Data security access method and device based on unique interface and storage medium
By using a unified access layer and a single entry point design, combined with encryption algorithms to process routing information, the problem of directly exposing backend interfaces is solved, thereby improving security and architectural compatibility.
Patent Information
- Application Number
- CN202511252076.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-03
- Publication Date
- 2025-11-18
AI Technical Summary
In web-based software development, backend interfaces are directly exposed to frontend users, leading to security risks and making management difficult, especially in scenarios involving architecture migration or hybrid architectures where compatibility is poor.
It adopts a unified access layer and a single entry point design, encrypts routing information through encryption algorithms and transmits it in the HTTP request header. The backend unified controller decrypts and distributes the request, which is suitable for monolithic services and microservice architectures.
It significantly reduces the risk of exposing the system's internal structure, enhances security, avoids the plaintext exposure of routing information, and maintains the flexibility and scalability of the architecture.
Smart Images
Figure CN120979772A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, and in particular to a data security access method, apparatus and storage medium based on a unique interface. Background Technology
[0002] In web-based software development, there are front-end and back-end development. Front-end development faces the user, while back-end development provides interfaces for various operations to the front-end. For example, the back-end might provide an interface for user registration at ` / aiSchool / user / register`, and the front-end calls this address and passes the registration parameters to allow the user to register. Similarly, the back-end might provide an interface for users to query their orders at ` / aiSchool / order / view`, and the front-end calls this address and passes the parameters to retrieve the data. In this scenario, the back-end interfaces are directly exposed to the front-end user, which can create security risks and hinder management.
[0003] Therefore, a data security access method, device, and storage medium based on a unique interface were developed to solve the above problems. Summary of the Invention
[0004] This invention proposes a data security access method, device, and storage medium based on a unique interface to solve the problem in the prior art where the backend interface is directly exposed to the frontend user, which can lead to security risks and is also not conducive to management.
[0005] The present invention achieves the above objectives through the following technical solutions: This invention provides a data security access method based on a unique interface, comprising: Obtain user's business operation information; Generate routing information based on the user's business operation information; The routing information is encrypted based on the encryption algorithm and the corresponding token obtained during business operations; The encrypted routing information is placed into the X-API-Route field of the HTTP request header through a front-end entry point, which is a unique entry point set by the request address; A request is generated based on the HTTP request header and the user's business operation information. The request is received by the unified controller in the backend. The controller then extracts the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypts it using the corresponding decryption algorithm, and executes the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. The front-end entry point receives the execution results returned by the back-end.
[0006] Furthermore, the business operation includes user registration and user order inquiry.
[0007] Furthermore, business operations are performed based on the decrypted information, including: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
[0008] Furthermore, the routing information is encrypted based on the encryption algorithm and the token obtained during business operations, including: Take the first 32 bits of the token as the key, and padded with 0 if necessary. The routing information is encrypted using the AES encryption algorithm based on the key.
[0009] Furthermore, for a monolithic service architecture, the request address is set as the unified, single entry point for all services.
[0010] Furthermore, for a microservice architecture, please set the request address to be the unique entry point for the corresponding service.
[0011] The present invention also provides a data security access device based on a unique interface, comprising: The acquisition module is used to acquire the user's business operation information; The generation module is used to generate routing information based on the user's business operation information; The encryption module is used to encrypt routing information based on the encryption algorithm and the TOKEN obtained during the business operation. The module is used to put the encrypted routing information into the X-API-Route field of the HTTP request header through the front-end entry point, which is a unique entry point set by the request address; The request generation module is used to generate a request based on the HTTP request header and the user's business operation information. The request is received by the unified controller in the backend, which then extracts the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypts it using the corresponding decryption algorithm, and executes the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. A receiving module is used to receive the execution results returned by the backend through the frontend entry point.
[0012] Furthermore, the business operation includes user registration and user order inquiry.
[0013] Furthermore, business operations are performed based on the decrypted information, including: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
[0014] The present invention also provides a storage medium, which is a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the data security access method based on a unique interface.
[0015] The beneficial effects of this invention are as follows: This invention significantly reduces the risk of exposing the system's internal structure and enhances security through a unified access layer and a single entry point design. It avoids the plaintext exposure of routing information while achieving secure route distribution. This invention is applicable to both monolithic service architectures and microservice architectures, maintaining architectural flexibility and scalability. Attached Figure Description
[0016] Figure 1 This is a schematic diagram of a data security access method based on a unique interface according to this application; Figure 2 This is a schematic diagram illustrating the implementation process of the data security access method based on a unique interface in this application embodiment. Detailed Implementation
[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0018] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.
[0019] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0020] like Figure 1As shown, a data security access method based on a unique interface includes: S1: Obtain user's business operation information; S2: Generate routing information based on the user's business operation information; S3: Encrypt routing information based on encryption algorithms and the corresponding tokens obtained during business operations; S4: The encrypted routing information is placed into the X-API-Route field of the HTTP request header through the front-end entry point, which is a unique entry point set by the request address; S5: Generate a request based on the HTTP request header and the user's business operation information. The request is used for the unified controller in the backend to receive and extract the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypt it using the corresponding decryption algorithm, and execute the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. S6: Receive the execution results returned by the backend through the frontend entry point.
[0021] In one embodiment, the business operation is one of user registration or user order inquiry.
[0022] In one embodiment, performing a business operation based on the decrypted information includes: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
[0023] In one embodiment, the routing information is encrypted based on the encryption algorithm and the token obtained during the service operation, including: Take the first 32 bits of the token as the key, and padded with 0 if necessary. The routing information is encrypted using the AES encryption algorithm based on the key.
[0024] In one embodiment, for a monolithic service architecture, the request address is set as a single, unified entry point for all services.
[0025] In one embodiment, for a microservice architecture, the request address is set as the unique entry point for the corresponding service.
[0026] In one embodiment, a data security access device based on a unique interface includes: The acquisition module is used to acquire the user's business operation information; The generation module is used to generate routing information based on the user's business operation information; The encryption module is used to encrypt routing information based on the encryption algorithm and the TOKEN obtained during the business operation. The module is used to put the encrypted routing information into the X-API-Route field of the HTTP request header through the front-end entry point, which is a unique entry point set by the request address; The request generation module is used to generate a request based on the HTTP request header and the user's business operation information. The request is received by the unified controller in the backend, which then extracts the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypts it using the corresponding decryption algorithm, and executes the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. A receiving module is used to receive the execution results returned by the backend through the frontend entry point.
[0027] In one embodiment, the business operation is one of user registration or user order inquiry.
[0028] In one embodiment, performing a business operation based on the decrypted information includes: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
[0029] In one embodiment, a storage medium is provided, which is a readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the data security access method based on a unique interface.
[0030] like Figure 2 As shown, taking the user registration and order query functions of the smart campus platform as an example, the implementation process of this technical solution is illustrated under both monolithic service architecture and microservice architecture: 1. Implementation under a monolithic service architecture Front-end processing: When a user fills in information and submits it on the registration page, the front-end system generates the route information "user / register". This route information is then encrypted using the AES algorithm combined with the token obtained during user login, resulting in the encrypted string "E1F3A7B2...". The specific steps are as follows: Take the first 32 bits of the token as the key, and padded with 0 if necessary.
[0031] AES encryption is performed using a password and path.
[0032] Subsequently, the frontend sets the request address to the unique entry point " / aiSchool", puts the encrypted routing information into the X-API-Route field of the HTTP Header, and sends a request along with the user registration parameters.
[0033] Backend processing: Upon receiving the request, the Unified Controller first extracts the encrypted information from the X-API-Route field in the request header, decrypts it using the corresponding decryption algorithm (AES combined with a token), and obtains the original route information "user / register". Then, based on this route information, the Unified Controller retrieves a custom annotation from the controller class, such as `@Facade(uri = " / user")`, and uses reflection to dispatch the request to the corresponding user registration function `userRegister()`. This function executes the registration logic (such as data validation and database writing) and returns the result to the frontend.
[0034] The order query function works similarly: the front end generates the routing information "order / view" and encrypts it, transmits it through the " / aiSchool" address and request header, and the back end decrypts it and dispatches it to the orderView() function for processing.
[0035] 2. Implementation under a microservice architecture User service scenario: The sole entry point for the user service is " / aiSchool / user". When a user performs registration-related operations, the frontend generates the route information "register", encrypts it, and places it in the request header X-API-Route, setting the request address to " / aiSchool / user". The unified controller of the backend user service decrypts the route information and calls the internal register() function to complete the registration.
[0036] Order service scenario: The sole entry point for the order service is " / aiSchool / order". When a user queries an order, the frontend generates routing information "view", encrypts it, and transmits it via the request header, with the request address being " / aiSchool / order". The unified controller of the backend order service decrypts the request and dispatches it to the view() function to process the order query.
[0037] 3. Security verification data During the platform testing phase, a security comparison test was conducted between the traditional solution and this solution: Traditional approach: In 1000 simulated attacks, the interface address and routing information were successfully obtained 32 times, with an information leakage rate of 3.2%.
[0038] This technical solution: In the same 1000 simulated attacks, due to the encryption of routing information and the uniqueness of interface addresses, no information leakage occurred, and the information leakage rate was 0%.
[0039] Test results show that this solution can effectively improve the security of the interface.
[0040] The advantages of this invention compared to existing technologies are: 1. Unified Access Layer and Unique Entry Point Design Traditional technology: Backend interfaces are directly exposed to the frontend, and each function corresponds to an independent request address (such as / aiSchool / user / register, / aiSchool / order / view). The frontend can directly obtain multiple interface addresses, which easily exposes the internal structure of the system.
[0041] This technical solution constructs a unified access layer as the sole entry point for all API requests ( / aiSchool in a monolithic architecture, and a unique address for each service in a microservice architecture, such as / aiSchool / user, / aiSchool / order). The frontend can only access this unique address and cannot obtain the specific interface paths within the system, significantly reducing the risk of exposing the internal system structure and enhancing security.
[0042] 2. Routing and distribution mechanism based on encrypted request headers Traditional technology: Routing information is directly included in the request address. The front end can know the routing path by viewing the request address, which poses a risk of routing information leakage. In addition, route distribution depends on the exposed address path and lacks security control.
[0043] This technical solution involves encrypting routing information on the front end using a custom encryption algorithm (such as AES combined with a token) and then encapsulating it in the HTTP header (X-API-Route) before transmission. The backend unified controller parses the encrypted routing information and then distributes the route accordingly. This mechanism of encrypting routing information and transmitting it through the request header avoids the plaintext exposure of routing information and achieves secure route distribution.
[0044] 3. Flexible design to adapt to multiple architectures Traditional technologies: Most interface management solutions are only applicable to a single architecture (either a monolithic architecture or a microservice architecture), and have poor compatibility in architecture migration or hybrid architecture scenarios.
[0045] This technical solution is applicable to both monolithic and microservice architectures. In a monolithic architecture, all functions are routed through a single entry point; in a microservice architecture, a single entry point is configured for each service, maintaining the flexibility and scalability of the architecture.
[0046] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A data security access method based on a unique interface, characterized in that, include: Obtain user's business operation information; Generate routing information based on the user's business operation information; The routing information is encrypted based on the encryption algorithm and the corresponding token obtained during business operations; The encrypted routing information is placed into the X-API-Route field of the HTTP request header through a front-end entry point, which is a unique entry point set by the request address; A request is generated based on the HTTP request header and the user's business operation information. The request is received by the unified controller in the backend. The controller then extracts the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypts it using the corresponding decryption algorithm, and executes the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. The front-end entry point receives the execution results returned by the back-end.
2. The data security access method based on a unique interface according to claim 1, characterized in that, The business operation includes user registration and user order inquiry.
3. The data security access method based on a unique interface according to claim 2, characterized in that, Perform business operations based on the decrypted information, including: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
4. The data security access method based on a unique interface according to claim 1, characterized in that, The routing information is encrypted based on the encryption algorithm and the token obtained during business operations, including: Take the first 32 bits of the token as the key, and padded with 0 if necessary. The routing information is encrypted using the AES encryption algorithm based on the key.
5. The data security access method based on a unique interface according to claim 1, characterized in that, For a monolithic service architecture, the request address is set as the unified, single entry point for all services.
6. The data security access method based on a unique interface according to claim 1, characterized in that, For microservice architectures, please set the request address to be the unique entry point for the corresponding service.
7. A data security access device based on a unique interface, characterized in that, include: The acquisition module is used to acquire the user's business operation information; The generation module is used to generate routing information based on the user's business operation information; The encryption module is used to encrypt routing information based on the encryption algorithm and the TOKEN obtained during the business operation. The module is used to put the encrypted routing information into the X-API-Route field of the HTTP request header through the front-end entry point, which is a unique entry point set by the request address; The request generation module is used to generate a request based on the HTTP request header and the user's business operation information. The request is received by the unified controller in the backend, which then extracts the encrypted information of the X-API-Route field from the HTTP request header through the backend entry point, decrypts it using the corresponding decryption algorithm, and executes the business operation based on the decrypted information. The backend entry point is a unique entry point set by the request address. A receiving module is used to receive the execution results returned by the backend through the frontend entry point.
8. A data security access device based on a unique interface according to claim 7, characterized in that, The business operation includes user registration and user order inquiry.
9. A data security access device based on a unique interface according to claim 8, characterized in that, Perform business operations based on the decrypted information, including: Based on the decrypted information, retrieve the custom annotations for the controller class; The request is dispatched to the corresponding function that handles the business operation based on the custom annotation of the controller class. This function is used to execute the business operation logic, which may be a function that executes the registration logic or a function that executes the order query logic.
10. A storage medium, characterized in that, The storage medium is a readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the data security access method based on a unique interface as described in any one of claims 1 to 6.