API (Application Program Interface) access control method and device between applications in mixed environment

Abstract

The invention discloses an API interface access control method and device between applications in a mixed environment, and the method comprises the steps: S1, configuring the access control data of an API interface through an access control background; s2, storing the configured core access control data into a first database cluster, and storing the configured temporary access control data into a second database cluster; and S3, reading the access control data in the first database cluster and the second database cluster into a local memory through the access control foreground, performing authentication on an API access request of a service party, and intercepting or running the API access request according to an authentication result. According to the API interface access control method between the applications in the mixed environment, API interface access control between the applications in the mixed environment (a container environment and a virtual machine environment) is achieved through a simple and efficient algorithm, and the risk caused by the fact that the API interface is abadjusted by an upstream service party is prevented.

Description

Technical Field

[0001] The present invention relates to the field of digital security technology, and specifically provides a method and device for controlling API interface access between applications in a hybrid environment. Background Art

[0002] With the popularity of Kubernetes and microservices architecture, more and more companies are adopting Kubernetes to deploy and manage applications. This has led to increasingly fine-grained applications within Kubernetes clusters, and the number of applications has increased. Managing API calls between these applications is a critical security issue. Unauthorized calls can lead to risks such as data leakage and malicious data tampering. The default API access control in a Kubernetes cluster only provides precise access from the business side to the resource side. After activation, upstream business parties can request all APIs from the resource side. This often fails to meet the resource side's requirements for API access control. Resource parties prefer to only provide a limited number of APIs that meet the needs of each upstream business party, ensuring the principle of least privilege.

[0003] Furthermore, migrating company projects from virtual machine environments to container environments is a lengthy process, and some older projects migrate very slowly or even not at all. Therefore, implementing API access control for business parties in virtual machine environments is a crucial issue; otherwise, supporting API access control solely in container environments would be meaningless.

[0004] In view of this, the present invention patent is proposed. Summary of the Invention

[0005] To address the above technical issues, the present invention proposes a method and device for controlling API interface access between applications in a hybrid environment, which implements API interface access control between applications in a hybrid environment (container environment and virtual machine environment), preventing the risk of API interfaces being abused by upstream business parties. Specifically, the following technical solutions are adopted:

[0006] In a first aspect, the present invention provides a method for controlling API interface access between applications in a hybrid environment, comprising:

[0007] Step S1, configuring access control data of the API interface through the access control background;

[0008] Step S2: storing the configured core access control data in the first database cluster, and storing the configured temporary access control data in the second database cluster;

[0009] Step S3: read the access control data in the first database cluster and the second database cluster into the local memory through the access control front end, authenticate the API interface access request of the business party, and intercept or execute the API interface access request according to the authentication result.

[0010] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, step S1 includes:

[0011] Configure the mapping rules between reqModule, rewriteNamespace, and rewriteApp, where reqModule represents the unique identifier X-XXX-Module of the upstream business party in the virtual machine environment, rewriteNamespace represents the identifier X-XXX-Referer-Namespace of the business line to which the upstream business party identified by reqModule belongs, mapped in the container environment, and rewriteApp represents the identifier X-XXX-Referer-App of the application to which the upstream business party identified by reqModule belongs, mapped in the container environment.

[0012] When the upstream business party has not migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are virtual values. When the upstream business party has migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are real values.

[0013] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, step S1 includes:

[0014] Configure the access control policy between api, namespace, and app. api represents the API handler apiHandle for the access control policy. Namespace represents the identifier of the business line of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-Namespace. App represents the identifier of the application of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-App.

[0015] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, step S2 includes:

[0016] The core access control data includes mapping rule data between reqModule, rewriteNamespace and rewriteApp configured through the access control backend, as well as access control policy data between api and namespace, app. The first database cluster uses a MySQL database cluster;

[0017] The temporary access control data includes access control data for update operations, and the second database cluster adopts a redis database cluster.

[0018] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, the step S3 of reading access control data from the first database cluster and the second database cluster into local memory through the access control front end includes:

[0019] Step S301: Apply for a mutual exclusion lock in the local memory. The mutual exclusion lock ensures that only one process loads access control data at a time.

[0020] Step S302: If the mutex lock application succeeds, then the configuration data of whether to enable access control for each API interface type in the access control data is loaded; if the mutex lock application fails, then proceed to step S306;

[0021] Step S303: If the data loading in step S302 is successful, the mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data is loaded to map the business party in the virtual environment to the business party in the container environment. If the data loading fails, the process proceeds to step S305.

[0022] Step S304: If the data loading in step S303 is successful, the access control policy between the API and the namespace and app is loaded, and the access control policy data of the API interface is configured. After the data loading is completed, the process proceeds to step S306. If the data loading fails, the process proceeds to step S305.

[0023] Step S305, releasing the mutex lock in the local memory;

[0024] Step S306: delay for a preset time interval and enter the next data loading cycle.

[0025] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, the configuration data for determining whether access control is enabled for each API interface type in the access control data loaded in step S302 includes:

[0026] Read the configuration data from the Redis database to determine whether access control is enabled for the "core write interface" API interface. A value of open indicates that access control is enabled, while a value of close indicates that access control is disabled.

[0027] Write data to local memory. The key is apiAuth:switchConf:coreWri te, and the corresponding value is the "core write interface" data read from the Redis database.

[0028] Read the configuration data of whether access control is enabled for the API interface type "read-write interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled.

[0029] Write data into local memory, the key is api, and the corresponding value is the "read-write interface" data read from the redis database;

[0030] Read the configuration data of whether access control is enabled for the API interface type "other interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled.

[0031] Write the data into the local memory. The key is apiAuth:switchConf:other, and the corresponding value is the "other interface" data read from the redis database.

[0032] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, step S303 loads mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data to map the business party in the virtual environment to the business party in the container environment, including:

[0033] Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0.

[0034] Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0;

[0035] The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID.

[0036] If true, the loop ends and the value of the local mapping rule ID is written to the local memory. The key in the local memory is apiAuth:LocalRewriteLastId, and the corresponding value is the maximum value of the mysql mapping rule ID.

[0037] If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

[0038] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, the access control policy between the API, namespace, and app is loaded in step S304, and the access control policy data for configuring the API interface includes:

[0039] Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0.

[0040] Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0;

[0041] Write the maximum value of the read MySQL mapping rule ID into the local memory. The key in the local memory is: apiAuth:LocalRuleDbMaxId;

[0042] The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID.

[0043] If so, the loop ends, and the access control rule data with update operations is read from the redis database, written into the local memory one by one, and the value of the local access control rule ID is written into the local memory;

[0044] If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

[0045] As an optional embodiment of the present invention, in a method for controlling API interface access between applications in a hybrid environment of the present invention, the step S3 of authenticating the API interface access request of the business party and intercepting or executing the API interface access request according to the authentication result includes:

[0046] Receive HTTP protocol requests from upstream business parties and parse them;

[0047] According to the parsing result of the http protocol request, determine whether the API interface handler apiHandle is empty. If it is empty, exit the API interface access request authentication;

[0048] If the answer is yes, the classification of the API interface is determined based on the APIHandle handler of the API interface;

[0049] Record XXX-Referer-Namespace, X-XXX-Referer-App, and X-XXX-Module in the parsed results of the http protocol request into the array referNsApplist;

[0050] Read the value of the MySQL access control rule ID and the value of the local access control rule ID from the local memory;

[0051] Judgment condition: The value of local access control rule ID is less than 1, or the value of local MySQL access control rule ID is less than 1, or the value of local access control rule ID equals the value of local MySQL access control rule ID.

[0052] If the condition is met, the HTTP protocol request will not be intercepted. If the condition is not met, proceed to the next step.

[0053] Traverse the array referNsApplist;

[0054] Read access control rule data from local memory based on the values of XXX-Referer-Namespace, X-XXX-Referer-App, and apiHandle in referNsApplist, authenticate the business party's API access request, and intercept or execute the API access request based on the authentication result;

[0055] After the array referNsApplist is traversed, the API interface type is read from the local memory to determine whether access control is enabled based on the category to which the API interface belongs. The API interface access request from the business party is authenticated, and the API interface access request is intercepted or executed based on the authentication result.

[0056] In a second aspect, the present invention provides an API interface access control device between applications in a hybrid environment, characterized by comprising:

[0057] Access control background configuration module, used to configure access control data of API interface;

[0058] The first database cluster module stores the configured core access control data in the first database cluster module;

[0059] The second database cluster module stores the configured temporary access control data in the second database cluster module;

[0060] Control the front-end module, read the access control data in the first database cluster module and the second database cluster module into the local memory, authenticate the API interface access request of the business party, and intercept or run the API interface access request based on the authentication result.

[0061] Compared with the prior art, the present invention has the following beneficial effects:

[0062] The present invention provides an API interface access control method between applications in a hybrid environment, supports API interface access control in container environments and virtual machine environments, and supports control granularity in application and API interface dimensions. Upstream business parties can access multiple API interfaces of resource parties, and one API interface can also be accessed by multiple upstream business parties. The upstream business parties and API interfaces have a many-to-many relationship. This can better ensure the security and stability of the resource party's API interface and prevent security risks caused by the upstream business parties' abuse of the API interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A main flow chart of a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0064] Figure 2An access control backend interface diagram in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0065] Figure 3 A specific method for storing core access control data in a MySQL database cluster in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention is as follows:

[0066] Figure 4 A second specific method for storing core access control data in a MySQL database cluster in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0067] Figure 5 The process of step S3 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention Figure 1 ;

[0068] Figure 6 A flowchart of step S302 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0069] Figure 7 A flowchart of step S303 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0070] Figure 8 A flowchart of step S304 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention;

[0071] Figure 9 The process of step S3 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention Figure 2 ;

[0072] Figure 10 The process of step S3 in a method for controlling API interface access between applications in a hybrid environment according to an embodiment of the present invention Figure 3 ;

[0073] Figure 11 A schematic structural diagram of an electronic device according to an embodiment of the present invention;

[0074] Figure 12 Schematic diagram of a computer-readable recording medium according to an embodiment of the present invention. DETAILED DESCRIPTION

[0075] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0076] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the claimed invention, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0077] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions therein may be combined with each other.

[0078] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0079] In the description of the present invention, it should be noted that the terms "upper" and "lower" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, or the orientations or positional relationships in which the inventive product is typically placed when in use, or the orientations or positional relationships commonly understood by those skilled in the art. Such terms are intended solely to facilitate the description of the present invention and simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limitations on the present invention. Furthermore, the terms "first" and "second" and the like are used solely for distinction and should not be construed as indicating or implying relative importance.

[0080] See also Figure 1 As shown, this embodiment provides an API interface access control method between applications in a hybrid environment, including:

[0081] Step S1, configuring access control data of the API interface through the access control background;

[0082] Step S2: storing the configured core access control data in the first database cluster, and storing the configured temporary access control data in the second database cluster;

[0083] Step S3: read the access control data in the first database cluster and the second database cluster into the local memory through the access control front end, authenticate the API interface access request of the business party, and intercept or execute the API interface access request according to the authentication result.

[0084] This embodiment provides a method for controlling API interface access between applications in a hybrid environment. It supports API interface access control in both container and virtual machine environments, and supports control granularity at both the application and API interface levels. Upstream business parties can access multiple API interfaces on the resource side, and a single API interface can be accessed by multiple upstream business parties. The relationship between upstream business parties and API interfaces is many-to-many. This ensures the security and stability of resource side API interfaces and prevents security risks caused by upstream business parties abusing API interfaces.

[0085] See also Figure 2 As shown in the figure, the interface diagram of the access control background of this embodiment and the description of each functional module in the interface diagram are as follows:

[0086] 1: API interfaces are divided into three categories: core write interfaces, read / write interfaces, and other interfaces. Clicking the "Stop: Core Write Interface Authorization" button will disable access control for these interfaces. This means that upstream businesses can access these API interfaces at will. This is generally used to handle emergencies and avoid impacting upstream businesses. After clicking the "Stop: Core Write Interface Authorization" button, the button text will change to "Start: Core Write Interface Authorization." Clicking the "Start: Core Write Interface Authorization" button will re-enable access control for these interfaces. The configuration data for whether to enable "Core Write Interface Authorization" is ultimately stored in the Redis cluster.

[0087] 2: API interfaces are divided into three categories: core write interfaces, read / write interfaces, and other interfaces. Clicking the "Stop: Read / Write Interface Authorization" button will disable access control for these interfaces. This means that upstream businesses can access these API interfaces at will. This is generally used to handle emergencies and avoid impacting upstream businesses. After clicking the "Stop: Read / Write Interface Authorization" button, the button text will change to "Start: Read / Write Interface Authorization." Clicking the "Start: Read / Write Interface Authorization" button will re-enable access control for these interfaces. The configuration data for whether to enable "Read / Write Interface Authorization" is ultimately stored in the Redis cluster.

[0088] 3: API interfaces are divided into three categories: core write interfaces, read / write interfaces, and other interfaces. Clicking the "Stop: Other Interface Authorization" button will disable access control for these interfaces. This means that upstream businesses can access these API interfaces at will. This is generally used to handle emergencies and avoid impacting upstream businesses. After clicking the "Stop: Other Interface Authorization" button, the button text will change to "Start: Other Interface Authorization." Clicking the "Start: Other Interface Authorization" button will re-enable access control for these interfaces. The configuration data for whether to enable "Other Interface Authorization" is ultimately stored in the Redis cluster.

[0089] 4: reqModule: The unique identifier of the upstream business party in the virtual machine environment. This is actually the value of X-XXX-Module.

[0090] 5: rewriteNamespace: The value of the X-XXX-Referer-Namespace of the upstream business party identified by reqModule in the container environment. This rewriteNamespace value can be virtual (because the upstream business party has not yet migrated to the container environment) or real (because the upstream business party may be in the process of containerization). It is simply used to map the business party in the virtual machine environment to the business party in the container environment, and to unify the access control policies of the container environment.

[0091] 6: rewriteApp: The value of X-XXX-Referer-App in the container environment for the upstream business party identified by reqModule. This rewriteApp value can be virtual (because the upstream business party has not yet migrated to the container environment) or real (because the upstream business party may be in the process of containerization). This is simply to simulate the virtual machine environment into a container environment and uniformly follow the access control policies of the container environment.

[0092] 7: After clicking the "Add - Module Rewrite NsApp" button, the system will map reqModule to rewriteNamespace and rewriteApp. Based on this mapping, the authorization control frontend module will treat the upstream business party in the virtual machine environment as the upstream business party in the container environment. Steps 4-7 are all about mapping the business party in the virtual machine environment to the business party in the container environment. Subsequent authentication will uniformly follow the container environment's authentication policy, ensuring a single, simple, and stable authentication process. Mapping rules only allow for adding new entries; there is no deletion.

[0093] 8: api refers to the API handle of the API interface to be accessed. This is also the path portion of the URL. For example, if the full URL is http: / / www.xxx.com / getuserinfo, the corresponding api handle is: getuserinfo.

[0094] 9: Namespace refers to the identifier of the business line of the upstream business party in the container environment. This is the X-XXX-Referer-Namespace of the upstream business party.

[0095] 10: app refers to the identifier of the application belonging to the upstream business party in the container environment, that is, X-XXX-Referer-App of the upstream business party.

[0096] 11: remark refers to the remarks when adding access control policies.

[0097] 12: Click the "Query Authorization" button to check whether an access control policy has been configured based on the contents of items 8, 9, and 10. The query results will be displayed on the list page in 14.

[0098] 13: Clicking the "Add Authorization" button will allow the upstream business parties corresponding to 9 and 10 to request the API interface of 8.

[0099] 14: Result display area. Used to show whether the namespace and app can access the API interface, the operation time, the operator, and the operation notes.

[0100] 15: Clicking the "Delete" button will revoke authorization. The upstream business parties corresponding to steps 9 and 10 will not be allowed to request the API endpoint 8. The "Delete" operation is a soft delete; it does not actually delete the data in the database; it simply updates the "Allow" setting to "Not Allowed." Data from the "Delete" operation is also temporarily stored in the secondary database cluster (the Redis database). This allows the "Access Control Front Desk" to detect data updates without having to traverse the entire database, thereby synchronizing only the updated data to local memory, improving data synchronization efficiency.

[0101] Specifically, in a method for controlling API interface access between applications in a hybrid environment in this embodiment, step S1 includes:

[0102] Configure the mapping rules between reqModule, rewriteNamespace, and rewriteApp, where reqModule represents the unique identifier X-XXX-Module of the upstream business party in the virtual machine environment, rewriteNamespace represents the identifier X-XXX-Referer-Namespace of the business line to which the upstream business party identified by reqModule belongs, mapped in the container environment, and rewriteApp represents the identifier X-XXX-Referer-App of the application to which the upstream business party identified by reqModule belongs, mapped in the container environment.

[0103] When the upstream business party has not migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are virtual values. When the upstream business party has migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are real values.

[0104] Specifically, in a method for controlling API interface access between applications in a hybrid environment in this embodiment, step S1 includes:

[0105] Configure the access control policy between api, namespace, and app. api represents the API handler apiHandle for the access control policy. Namespace represents the identifier of the business line of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-Namespace. App represents the identifier of the application of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-App.

[0106] As an optional implementation of this embodiment, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, step S2 includes:

[0107] The core access control data includes mapping rule data between reqModule, rewriteNamespace and rewriteApp configured through the access control backend, as well as access control policy data between api and namespace, app. The first database cluster uses a MySQL database cluster;

[0108] The temporary access control data includes access control data for update operations, and the second database cluster adopts a redis database cluster.

[0109] The specific way that the MySQL database cluster stores core access control data is as follows:

[0110] See also Figure 3 The tblUcloudApiAuthRewrite table shown is primarily used to store the mapping relationship data for items 4, 5, and 6 in the "Access Control Backend." It actually stores configuration data for mapping business parties in the virtual machine environment to business parties in the container environment. The id column in the diagram is the ID of the mapping rule; the id is unique and auto-incrementing. The req_module column in the diagram stores the unique identifier of the business party in the virtual machine environment, which is the value of X-XXX-Module. The refer_ns column in the diagram stores the identifier of the business line to which the business party belongs in the container environment, which is X-XXX-Referer-Namespace. The refer_app column in the diagram stores the identifier of the application to which the business party belongs in the container environment, which is X-XXX-Referer-App. With the mapping rules in place, business parties in the virtual machine environment can be treated as if they were business parties in the container environment, and the access control policies of the container environment can be unified.

[0111] See also Figure 4 The tblUcloudApiAuth table shown in the figure primarily stores access control data for items 8, 9, 10, and 11 in the "Access Control Backend." This refers to whether a particular API interface is accessible to upstream business parties. The id column in the figure is the ID of the access control rule, which is unique and auto-incrementing. The api_handle column in the figure stores the API Handle of the API interface. The refer_ns column in the figure stores the identifier of the business line to which the business party belongs in the container environment, namely, X-XXX-Referer-Namespace. The refer_app column in the figure stores the identifier of the application to which the business party belongs in the container environment, namely, X-XXX-Referer-App. The all low column in the figure stores whether access is allowed, with 1 indicating access allowed and 0 indicating access denied. The update_time column in the figure stores the operation time, accurate to the second. The update_user column in the figure stores the unique ID of the operator. The update_remark column in the figure stores comments about the operation. You can see that an API interface can allow or deny access to multiple upstream business parties. Upstream business parties can also access multiple API interfaces. The API interface and upstream business parties have a many-to-many relationship.

[0112] The specific method of storing temporary access control data in the Redis database cluster is as follows:

[0113] 1. Storing access control data with update operations

[0114] redis key: ucloud:cache:apiAuth:incrementRuleConf;

[0115] Redis key type: hash;

[0116] Redis key members: The value of apiHandle is concatenated with “|”, the value of X-XXX-Referer-Namespace is concatenated with “|”, and the value of X-XXX-Referer-App is concatenated with “|”.

[0117] The value corresponding to the member of the redis key: 1 or 0. 1 means access is allowed, and 0 means access is denied.

[0118] The validity period of a redis key is 600 seconds.

[0119] 2. Store rule data on whether each API interface type is enabled

[0120] 2.1, "Core Write Interface" Type

[0121] redis key: ucloud:cache:apiAuth:switchConf:coreWrite;

[0122] Redis key type: string;

[0123] The value corresponding to the redis key: open means enabling this type of access control rule, and close means disabling this type of access control rule.

[0124] 2.2, "Read and Write Interface" Type

[0125] redis key: ucloud:cache:apiAuth:switchConf:readWrite;

[0126] Redis key type: string;

[0127] The value corresponding to the redis key: open means enabling this type of access control rule, and close means disabling this type of access control rule.

[0128] 2.3, "Core Write Interface" Type

[0129] redis key:ucloud:cache:apiAuth:switchConf:other;

[0130] Redis key type: string;

[0131] The value corresponding to the redis key: open means enabling this type of access control rule, and close means disabling this type of access control rule.

[0132] This embodiment provides an API interface access control method between applications in a hybrid environment, wherein in step S3, data loading and access control are implemented through an access control frontend.

[0133] See also Figure 5 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, step S3 of reading access control data from the first database cluster and the second database cluster into local memory through the access control front end includes:

[0134] Step S301: Apply for a mutual exclusion lock in the local memory. The mutual exclusion lock ensures that only one process loads access control data at a time.

[0135] Step S302: If the mutex lock application succeeds, then the configuration data of whether to enable access control for each API interface type in the access control data is loaded; if the mutex lock application fails, then proceed to step S306;

[0136] Step S303: If the data loading in step S302 is successful, the mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data is loaded to map the business party in the virtual environment to the business party in the container environment. If the data loading fails, the process proceeds to step S305.

[0137] Step S304: If the data loading in step S303 is successful, the access control policy between the API and the namespace and app is loaded, and the access control policy data of the API interface is configured. After the data loading is completed, the process proceeds to step S306. If the data loading fails, the process proceeds to step S305.

[0138] Step S305, releasing the mutex lock in the local memory;

[0139] Step S306: delay for a preset time interval and enter the next data loading cycle.

[0140] In this embodiment, the local memory refers to the memory of the machine that processes various requests from the upstream business party. In a virtual machine environment, it is the memory of the virtual machine; in a container environment, it is the memory of a pod (similar to a virtual machine in a virtual machine environment).

[0141] See also Figure 6 As shown, in the method for controlling API interface access between applications in a hybrid environment of this embodiment, the configuration data for whether to enable access control for each API interface type in the access control data loaded in step S302 includes:

[0142] Read the configuration data from the Redis database to determine whether access control is enabled for the "core write interface" API interface. A value of open indicates that access control is enabled, while a value of close indicates that access control is disabled.

[0143] Write data to local memory. The key is apiAuth:switchConf:coreWri te, and the corresponding value is the "core write interface" data read from the Redis database.

[0144] Read the configuration data of whether access control is enabled for the API interface type "read-write interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled.

[0145] Write data into local memory, the key is api, and the corresponding value is the "read-write interface" data read from the redis database;

[0146] Read the configuration data of whether access control is enabled for the API interface type "other interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled.

[0147] Write the data into the local memory. The key is apiAuth:switchConf:other, and the corresponding value is the "other interface" data read from the redis database.

[0148] See also Figure 7 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, step S303 loads mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data, and maps the business party in the virtual environment to the business party in the container environment, including:

[0149] Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0.

[0150] Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0;

[0151] The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID.

[0152] If true, the loop ends and the value of the local mapping rule ID is written to the local memory. The key in the local memory is apiAuth:LocalRewriteLastId, and the corresponding value is the maximum value of the mysql mapping rule ID.

[0153] If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

[0154] See also Figure 8 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, the access control policy between the API, namespace, and app is loaded in step S304, and the access control policy data for configuring the API interface includes:

[0155] Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0.

[0156] Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0;

[0157] Write the maximum value of the read MySQL mapping rule ID into the local memory. The key in the local memory is: apiAuth:LocalRuleDbMaxId;

[0158] The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID.

[0159] If so, the loop ends, and the access control rule data with update operations is read from the redis database, written into the local memory one by one, and the value of the local access control rule ID is written into the local memory;

[0160] If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

[0161] See also Figure 9 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, the step S3 performs authentication on the API interface access request of the business party, and intercepts or executes the API interface access request according to the authentication result, including:

[0162] HTTP protocol request from the upstream business party;

[0163] Determine whether to allow HTTP protocol request access based on the access control policy;

[0164] If access is allowed, the API will process the HTTP request normally and return the result.

[0165] If it is determined that the access is prohibited, a predefined error code will be returned.

[0166] Specifically, see Figure 10 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, the step S3 performs authentication on the API interface access request of the business party, and intercepts or executes the API interface access request according to the authentication result, including:

[0167] Receive HTTP protocol requests from upstream business parties and parse them;

[0168] According to the parsing result of the http protocol request, determine whether the API interface handler apiHandle is empty. If it is empty, exit the API interface access request authentication;

[0169] If the answer is yes, the classification of the API interface is determined based on the APIHandle handler of the API interface;

[0170] Record XXX-Referer-Namespace, X-XXX-Referer-App, and X-XXX-Module in the parsed results of the http protocol request into the array referNsApplist;

[0171] Read the value of the MySQL access control rule ID and the value of the local access control rule ID from the local memory;

[0172] Judgment condition: The value of local access control rule ID is less than 1, or the value of local MySQL access control rule ID is less than 1, or the value of local access control rule ID equals the value of local MySQL access control rule ID.

[0173] If the condition is met, the HTTP protocol request will not be intercepted. If the condition is not met, proceed to the next step.

[0174] Traverse the array referNsApplist;

[0175] Read access control rule data from local memory based on the values of XXX-Referer-Namespace, X-XXX-Referer-App, and apiHandle in referNsApplist, authenticate the business party's API access request, and intercept or execute the API access request based on the authentication result;

[0176] After the array referNsApplist is traversed, the API interface type is read from the local memory to determine whether access control is enabled based on the category to which the API interface belongs. The API interface access request from the business party is authenticated, and the API interface access request is intercepted or executed based on the authentication result.

[0177] See also Figure 10 As shown, in a method for controlling API interface access between applications in a hybrid environment of this embodiment, recording XXX-Referer-Namespace, X-XXX-Referer-App, and X-XXX-Module in the parsing result of the http protocol request into the array referNsApplist includes:

[0178] Initialize the array, record it as referNsApplist;

[0179] Read the values of XXX-Referer-Namespace and X-XXX-Referer-App in the HTTP protocol request and determine whether the condition is met: the value of XXX-Referer-Namespace is not empty and the value of X-XXX-Referer-App is not empty.

[0180] If the condition is met, the value of XXX-Referer-Namespace and the value of X-XXX-Referer-App are recorded in referNsApplist. If the condition is not met, proceed to the next step.

[0181] Read the value of X-XXX-Module in the http protocol request;

[0182] Based on the value of X-XXX-Module, the corresponding XXX-Referer-Namespace and X-XXX-Referer-App values are searched in the mapping rule in local memory. The judgment condition is: the value of XXX-Referer-Namespace is not empty, and the value of X-XXX-Referer-App is not empty.

[0183] If the condition is met, the value of XXX-Referer-Namespace and the value of X-XXX-Referer-App are recorded in referNsApplist. If the condition is not met, the value of referNsApplist is returned.

[0184] This embodiment uses Redis and MySQL for data storage. Other alternatives may use storage solutions such as Memcache and TiDB.

[0185] This embodiment is developed based on the golang language. Other alternatives may be developed using languages such as java, php, c, c++, and python.

[0186] This embodiment also provides an API interface access control device between applications in a hybrid environment, including:

[0187] Access control background configuration module, used to configure access control data of API interface;

[0188] The first database cluster module stores the configured core access control data in the first database cluster module;

[0189] The second database cluster module stores the configured temporary access control data in the second database cluster module;

[0190] Control the front-end module, read the access control data in the first database cluster module and the second database cluster module into the local memory, authenticate the API interface access request of the business party, and intercept or run the API interface access request based on the authentication result.

[0191] The present embodiment provides an API interface access control device between applications in a hybrid environment, which supports API interface access control in container environments and virtual machine environments, and supports control granularity in application and API interface dimensions. The upstream business party can access multiple API interfaces of the resource party, and one API interface can also be accessed by multiple upstream business parties. The upstream business party and the API interface have a many-to-many relationship. In this way, the security and stability of the resource party's API interface can be better guaranteed, and security risks caused by the upstream business party's abuse of the API interface can be prevented.

[0192] The following describes an electronic device embodiment of the present invention, which can be considered a specific physical implementation of the method and apparatus embodiments of the present invention described above. Details described in the electronic device embodiment of the present invention should be considered supplementary to the above-mentioned method or apparatus embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above-mentioned method or apparatus embodiments.

[0193] Figure 11 This is a structural diagram of an electronic device according to an embodiment of the present invention. The electronic device includes a processor and a memory. The memory is used to store a computer executable program. When the computer program is executed by the processor, the processor executes a method of automatically generating full-body digital human data according to an embodiment.

[0194] like Figure 11 As shown, the electronic device is implemented as a general-purpose computing device. The processor may be one or multiple processors working in concert. The present invention also does not exclude distributed processing, meaning that the processors may be dispersed across different physical devices. The electronic device of the present invention is not limited to a single entity but may also be the sum of multiple physical devices.

[0195] The memory stores a computer executable program, typically a machine-readable code, which can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least some of the steps in the method.

[0196] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0197] Optionally, in this embodiment, the electronic device further includes an I / O interface for exchanging data with an external device. The I / O interface may represent one or more of several types of bus structures, including a storage unit bus or storage unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus structures.

[0198] It should be understood that Figure 11 The electronic device shown is merely an example of the present invention. The electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as screens, and some electronic devices also include human-computer interaction elements such as buttons and keyboards. As long as the electronic device can execute a computer-readable program stored in its memory to implement the method of the present invention or at least some of the steps of the method, it is considered an electronic device covered by the present invention.

[0199] Figure 12 FIG is a schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 12 As shown, a computer-readable recording medium stores a computer-executable program. When executed, the computer-executable program implements a method for automatically generating full-body digital human data according to an embodiment of the present invention. The computer-readable recording medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable recording medium may also be any readable medium other than a readable recording medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0200] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and the like, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0201] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), or it can be distributed and stored on a network, as long as it enables an electronic device to execute the method according to the present invention.

[0202] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although this specification has described the present invention in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A method for controlling API interface access between applications in a hybrid environment, characterized in that: include: Step S1, configuring access control data of the API interface through the access control background; Step S2: storing the configured core access control data in the first database cluster, and storing the configured temporary access control data in the second database cluster; Step S3: read the access control data in the first database cluster and the second database cluster into the local memory through the access control front end, authenticate the API interface access request of the business party, and intercept or execute the API interface access request according to the authentication result.

2. The method for controlling API interface access between applications in a hybrid environment according to claim 1, characterized in that: The step S1 comprises: Configure the mapping rules between reqModule, rewriteNamespace, and rewriteApp, where reqModule represents the unique identifier X-XXX-Module of the upstream business party in the virtual machine environment, rewriteNamespace represents the identifier X-XXX-Referer-Namespace of the business line to which the upstream business party identified by reqModule belongs, mapped in the container environment, and rewriteApp represents the identifier X-XXX-Referer-App of the application to which the upstream business party identified by reqModule belongs, mapped in the container environment. When the upstream business party has not migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are virtual values. When the upstream business party has migrated the project application from the virtual environment to the container environment, the values of rewriteNamespace and rewriteApp are real values.

3. The method for controlling API interface access between applications in a hybrid environment according to claim 2, characterized in that: The step S1 comprises: Configure the access control policy between api, namespace, and app. api represents the API handler apiHandle for the access control policy. Namespace represents the identifier of the business line of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-Namespace. App represents the identifier of the application of the upstream business party in the container environment, that is, the upstream business party's X-XXX-Referer-App.

4. The method for controlling API interface access between applications in a hybrid environment according to claim 3, characterized in that: The step S2 comprises: The core access control data includes mapping rule data between reqModule, rewriteNamespace and rewriteApp configured through the access control backend, as well as access control policy data between api and namespace, app. The first database cluster uses a MySQL database cluster; The temporary access control data includes access control data for update operations, and the second database cluster adopts a redis database cluster.

5. The method for controlling API interface access between applications in a hybrid environment according to claim 4, characterized in that: In step S3, reading the access control data in the first database cluster and the second database cluster into the local memory through the access control front end includes: Step S301: Apply for a mutual exclusion lock in the local memory. The mutual exclusion lock ensures that only one process loads access control data at a time. Step S302: If the mutex lock application succeeds, then the configuration data of whether to enable access control for each API interface type in the access control data is loaded; if the mutex lock application fails, then proceed to step S306; Step S303: If the data loading in step S302 is successful, the mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data is loaded to map the business party in the virtual environment to the business party in the container environment. If the data loading fails, the process proceeds to step S305. Step S304: If the data loading in step S303 is successful, the access control policy between the API and the namespace and app is loaded, and the access control policy data of the API interface is configured. After the data loading is completed, the process proceeds to step S306. If the data loading fails, the process proceeds to step S305. Step S305, releasing the mutex lock in the local memory; Step S306: delay for a preset time interval and enter the next data loading cycle.

6. The method for controlling API interface access between applications in a hybrid environment according to claim 5, characterized in that: The configuration data of whether access control is enabled for each API interface type in the access control data loaded in step S302 includes: Read the configuration data from the Redis database to determine whether access control is enabled for the "core write interface" API. A value of open indicates that access control is enabled, while a value of close indicates that access control is disabled. Write data to local memory. The key is apiAuth:switchConf:coreWri te, and the corresponding value is the "core write interface" data read from the Redis database. Read the configuration data of whether access control is enabled for the API interface type "read-write interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled. Write data into local memory, the key is api, and the corresponding value is the "read-write interface" data read from the redis database; Read the configuration data of whether access control is enabled for the API interface type "other interface" from the redis database. The value of the configuration data is open, indicating that access control is enabled; the value of the configuration data is close, indicating that access control is disabled. Write the data into the local memory. The key is apiAuth:switchConf:other, and the corresponding value is the "other interface" data read from the redis database.

7. The method for controlling API interface access between applications in a hybrid environment according to claim 5, characterized in that: In step S303, the mapping rule data between reqModule, rewriteNamespace, and rewriteApp in the access control data is loaded to map the business party in the virtual environment to the business party in the container environment, including: Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0. Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0; The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID. If true, the loop ends and the value of the local mapping rule ID is written to the local memory. The key in the local memory is apiAuth:LocalRewriteLastId, and the corresponding value is the maximum value of the mysql mapping rule ID. If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

8. The method for controlling API interface access between applications in a hybrid environment according to claim 5, characterized in that: In step S304, the access control policy between the API, namespace, and app is loaded, and the access control policy data for configuring the API interface includes: Read the mapping rule ID in the local memory, recorded as the local mapping rule ID. The key in the local memory is the most recently written local mapping rule ID (apiAuth:LocalRewriteLastId), and its value is a positive integer greater than or equal to 0. Obtain the maximum value of the rule ID in all mapping rule data from the MySQL database, which is recorded as the maximum value of the MySQL mapping rule ID, and its value is a positive integer greater than or equal to 0; Write the maximum value of the read MySQL mapping rule ID into the local memory. The key in the local memory is: apiAuth:LocalRuleDbMaxId; The loop starts to determine whether the local mapping rule ID is greater than or equal to the maximum value of the MySQL mapping rule ID. If so, the loop ends, and the access control rule data with update operations is read from the redis database, written into the local memory one by one, and the value of the local access control rule ID is written into the local memory; If not, read the mapping rule data in the MySQL database. The reading condition is: the rule ID is greater than the local mapping rule ID. Arrange in ascending order according to the rule ID, read N items each time, N is the preset value, and write the mapping rule data read from the MySQL database into the local memory one by one. The key in the local memory is apiAuth:LocalRewriteReqModule:{the value of the reqModule column of the mapping rule data}, and the corresponding value is:{the value of the rewriteNamespace column of the mapping rule data}{the value of the rewriteApp column of the mapping rule data}, and update the value of the local mapping rule ID to the maximum value of the MySQL mapping rule ID.

9. The method for controlling API interface access between applications in a hybrid environment according to any one of claims 5 to 8, characterized in that: In step S3, the API access request from the business party is authenticated, and the API access request is intercepted or executed according to the authentication result, including: Receive HTTP protocol requests from upstream business parties and parse them; According to the parsing result of the http protocol request, determine whether the API interface handler apiHandle is empty. If it is empty, exit the API interface access request authentication; If the answer is yes, the classification of the API interface is determined based on the APIHandle handler of the API interface; Record XXX-Referer-Namespace, X-XXX-Referer-App, and X-XXX-Module in the parsed results of the http protocol request into the array referNsApplist; Read the value of the MySQL access control rule ID and the value of the local access control rule ID from the local memory; Judgment condition: The value of local access control rule ID is less than 1, or the value of local MySQL access control rule ID is less than 1, or the value of local access control rule ID equals the value of local MySQL access control rule ID. If the condition is met, the HTTP protocol request will not be intercepted. If the condition is not met, proceed to the next step. Traverse the array referNsApplist; Read access control rule data from local memory based on the values of XXX-Referer-Namespace, X-XXX-Referer-App, and apiHandle in referNsApplist, authenticate the business party's API access request, and intercept or execute the API access request based on the authentication result; After the array referNsApplist is traversed, the API interface type is read from the local memory to determine whether access control is enabled based on the category to which the API interface belongs. The API interface access request from the business party is authenticated, and the API interface access request is intercepted or executed based on the authentication result.

10. An API interface access control device between applications in a hybrid environment, characterized in that: include: Access control background configuration module, used to configure access control data of API interface; The first database cluster module stores the configured core access control data in the first database cluster module; The second database cluster module stores the configured temporary access control data in the second database cluster module; Control the front-end module, read the access control data in the first database cluster module and the second database cluster module into the local memory, authenticate the API interface access request of the business party, and intercept or run the API interface access request based on the authentication result.

Images