Security arrangement method, device, equipment, medium and product

Abstract

The invention discloses a safety arrangement method and device, equipment, a medium and a product, and the method comprises the steps: obtaining an API (Application Programming Interface) request, and determining a target API to which the API request belongs; analyzing the API request according to a pre-configured screening condition of the target API to obtain an analysis result; and performing security arrangement processing on the analysis result according to a pre-configuration arrangement plug-in corresponding to the target API to obtain target data. And performing security arrangement processing on the API request through a pre-configured screening condition and an arrangement plug-in corresponding to the API interface to obtain target data. According to the invention, efficient processing is realized at a unified gateway entry, secure transmission of API data is guaranteed, the operation and maintenance cost is reduced, and the convenience and suitability of security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security orchestration method, apparatus, device, medium, and product. Background Art

[0002] In today's digital age, businesses rely on a large number of application programming interfaces (APIs) for internal system integration and external data exchange services. As a key channel for data circulation, the security of APIs is of paramount importance.

[0003] Traditionally, API data security operations are often scattered across various business servers, with security processing performed before transmission to the API gateway. The API gateway can also provide powerful basic capabilities such as traffic control and plug-in extensions to securely process API data.

[0004] However, when faced with complex and ever-changing security demand scenarios, the existing processing methods have exposed many shortcomings. On the one hand, the flexible adaptability of the security processing method in the API gateway is high in modification cost and easy to affect the stability of the overall system once the business security policy is adjusted; on the other hand, decentralized processing leads to a sharp increase in operation and maintenance complexity, inconsistent encryption algorithms between different modules and confusing signature verification rules, and additional data transfer, repeated verification and other operations bring performance loss, making it difficult to meet the demands of efficient and secure modern API interaction. Summary of the Invention

[0005] The present invention provides a security orchestration method, apparatus, device, medium and product to achieve unified security orchestration of API data through a gateway, thereby improving the adaptability of security protection.

[0006] According to a first aspect of the present invention, a security orchestration method is provided, which is applied to a gateway and includes:

[0007] Obtaining an application programming interface (API) request and determining a target API to which the API request belongs;

[0008] Parsing the API request according to the pre-configured filtering conditions of the target API to obtain a parsing result;

[0009] The parsing result is securely orchestrated according to a pre-configured orchestration plug-in corresponding to the target API to obtain target data.

[0010] According to a second aspect of the present invention, there is provided a security orchestration device, comprising:

[0011] A request acquisition module, configured to acquire an application programming interface (API) request and determine a target API to which the API request belongs;

[0012] A result determination module, configured to parse the API request according to the pre-configured screening conditions of the target API to obtain a parsing result;

[0013] The data orchestration module is used to perform security orchestration processing on the parsing result according to the pre-configured orchestration plug-in corresponding to the target API to obtain the target data.

[0014] According to a third aspect of the present invention, there is provided an electronic device, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the security orchestration method described in any embodiment of the present invention.

[0018] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security orchestration method described in any embodiment of the present invention when executed.

[0019] According to a fifth aspect of the present invention, an embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the security orchestration method of any embodiment of the present invention.

[0020] The technical solution of the embodiment of the present invention obtains an application programming interface (API) request and determines the target API to which the API request belongs; parses the API request according to the preconfigured screening conditions of the target API to obtain a parsing result; and performs security orchestration processing on the parsing result according to the preconfigured orchestration plug-in corresponding to the target API to obtain the target data. The API request is securely orchestrated using the preconfigured screening conditions and orchestration plug-in corresponding to the API interface to obtain the target data. This achieves efficient processing at a unified gateway entrance, ensures secure transmission of API data, reduces operation and maintenance costs, and improves the convenience and adaptability of security protection.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 This is a flowchart of a security orchestration method provided according to the first embodiment of the present invention;

[0024] Figure 2 This is an example diagram of an interface in a security orchestration method provided according to the first embodiment of the present invention;

[0025] Figure 3 This is a structural diagram of a security orchestration device provided according to Embodiment 2 of the present invention;

[0026] Figure 4 It is a schematic structural diagram of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Example 1

[0030] Figure 1 A flowchart of a security orchestration method is provided for the first embodiment of the present invention. This embodiment is applicable to security orchestration of different API requests. The method can be executed by a security orchestration device. The security orchestration device can be implemented in the form of hardware and / or software. The security orchestration device can be configured in an electronic device. Figure 1 As shown, the method is applied to a gateway, comprising:

[0031] S110 : Obtain an application programming interface (API) request and determine a target API to which the API request belongs.

[0032] In this embodiment, the API request can be understood as a request sent to the gateway through the API interface to obtain data or perform a specific operation through the request. The target API can be understood as the API that sends the API request.

[0033] Specifically, the processor of the gateway (hereinafter referred to as the processor) can obtain the API request initiated by the external client. The processor can first determine the target API to transmit the API request.

[0034] S120: Parse the API request according to the pre-configured screening conditions of the target API to obtain a parsing result.

[0035] In this embodiment, the preconfigured filtering conditions can be understood as the conditions used to determine the characteristics of the filtering encoding. Since the business characteristics, requirements and data sensitivity corresponding to different fields or different businesses are different, the preconfigured filtering conditions can be used to pre-set the content that needs to be securely orchestrated for the target API.

[0036] Specifically, the processor can first determine the preconfigured filtering conditions corresponding to the target API. For example, the API can be bound to the preconfigured filtering conditions through binding or other means to trigger rapid parsing of the API request based on the preconfigured filtering conditions and obtain the parsing results. If security orchestration may not be required for certain data, the preconfigured filtering conditions can be omitted, indicating that security orchestration is not required.

[0037] S130: Perform security orchestration processing on the parsing result according to the pre-configured orchestration plug-in corresponding to the target API to obtain target data.

[0038] In this embodiment, the pre-configured orchestration plug-in can be understood as a pre-configured tool or component for automatically performing security orchestration on the target API, and the target data can be understood as the data result after orchestration.

[0039] Specifically, the processor can perform secure orchestration processing on the parsing results based on the pre-configured orchestration plug-in bound to the target API. For example, the pre-configured orchestration plug-in includes encryption, encoding, and signing steps. The parsing results are processed in sequence through the configuration parameters and corresponding algorithms in the pre-configured orchestration plug-in to obtain the securely orchestrated target data.

[0040] The technical solution of the embodiment of the present invention obtains an application programming interface (API) request and determines the target API to which the API request belongs; parses the API request according to the preconfigured screening conditions of the target API to obtain a parsing result; and performs secure orchestration processing on the parsing result according to the preconfigured orchestration plug-in corresponding to the target API to obtain the target data. By using the preconfigured screening conditions and orchestration plug-in corresponding to the API interface, the API request is securely orchestrated to obtain the target data. This achieves efficient processing at a unified gateway entrance, ensures the secure transmission of API data, reduces operation and maintenance costs, and improves the convenience and adaptability of security protection.

[0041] Furthermore, based on the above embodiment, the steps of parsing the API request according to the pre-configured screening conditions of the target API and obtaining the parsing result can be refined as follows:

[0042] Analyze the request header structure in the API request according to the pre-configured filtering conditions and scan the request body data characteristics to determine the fields to be marshaled; the fields to be marshaled are used as the parsing results.

[0043] In this embodiment, the request header structure can be understood as the portion used to convey additional information about the request, including information related to the external client. The request body data features can be understood as the characteristics and attributes of the data in the request body. The fields to be orchestrated can be understood as the fields that undergo security orchestration processing.

[0044] Specifically, the processor can analyze the request header structure in the API request according to the preconfigured filtering conditions and scan the request body data characteristics to determine the fields to be arranged. For example, the fields to be arranged can be the request method, request address, request header and request parameters, etc. The processor can use the fields to be arranged as the parsing results.

[0045] Furthermore, based on the above embodiment, the parsing results can be securely orchestrated using a pre-configured orchestration plug-in corresponding to the target API to obtain target data in the following steps:

[0046] The parsing results are securely orchestrated according to the algorithm in the pre-configured orchestration plug-in corresponding to the target API to obtain an intermediate result; the intermediate result is replaced in the API request based on the location information in the pre-configured orchestration plug-in to obtain the target data.

[0047] In this embodiment, the algorithm can be understood as an algorithm for performing security orchestration processing, for example, it can include a signature algorithm, a coding algorithm, an encryption algorithm, etc. The position information can be understood as the position where the processed target data is replaced.

[0048] Specifically, the processor can perform secure orchestration processing on the parsing result according to the algorithm in the preconfigured orchestration plug-in bound to the target API to obtain an intermediate result; and replace the intermediate result in the API request based on the location information in the preconfigured orchestration plug-in to obtain the target data.

[0049] Among them, based on the above embodiment, the parsing results can be securely orchestrated according to the algorithm in the pre-configured orchestration plug-in corresponding to the target API, and the steps of obtaining the intermediate results can be refined as follows:

[0050] The parsing result is signed based on the signature algorithm set in the preconfigured orchestration plug-in to obtain the signed result and temporarily store it in the preset cache area; the signed result is encoded based on the encoding algorithm set in the preconfigured orchestration plug-in to obtain the encoded result and temporarily store it in the preset cache area; the encoded result is encrypted based on the encryption algorithm set in the preconfigured orchestration plug-in to obtain the intermediate result.

[0051] In this embodiment, the signature algorithm set can be understood as a set of pre-configured signing algorithms, which can be a combination of one or more. The signing result can be understood as the result after signing. The preset cache area can be understood as a dedicated cache area pre-set in memory for temporarily storing temporary results during the processing process, such as intermediate signature calculation values, temporary encoding conversion results, and encrypted ciphertext fragments. The encoding algorithm set can be understood as a set of pre-configured encoding algorithms, which can be a combination of one or more. The encoding result can be understood as the result after encoding. The encryption algorithm set can be understood as a set of pre-configured encryption algorithms.

[0052] Specifically, the processor can sign the parsing result based on the signature algorithm set in the preconfigured orchestration plug-in, obtain the signed result and temporarily store it in a preset cache area, encode the signed result based on the encoding algorithm set in the preconfigured orchestration plug-in, obtain the encoded result and temporarily store it in the preset cache area, and encrypt the encoded result based on the encryption algorithm set in the preconfigured orchestration plug-in to obtain an intermediate result. The order of signing, encoding, and encryption can be set or reduced as needed, for example, including only signing, signing and encoding, encoding and encryption, etc. The order and operations can be set as needed.

[0053] Exemplarily, the preconfigured orchestration plug-in includes signing, encoding and encryption steps. First, the signing step is entered. The processor can extract the content of the specified request header field based on the preconfigured orchestration plug-in, calculate the signature value according to the preconfigured signature algorithm (for example, it can be the HMAC-SHA256 signing algorithm, combined with the configuration key "sign_secret_key_1") and store it in a dedicated cache area, then encode it according to the selected encoding algorithm (assuming base64 is selected), and finally encrypt it according to the selected encryption algorithm (assuming the RSA encryption algorithm is used, combined with the configuration key "encrypt_secret_key_1"). The intermediate result obtained after encryption is replaced with the specified position of the API request according to the location information, such as placing it in a field in the message header or message body, and forwarding it to the back-end business service through the gateway processor to verify the legitimacy of the data.

[0054] Beneficial effects of

[0055] As a first optional embodiment of the first embodiment, based on the above embodiment, the configuration process of the pre-configured orchestration plug-in includes:

[0056] In response to a security orchestration request for a registration API, at least three component function modules are displayed through a visual configuration interactive interface, where the component function modules include a signature component function module, an encoding component function module, and an encryption component function module; orchestration information, location information, and parameter configuration information of each component function module fed back by the visual configuration interactive interface are received; based on the orchestration information, a processing order of each component function module is determined; based on the parameter configuration information, a request data range and algorithm parameter information of the component function module is determined; and a pre-configured orchestration plug-in for the registration API is generated based on the processing order, location information, each request data range, and each detailed algorithm parameter.

[0057] In this embodiment, the registration API can be understood as the API registered to the gateway. The security orchestration request can be understood as a request for establishing a pre-configured orchestration plug-in. The visual configuration interactive interface can be understood as an interface that displays the configuration content in a visual form. The component function module can be understood as providing orchestration functions in the form of components. The orchestration information can be understood as the orchestration operations included and the order of operations, for example, the orchestration information includes first encrypting and then signing; or first encoding and then encrypting; or first signing and then encoding and finally encrypting, etc. Parameter configuration information can be understood as configuration content related to algorithm processing. The request data range can be understood as the processing range in the request, for example, it can be a specific request header field and a request parameter field. Algorithm parameter information can be understood as information related to the budget method parameters, for example, it can include keys, initial vectors and encoding format specifications, etc. The processing order can be understood as the application order of the component function modules.

[0058] Specifically, the processor can respond to secure orchestration requests from an external client's registration API by displaying at least three component modules through a visual configuration interface. These modules include a signature component, an encoding component, and an encryption component. Each module corresponds to a rich library of algorithms and parameter configuration items. For example, the signature component covers the HMAC-SHA series (such as HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512) and RSA signature algorithms. The encoding component includes common types such as Base64 and Hex encoding. The encryption component supports mainstream encryption algorithms such as AES (in different modes such as AES-CBC and AES-GCM) and RSA public key encryption. External client users can select the required functions and enter parameters according to their needs. The processor receives orchestration information, location information, and parameter configuration information for each component module from the visual configuration interface. The processor can determine the processing order of each component functional module based on the orchestration information; determine the request data range and algorithm parameter information of the component functional module based on the parameter configuration information; generate a pre-configured orchestration plug-in for the registration API based on the processing order, location information, each request data range and each detailed algorithm parameter, and establish a binding relationship between the registration API and the pre-configured orchestration plug-in so that the pre-configured orchestration plug-in corresponding to the registration API can be directly called in the future and the API can be published.

[0059] Furthermore, based on the above embodiment, the request data range and algorithm parameter information of the component function module are determined according to the parameter configuration information, including:

[0060] In response to the parameter configuration information belonging to the signature component functional module, the request data range and algorithm parameter information of the signature component functional module are determined, the algorithm parameter information includes at least one signature algorithm, signature key and signature algorithm processing order, and the request data range includes at least one of the request method, request address, request header and request parameter; in response to the parameter configuration information belonging to the encoding component functional module, at least one encoding conversion algorithm and encoding algorithm processing order of the encoding component module are determined as the algorithm parameter information; in response to the parameter configuration information belonging to the encryption component functional module, the key and encryption algorithm processing order corresponding to at least one encryption algorithm of the encryption component module are determined as the algorithm parameter information.

[0061] In this embodiment, the signature algorithm processing order can be understood as the execution order of different algorithms when there are multiple preceding algorithms. The encoding algorithm processing order can be understood as the execution order of different algorithms when there are multiple encoding algorithms. The encryption algorithm processing order can be understood as the execution order of different algorithms when there are multiple encryption algorithms. The key can be understood as the character sequence used to encrypt and decrypt data. Different keys can be used for different encryption algorithms or signature algorithms.

[0062] Specifically, in response to the parameter configuration information belonging to the signature component functional module, the request data range and algorithm parameter information of the signature component functional module are determined. Since one or more algorithms can be selected for signing according to requirements, the algorithm parameter information includes at least one signature algorithm, a signature key, and a signature algorithm processing order. The request data range includes at least one of the request method, request address, request header, and request parameters. In response to the parameter configuration information belonging to the encoding component functional module, at least one encoding conversion algorithm and the encoding algorithm processing order of the encoding component module are determined as the algorithm parameter information. In response to the parameter configuration information belonging to the encryption component functional module, the key corresponding to at least one encryption algorithm of the encryption component module and the encryption algorithm processing order are determined as the algorithm parameter information.

[0063] The first optional embodiment of this embodiment one freely configures the orchestration signature, encoding, and encryption processes of different registration APIs through a visual configuration interactive interface, allowing users to flexibly customize the combined security orchestration operation sequence and detailed parameter configuration according to different needs of business characteristics, compliance requirements, and data sensitivity, and automatically generate pre-configured orchestration plug-ins belonging to different APIs, fully leveraging the advantages of the gateway architecture and the plug-in expansion characteristics, thereby improving the accuracy of system security protection.

[0064] For example, in order to facilitate understanding of the configuration process, a visual configuration interaction interface is used as an example. Figure 2 This is an example diagram of an interface in a security orchestration method provided in the first embodiment of the present invention. Figure 2As shown, the signature processing section includes four signature fields: request method, request address, request header, and request parameters. You can select a signature field and enter specific field content as needed. Different signature algorithms can be selected based on your needs. Two signature algorithms are shown in the figure, and you can also select one or more to combine. Each signature algorithm can have the same or different keys to enrich the encryption method and improve the encryption effect. The encoding conversion algorithm can also be combined with multiple different encoding algorithms. For example, as shown in the figure, you can select Base64 and Hex algorithms for encoding conversion in sequence. You can select all the provided encoding algorithms using the drop-down menu in the lower right corner. You can select any combination to improve the encoding effect and meet your personalized requirements. The encryption component module provides multiple encryption algorithms. By adding encryption algorithms and corresponding keys, you can meet the different encryption requirements of different API interfaces. In the figure, the encryption algorithms can be RSA2Encrypt, AES128, and AES192. Each of them has a corresponding key, and different keys can be set to encrypt with different encryption algorithms. After selecting and filling in all the required information, the user can click the Generate button. The processor will automatically generate the execution code corresponding to the API and the configuration orchestration plug-in based on the selected algorithm and corresponding parameter configuration information. The generated code can be displayed in a visual format. After the code is generated, the location where the processed data will be filled in can be entered in the location processing. The message header and message body can be selected. The field names corresponding to the locations to be filled in the message body and message header can be entered. By clicking the OK control, the final pre-configured orchestration plug-in is generated, bound to the registered API, and the API is published.

[0065] Example 2

[0066] Figure 3 This is a structural diagram of a security orchestration device provided by the second embodiment of the present invention. Figure 3 As shown, the device includes:

[0067] A request acquisition module 31 is configured to acquire an application programming interface (API) request and determine a target API to which the API request belongs;

[0068] A result determination module 32 is used to parse the API request according to the pre-configured screening conditions of the target API to obtain a parsing result;

[0069] The data orchestration module 33 is configured to perform security orchestration processing on the parsing result according to the pre-configured orchestration plug-in corresponding to the target API to obtain target data.

[0070] Furthermore, the result determination module 32 is specifically configured to:

[0071] Analyze the request header structure in the API request according to pre-configured screening conditions and scan the request body data features to determine the fields to be arranged;

[0072] The field to be formatted is used as the parsing result.

[0073] Furthermore, the data arrangement module 33 includes:

[0074] A first determining unit is configured to perform security orchestration processing on the parsing result according to an algorithm in a pre-configured orchestration plug-in corresponding to the target API to obtain an intermediate result;

[0075] The second determining unit is configured to replace the intermediate result in the API request based on the location information in the preconfigured orchestration plug-in to obtain target data.

[0076] The technical solution of the embodiment of the present invention obtains an application programming interface (API) request and determines the target API to which the API request belongs; parses the API request according to the preconfigured screening conditions of the target API to obtain a parsing result; and performs security orchestration processing on the parsing result according to the preconfigured orchestration plug-in corresponding to the target API to obtain the target data. The API request is securely orchestrated using the preconfigured screening conditions and orchestration plug-in corresponding to the API interface to obtain the target data. This achieves efficient processing at a unified gateway entrance, ensures secure transmission of API data, reduces operation and maintenance costs, and improves the convenience and adaptability of security protection.

[0077] The first determining unit is specifically configured to:

[0078] Sign the parsing result based on the signature algorithm set in the pre-configured orchestration plug-in, obtain the signed result and temporarily store it in a preset cache area;

[0079] Encoding the signature result based on the encoding algorithm set in the preconfigured orchestration plug-in, obtaining an encoding result and temporarily storing it in the preset cache area;

[0080] The encoding result is encrypted based on the encryption algorithm set in the preconfigured orchestration plug-in to obtain an intermediate result.

[0081] Optionally, the device further includes: a plug-in configuration module.

[0082] The plug-in configuration module includes:

[0083] An interface display unit, configured to respond to a security orchestration request of a registration API and display at least three component function modules through a visual configuration interactive interface, wherein the component function modules include a signature component function module, an encoding component function module, and an encryption component function module;

[0084] An information receiving unit, configured to receive the arrangement information, location information and parameter configuration information of each component functional module fed back by the visual configuration interaction interface;

[0085] a third determining unit, configured to determine a processing order of each of the component functional modules according to the arrangement information;

[0086] a fourth determining unit, configured to determine a request data range and algorithm parameter information of the component function module according to the parameter configuration information;

[0087] A fifth determining unit is configured to generate the preconfigured orchestration plug-in for the registration API according to the processing order, the location information, the request data ranges, and the detailed algorithm parameters.

[0088] The fourth determining unit is specifically configured to:

[0089] In response to the parameter configuration information belonging to the signature component functional module, determining a request data range and algorithm parameter information of the signature component functional module, the algorithm parameter information including at least one signature algorithm, a signature key, and a signature algorithm processing order, and the request data range including at least one of a request method, a request address, a request header, and a request parameter;

[0090] In response to the parameter configuration information belonging to the coding component functional module, determining at least one coding conversion algorithm and a coding algorithm processing order of the coding component module as the algorithm parameter information;

[0091] In response to the parameter configuration information belonging to the encryption component functional module, a key and an encryption algorithm processing order corresponding to at least one encryption algorithm of the encryption component module are determined as the algorithm parameter information.

[0092] The security orchestration device provided in the embodiment of the present invention can execute the security orchestration method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0093] Example 3

[0094] Figure 4A schematic diagram of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0095] like Figure 4 As shown, electronic device 40 includes at least one processor 41 and memory, such as read-only memory (ROM) 42 and random access memory (RAM) 43, communicatively connected to at least one processor 41. The memory stores computer programs executable by the at least one processor. Processor 41 can perform various appropriate actions and processes based on the computer programs stored in ROM 42 or loaded from storage unit 48 into RAM 43. RAM 43 can also store various programs and data required for the operation of electronic device 40. Processor 41, ROM 42, and RAM 43 are interconnected via bus 44. An input / output (I / O) interface 45 is also connected to bus 44.

[0096] Multiple components in the electronic device 40 are connected to the I / O interface 45, including an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a magnetic disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0097] Processor 41 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processor, controller, microcontroller, etc. Processor 41 executes the various methods and processes described above, such as the security orchestration method.

[0098] In some embodiments, the security orchestration method can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the security orchestration method described above can be performed. Alternatively, in other embodiments, processor 41 can be configured to perform the security orchestration method in any other suitable manner (e.g., via firmware).

[0099] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0101] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0103] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0104] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0105] In one embodiment, the present invention further includes a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the security orchestration method of any embodiment of the present invention.

[0106] During implementation, the computer program product may be written in one or more programming languages ​​or a combination thereof to perform the operations of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0107] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0108] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A security orchestration method, characterized in that: Applied to gateways, including: Obtaining an application programming interface (API) request and determining a target API to which the API request belongs; Parsing the API request according to the pre-configured filtering conditions of the target API to obtain a parsing result; Performing security orchestration processing on the parsing result according to the pre-configured orchestration plug-in corresponding to the target API to obtain target data; The configuration process of the pre-configured orchestration plug-in includes: In response to a security orchestration request from a registration API, at least three component function modules are displayed through a visual configuration interactive interface, wherein the component function modules include a signature component function module, an encoding component function module, and an encryption component function module; Receive the arrangement information, location information and parameter configuration information of each component functional module fed back by the visual configuration interaction interface; Determining the processing order of each component functional module according to the arrangement information; Determining the requested data range and algorithm parameter information of the component function module according to the parameter configuration information; The pre-configured orchestration plug-in of the registration API is generated according to the processing order, location information, each request data range and each algorithm parameter information.

2. The method according to claim 1, characterized in that Determining the requested data range and algorithm parameter information of the component function module according to the parameter configuration information includes: In response to the parameter configuration information belonging to the signature component functional module, determining a request data range and algorithm parameter information of the signature component functional module, the algorithm parameter information including at least one signature algorithm, a signature key, and a signature algorithm processing order, and the request data range including at least one of a request method, a request address, a request header, and a request parameter; In response to the parameter configuration information belonging to the encoding component functional module, determining at least one encoding conversion algorithm and an encoding algorithm processing order of the encoding component functional module as the algorithm parameter information; In response to the parameter configuration information belonging to the encryption component functional module, a key and an encryption algorithm processing order corresponding to at least one encryption algorithm of the encryption component functional module are determined as the algorithm parameter information.

3. The method according to claim 1, characterized in that The step of parsing the API request according to the preconfigured screening conditions of the target API to obtain a parsing result includes: Analyze the request header structure in the API request according to pre-configured screening conditions and scan the request body data features to determine the fields to be arranged; The field to be formatted is used as the parsing result.

4. The method according to claim 1, wherein The performing security orchestration processing on the parsing result according to the pre-configured orchestration plug-in corresponding to the target API to obtain target data includes: Performing security orchestration processing on the parsed result according to the algorithm in the pre-configured orchestration plug-in corresponding to the target API to obtain an intermediate result; The intermediate result is replaced in the API request based on the location information in the preconfigured orchestration plug-in to obtain the target data.

5. The method according to claim 4, characterized in that The step of performing security orchestration processing on the parsing result according to the algorithm in the pre-configured orchestration plug-in corresponding to the target API to obtain an intermediate result includes: Sign the parsing result based on the signature algorithm set in the pre-configured orchestration plug-in, obtain the signed result and temporarily store it in a preset cache area; Encoding the signature result based on the encoding algorithm set in the preconfigured orchestration plug-in, obtaining an encoding result and temporarily storing it in the preset cache area; The encoding result is encrypted based on the encryption algorithm set in the preconfigured orchestration plug-in to obtain an intermediate result.

6. A security orchestration device, characterized in that: include: A request acquisition module, configured to acquire an application programming interface (API) request and determine a target API to which the API request belongs; A result determination module, configured to parse the API request according to the pre-configured screening conditions of the target API to obtain a parsing result; A data orchestration module, configured to perform secure orchestration processing on the parsing result according to a pre-configured orchestration plug-in corresponding to the target API to obtain target data; Wherein, the device further comprises: a plug-in configuration module; The plug-in configuration module includes: An interface display unit, configured to respond to a security orchestration request of a registration API and display at least three component function modules through a visual configuration interactive interface, wherein the component function modules include a signature component function module, an encoding component function module, and an encryption component function module; An information receiving unit, configured to receive arrangement information, location information, and parameter configuration information of each component functional module fed back by the visual configuration interaction interface; a third determining unit, configured to determine a processing order of each of the component functional modules according to the arrangement information; a fourth determining unit, configured to determine a request data range and algorithm parameter information of the component function module according to the parameter configuration information; A fifth determining unit is configured to generate the preconfigured orchestration plug-in for the registration API according to the processing order, the location information, the range of each request data, and the algorithm parameter information.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the security orchestration method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security orchestration method according to any one of claims 1 to 5 when executed.

9. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the security orchestration method according to any one of claims 1 to 5.

Images