Method and apparatus for interfacing mobile terminal integrated external service with backend autonomous service

Abstract

The application provides a docking method and device for mobile terminal integrated external services and backend autonomous services, the method comprising: an intermediate layer between the mobile terminal integrated external services and the backend autonomous services receiving an access and call request from the external or autonomous services, the request carrying to-be-accessed and called data, service identity information, a service interface address to be accessed and called, and an access and call type; checking the service identity information based on a whitelist preset by the intermediate layer, and determining whether the service interface address matches the service interface address preset by the intermediate layer; when the checking passes and the address is determined to match, generating an access and call key based on the checked service identity information, the to-be-accessed and called data, the access and call type, a custom random number, and a shared key of the autonomous and external services, and sending the access and call key to the autonomous or external service, so that the autonomous or external service can verify the received access and call key, and access and call related data after the verification passes.

Description

Technical Field

[0001] This invention relates to the field of mobile terminal technology, and in particular to a method and apparatus for connecting external services integrated into a mobile terminal with backend autonomous services. Background Technology

[0002] In mobile applications, a self-developed backend service refers to a program service that is independently developed, possesses its own code intellectual property rights, and is integrated into the mobile application's backend. External services, in contrast, are program services developed by other development teams that provide certain service capabilities to external parties; their source code is generally not publicly available. Currently, both self-developed and external services typically use provided APIs to transmit data or receive external events and data for function forwarding. Transmitting data means enabling the corresponding external service to obtain partial data from the current self-developed service; receiving external events and data means providing the corresponding external service with a way to invoke the current self-developed service to achieve certain service capabilities or functions.

[0003] Inter-service interaction capabilities mostly require code-level integration and calls, resulting in high coupling. The security of this interaction primarily relies on security checks at the interface layer. This means that after calling the interface, the called service must perform relevant security checks to ensure access security. However, this approach cannot guarantee the security of interface calls during interactions between external services integrated into the mobile app and backend self-developed services. For example, malicious attacks such as network attacks on the interfaces may occur. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and apparatus for connecting external services integrated on a mobile terminal with autonomous backend services, so as to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides a method for interfacing external services integrated into a mobile terminal with backend self-developed services, the method comprising the following steps: An intermediate layer is set up between the external service integrated on the mobile terminal and the backend self-service to receive access and call requests from the external service or the self-service. The access and call request carries the data to be accessed and called from the external service or the self-service, service identity information, the address information of the service interface to be accessed and called, and the access and call type. The service identity information is verified based on the whitelist pre-configured in the middle layer, and it is determined whether the service interface address information matches the service interface address information pre-configured in the middle layer. When the verification passes and the address information matches, an access and invocation key is generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that they can verify the received access and invocation key. After successful verification, the middle layer authorizes access and invocation to the external service or the autonomous service. This allows the external service or the autonomous service to invoke the interface of the autonomous service or the external service based on the matched service interface address information, and to access and invoke the relevant data of the autonomous service or the external service based on the data to be accessed and invoked and the access and invocation type.

[0006] In some embodiments of the present invention, mutual access and invocation between the autonomous service and the external service are performed through different independent modules of the intermediate layer.

[0007] In some embodiments of the present invention, the intermediate layer includes an independent integration module and an open module. The integration module is used for the external service to access and call the autonomous service, and pre-integrates and configures the standard interface address information of the autonomous service. The open module is used for the autonomous service to access and call the external service, and pre-integrates and configures the standard interface address information of the external service.

[0008] In some embodiments of the present invention, the step of generating an access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and a shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, and the custom random number between the autonomous service and the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful. Alternatively, an access and invocation key can be generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that the autonomous service or the external service can decrypt the service encrypted with the shared key based on the received access and invocation key. If the decryption is successful, the verification is passed.

[0009] In some embodiments of the present invention, the access and invocation keys are also generated based on timestamps.

[0010] In some embodiments of the present invention, the step of generating an access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and a shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, the timestamp, and the custom random number defined by the autonomous service or the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful.

[0011] In some embodiments of the present invention, the service identity information includes account information, IP address information, and application; the access and invocation types include obtaining data, adding data, modifying data, and deleting data.

[0012] Another aspect of the present invention provides a device for interfacing external services integrated into a mobile terminal with backend autonomous services. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the aforementioned method.

[0013] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method.

[0014] Another aspect of the present invention provides a computer program product including computer instructions that, when executed by a processor, implement the steps of the aforementioned method.

[0015] The present invention provides a method and apparatus for connecting external services integrated into a mobile terminal with backend autonomous services. This method and apparatus can perform security verification on the services to be accessed and called before calling the interface through an intermediate layer set between the mobile terminal backend autonomous services and the integrated external services. The accessed and called services also perform security verification on the services to be accessed and called. After the security verification is passed by the dual protection, the corresponding services can be accessed and called through the service interface. This provides security protection for the service interface, avoids security risks of the service interface, and greatly improves the security of inter-service calls.

[0016] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0017] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0018] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0019] Figure 1 This is a flowchart illustrating a method for connecting external services integrated on a mobile device with self-developed backend services in one embodiment of the present invention. Figure 2 This is a schematic diagram of the architecture for connecting external services integrated on a mobile device with self-developed backend services in one embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0021] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0022] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0023] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0024] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0025] To improve the security of interface calls during inter-service communication, this invention proposes a method and apparatus for connecting external services integrated on a mobile device with self-developed backend services. An intermediate layer is set up between the external services integrated on the mobile device and the self-developed backend services. The intermediate layer performs security verification on the services to be accessed and called before calling the interface. After the security verification is passed, the corresponding services are accessed and called through the service interface, thereby providing security protection for the service interfaces and avoiding security risks.

[0026] Figure 1 This is a flowchart illustrating a method for connecting external services integrated into a mobile terminal with self-developed backend services in one embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the architecture of the integration of external services on the mobile terminal and the self-developed backend services in one embodiment of the present invention. Figure 1 and Figure 2 As shown, the method includes the following steps: In step S110, the intermediate layer set up between the external service integrated on the mobile terminal and the backend autonomous service receives access and call requests from the external service or autonomous service. The access and call requests carry the data to be accessed and called from the external service or autonomous service, service identity information, the address information of the service interface to be accessed and called, and the access and call type.

[0027] Specifically, the middleware layer is pre-configured with a standard interface configuration method for receiving access and invocation requests from external or self-developed services. This configuration method includes the following defined parameters: configuration method name (which can use naming conventions such as camelCase), interface address, request method, request header parameters, request parameters, and return parameters. Access and invocation requests can be sent according to the above definitions. Service identity information includes account information, IP address information, and application information. Account information can be, for example, service name and service ID. Access and invocation types include retrieving data, adding data, modifying data, and deleting data. During the mutual access and invocation process between external services integrated on the mobile device and backend self-developed services, different access and invocation types are selected according to different needs. Specifically, data can be retrieved, added, modified, or deleted from the self-developed or external services to be accessed or invoked.

[0028] Step S120: Verify the service identity information based on the whitelist pre-configured in the intermediate layer, and determine whether the service interface address information matches the service interface address information pre-configured in the intermediate layer.

[0029] Specifically, the pre-configured whitelist in the middleware layer contains a predefined list of allowed access to and invocation of self-owned or external services, including usernames, IP addresses, and IDs. Upon receiving a request from an external or self-owned service, the middleware layer first performs a security check on the service identity information of the service to be accessed or invoked, carried in the request data, against the whitelist. The service identity information is compared and matched with the list of allowed services in the whitelist. A successful match indicates that the service is permitted, and the security check on the service identity information is successful. Next, the service interface address information carried in the request data is matched with the service interface address information pre-integrated and configured by the middleware layer. A successful match indicates that the service interface address information carried in the request exists and is correct and can be accessed and invoked. If the service identity information security check is successful but the service interface address information does not match, the middleware layer will send feedback to the service to be accessed or invoked to correct the service interface address information or indicate that access and invocation are not possible.

[0030] Step S130: When the verification passes and the address information matches, an access and invocation key is generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key. After successful verification, the access and invocation are authorized to the external service or the autonomous service through the intermediate layer. This allows the external service or the autonomous service to invoke the interface of the autonomous service or the external service based on the matched service interface address information through the intermediate layer, and to access and invoke the relevant data of the autonomous service or the external service based on the data to be accessed and invoked and the access and invocation type.

[0031] Based on the above solution, by setting up an intermediate layer between the self-developed services on the mobile backend and the integrated external services, and by adding security verification and protection of the intermediate layer before mutual calls between services, as well as security verification of the accessed and called services against the services to be accessed and called, the security of service interface calls can be greatly improved by achieving dual protection of the intermediate layer and the called services.

[0032] In some embodiments, the step of generating an access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and a shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes the following steps: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, and the custom random number between the autonomous service and the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful. Alternatively, an access and invocation key can be generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that the autonomous service or the external service can decrypt the service encrypted with the shared key based on the received access and invocation key. If the decryption is successful, the verification is passed.

[0033] In other embodiments, the access and invocation key is also generated based on a timestamp. In this embodiment, using a custom random number and a timestamp to generate the access and invocation key can effectively prevent replay attacks, ensure the uniqueness of the generated key, and provide high security. Correspondingly, the process of generating the access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, the custom random number, and the shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes the following steps: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, the timestamp, and the custom random number defined by the autonomous service or the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful.

[0034] In some embodiments, mutual access and invocation between the autonomous service and the external service can be carried out through different independent modules of the intermediate layer, so that the access and invocation of the autonomous service by the external service to the autonomous service, and the access and invocation of the external service by the autonomous service to the external service, can be independent and will not interfere with the invocation process of the other party.

[0035] In some embodiments, such as Figure 2 As shown, the middleware layer includes an independent integration module and an open module. The integration module is used for external services to access and call the autonomous service, and pre-integrates and configures the standard interface address information of the autonomous service. The open module is used for the autonomous service to access and call the external service, and pre-integrates and configures the standard interface address information of the external service. By pre-integrating and configuring the service standard interface address information, it is possible to match and perform security verification on the service interface address information being accessed and called carried in the request data. It is also possible to convert the service interface address information of accessed and called services with different interface standards into a unified standard before matching, enabling access and calling of services with different interface standards. Furthermore, the unified interface standard simplifies integration. In addition, by setting up two independent modules for external services to access and call the autonomous service, and for the autonomous service to access and call external services, the middleware layer decouples the integration and calling between services, thereby improving the security and accuracy of access and calling.

[0036] Corresponding to the above method, the present invention also provides a device for interfacing external services integrated on a mobile terminal with backend autonomous services. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the aforementioned method.

[0037] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned method. The computer-readable storage medium may be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0038] This invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the aforementioned method.

[0039] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0040] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0041] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0042] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for connecting external services integrated into a mobile terminal with self-developed backend services, characterized in that, The method includes: an intermediate layer set up between an external service integrated on the mobile terminal and a backend self-service receives access and call requests from the external service or the self-service, wherein the access and call request carries the data to be accessed and called from the external service or the self-service, service identity information, the service interface address information of the accessed and called service, and the access and call type. The service identity information is verified based on the whitelist pre-configured in the middle layer, and it is determined whether the service interface address information matches the service interface address information pre-configured in the middle layer. When the verification passes and the address information matches, an access and invocation key is generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that they can verify the received access and invocation key. After successful verification, the middle layer authorizes access and invocation to the external service or the autonomous service. This allows the external service or the autonomous service to invoke the interface of the autonomous service or the external service based on the matched service interface address information, and to access and invoke the relevant data of the autonomous service or the external service based on the data to be accessed and invoked and the access and invocation type.

2. The method according to claim 1, characterized in that, The autonomous service and the external service can access and call each other through different independent modules in the middle layer.

3. The method according to claim 2, characterized in that, The intermediate layer includes an independent integration module and an open module. The integration module is used for external services to access and call the autonomous service, and pre-integrates and configures the standard interface address information of the autonomous service. The open module is used for the autonomous service to access and call the external service, and pre-integrates and configures the standard interface address information of the external service.

4. The method according to claim 1, characterized in that, The process of generating an access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, and the custom random number between the autonomous service and the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful. Alternatively, an access and invocation key can be generated based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service. This key is then sent to the autonomous service or the external service so that the autonomous service or the external service can decrypt the service encrypted with the shared key based on the received access and invocation key. If the decryption is successful, the verification is passed.

5. The method according to claim 1, characterized in that, The access and invocation keys are also generated based on timestamps.

6. The method according to claim 5, characterized in that, The process of generating an access and invocation key based on the verified service identity information, the data to be accessed and invoked, the access and invocation type, a custom random number, and the shared key between the autonomous service and the external service, and sending it to the autonomous service or the external service so that the autonomous service or the external service can verify the received access and invocation key, includes: Based on the verified service identity information, the data to be accessed and invoked, the access and invoke type, a custom random number, and the shared key between the autonomous service and the external service, an access and invoke key is generated and sent to the autonomous service or the external service. This allows the autonomous service or the external service to extract information from the received access and invoke key and generate an updated access and invoke key based on the extracted service identity information, the data to be accessed and invoked, the access and invoke type, the shared key, the timestamp, and the custom random number defined by the autonomous service or the external service. If the updated access and invoke key matches the received access and invoke key, the verification is successful.

7. The method according to any one of claims 1 to 6, characterized in that, The service identity information includes account information, IP address information, and application; the access and invocation types include obtaining data, adding data, modifying data, and deleting data.

8. A device for interfacing external services integrated into a mobile terminal with backend autonomous services, comprising a processor, a memory, and computer instructions stored in the memory, characterized in that, The processor is configured to execute the computer instructions, and when the computer instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the steps of the method according to any one of claims 1 to 7.

Images