer is used to standardize the original API if the original API passes the security verification, so as to obtain a standard API that meets the preset standard, and the message format and encryption and decryption method of each standard API are the same; The service layer is used to perform user-level control on the internal API of the API gateway device and the standard API and then output them to the user side so that the user can call the corresponding API and use the corresponding API service; Among them, the standardization layer includes: a request address conversion module, which is used to redefine the original URL address of the original API according to the preset standard; a request method conversion module, which is used to convert the original request method of the original API into a preset request method; a message format conversion module, which is used to convert the original message format of the original API into a preset message format; an input parameter position adjustment module, which is used to adjust the original parameter position of the original API according to the preset standard; an input parameter attribute adjustment module, which is used to modify the original input parameter attribute information of the original API according to the preset standard; an input parameter number adjustment module, which is used to add or delete the input parameters of the original API according to the preset standard; an output parameter format standardization module, which is used to standardize the output parameter message format of the original API according to the preset standard; an output parameter field clipping module, which is used to clip the output parameter field of the original API according to the preset standard; a return code standardization module, which is used to map the original return code of the original API to a preset return code.

2. The API gateway device according to claim 1, characterized in that: The standardization layer is further used to convert one of the original APIs into at least one standard API when the original API meets a preset condition.

3. The API gateway device according to claim 1, characterized in that: The access layer includes: API registration module; A first SSL certificate management module is used to encapsulate the SSL certificates corresponding to the multiple heterogeneous APIs to call the corresponding interfaces; The first authentication management module is used to dynamically obtain authentication method information corresponding to each of multiple external heterogeneous APIs accessed through the access layer, and encapsulate the authentication method information.

4. The API gateway device according to claim 1, characterized in that: The service layer includes: The export address management module is used to control export addresses, as well as temporarily freeze and unfreeze them; The second authentication management module is used to perform key management and real-time call authentication when providing API services to the outside world; A management module for removing and delisting a target interface of a target object corresponding to the abnormality in response to the abnormality; A flow control management module, used to limit access to a corresponding target object in response to flow information of the target object satisfying a flow control condition; The monitoring module is used to monitor whether there are any abnormalities in the internal operation information of the API gateway device and the external API call behavior information, and obtain real-time monitoring information.

5. The API gateway device according to claim 3, characterized in that: The service layer includes a second SSL certificate management module, and the first SSL certificate management module matches the second SSL certificate management module.

6. The API gateway device according to claim 1, characterized in that: The input parameter number adjustment module is specifically used to add or delete the fixed value input parameters of the original API according to the preset standard, and to trim the input parameters of the original API according to the preset standard.

7. The API gateway device according to claim 1, characterized in that: The output parameter format standardization module is specifically used to determine the return information of the original API as return information in a preset format and named in a preset manner according to the preset standard.

8. A method for implementing an API gateway, characterized in that: The method is applied to an API gateway device according to any one of claims 1 to 7, and the method includes: Access multiple heterogeneous original APIs of multiple external data sources to the API gateway device through the access layer, and perform security verification on the original APIs; When the original API passes the security verification, the original API is standardized through the standardization layer to obtain a standard API that meets the preset standard, and the message format and encryption and decryption method of each standard API are the same; The internal API of the API gateway device and the standard API are controlled at the user level through the service layer and then output to the user side so that the user can call the corresponding API and use the corresponding API service.

9. The method according to claim 8, characterized in that The standardization layer performs standardization on the original API to obtain a standard API that meets a preset standard, including: Redefine the original URL address of the original API according to the preset standard through a request address conversion module; The original request method of the original API is converted into a preset request method by a request method conversion module; The original message format of the original API is converted into a preset message format by a message format conversion module; Adjusting the original parameter position of the original API according to the preset standard through the input parameter position adjustment module; Modifying original input parameter attribute information of the original API according to the preset standard through an input parameter attribute adjustment module; Adding or deleting input parameters of the original API according to the preset standard through the input parameter number adjustment module; The output parameter format of the original API is standardized according to the preset standard by the output parameter format standardization module; The output parameter fields of the original API are clipped according to the preset standard by the output parameter field clipping module; The original return code of the original API is mapped to a preset return code through a return code standardization module.

Images