Identity management platform-based undisclosed interface structure induction method and device

Abstract

The embodiment of the application provides a kind of based on identity management platform's undisclosed interface structure induction method and device, method includes: by the request data of parsing to oneself identity management platform obtains undisclosed interface data set, including request method and request path;Interface data belonging to identity management platform is classified by service type, by regular expression to the request path of each service category interface data set is dynamically variable matching and parameterized replacement, obtains standardized interface path, according to the path key field in standardized interface path carries out permission matching and obtains permission mapping table, the request method in permission mapping table is divided by semantics, determine corresponding operation type, according to the resource type in key field, operation type and standardized interface path are inducted and aggregated, determine the interface structure under each resource type, the structured display of undisclosed interface is carried out, and the application can improve the management efficiency and security of identity and access management platform.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a method and apparatus for the structured induction of undisclosed interfaces based on an identity management platform. Background Technology

[0002] With the rapid development of cloud computing technology and the continuous improvement of enterprise informatization, Azure Active Directory (Azure AD), an enterprise-level identity and access management platform, has become a unified identity platform adopted by many organizations worldwide. Azure AD not only provides centralized management capabilities for user identities, but also deeply integrates with Microsoft 365 (Microsoft's integrated office software), Azure Resource Manager (ARM), Power Platform (a low-code application development platform), SaaS applications (Software as a Service applications), and DevOps processes (development and operations integration processes), building a solid "identity infrastructure" for modern organizations.

[0003] However, Azure AD's critical role also makes it a high-risk target for potential attackers. Traditional attack paths, such as obtaining login credentials through phishing emails, expanding privilege boundaries by exploiting misconfigurations, or achieving persistent attacks, remain effective in cloud infrastructure. In recent years, security research targeting Azure AD has become increasingly active, with security vendors and researchers continuously disclosing high-risk vulnerabilities and misuse techniques. However, current research still faces many limitations.

[0004] For example, most research and tools rely on the publicly available Graph API interfaces in the Azure official documentation for data interaction. However, Microsoft has a large number of undocumented Graph APIs internally, used only for testing or platform internal purposes. These interfaces have capabilities beyond the boundaries of the publicly available APIs, such as hidden parameters for managing Active Directory policies and vulnerability exposure for specific authentication paths. Current tools lack effective mechanisms for discovering and utilizing these undocumented interfaces, thus failing to obtain deeper data and permission information.

[0005] As mentioned above, there is an urgent need for a structured inductive method for undisclosed interfaces based on identity management platforms to provide comprehensive technical support for Azure cloud security research and improve the management efficiency and security of identity and access management platforms. Summary of the Invention

[0006] To address the problems in the prior art, this application provides a method and apparatus for the structured summarization of undisclosed interfaces based on an identity management platform, which can improve the management efficiency and security of the identity and access management platform.

[0007] To solve at least one of the above problems, this application provides the following technical solution:

[0008] Firstly, this application provides a method for structured induction of undisclosed interfaces based on an identity management platform, including:

[0009] Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path;

[0010] The undisclosed interface dataset is categorized by platform, and interface data belonging to the identity management platform is filtered out. The interface dataset belonging to the identity management platform is then categorized by service type to determine multiple service category interface datasets. The request paths of each service category interface dataset are dynamically matched using regular expressions. A parameter dictionary is constructed to parameterize and replace the dynamic variables, and the corresponding standardized interface path is determined. A unified calling template is constructed based on the standardized interface path, the parameter dictionary, and the request method.

[0011] The unified call template is mapped to the permission entries of the permission model of the identity management platform. Permission matching is performed based on the path key fields in the unified call template to determine the corresponding permission mapping table. The request methods in the permission mapping table are semantically segmented to determine the corresponding operation types. The operation types and the standardized interface paths are summarized and aggregated according to the resource types in the key fields to determine the interface structure under each resource type. The structured display of the undisclosed interfaces of the identity management platform is performed based on the interface structure.

[0012] Furthermore, the step of dynamically matching request paths for each of the service category interface datasets using regular expressions includes:

[0013] Common fields are extracted from the request paths of each service category interface dataset to determine the corresponding static fields and dynamic variables. The static fields are fixed identifiers that represent the service type, and the dynamic variables are unique identifier parameters in the resource layer.

[0014] The dynamic variables are matched based on preset regular expression rules, which include resource identifier patterns, subscription ID patterns, and resource group name patterns.

[0015] Furthermore, the construction of the parameter dictionary performs parameterized replacement on the dynamic variables to determine the corresponding standardized interface path, including:

[0016] A parameter dictionary is constructed based on the matched dynamic variables, and the parameter dictionary is compared with the official documentation of the identity management platform for integrity checks.

[0017] Based on the parameter dictionary that has undergone the integrity check, the matched dynamic variables are parameterized and replaced to determine the corresponding standardized interface path.

[0018] Further, the step of mapping the unified invocation template to the permission entries of the permission model of the identity management platform, and performing permission matching based on the path key field in the unified invocation template to determine the corresponding permission mapping table, includes:

[0019] Obtain role definition data from the permission model of the identity management platform, wherein the role definition data includes a set of permission actions and resource types associated with the set of permission actions;

[0020] Extract the path key fields from the unified call template, perform resource hierarchy structure parsing on the path key fields, and determine the corresponding undisclosed interface resource types;

[0021] Perform a fuzzy match between the undisclosed interface resource types and the resource types in the role definition data. If the match is successful, output the mapping relationship to determine the corresponding permission mapping table.

[0022] Furthermore, the step of summarizing and aggregating the operation type and the standardized interface path according to the resource type in the key field to determine the interface structure under each resource type includes:

[0023] Cluster analysis is performed on the operation type and the standardized interface path according to the undisclosed interface resource type to establish a resource-operation matrix, where the matrix rows represent resource types, the matrix columns represent operation types, and the matrix values ​​record the set of interface paths.

[0024] Based on the resource-operation matrix, a standardized interface structure tree is generated for each resource type. The standardized interface structure tree includes resource level, supported operation methods, and associated permission policies.

[0025] Furthermore, the process of classifying the interface dataset belonging to the identity management platform by service type to determine multiple service category interface datasets includes:

[0026] Identify the service type of the interface based on key fields in the request path;

[0027] Based on the preset service classification rules, the interface dataset is grouped according to service type.

[0028] Furthermore, the step of receiving request data from the identity management platform and parsing and structuring the request data to determine the corresponding undisclosed interface dataset includes:

[0029] The proxy module receives request data from the identity management platform, wherein the request data includes a request URL, a request method, a request header, and a request body.

[0030] The HTTP protocol parser performs content analysis on the request data and then performs structured syntax parsing on the data after content analysis to determine the corresponding unpublished interface dataset. The unpublished interface dataset includes the request method, request path, request header, identity credentials, query parameters, and request body.

[0031] Secondly, this application provides a structured summarization device for an undisclosed interface based on an identity management platform, comprising:

[0032] The undisclosed interface structure extraction module is used to receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding undisclosed interface dataset, wherein the undisclosed interface dataset includes request methods and request paths;

[0033] The module for determining the unified call template for undisclosed interfaces is used to classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, perform dynamic variable matching on the request path of each service category interface dataset using regular expressions, construct a parameter dictionary to perform parameterized replacement on the dynamic variables, determine the corresponding standardized interface path, and construct a unified call template based on the standardized interface path, the parameter dictionary, and the request method.

[0034] The undisclosed interface structured display module is used to map the unified call template to the permission entries of the permission model of the identity management platform. It performs permission matching based on the path key fields in the unified call template to determine the corresponding permission mapping table. It performs semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types. It summarizes and aggregates the operation types and the standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type. Based on the interface structure, it displays the undisclosed interfaces of the identity management platform in a structured manner.

[0035] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the undisclosed interface structured induction method based on the identity management platform.

[0036] Fourthly, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the undisclosed interface structured induction method based on the identity management platform described above.

[0037] Fifthly, this application provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the undisclosed interface structured induction method based on the identity management platform.

[0038] As can be seen from the above technical solution, this application provides a method and apparatus for the structured summarization of undisclosed interfaces based on an identity management platform. It obtains an undisclosed interface dataset, including request methods and request paths, by parsing request data from the identity management platform. The interface data belonging to the identity management platform is categorized by service type. Regular expressions are used to dynamically match variables and perform parameterized replacement on the request paths of each service category's interface dataset to obtain standardized interface paths. Permission mapping tables are obtained by matching permissions based on the key fields of the standardized interface paths. The request methods in the permission mapping tables are semantically segmented to determine the corresponding operation types. The operation types and standardized interface paths are summarized and aggregated according to the resource types in the key fields to determine the interface structure under each resource type. This results in a structured display of undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is one of the flowcharts illustrating the undisclosed interface structured induction method based on an identity management platform in this application embodiment;

[0041] Figure 2 This is a structural diagram of the undisclosed interface structured summarization device based on the identity management platform in the embodiments of this application;

[0042] Figure 3 This is a schematic diagram of the structure of the electronic device in the embodiments of this application.

[0043] Figure label:

[0044] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver storage unit 9144, antenna 9111, speaker 9131, microphone 9132. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0047] As enterprises increasingly prioritize IT infrastructure, Azure Active Directory (Azure AD), Microsoft's enterprise-grade identity and access management platform, has become the unified identity platform adopted by numerous organizations worldwide. This critical position of Azure AD also places it in a high-risk location targeted by potential attackers. However, research on Azure AD still faces several key limitations, one of which is that the attack models, test data, and verification tools currently available in industry and academia are mostly focused on publicly available interfaces, lacking support for in-depth structural reconstruction and attack surface exploration of the Azure AD environment. For example, this includes issues such as hidden parameters in AD management policies, vulnerability exposure in specific authentication paths, and bypassing log and audit paths. Therefore, discovering and structurally summarizing undisclosed (internal / preview / beta) Graph API interfaces in the Microsoft Azure platform is an urgent problem to be solved.

[0048] This application provides a method and apparatus for the structured summarization of undisclosed interfaces based on an identity management platform. It obtains an undisclosed interface dataset, including request methods and request paths, by parsing request data from the identity management platform. The interface data belonging to the identity management platform is categorized by service type. Regular expressions are used to dynamically match variables and perform parameterized replacement on the request paths of each service category's interface dataset to obtain standardized interface paths. Permission mapping tables are obtained by matching permissions based on key fields in the standardized interface paths. The request methods in the permission mapping tables are semantically segmented to determine the corresponding operation types. The operation types and standardized interface paths are summarized and aggregated according to the resource types in the key fields to determine the interface structure under each resource type. This results in a structured display of the undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform.

[0049] To improve the management efficiency and security of identity and access management platforms, this application provides an embodiment of an undisclosed interface structured generalization method based on an identity management platform. See [link to relevant documentation]. Figure 1 The structured induction method for undisclosed interfaces based on the identity management platform specifically includes the following:

[0050] Step S101: Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path;

[0051] Optionally, in this embodiment, after obtaining security permission, the browser proxy module (or proxy gateway) in the system will intercept HTTP / HTTPS request data from the cloud service console, CLI tool, or SDK, mainly including: request URL, request method (GET / POST / PUT / DELETE), request headers (including Authorization, Content-Type, etc.), request body (usually JSON or form data), response status code, and response body.

[0052] Next, an HTTP protocol parser is used to analyze the content of network packets; syntax parsing is performed on the structured formats of common cloud platform SDK calls (such as JSON, REST API path specifications); key fields are extracted: URL path, request method, parameter location, and identity credentials. This forms a structured raw API dataset.

[0053] For example, a structured raw API dataset includes:

[0054] {

[0055] "method": "GET", [Request Method]

[0056] "url":" / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name", [The URL of the requested resource path]

[0057] "headers": {

Request headers

[0058] "Authorization": "Bearer eyxxxx...", [Authorization credentials]

[0059] "Content-Type": "application / json" [Media type in the request body]

[0060] },

[0061] "query": {}, [query parameters]

[0062] "body": {} [Request Body]

[0063] }

[0064] Further extraction is possible:

[0065] The cloud provider to be used [the cloud service provider identified from the request URL or other context, such as Azure, AWS, etc.], the request identity [identity information extracted from the Authorization field or other identity identifiers in the request header, such as the token used, service principal, etc.], and the type and ID of the target resource [the resource type and unique identifier of the resource extracted from the URL].

[0066] The system compares the structured request data with known public interfaces to identify unpublished interfaces.

[0067] Specifically, one way to identify undisclosed interfaces is by having the request path contain a specific resource type or operation that is not mentioned in the public documentation.

[0068] One way to identify undisclosed interfaces is by having the request path contain a specific prefix or suffix.

[0069] The system extracts the request methods and request paths of these undocumented interfaces to form an undocumented interface dataset.

[0070] By parsing and structuring request data, the system can proactively discover undocumented internal interfaces, test interfaces, and Beta Preview interfaces within the Microsoft Graph API. These interfaces may contain more high-privilege attribute fields. The system extracts the request methods and paths of these undocumented interfaces to form an interface dataset for subsequent interface call and permission analysis. This allows the system to obtain more hidden fields and information, thereby improving data completeness and accuracy. This is crucial for comprehensively analyzing the permission structure and potential security risks of Azure Active Directory.

[0071] Step S102: Classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, use regular expressions to perform dynamic variable matching on the request path of each service category interface dataset, construct a parameter dictionary to perform parameterized replacement of the dynamic variables, determine the corresponding standardized interface path, and construct a unified calling template based on the standardized interface path, the parameter dictionary, and the request method.

[0072] Optionally, in this embodiment, this step categorizes and abstracts the undisclosed interface data and extracts the corresponding interface standard path template.

[0073] First, the intercepted API requests are categorized and processed as follows:

[0074] Categorized by cloud platform (Azure, AWS, GCP);

[0075] Categorize by service type (e.g., resource management, storage, containers, KeyVault, etc.);

[0076] Categorize by resource level and URI pattern, and extract common fields.

[0077] Specifically, the system categorizes a large dataset of unpublished APIs based on their request URLs and cloud service provider identifiers in the request headers, according to the cloud platform they belong to. For example, APIs belonging to Azure are grouped into one category, those belonging to AWS into another, and those belonging to GCP into yet another. This step aims to process API data from different cloud platforms separately because their API specifications and permission models differ.

[0078] Specifically, the interface data belonging to the Identity Management Platform (Azure AD) is further categorized by service type. For example, interfaces related to user management are grouped into the "User Management" category, interfaces related to role management into the "Role Management" category, and interfaces related to policy management into the "Policy Management" category, etc. The purpose of this step is to centrally process interface data of the same service type so that interface paths can be standardized and parameterized more efficiently in the future.

[0079] Specifically, for each service type interface, it is classified according to resource level. Based on the URI structure of the interface path, the unexposed interfaces are divided into Tenant-Level, Subscription-Level, ResourceGroup-Level, and Resource-Level interfaces, and the common path template is extracted.

[0080] First, the system parses the request path in the dataset for each service category interface. The request path is the URL portion of the API call:

[0081] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0082] The purpose of parsing is to break down a path into multiple components for further analysis and processing.

[0083] During the request path parsing process, the system extracts static common fields from the path. Static common fields refer to the parts that appear consistently in similar interface paths; these fields typically represent the service type or resource type. For example, in the path above:

[0084] / subscriptions / , / resourceGroups / , and / providers / Microsoft.Compute / virtualMachines / are all static public fields that remain unchanged across similar interfaces, helping to identify the service type and resource level to which the interface belongs.

[0085] Next, in addition to static public fields, the path also contains dynamic variables, which are unique identifier parameters at the resource level. For example, {subscriptionId}, {resourceGroupName}, and {vmName} are all dynamic variables that will take different values ​​in different API calls.

[0086] We have predefined a series of regular expression rules for matching dynamic variables.

[0087] Regular expression rules can be:

[0088] The Resource Identifier pattern matches the unique identifier of an Azure resource (such as virtualMachines, storageAccounts).

[0089] The Subscription ID pattern matches the Azure Subscription ID, which is a 32-bit hexadecimal string.

[0090] Resource Group Name pattern that matches Azure resource group names (such as my-resource-group), allowing letters, numbers, hyphens, and underscores.

[0091] Resource Name pattern that matches Azure resource names (such as myVM, storageAccount01) and consists of letters, numbers, and hyphens.

[0092] Resource Path pattern matches the complete Azure resource path.

[0093] Tenant ID pattern, matching Azure AD tenant ID, format is similar to subscription ID.

[0094] Access Token mode, matching Azure AD access tokens in JWT format.

[0095] Storage Connection String pattern that matches the connection string of an Azure storage account.

[0096] More complex rules (such as nested JSON parsing) can be combined with recursive regular expressions or JSON parsing libraries to enhance matching capabilities.

[0097] The system uses preset regular expression rules to match the identified dynamic variables. Through matching, the system can verify whether the dynamic variables conform to the expected format and extract their specific values.

[0098] Then, based on the dynamic variables matched by regular expressions, the system constructs a parameter dictionary.

[0099] The parameter dictionary is a collection of key-value pairs, where the key is the name of the dynamic variable and the value is the actual value of the dynamic variable.

[0100] For example, for the original URL path mentioned above

[0101] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0102] The dynamic variables are "xxxxxxx", "rg-name", and "vm-name".

[0103] We construct a parameter dictionary based on the aforementioned dynamic variables.

[0104] "parameters": {[parameter dictionary]}

[0105] "subscriptionId": "xxxxxxx",

[0106] "resourceGroup": "rg-name",

[0107] "vmName": "vm-name

[0108] },

[0109] After constructing the parameter dictionary, the system compares it with the official documentation of the identity management platform to perform a completeness check. By comparing it with the official documentation, the system can check whether any dynamic variables are missing or whether there are any redundant variables in the parameter dictionary. The purpose of this step is to ensure the completeness and accuracy of the parameter dictionary.

[0110] Based on the parameter dictionary, which has undergone integrity checks, the system performs parameterized replacement on the dynamic variables after regular expression matching. Parameterized replacement replaces the dynamic variables with specific values ​​from the parameter dictionary, thereby generating standardized interface paths.

[0111] Let's take the original URL path mentioned above as an example again:

[0112] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0113] The standardized interface path after parameter replacement using a parameterized dictionary is as follows:

[0114] " / subscriptions / {subscriptionId} / resourceGroups / {resourceGroup} / providers / Microsoft.Compute / virtualMachines / {vmName}", [Path Template]

[0115] After the replacement is completed, the system determines the corresponding standardized interface path. The standardized interface path is the path after parameterized replacement. It is a specific path that can be directly used for API calls, making interface calls more standardized and automated, and facilitating subsequent interface management and permission analysis.

[0116] Finally, after obtaining the standardized interface path, we construct a unified invocation template based on the standardized interface path, the parameter dictionary we just built, and the request methods present in the original unpublished interface data. For example, the unified invocation template is as follows:

[0117] {

[0118] "template": " / subscriptions / {subscriptionId} / resourceGroups / {resourceGroup} / providers / Microsoft.Compute / virtualMachines / {vmName}", [Standardized Interface Path Template]

[0119] "parameters": {[parameter dictionary]}

[0120] "subscriptionId": "xxxxxxx",

[0121] "resourceGroup": "rg-name",

[0122] "vmName": "vm-name

[0123] },

[0124] "method": "GET" [Request method]

[0125] }

[0126] Mapping relationship: Request URL → Abstract resource type → Permission item category (e.g., Microsoft.Compute / virtualMachines / read)

[0127] Based on the above steps, the system can efficiently process and analyze unpublished interface datasets, generate unified call templates for unpublished interfaces, and provide a solid foundation for subsequent interface calls, data collection, and permission analysis.

[0128] Step S103: Map the unified call template to the permission entries of the permission model of the identity management platform, perform permission matching based on the path key fields in the unified call template, determine the corresponding permission mapping table, perform semantic segmentation on the request methods in the permission mapping table, determine the corresponding operation types, summarize and aggregate the operation types and the standardized interface paths according to the resource types in the key fields, determine the interface structure under each resource type, and perform a structured display of the undisclosed interfaces of the identity management platform based on the interface structure.

[0129] Optionally, in this embodiment, the path template in step 102 is mapped to the following dimensions to achieve semantic uniformity:

[0130] The permission model mapped to the cloud platform;

[0131] Mapped to Microsoft. / / ;

[0132] Mapped to permission entries in Role Definitions;

[0133] Permission mapping can be obtained by using the path key field and the method.

[0134] Specifically, role definition data is first extracted from the permission entries in Azure AD's permission model, including predefined roles (such as "Global Administrator" and "Reader") and custom roles. Role definition data contains two core parts:

[0135] Permission Action Set: Describes the operations that a role can perform.

[0136] For example: Microsoft.Compute / virtualMachines / read

[0137] Associated resource type: Specifies the scope of resources to which the operation applies. Each set of permission actions is associated with a specific resource type.

[0138] For example: VirtualMachines, KeyVault

[0139] Then, the resource level identifier is separated from the unified call template to parse the resource types of undisclosed interfaces.

[0140] For example: path / beta / internalVaults / {vaultName} / secrets → the key fields are internalVaults and secrets.

[0141] Map key fields to resource types according to the Azure resource naming convention ({service name} / {resource type} / {sub-resource}). For example:

[0142] internalVaults → Inferred to be an undocumented variant of Microsoft.KeyVault / vaults.

[0143] secrets → Sub-resource type, belonging to the KeyVault main resource.

[0144] This step will use fuzzy matching and resource hierarchy resolution to transform the poorly named undocumented interfaces into a structure consistent with the Azure resource model, eliminating naming differences (such as the association between internalVaults and vaults), solving the problem that traditional tools cannot identify non-standard paths, providing standardized input for fuzzy matching, and avoiding misjudgments caused by path naming differences.

[0145] Next, compare the unexposed interface resource types (internalVaults) with the resource types (KeyVaults) in the role definition, allowing partial string matching (such as internal). match (vaults). If the resource type matches successfully, output the permission mapping table. For example, the mapped permission table is as follows:

[0146] {

[0147] "path_template": Standardized interface path template

[0148] " / subscriptions / {s} / resourceGroups / {r} / providers / Microsoft.KeyVault / vaults / {v}",

[0149] "method": "GET", [Request Method]

[0150] "mapped_permission": "Microsoft.KeyVault / vaults / read", [Mapped Permission]

[0151] "resource_type": "KeyVault", [Resource Type]

[0152] "cloud": "Azure" [Cloud Platform]

[0153] }

[0154] After obtaining the mapping permission table, semantic segmentation is performed according to the HTTP Method (request method):

[0155] GET → read permission

[0156] PUT / POST → write / contribute

[0157] DELETE → delete permission

[0158] The resource-operation matrix is ​​constructed by using the parsed unpublished interface resource types (such as KeyVault and VirtualMachines) as rows and the semantically divided actions (such as read, write, and delete) as columns. Each cell records all interface paths that support a certain operation under the resource type.

[0159] By establishing a resource-operation matrix, the operation types and interface paths under different resource types can be managed systematically, supporting multi-dimensional analysis and allowing for easy querying of all operation types and their corresponding interface paths under a specific resource type.

[0160] Next, based on the resource-operation matrix, a corresponding standardized interface structure tree is generated for each resource type. The standardized interface structure tree is a hierarchical data structure that includes resource levels, supported operation methods, and associated permission policies.

[0161] The resource-operation matrix and structure tree provide a multi-dimensional perspective, allowing for both macroscopic comparison of the capability differences between public and non-public interfaces and microscopic analysis of the compliance of permission policies for individual interfaces.

[0162] For a specific implementation example, the interface structure tree is as follows:

[0163] {

[0164] "resource": "Microsoft.Compute / virtualMachines", [Resource Type]

[0165] "operations": [This represents a list of operations supported by this resource type]

[0166] {

[0167] "action": "read", [Operation Type]

[0168] "method": "GET", [Request Method]

[0169] "path": " / subscriptions / {...} / ... / virtualMachines / {vmName}" [Path Template]

[0170] },

[0171] {

[0172] "action": "write", [Operation Type]

[0173] "method": "PUT", [Request Method]

[0174] "path": " / subscriptions / {...} / ... / virtualMachines / {vmName}" [Path Template]

[0175] } ]

[0177] }

[0178] The standardized interface structure tree presents the structure and permission policies of the identity management platform's unpublished interfaces under different resource types in a hierarchical manner, enabling users to quickly understand the unpublished interface paths, supported operation methods, and corresponding permission policies for each resource type.

[0179] For example, a company discovered through this step that the undisclosed interface / beta / internalRoles / assign did not match any role definition. Further analysis confirmed that it was a role assignment vulnerability that bypassed RBAC. After timely repair, it avoided loss of control over permissions across the entire domain.

[0180] Through the above steps, the transformation from the raw path of the unexposed interface to the standardized permission structure tree was realized, providing unprecedented fine-grained analysis capabilities for security research in Azure AD.

[0181] This example demonstrates how this embodiment obtains a complete undisclosed interface structure tree model by parsing undisclosed interface data, uniformly collecting these internal interfaces, restoring fields, and performing specification analysis. This model displays the undisclosed interfaces and is more in line with security analysis requirements than traditional JSON output, thereby improving the management efficiency and security of the identity and access management platform.

[0182] As described above, the undisclosed interface structured summarization method based on an identity management platform provided in this application can obtain an undisclosed interface dataset, including request methods and request paths, by parsing request data from the identity management platform; classify the interface data belonging to the identity management platform by service type; perform dynamic variable matching and parameterized replacement of the request paths of each service category interface dataset using regular expressions to obtain standardized interface paths; perform permission matching based on the path key fields in the standardized interface paths to obtain a permission mapping table; perform semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types; summarize and aggregate the operation types and standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type; and perform structured display of undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform.

[0183] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0184] Step S201: Extract common fields from the request paths of each service category interface dataset, and determine the corresponding static fields and dynamic variables. The static fields are fixed identifiers that represent the service type, and the dynamic variables are unique identifier parameters in the resource layer.

[0185] Step S202: Match the dynamic variables based on preset regular expression rules, wherein the regular expression rules include resource identifier patterns, subscription ID patterns, and resource group name patterns.

[0186] Optionally, in this embodiment, the system first parses the request path in the dataset for each service category interface. The request path is the URL portion of the API call:

[0187] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0188] The purpose of parsing is to break down a path into multiple components for further analysis and processing.

[0189] During the request path parsing process, the system extracts static common fields from the path. Static common fields refer to the parts that appear consistently in similar interface paths; these fields typically represent the service type or resource type. For example, in the path above:

[0190] / subscriptions / , / resourceGroups / , and / providers / Microsoft.Compute / virtualMachines / are all static public fields that remain unchanged across similar interfaces, helping to identify the service type and resource level to which the interface belongs.

[0191] Next, in addition to static public fields, the path also contains dynamic variables, which are unique identifier parameters at the resource level. For example, {subscriptionId}, {resourceGroupName}, and {vmName} are all dynamic variables that will take different values ​​in different API calls.

[0192] We have predefined a series of regular expression rules for matching dynamic variables.

[0193] Regular expression rules can be:

[0194] The Resource Identifier pattern matches the unique identifier of an Azure resource (such as virtualMachines, storageAccounts).

[0195] The Subscription ID pattern matches the Azure Subscription ID, which is a 32-bit hexadecimal string.

[0196] Resource Group Name pattern that matches Azure resource group names (such as my-resource-group), allowing letters, numbers, hyphens, and underscores.

[0197] Resource Name pattern that matches Azure resource names (such as myVM, storageAccount01) and consists of letters, numbers, and hyphens.

[0198] Resource Path pattern matches the complete Azure resource path.

[0199] Tenant ID pattern, matching Azure AD tenant ID, format is similar to subscription ID.

[0200] Access Token mode, matching Azure AD access tokens in JWT format.

[0201] Storage Connection String pattern that matches the connection string of an Azure storage account.

[0202] More complex rules (such as nested JSON parsing) can be combined with recursive regular expressions or JSON parsing libraries to enhance matching capabilities.

[0203] The system uses preset regular expression rules to match the identified dynamic variables. Through matching, the system can verify whether the dynamic variables conform to the expected format and extract their specific values.

[0204] Through step S202, this embodiment successfully extracts dynamic variables and static common fields from the request path, laying the foundation for the subsequent generation of an abstract request path template.

[0205] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0206] Step S301: Construct a parameter dictionary based on the matched dynamic variables, and perform a completeness check by comparing the parameter dictionary with the official documentation of the identity management platform;

[0207] Step S302: Based on the parameter dictionary that has undergone the integrity check, perform parameterized replacement on the matched dynamic variables to determine the corresponding standardized interface path.

[0208] Optionally, in this embodiment, the system constructs a parameter dictionary based on the dynamic variables after regular expression matching.

[0209] The parameter dictionary is a collection of key-value pairs, where the key is the name of the dynamic variable and the value is the actual value of the dynamic variable.

[0210] For example, for the original URL path mentioned above

[0211] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0212] The dynamic variables are "xxxxxxx", "rg-name", and "vm-name".

[0213] We construct a parameter dictionary based on the aforementioned dynamic variables.

[0214] "parameters": {[parameter dictionary]}

[0215] "subscriptionId": "xxxxxxx",

[0216] "resourceGroup": "rg-name",

[0217] "vmName": "vm-name

[0218] },

[0219] After constructing the parameter dictionary, the system compares it with the official documentation of the identity management platform to perform a completeness check. By comparing it with the official documentation, the system can check whether any dynamic variables are missing or whether there are any redundant variables in the parameter dictionary. The purpose of this step is to ensure the completeness and accuracy of the parameter dictionary.

[0220] Based on the parameter dictionary, which has undergone integrity checks, the system performs parameterized replacement on the dynamic variables after regular expression matching. Parameterized replacement replaces the dynamic variables with specific values ​​from the parameter dictionary, thereby generating standardized interface paths.

[0221] Let's take the original URL path mentioned above as an example again:

[0222] / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name"

[0223] The standardized interface path after parameter replacement using a parameterized dictionary is as follows:

[0224] " / subscriptions / {subscriptionId} / resourceGroups / {resourceGroup} / providers / Microsoft.Compute / virtualMachines / {vmName}", [Path Template]

[0225] After the replacement is completed, the system determines the corresponding standardized interface path. The standardized interface path is the path after parameterized replacement. It is a specific path that can be directly used for API calls, making interface calls more standardized and automated, and facilitating subsequent interface management and permission analysis.

[0226] Through step S302, this embodiment successfully constructs a parameter dictionary through dynamic variable matching and templates the request path to obtain a standardized interface path, laying the foundation for subsequent interface calls and unified analysis.

[0227] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0228] Step S401: Obtain role definition data from the permission model of the identity management platform, wherein the role definition data includes a set of permission actions and resource types associated with the set of permission actions;

[0229] Step S402: Extract the path key fields from the unified call template, parse the resource hierarchy structure of the path key fields, and determine the corresponding undisclosed interface resource types;

[0230] Step S403: Perform fuzzy matching between the undisclosed interface resource type and the resource type in the role definition data. If the match is successful, output the mapping relationship to determine the corresponding permission mapping table.

[0231] Optionally, in this embodiment, role definition data is first extracted from the permission entries of the Azure AD permission model, including predefined roles (such as "Global Administrator" and "Reader") and custom roles. Role definition data contains two core parts:

[0232] Permission Action Set: Describes the operations that a role can perform.

[0233] For example: Microsoft.Compute / virtualMachines / read

[0234] Associated resource type: Specifies the scope of resources to which the operation applies. Each set of permission actions is associated with a specific resource type.

[0235] For example: VirtualMachines, KeyVault

[0236] Then, the resource level identifier is separated from the unified call template to parse the resource types of undisclosed interfaces.

[0237] For example: path / beta / internalVaults / {vaultName} / secrets → the key fields are internalVaults and secrets.

[0238] Map key fields to resource types according to the Azure resource naming convention ({service name} / {resource type} / {sub-resource}). For example:

[0239] internalVaults → Inferred to be an undocumented variant of Microsoft.KeyVault / vaults.

[0240] secrets → Sub-resource type, belonging to the KeyVault main resource.

[0241] This step will use fuzzy matching and resource hierarchy resolution to transform the poorly named undocumented interfaces into a structure consistent with the Azure resource model, eliminating naming differences (such as the association between internalVaults and vaults), solving the problem that traditional tools cannot identify non-standard paths, providing standardized input for fuzzy matching, and avoiding misjudgments caused by path naming differences.

[0242] Next, compare the unexposed interface resource types (internalVaults) with the resource types (KeyVaults) in the role definition, allowing partial string matching (such as internal). match (vaults). If the resource type matches successfully, output the permission mapping table. For example, the mapped permission table is as follows:

[0243] {

[0244] "path_template": Standardized interface path template

[0245] " / subscriptions / {s} / resourceGroups / {r} / providers / Microsoft.KeyVault / vaults / {v}",

[0246] "method": "GET", [Request Method]

[0247] "mapped_permission": "Microsoft.KeyVault / vaults / read", [Mapped Permission]

[0248] "resource_type": "KeyVault", [Resource Type]

[0249] "cloud": "Azure" [Cloud Platform]

[0250] }

[0251] Through step S403, this embodiment successfully eliminates the structural differences between undisclosed interfaces and the Azure resource model through fuzzy matching, constructs a permission mapping table, and lays the foundation for subsequent clustering and summarization of undisclosed interface data.

[0252] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0253] Step S501: Perform cluster analysis on the operation type and the standardized interface path according to the undisclosed interface resource type to establish a resource-operation matrix, wherein the matrix rows represent resource types, the matrix columns represent operation types, and the matrix values ​​record the set of interface paths;

[0254] Step S502: Based on the resource-operation matrix, generate a standardized interface structure tree for each resource type. The standardized interface structure tree includes resource levels, supported operation methods, and associated permission policies.

[0255] Optionally, in this embodiment, after obtaining the mapping permission table, semantic segmentation is performed according to the HTTP Method (request method):

[0256] GET → read permission

[0257] PUT / POST → write / contribute

[0258] DELETE → delete permission

[0259] The resource-operation matrix is ​​constructed by using the parsed unpublished interface resource types (such as KeyVault and VirtualMachines) as rows and the semantically divided actions (such as read, write, and delete) as columns. Each cell records all interface paths that support a certain operation under the resource type.

[0260] By establishing a resource-operation matrix, the operation types and interface paths under different resource types can be managed systematically, supporting multi-dimensional analysis and allowing for easy querying of all operation types and their corresponding interface paths under a specific resource type.

[0261] Next, based on the resource-operation matrix, a corresponding standardized interface structure tree is generated for each resource type. The standardized interface structure tree is a hierarchical data structure that includes resource levels, supported operation methods, and associated permission policies.

[0262] The resource-operation matrix and structure tree provide a multi-dimensional perspective, allowing for both macroscopic comparison of the capability differences between public and non-public interfaces and microscopic analysis of the compliance of permission policies for individual interfaces.

[0263] For a specific implementation example, the interface structure tree is as follows:

[0264] {

[0265] "resource": "Microsoft.Compute / virtualMachines", [Resource Type]

[0266] "operations": [This represents a list of operations supported by this resource type]

[0267] {

[0268] "action": "read", [Operation Type]

[0269] "method": "GET", [Request Method]

[0270] "path": " / subscriptions / {...} / ... / virtualMachines / {vmName}" [Path Template]

[0271] },

[0272] {

[0273] "action": "write", [Operation Type]

[0274] "method": "PUT", [Request Method]

[0275] "path": " / subscriptions / {...} / ... / virtualMachines / {vmName}" [Path Template]

[0276] } ]

[0278] }

[0279] The standardized interface structure tree presents the structure and permission policies of the identity management platform's unpublished interfaces under different resource types in a hierarchical manner, enabling users to quickly understand the unpublished interface paths, supported operation methods, and corresponding permission policies for each resource type.

[0280] For example, a company discovered through this step that the undisclosed interface / beta / internalRoles / assign did not match any role definition. Further analysis confirmed that it was a role assignment vulnerability that bypassed RBAC. After timely repair, it avoided loss of control over permissions across the entire domain.

[0281] Through step S502, this embodiment successfully transformed the raw path of the undisclosed interface into a standardized permission structure tree, providing unprecedented fine-grained analysis capabilities for security research in Azure AD.

[0282] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0283] Step S601: Identify the service type of the interface based on the key fields of the request path;

[0284] Step S602: Group the interface dataset by service type according to the preset service classification rules.

[0285] Optionally, in this embodiment, key fields are identified from the request path to determine the service type of the interface. For example:

[0286] If the request path contains Microsoft.Compute, it is identified as "Compute Service";

[0287] If the request path contains Microsoft.KeyVault, it is identified as "Key Management Service";

[0288] If the request path contains Microsoft.Storage, it is identified as "Storage Service".

[0289] Optionally, in this embodiment, the interface dataset is grouped according to the identified service type. The specific steps are as follows:

[0290] Iterate through all identified interface data and categorize them into the corresponding groups based on their service type.

[0291] For example, all interface data belonging to "Computing Services" is categorized into the "Computing Services" group, and all interface data belonging to "Key Management Services" is categorized into the "Key Management Services" group.

[0292] By grouping interface data by service type, this data can be managed and processed more efficiently. For example, performance analysis can be performed on "computing services," and security analysis can be performed on "key management services," thereby improving the relevance and accuracy of the analysis.

[0293] Through step S602, this embodiment successfully categorized the undisclosed interface data into services, laying the foundation for subsequent data content analysis.

[0294] In one embodiment of the undisclosed interface structured induction method based on the identity management platform in this application, it may further include the following:

[0295] Step S701: Receive request data from the identity management platform through the proxy module, wherein the request data includes a request URL, a request method, a request header, and a request body;

[0296] Step S702: Perform content analysis on the request data according to the HTTP protocol parser, and perform structured syntax parsing on the data after content analysis to determine the corresponding unpublished interface dataset. The unpublished interface dataset includes the request method, request path, request header, identity credentials, query parameters, and request body.

[0297] Optionally, in this embodiment, after security permission is granted, the browser proxy module (or proxy gateway) in the system will intercept HTTP / HTTPS request data from the cloud service console, CLI tool, or SDK, mainly including: request URL, request method (GET / POST / PUT / DELETE), request headers (including Authorization, Content-Type, etc.), request body (usually JSON or form data), response status code, and response body.

[0298] Next, an HTTP protocol parser is used to analyze the content of network packets; syntax parsing is performed on the structured formats of common cloud platform SDK calls (such as JSON, REST API path specifications); key fields are extracted: URL path, request method, parameter location, and identity credentials. This forms a structured raw API dataset.

[0299] For example, a structured raw API dataset includes:

[0300] {

[0301] "method": "GET", [Request Method]

[0302] "url":" / subscriptions / xxxx / resourceGroups / rgname / providers / Microsoft.Compute / virtualMachines / vm-name", [The URL of the requested resource path]

[0303] "headers": {

Request headers

[0304] "Authorization": "Bearer eyxxxx...", [Authorization credentials]

[0305] "Content-Type": "application / json" [Media type in the request body]

[0306] },

[0307] "query": {}, [query parameters]

[0308] "body": {} [Request Body]

[0309] }

[0310] Further extraction is possible:

[0311] The cloud provider to be used [the cloud service provider identified from the request URL or other context, such as Azure, AWS, etc.], the request identity [identity information extracted from the Authorization field or other identity identifiers in the request header, such as the token used, service principal, etc.], and the type and ID of the target resource [the resource type and unique identifier of the resource extracted from the URL].

[0312] The system compares the structured request data with known public interfaces to identify unpublished interfaces.

[0313] Specifically, one way to identify undisclosed interfaces is by having the request path contain a specific resource type or operation that is not mentioned in the public documentation.

[0314] One way to identify undisclosed interfaces is by having the request path contain a specific prefix or suffix.

[0315] The system extracts the request methods and request paths of these undocumented interfaces to form an undocumented interface dataset.

[0316] By parsing and structuring request data, the system can proactively discover undocumented internal interfaces, test interfaces, and Beta Preview interfaces within the Microsoft Graph API. These interfaces may contain more high-privilege attribute fields. The system extracts the request methods and paths of these undocumented interfaces to form an interface dataset for subsequent interface call and permission analysis. This allows the system to obtain more hidden fields and information, thereby improving data completeness and accuracy. This is crucial for comprehensively analyzing the permission structure and potential security risks of Azure Active Directory.

[0317] Through step S702, this embodiment successfully obtains service data from the identity management platform for data parsing and structuring, laying a data foundation for subsequent template extraction from undisclosed interfaces.

[0318] To improve the management efficiency and security of the identity and access management platform, this application provides an embodiment of an apparatus for implementing all or part of the structured induction method for undisclosed interfaces based on the identity management platform. See [link to embodiment]. Figure 2The undisclosed interface structured summarization device based on the identity management platform specifically includes the following:

[0319] The undisclosed interface structure extraction module 10 is used to receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding undisclosed interface dataset, wherein the undisclosed interface dataset includes request methods and request paths;

[0320] The module 20 for determining the unified call template for undisclosed interfaces is used to classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, perform dynamic variable matching on the request path of each service category interface dataset using regular expressions, construct a parameter dictionary to perform parameterized replacement on the dynamic variables, determine the corresponding standardized interface path, and construct a unified call template based on the standardized interface path, the parameter dictionary, and the request method.

[0321] The undisclosed interface structured display module 30 is used to map the unified call template to the permission entries of the permission model of the identity management platform, perform permission matching based on the path key fields in the unified call template, determine the corresponding permission mapping table, perform semantic segmentation on the request methods in the permission mapping table, determine the corresponding operation type, summarize and aggregate the operation type and the standardized interface path according to the resource type in the key fields, determine the interface structure under each resource type, and perform structured display of the undisclosed interfaces of the identity management platform based on the interface structure.

[0322] As described above, the structured summarization device for undisclosed interfaces based on an identity management platform provided in this application embodiment can obtain an undisclosed interface dataset, including request methods and request paths, by parsing request data from the identity management platform; classify the interface data belonging to the identity management platform by service type; perform dynamic variable matching and parameterized replacement on the request paths of each service category interface dataset using regular expressions to obtain standardized interface paths; perform permission matching based on the path key fields in the standardized interface paths to obtain a permission mapping table; perform semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types; summarize and aggregate the operation types and standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type; and perform structured display of undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform.

[0323] From a hardware perspective, in order to improve the management efficiency and security of the identity and access management platform, this application provides an embodiment of an electronic device for implementing all or part of the undisclosed interface structured induction method based on the aforementioned identity management platform. The electronic device specifically includes the following components:

[0324] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to transmit information between the undisclosed interface structured summarization method based on the identity management platform and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the undisclosed interface structured summarization method based on the identity management platform in the previous embodiments, and the contents of these embodiments are incorporated herein, and repeated details will not be described again.

[0325] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0326] In practical applications, the structured induction method based on the undisclosed interface of the identity management platform can be executed on the electronic device side as described above, or all operations can be completed in the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed in the client device, the client device may further include a processor.

[0327] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0328] Figure 3 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 3 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 3 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0329] In one embodiment, the structured induction method functionality based on the undisclosed interface of the identity management platform can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following controls:

[0330] Step S101: Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path;

[0331] Step S102: Classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, use regular expressions to perform dynamic variable matching on the request path of each service category interface dataset, construct a parameter dictionary to perform parameterized replacement of the dynamic variables, determine the corresponding standardized interface path, and construct a unified calling template based on the standardized interface path, the parameter dictionary, and the request method.

[0332] Step S103: Map the unified call template to the permission entries of the permission model of the identity management platform, perform permission matching based on the path key fields in the unified call template, determine the corresponding permission mapping table, perform semantic segmentation on the request methods in the permission mapping table, determine the corresponding operation types, summarize and aggregate the operation types and the standardized interface paths according to the resource types in the key fields, determine the interface structure under each resource type, and perform a structured display of the undisclosed interfaces of the identity management platform based on the interface structure.

[0333] As described above, the electronic device provided in this application embodiment obtains a dataset of undisclosed interfaces, including request methods and request paths, by parsing request data from an identity management platform. It then categorizes the interface data belonging to the identity management platform by service type, performs dynamic variable matching and parameterized replacement of the request paths of each service category's interface dataset using regular expressions to obtain standardized interface paths. Based on the key fields of the standardized interface paths, it performs permission matching to obtain a permission mapping table. It then performs semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types. Finally, it summarizes and aggregates the operation types and standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type, and provides a structured display of the undisclosed interfaces. This improves the management efficiency and security of the identity and access management platform.

[0334] In another implementation, the undisclosed interface structured induction method based on the identity management platform can be configured separately from the central processing unit 9100. For example, the undisclosed interface structured induction method based on the identity management platform can be configured as a chip connected to the central processing unit 9100, and the function of the undisclosed interface structured induction method based on the identity management platform can be realized through the control of the central processing unit.

[0335] like Figure 3 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 3 All components shown; in addition, the electronic device 9600 may also include Figure 3 For components not shown, please refer to existing technologies.

[0336] like Figure 3 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0337] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0338] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0339] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0340] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device for communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0341] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which is the same as in a conventional mobile communication terminal.

[0342] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is also coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored sound via the speaker 9131.

[0343] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the undisclosed interface structured induction method based on an identity management platform, where the execution subject is a server or client, as described in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the undisclosed interface structured induction method based on an identity management platform, where the execution subject is a server or client, as described in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0344] Step S101: Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path;

[0345] Step S102: Classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, use regular expressions to perform dynamic variable matching on the request path of each service category interface dataset, construct a parameter dictionary to perform parameterized replacement of the dynamic variables, determine the corresponding standardized interface path, and construct a unified calling template based on the standardized interface path, the parameter dictionary, and the request method.

[0346] Step S103: Map the unified call template to the permission entries of the permission model of the identity management platform, perform permission matching based on the path key fields in the unified call template, determine the corresponding permission mapping table, perform semantic segmentation on the request methods in the permission mapping table, determine the corresponding operation types, summarize and aggregate the operation types and the standardized interface paths according to the resource types in the key fields, determine the interface structure under each resource type, and perform a structured display of the undisclosed interfaces of the identity management platform based on the interface structure.

[0347] As described above, the computer-readable storage medium provided in this application provides a dataset of undisclosed interfaces, including request methods and request paths, by parsing request data from an identity management platform. It categorizes the interface data belonging to the identity management platform by service type, performs dynamic variable matching and parameterized replacement of the request paths of each service category's interface dataset using regular expressions to obtain standardized interface paths, performs permission matching based on the path key fields in the standardized interface paths to obtain a permission mapping table, performs semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types, and summarizes and aggregates the operation types and standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type. This results in a structured display of the undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform.

[0348] Embodiments of this application also provide a computer program product capable of implementing all steps of the undisclosed interface structured induction method based on an identity management platform, where the execution subject is a server or client, as described in the above embodiments. When executed by a processor, this computer program / instruction implements the steps of the undisclosed interface structured induction method based on an identity management platform. For example, the computer program / instruction implements the following steps:

[0349] Step S101: Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path;

[0350] Step S102: Classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, use regular expressions to perform dynamic variable matching on the request path of each service category interface dataset, construct a parameter dictionary to perform parameterized replacement of the dynamic variables, determine the corresponding standardized interface path, and construct a unified calling template based on the standardized interface path, the parameter dictionary, and the request method.

[0351] Step S103: Map the unified call template to the permission entries of the permission model of the identity management platform, perform permission matching based on the path key fields in the unified call template, determine the corresponding permission mapping table, perform semantic segmentation on the request methods in the permission mapping table, determine the corresponding operation types, summarize and aggregate the operation types and the standardized interface paths according to the resource types in the key fields, determine the interface structure under each resource type, and perform a structured display of the undisclosed interfaces of the identity management platform based on the interface structure.

[0352] As described above, the computer program product provided in this application provides a dataset of undisclosed interfaces, including request methods and request paths, by parsing request data from an identity management platform. It categorizes the interface data belonging to the identity management platform by service type, performs dynamic variable matching and parameterized replacement of the request paths of each service category's interface dataset using regular expressions to obtain standardized interface paths, performs permission matching based on the path key fields in the standardized interface paths to obtain a permission mapping table, performs semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types, and summarizes and aggregates the operation types and standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type. This results in a structured display of the undisclosed interfaces, thereby improving the management efficiency and security of the identity and access management platform.

[0353] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0354] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0355] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0356] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0357] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for structured induction of undisclosed interfaces based on an identity management platform, characterized in that, The method includes: Receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding unpublished interface dataset, wherein the unpublished interface dataset includes the request method and the request path; The undisclosed interface dataset is categorized by platform, and interface data belonging to the identity management platform is filtered out. The interface dataset belonging to the identity management platform is then categorized by service type to determine multiple service category interface datasets. The request paths of each service category interface dataset are dynamically matched using regular expressions. A parameter dictionary is constructed to parameterize and replace the dynamic variables, and the corresponding standardized interface path is determined. A unified calling template is constructed based on the standardized interface path, the parameter dictionary, and the request method. The unified call template is mapped to the permission entries of the permission model of the identity management platform. Permission matching is performed based on the path key fields in the unified call template to determine the corresponding permission mapping table. The request methods in the permission mapping table are semantically segmented to determine the corresponding operation types. The operation types and the standardized interface paths are summarized and aggregated according to the resource types in the key fields to determine the interface structure under each resource type. The structured display of the undisclosed interfaces of the identity management platform is performed based on the interface structure.

2. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 1, characterized in that, The dynamic variable matching of request paths for each of the service category interface datasets using regular expressions includes: Common fields are extracted from the request paths of each service category interface dataset to determine the corresponding static fields and dynamic variables. The static fields are fixed identifiers that represent the service type, and the dynamic variables are unique identifier parameters in the resource layer. The dynamic variables are matched based on preset regular expression rules, which include resource identifier patterns, subscription ID patterns, and resource group name patterns.

3. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 2, characterized in that, The construction of the parameter dictionary performs parameter replacement on the dynamic variables and determines the corresponding standardized interface path, including: A parameter dictionary is constructed based on the matched dynamic variables, and the parameter dictionary is compared with the official documentation of the identity management platform for integrity checks. Based on the parameter dictionary that has undergone the integrity check, the matched dynamic variables are parameterized and replaced to determine the corresponding standardized interface path.

4. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 1, characterized in that, The step of mapping the unified invocation template to the permission entries of the permission model of the identity management platform, and performing permission matching based on the path key field in the unified invocation template to determine the corresponding permission mapping table, includes: Obtain role definition data from the permission model of the identity management platform, wherein the role definition data includes a set of permission actions and resource types associated with the set of permission actions; Extract the path key fields from the unified call template, parse the resource hierarchy structure of the path key fields, and determine the corresponding undisclosed interface resource types; Perform a fuzzy match between the undisclosed interface resource types and the resource types in the role definition data. If the match is successful, output the mapping relationship and determine the corresponding permission mapping table.

5. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 4, characterized in that, The step of summarizing and aggregating the operation type and the standardized interface path according to the resource type in the key fields to determine the interface structure under each resource type includes: Cluster analysis is performed on the operation type and the standardized interface path according to the undisclosed interface resource type to establish a resource-operation matrix, where the matrix rows represent resource types, the matrix columns represent operation types, and the matrix values ​​record the set of interface paths. Based on the resource-operation matrix, a standardized interface structure tree is generated for each resource type. The standardized interface structure tree includes resource level, supported operation methods, and associated permission policies.

6. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 1, characterized in that, The process of classifying the interface dataset belonging to the identity management platform by service type determines multiple service category interface datasets, including: Identify the service type of the interface based on key fields in the request path; Based on the preset service classification rules, the interface dataset is grouped according to service type.

7. The method for structured induction of undisclosed interfaces based on an identity management platform according to claim 1, characterized in that, The process of receiving request data from the identity management platform and parsing and structuring the request data to determine the corresponding unpublished interface dataset includes: The proxy module receives request data from the identity management platform, wherein the request data includes a request URL, a request method, a request header, and a request body. The HTTP protocol parser performs content analysis on the request data and then performs structured syntax parsing on the data after content analysis to determine the corresponding unpublished interface dataset. The unpublished interface dataset includes the request method, request path, request header, identity credentials, query parameters, and request body.

8. A structured summarization device based on an identity management platform with undisclosed interfaces, characterized in that, The device includes: The undisclosed interface structure extraction module is used to receive request data from the identity management platform and parse and structure the interface information of the request data to determine the corresponding undisclosed interface dataset, wherein the undisclosed interface dataset includes request methods and request paths; The module for determining the unified call template for undisclosed interfaces is used to classify the undisclosed interface dataset by platform, filter out the interface data belonging to the identity management platform, classify the interface dataset belonging to the identity management platform by service type, determine multiple service category interface datasets, perform dynamic variable matching on the request path of each service category interface dataset using regular expressions, construct a parameter dictionary to perform parameterized replacement on the dynamic variables, determine the corresponding standardized interface path, and construct a unified call template based on the standardized interface path, the parameter dictionary, and the request method. The undisclosed interface structured display module is used to map the unified call template to the permission entries of the permission model of the identity management platform. It performs permission matching based on the path key fields in the unified call template to determine the corresponding permission mapping table. It performs semantic segmentation on the request methods in the permission mapping table to determine the corresponding operation types. It summarizes and aggregates the operation types and the standardized interface paths according to the resource types in the key fields to determine the interface structure under each resource type. Based on the interface structure, it displays the undisclosed interfaces of the identity management platform in a structured manner.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the undisclosed interface structured induction method based on the identity management platform as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the undisclosed interface structured induction method based on an identity management platform as described in any one of claims 1 to 7.

Images