Implementation method and system for API service authorization and auditing based on block chain

Abstract

The invention relates to the technical field of API service authorization and auditing, in particular to an API service authorization and auditing implementation method and system based on a block chain, and the method comprises the following steps: building a block chain network based on Fabric, registering block chain identities for a service provider user and a service user user respectively, and generating a corresponding public key, a corresponding private key and the like; the method has the advantages that the audit logs are stored through the block chain technology, it is ensured that all operation records cannot be tampered, and the credibility of audit data is improved. Authorization and auditing processes are automatically processed by using an intelligent contract, human intervention is reduced, and operation errors and fraud risks are reduced. Asymmetric encryption and digital signature technologies are adopted to ensure that identities of a service provider and a user are real and reliable, and man-in-the-middle attack and identity false use are prevented.

Description

Technical Field

[0001] This invention relates to the field of API service authorization and auditing technology, specifically to a blockchain-based method and system for API service authorization and auditing. Background Technology

[0002] Blockchain is an immutable, distributed, shared ledger. In a blockchain, data is stored across multiple parties, and consensus algorithms ensure data consistency across nodes. Data in a blockchain can only be appended, not deleted or modified. Newer blockchains are programmable; smart contracts can encode business rules into the blockchain. These rules (code), like data, cannot be deleted or modified. The code executes automatically when invoked and cannot be skipped; the execution results are also written to the blockchain. Because data is stored across multiple parties, on-chain data is immutable.

[0003] Asymmetric encryption algorithms are a special type of cryptographic algorithm that involves a pair of keys during encryption and decryption: a public key and a private key. If data is encrypted with the public key, it can only be decrypted with the corresponding private key; conversely, if data is encrypted with the private key, it can only be decrypted with the corresponding public key.

[0004] Furthermore, the existing API service authorization and auditing processes suffer from issues such as lack of trust, susceptibility to data tampering, and low auditing efficiency. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for implementing API service authorization and auditing based on blockchain, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for implementing API service authorization and auditing based on blockchain, comprising the following steps:

[0007] (1) Build a blockchain network based on Fabric, including service provider organizations and service user organizations, and deploy peer nodes under each organization;

[0008] (2) Register blockchain identities for service provider users and service user users respectively, and generate corresponding public and private keys;

[0009] (3) Deploy service authorization and audit smart contracts on the blockchain network. The smart contracts include functions for saving service information, viewing service information, authorizing services, viewing authorized information, and saving service audit information.

[0010] (4) Service provider users upload API service information to the blockchain through smart contracts. The information includes the API unique number, URL, method and public key.

[0011] (5) The service user applies for authorization from the service provider. The service provider generates authorization information containing API number, user public key hash, authorization time and signature, and puts it on the blockchain through smart contract;

[0012] (6) When the service user calls the API, a Proof header containing a timestamp, public key hash and signature is generated. The service provider executes the service after verifying the validity of the Proof.

[0013] (7) The service provider regularly uploads audit information to the blockchain in batches, including the call time, signature and service provider signature, to form an unalterable audit log.

[0014] Preferably, in step (5), the signature of the authorization information is generated by the service provider using its private key to sign the original text concatenated with the API number, the user's public key hash, and the authorization time.

[0015] Preferably, the Proof header generation in step (6) includes: concatenating the API number, public key hash, timestamp, and call parameters as the original signature, signing it with the service user's private key, and then encoding it with Base64 to generate the header.

[0016] Preferably, in step (7), the identity of the service provider, authorization matching and signature validity need to be verified before the audit information is uploaded to the blockchain.

[0017] Preferably, the blockchain network adopts the Fabric framework, the smart contracts are implemented based on chaincode, and the audit information is uploaded to the chain in batches when the same user makes the same API call a preset number of times.

[0018] A system for implementing a blockchain-based API service authorization and auditing method includes:

[0019] The blockchain network building module is used to build a Fabric-based blockchain network, which includes service provider organizations and service user organizations, and deploys peer nodes under each organization.

[0020] The user identity registration module is connected to the service provider organization and the service user organization respectively. It is used to register blockchain identities for service provider users and service user users respectively, and generate corresponding public and private keys.

[0021] The smart contract deployment module, connected to the blockchain network construction module, is used to deploy service authorization and audit smart contracts on the blockchain network. The smart contracts have the functions of saving service information, viewing service information, authorizing services, viewing authorization information, and saving service audit information.

[0022] The API service information on-chain module is connected to the service provider user and the smart contract deployment module. It is used by the service provider user to upload API service information to the blockchain through a smart contract. The information includes the API unique number, URL, method and public key.

[0023] The authorization information on-chain module is connected to the service provider user, the service user user, and the smart contract deployment module. When the service user user requests authorization from the service provider, the service provider generates authorization information containing the API number, user public key hash, authorization time, and signature, and uploads it to the blockchain through the smart contract.

[0024] The API call verification module is connected to the service user and the service provider user. It is used to generate a Proof header containing a timestamp, public key hash and signature when the service user calls the API. The service provider executes the service after verifying the validity of the Proof.

[0025] The audit information upload module is connected to the service provider user and the smart contract deployment module. It is used by the service provider to upload audit information to the blockchain in batches on a regular basis, including the call time, signature and service provider signature, to form an immutable audit log.

[0026] Preferably, in the authorization information on-chain module, the authorization information signature generation unit is used by the service provider to use its private key to sign the original text concatenated with the API number, user public key hash, and authorization time to generate the signature in the authorization information.

[0027] Preferably, in the API call verification module, the Proof header generation unit is used to concatenate the API number, public key hash, timestamp, and call parameters as the original signature, and then generate the Proof header by signing it with the service user's private key and encoding it with Base64.

[0028] Preferably, the audit information on-chain module includes: a verification unit, used to verify the service provider's identity, authorization matching, and signature validity before the audit information is on-chain; and an on-chain execution unit, connected to the verification unit, used to on-chain the audit information in batches after the verification is passed.

[0029] Preferably, the blockchain network built by the blockchain network building module adopts the Fabric framework, the smart contracts deployed by the smart contract deployment module are implemented based on chaincode, and the audit information uploaded to the chain in batches by the audit information upload module is when the same user makes the same API call a preset number of times.

[0030] Compared with the prior art, the beneficial effects of the present invention are:

[0031] This invention proposes a blockchain-based method and system for API service authorization and auditing. By storing audit logs using blockchain technology, it ensures that all operation records are tamper-proof, thus improving the credibility of audit data. Smart contracts are used to automatically process the authorization and auditing processes, reducing human intervention and mitigating the risks of operational errors and fraud. Asymmetric encryption and digital signature technologies are employed to ensure the authenticity and reliability of the identities of service providers and users, preventing man-in-the-middle attacks and identity impersonation. The blockchain's multi-party consensus mechanism enables service providers and users to collaborate efficiently in an environment of partial trust, reducing trust costs. Audit information is uploaded to the blockchain in real time and combined with timestamps, facilitating rapid tracing of service call history and improving troubleshooting efficiency. Attached Figure Description

[0032] Figure 1 Service authorization flowchart for this invention;

[0033] Figure 2 This is a flowchart of the service call process for this invention;

[0034] Figure 3 This is a flowchart of the auditing process for this invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of the present invention clear and complete, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some, not all, embodiments of the present invention, and are merely illustrative of the embodiments of the present invention. They are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Example 1: This invention provides a technical solution: a method for implementing API service authorization and auditing based on blockchain, comprising the following steps:

[0037] (1) Building a blockchain network

[0038] A Fabric blockchain network is established as the foundation for the service authorization audit implementation method. In this implementation method, users will save service information, service authorization information, and service audit log information to the Fabric blockchain network through smart contracts, i.e., put them on the chain.

[0039] The Fabric blockchain network consists of two organizations: a service provider organization and a service user organization. The service provider organization and its peer nodes are used by service provider users to upload and view service information, service authorization information, and service audit logs on the chain. The service user organization and its peer nodes are used by service user users to audit and view the service audit logs on the chain.

[0040] (2) Register a blockchain identity

[0041] For ordinary users, accessing the Fabric blockchain network requires prior registration of a blockchain identity. A blockchain identity essentially refers to a private key and certificate.

[0042] This scheme includes two types of users: service provider users and service user users. Service provider users are users registered under the service provider organization, and service user users are users registered under the service user organization. After successful registration, each user has their own user certificate (public key) and private key, and the blockchain network can verify the user's identity through the user certificate.

[0043] (3) Deployment of service authorization and audit smart contracts

[0044] Deploy a service authorization and auditing smart contract on the already deployed Fabric blockchain network. The smart contract provides the following call functions:

[0045] Service information storage

[0046] The service authorization and auditing smart contract provides a function for storing API service information on the blockchain. This function can only be called by service provider users. When calling this function, two parameters need to be passed: the first parameter is the api-id, which is the unique number of the API service, and the second parameter is the relevant information of the API service, which is a JSON format string, as shown in the example below:

[0047]

[0048] View service information

[0049] The service authorization and audit smart contract provides a function to retrieve and view API service information. This function can be called by all users. When calling this function, one parameter, api-id, and the unique number of the API service, must be passed in.

[0050] Service Authorization

[0051] The service authorization and auditing smart contract provides a function to store API service authorization information. This function can only be called by the service provider. When calling this function, two parameters are required: the first is a key, and the second is a value. The key is {api-id}:{key-id}, where key-id is the hash value of the public key of the user requesting the API service, using the SHA256 hash algorithm. The value is a JSON string with the following format:

[0052]

[0053] "api-id":"Unique API service ID",

[0054] "key-id":"Hash value of the public key of the service user",

[0055] "time":"Authorization period",

[0056] "sign":"signature"

[0057] }

[0058] The sign field is the signature of the authorization information by the service provider using its private key. The format of the signed information (authorization information) is: {api-id}#{key-id}#{time}.

[0059] During the service authorization process, a series of verifications are performed to ensure that the authorization is made by a genuine service provider user: First, the service information viewing function is called to obtain API service information and verify that the API service does indeed belong to the current caller; next, the authorization time is verified, and the difference between the authorization time and the current time cannot exceed 5 minutes to avoid the signature being reused; finally, the caller's public key is used to sign and verify the sign in the parameter to ensure that the authorization operation is the true intention of the service provider.

[0060] Viewing authorization information

[0061] The service authorization and audit smart contract provides a function to view authorization information. This function can be called by any user. When calling this function, one parameter, key, needs to be passed in. The key is {api-id}:{key-id}, where key-id is the hash value of the public key of the user who applied to use the API service. The hash algorithm used is SHA256.

[0062] Service audit information storage

[0063] The service authorization and audit smart contract provides a function to store API service audit information. This function can only be called by the service provider. When calling this function, two parameters are required: the first is a key, and the second is a value. The key is in the format {key-id}:{api-id}:{timestamp}, where key-id is the hash value of the public key of the user requesting the API service, api-id is the unique identifier of the API service, and timestamp is the current timestamp; the value is a JSON string, with the following format:

[0064] {

[0065]

[0066] A series of verifications are performed during the process of saving service audit information:

[0067] 1) Verify that the current caller is the provider of the API service corresponding to the api-id in the key;

[0068] 2) Verify authorization information, that is, ensure that the key-id and api-id can be correctly matched when querying authorization information;

[0069] 3) Verify the proof signature using the service provider's public key, where the original text information being signed is audit-info.

[0070] (4) Service Authorization Process

[0071] The specific process is as follows:

[0072] The service user applies to the service provider for authorization to provide a specific API service (such as purchasing the service);

[0073] After the service provider and the service user reach an agreement on authorization, the service provider obtains the authorization parameters, which include: 1) the unique number of the authorized API service (api-id); 2) the key-id, which is the hash value (sha256 algorithm) of the public key of the service user; 3) the timestamp of the authorization time (time); 4) the signature of the authorization information by the service provider using its private key. The format of the signed information (authorization information) is: {api-id}#{key-id}#{time}.

[0074] The service licensor uses its own blockchain identity to call the function in the service authorization and audit smart contract that stores API service authorization information.

[0075] (5) Service Invocation Process

[0076] After obtaining authorization for the corresponding API service, the service user can organize service parameters according to the API service description information and then call the service. During the call process, the service user needs to add a header named Proof to the API service request. The process of generating the Proof value is as follows.

[0077] Get the current timestamp, which is the time the service was invoked, denoted as time;

[0078] The public key of the service user is hashed using the SHA256 hash algorithm, and the resulting value is denoted as key-id;

[0079] The unique identifier of the API service, api-id, key-id, time, and API service call parameters are concatenated in order to form the original signature text. The original signature text is then signed using the private key of the user of the service. The resulting signature value is denoted as sign.

[0080] Perform base64 calculations on time, key-id, and sign respectively, and then concatenate the resulting values ​​using ".". The resulting value is the Proof value.

[0081] (6) Service audit retention process

[0082] When the service provider receives a request from a user to call the API service, the specific processing procedure is as follows:

[0083] The Proof parameter is obtained from the request header and split into three parts based on "." to obtain three strings. Each of these three strings is then base64 decoded to obtain the call time (time), the service user's public key hash (key-id), and the signature value (sign).

[0084] The time interval between the verification call time and the current time should not be too large, for example, the interval should not exceed 5 minutes;

[0085] Using the unique api-id and key-id of the API service, and with the blockchain identity of the service provider user, the authorization information of the service authorization and audit smart contract can be viewed to confirm that the service has been authorized to the caller;

[0086] The signature is created by concatenating the API service's unique ID (api-id), key-id, time, and API service call parameters in sequence.

[0087] The signature verification operation is performed using the service user's public key, the original signature text, and the signature value sign to determine that the caller is the real service user.

[0088] After verification, the service provider processes the data according to the corresponding business logic and organizes a response to return to the service user.

[0089] The service provider will persistently save the call time (time), key-id, sign, and parameter information of this call to the service provider's database (or cache);

[0090] When the same service user makes a certain number of calls to the same API service (e.g., 1000 times), the service provider queries the database for call record information and organizes it into JSON format, as follows:

[0091]

[0092] The "proof" in the above JSON is the signature of the audit-info using the service provider's user private key;

[0093] The parameter key is concatenated in the format {key-id}:{api-id}:{timestamp}, and the above JSON is used as the value. The service provider's blockchain identity is used to call the service authorization and audit smart contract to save the service audit information of the smart contract, thus completing the audit record of a batch of API service calls.

[0094] Example 2, based on Example 1, such as Figure 1 The service authorization process is described in detail below:

[0095] 1) The service user submits an authorization request, including the API number (api-id) and its own public key hash (key-id);

[0096] 2) The service provider verifies API ownership, generates authorization information (api-id, key-id, timestamp), and signs the original authorization text ({api-id}#{key-id}#{time}) using its private key;

[0097] 3) Call the "Service Authorization" function of the smart contract to store the authorization information on the blockchain;

[0098] 4) The blockchain network writes the authorization record into the ledger through a consensus mechanism, thus completing the authorization process.

[0099] like Figure 2 The diagram illustrates the key steps in Proof generation and verification during service calls:

[0100] 1) The service user concatenates the API number, key-id, timestamp, and call parameters as the original signature and generates a signature using the private key;

[0101] 2) Encode the timestamp, key-id, and sign using Base64, concatenate them into a Proof value, and add it to the request header;

[0102] 3) The service provider parses the Proof, decodes it, and then verifies the validity of the time, the authorization status, and the authenticity of the signature (using the public key of the service user);

[0103] 4) After successful verification, execute the business logic, return a response, and cache the call record.

[0104] like Figure 3 The diagram illustrates the process of batch uploading audit logs to the blockchain:

[0105] 1) The service provider monitors the call records and triggers the audit on the blockchain when the same user makes the same API call to the same API 1000 times (e.g., 1000 times).

[0106] 2) Organize the audit information (audit-info) and attach the service provider's signature (proof), forming JSON format data;

[0107] 3) Call the "Service Audit Information Saving" function of the smart contract, and upload the audit data to the blockchain using {key-id}:{api-id}:{timestamp} as the key;

[0108] 4) After verifying the identity, authorization matching, and signature validity of the service provider, the blockchain network writes the audit log to the ledger.

[0109] Example 3, based on Example 2, proposes a system for implementing the blockchain-based API service authorization and auditing method according to claim 5, comprising:

[0110] The blockchain network construction module is used to build a Fabric-based blockchain network, which includes service provider organizations and service user organizations, and deploys peer nodes under each organization. The blockchain network built by the blockchain network construction module adopts the Fabric framework. The smart contracts deployed by the smart contract deployment module are implemented based on chaincode. The audit information upload module uploads audit information to the chain in batches when the same user makes the same API call a preset number of times.

[0111] The user identity registration module is connected to the service provider organization and the service user organization respectively. It is used to register blockchain identities for service provider users and service user users respectively, and generate corresponding public and private keys.

[0112] The smart contract deployment module, connected to the blockchain network construction module, is used to deploy service authorization and audit smart contracts on the blockchain network. The smart contracts have the functions of saving service information, viewing service information, authorizing services, viewing authorization information, and saving service audit information.

[0113] The API service information on-chain module is connected to the service provider user and the smart contract deployment module. It is used by the service provider user to upload API service information to the blockchain through a smart contract. The information includes the API unique number, URL, method and public key.

[0114] The authorization information on-chain module is connected to the service provider user, the service user user, and the smart contract deployment module. When the service user user requests authorization from the service provider, the service provider generates authorization information containing the API number, user public key hash, authorization time, and signature, and uploads it to the blockchain through a smart contract. The authorization information signature generation unit is used by the service provider to use its private key to sign the original text concatenated with the API number, user public key hash, and authorization time to generate the signature in the authorization information.

[0115] The API call verification module is connected to both the service user and the service provider. It is used to generate a Proof header containing a timestamp, public key hash, and signature when the service user calls the API. The service provider executes the service after verifying the validity of the Proof. The Proof header generation unit is used to concatenate the API number, public key hash, timestamp, and call parameters as the original signature. After signing with the service user's private key, the signature is generated by Base64 encoding.

[0116] The audit information upload module is connected to the service provider user and smart contract deployment module. It is used by the service provider to upload audit information to the blockchain in batches on a regular basis, including the call time, signature, and service provider signature, forming an immutable audit log. It includes: a verification unit, which is used to verify the service provider's identity, authorization matching, and signature validity before the audit information is uploaded to the blockchain; and an upload execution unit, which is connected to the verification unit, and is used to upload the audit information to the blockchain in batches after the verification is passed.

[0117] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for implementing API service authorization and auditing based on blockchain, characterized in that: The following steps are involved: (1) Build a blockchain network based on Fabric, including service provider organizations and service user organizations, and deploy peer nodes under each organization; (2) Register blockchain identities for service provider users and service user users respectively, and generate corresponding public and private keys; (3) Deploy service authorization and audit smart contracts on the blockchain network. The smart contracts include functions for saving service information, viewing service information, authorizing services, viewing authorized information, and saving service audit information. (4) Service provider users upload API service information to the blockchain through smart contracts. The information includes the API unique number, URL, method and public key. (5) The service user applies for authorization from the service provider. The service provider generates authorization information containing API number, user public key hash, authorization time and signature, and puts it on the blockchain through smart contract; (6) When the service user calls the API, a Proof header containing a timestamp, public key hash and signature is generated. The service provider executes the service after verifying the validity of the Proof. (7) The service provider regularly uploads audit information to the blockchain in batches, including the call time, signature and service provider signature, to form an unalterable audit log.

2. The implementation method for API service authorization and auditing based on blockchain according to claim 1, characterized in that: In step (5), the signature of the authorization information is generated by the service provider using its private key to sign the original text concatenated with the API number, the user's public key hash, and the authorization time.

3. The implementation method for API service authorization and auditing based on blockchain according to claim 2, characterized in that: The Proof header generation in step (6) includes: concatenating the API number, public key hash, timestamp, and call parameters as the original signature, signing it with the service user's private key, and then encoding it with Base64 to generate the header.

4. The implementation method for API service authorization and auditing based on blockchain according to claim 3, characterized in that: In step (7), the identity of the service provider, authorization matching, and signature validity must be verified before the audit information is uploaded to the blockchain.

5. The implementation method for API service authorization and auditing based on blockchain according to claim 4, characterized in that: The blockchain network uses the Fabric framework, and smart contracts are implemented based on chaincode. Audit information is uploaded to the chain in batches when the same user makes a preset threshold number of calls to the same API.

6. A system for implementing the blockchain-based API service authorization and auditing method according to claim 5, characterized in that: include: The blockchain network building module is used to build a Fabric-based blockchain network, which includes service provider organizations and service user organizations, and deploys peer nodes under each organization. The user identity registration module is connected to the service provider organization and the service user organization respectively. It is used to register blockchain identities for service provider users and service user users respectively, and generate corresponding public and private keys. The smart contract deployment module, connected to the blockchain network construction module, is used to deploy service authorization and audit smart contracts on the blockchain network. The smart contracts have the functions of saving service information, viewing service information, authorizing services, viewing authorization information, and saving service audit information. The API service information on-chain module is connected to the service provider user and the smart contract deployment module. It is used by the service provider user to upload API service information to the blockchain through a smart contract. The information includes the API unique number, URL, method and public key. The authorization information on-chain module is connected to the service provider user, the service user user, and the smart contract deployment module. When the service user user requests authorization from the service provider, the service provider generates authorization information containing the API number, user public key hash, authorization time, and signature, and uploads it to the blockchain through the smart contract. The API call verification module is connected to the service user and the service provider user. It is used to generate a Proof header containing a timestamp, public key hash and signature when the service user calls the API. The service provider executes the service after verifying the validity of the Proof. The audit information upload module is connected to the service provider user and the smart contract deployment module. It is used by the service provider to upload audit information to the blockchain in batches on a regular basis, including the call time, signature and service provider signature, to form an immutable audit log.

7. The system according to claim 6, characterized in that: In the authorization information on-chain module, the authorization information signature generation unit is used by the service provider to sign the original text concatenated with the API number, user public key hash and authorization time using the private key to generate the signature in the authorization information.

8. A system according to claim 6, characterized in that: In the API call verification module, the Proof header generation unit is used to concatenate the API number, public key hash, timestamp, and call parameters as the original signature. After signing with the service user's private key, the Proof header is generated by Base64 encoding.

9. A system according to claim 6, characterized in that: The audit information upload module includes: a verification unit, used to verify the service provider's identity, authorization matching, and signature validity before the audit information is uploaded to the blockchain; and an upload execution unit, connected to the verification unit, used to upload the audit information to the blockchain in batches after the verification is passed.

10. A system according to claim 6, characterized in that: The blockchain network built by the blockchain network construction module adopts the Fabric framework. The smart contracts deployed by the smart contract deployment module are implemented based on chaincode. The audit information uploaded to the chain in batches by the audit information upload module is based on the condition that the same user makes the same API call a preset number of times.

Images