Interface information management method of interface engine and storage medium
By integrating the data integration needs of enterprise IT departments through the interface engine's interface information management method, the problems of resource waste and high management costs are solved, and a unified client call mode and efficient resource management are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HANGZHOU ROBAM APPLIANCES CO LTD
- Filing Date
- 2024-10-18
- Publication Date
- 2026-04-21
AI Technical Summary
Enterprise IT departments need to apply for a large number of public network resources and security certificates for the data integration needs of different information systems, resulting in resource waste, high management costs, and susceptibility to personnel changes.
The interface information management method of the interface engine is adopted. Through the application module and the proxy module, it connects with the client and business system respectively to realize the encrypted verification of parameter information and the actual application call of the business system. It integrates the calling methods of various business systems, and only a digital certificate and public network address are needed to meet the interface calls of multiple systems.
It saves data resources, reduces management costs, avoids data loss due to personnel changes, and achieves unified and convenient management of client call modes.
Smart Images
Figure CN121907474A_ABST
Abstract
Description
Technical Field
[0001] This specification relates to data processing technology in one or more embodiments, and more particularly to an interface information management method and storage medium for an interface engine. Background Technology
[0002] Currently, many enterprises have various internal and external data integration needs. These needs are all transmitted over networks through information systems. Each information system providing an interface needs to apply for public network resources, such as public IP addresses and digital certificates. Furthermore, the data integration requirements of different information systems vary. For example, for a logistics department's automated product warehouse, if it needs to provide customers with available inventory and product freeze data, it can only be accessed through the automated warehouse client within the company's intranet. Therefore, due to security requirements, the client cannot be provided to customers; only an interface can be provided, and this interface needs an external domain name for customers to obtain the required data. Another example is a company's distribution system. Orders from third-party platforms need to be processed through the distribution system for delivery. Since accounts cannot be provided to third parties, an interface service must be provided. Because orders involve consumer information, encrypted digital certificates are required to provide this service. In summary, to ensure the data integration needs of various information systems, enterprise IT departments typically need to apply for several or even dozens of public domain names and security certificates for different application scenarios and systems. This not only consumes significant data resources but also requires dedicated maintenance personnel for each system, resulting in high management costs and the potential for data loss due to personnel changes. Summary of the Invention
[0003] To address the aforementioned issues, this specification describes one or more embodiments of an interface engine's interface information management method and storage medium.
[0004] According to the first aspect, a method for managing interface information of an interface engine is provided, applied to an interface engine, the interface engine including an application module and a proxy module, the method comprising:
[0005] When a client calls the interface engine, the application module obtains the parameter information transmitted by the client, and combines at least two of the parameter information based on a preset combination rule to obtain the first encrypted information. The parameter information includes the request time, request content, visitor number, request method name, and the second encrypted information.
[0006] After the first encrypted information and the second encrypted information are matched, the application module sends the parameter information to the proxy module;
[0007] The proxy module determines the business system based on the parameter information, and after querying the call information in the preset database according to the request method name, it performs the actual application call on the business system according to the request content and the call information, and returns the application data of the call to the application module. The preset database stores the mapping relationship between different request method names and call information. The call information includes service address, service parameters, call method and request parameters.
[0008] The application module returns the application data to the client.
[0009] Preferably, the application module obtains the parameter information transmitted by the client, including:
[0010] The application module obtains the third encrypted information transmitted by the client and decrypts the third encrypted information according to the digital certificate to obtain parameter information.
[0011] Preferably, the first encrypted information is obtained by combining at least two types of parameter information based on a preset combination rule, including:
[0012] The application module obtains the encrypted private key stored in the interface engine, and combines the encrypted private key, request time, request content, visitor number and request method name according to the preset combination rules to obtain the first encrypted information.
[0013] Preferably, after the first encrypted information matches the second encrypted information, the application module sends the parameter information to the proxy module, including:
[0014] The application module calculates the time difference between the request time and the current server time. After the time difference is less than a preset difference and the first encrypted information matches the second encrypted information, the application module sends the parameter information to the proxy module.
[0015] Preferably, before the application module sends the parameter information to the proxy module, it further includes:
[0016] The application module verifies the legitimacy of the client based on the visitor ID.
[0017] Preferably, before the application module sends the parameter information to the proxy module, it further includes:
[0018] The application module verifies the access permissions of the visitor ID for the request method name.
[0019] Preferably, returning the invoked application data to the application module includes:
[0020] After the proxy module de-identifies the application data it calls, it returns the application data to the application module.
[0021] Preferably, the application module returns the application data to the client, including:
[0022] When the waiting time is less than a preset time, the application module returns the application data to the client. The waiting time is the time the application module waits after sending the parameter information to the proxy module.
[0023] Preferably, the method further includes:
[0024] When the waiting time is not less than the preset time, an alert message is generated based on the visitor ID and the request content, and a warning is sent to the preset management terminal based on the alert message.
[0025] According to a second aspect, a computer-readable storage medium is provided having a computer program stored thereon, the computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform the method provided as in the first aspect or any possible implementation thereof.
[0026] The method provided in the embodiments of this specification has the following beneficial effects:
[0027] 1. By connecting the application module and proxy module in the interface engine to the client and business system respectively, the client only needs to call the interface engine according to the provided interface. After the client passes the encrypted verification, the application module transmits the parameter information to the proxy module, and the proxy module calls and returns application data to the actual application of the business system, realizing the integration of various business systems. The interface engine only needs to bind a digital certificate and an encrypted public network address for each client and business system to make interface calls. There is no need to apply for additional digital certificates and public network addresses for different clients and business systems, saving a lot of data resources.
[0028] 2. It enables the management of all data by simply managing the interface engine, eliminating the need to assign dedicated personnel to manage each business system and preventing data loss due to personnel changes.
[0029] 3. The processing of different calling methods for interfaces of various business systems has been integrated into the interface engine. The client no longer needs to pay attention to the calling method of specific business systems, which makes the client calling interface mode uniform and easier to manage. Attached Figure Description
[0030] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0031] Figure 1 This is a schematic diagram of the system architecture of an interface engine interface information management method provided in one embodiment of this specification.
[0032] Figure 2 This is a flowchart illustrating an interface information management method for an interface engine in one embodiment of this specification.
[0033] Figure 3 This is a flowchart illustrating an interface information management method for an interface engine in yet another embodiment of this specification. Detailed Implementation
[0034] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.
[0035] In the following description, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The following description provides multiple embodiments of this application, which can be substituted or combined with each other. Therefore, this application can also be considered to include all possible combinations of the same and / or different embodiments described. Thus, if one embodiment includes features A, B, and C, and another embodiment includes features B and D, then this application should also be considered to include embodiments containing one or more other possible combinations of A, B, C, and D, even if such embodiments are not explicitly described in the following text.
[0036] The following description provides examples and does not limit the scope, applicability, or examples set forth in the claims. Changes may be made to the function and arrangement of the described elements without departing from the scope of this application. Various processes or components may be appropriately omitted, substituted, or added to the examples. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Furthermore, features described with respect to some examples may be combined into other examples.
[0037] Please see Figure 1 , Figure 1 This document illustrates a system architecture diagram of an interface information management method for an interface engine provided in an embodiment of this specification.
[0038] like Figure 1As shown, the system architecture of the interface information management method of this interface engine can include at least a client 10, an application module 20, a proxy module 30, and a business system 40. The application module 20 and the proxy module 30 constitute an interface engine. When the client 10 wants to call the application data of the business system 40, it will submit a call request to the application module 20 in the interface engine and transmit parameter information to the application module 20. The application module 20 will combine the parameter information according to the preset combination rules to generate the first encrypted information to verify the security of the client 10. After the security verification is passed, the parameter information will be sent to the proxy module 30. The proxy module 30 will determine the business system 40 to be called based on the parameter information, and after querying the call information according to the request method name, it will perform the actual application call on the corresponding business system 40 according to the call information and return the application data to the application module 20. The application module 20 will then return the application data to the client 10, completing the entire application call process.
[0039] The interface engine is composed of two parts: application module 20 and proxy module 30. Application module 20 is the front-end application of the rules platform, used for digital certificate management and encryption authentication rules, as well as generating interface access logs and managing the validity of each call. A company or organization often has dozens or even hundreds of business systems, each providing different interface services as needed; some systems may provide dozens of services. For example, a WMS system might provide interface services for goods delivery, inventory query, and inventory transfer; an OMS system might provide an order creation interface; and financial software might provide employee expense reimbursement and employee loan interface services. These interface services are deployed on their respective application servers and cannot be transferred to application module 20. Therefore, proxy module 30 is needed to provide calls to these interface services.
[0040] In addition, it should be noted that, Figure 1 The system shown is only one example of the system provided in this disclosure. In practical applications, other systems can also be selected. For example, multiple agent modules and application modules can be set up so that each agent module and / or application module is only responsible for a specific or specified number of clients and business systems, etc.
[0041] See Figure 2 , Figure 2 This is a flowchart illustrating an interface information management method for an interface engine provided in an embodiment of this application. In this embodiment, the method is applied to an interface engine, which includes an application module and a proxy module. The method includes:
[0042] S201, Client calls the interface engine.
[0043] In the embodiments described in this specification, the business system pre-registers the interface information with the interface engine, generating an interface ID. Simultaneously, based on specific business requirements, the interface engine sets different client IDs and permissions for each client corresponding to an interface ID. When a client wants to access the business system to call corresponding application data, it sends a corresponding call request to the interface engine through the public IP address corresponding to the interface engine.
[0044] S202. The application module obtains the parameter information transmitted by the client, and combines at least two types of the parameter information based on a preset combination rule to obtain the first encrypted information.
[0045] The parameter information includes request time, request content, visitor ID, request method name, and second encryption information.
[0046] In the embodiments described in this specification, when the client sends a call request to the interface engine, it sends parameter information to the interface engine. This parameter information may include `time` (request time), `body` (request content), `clientCode` (visitor ID), `method` (request method name), and `sign` (second encrypted information). After the application module receives the parameter information transmitted by the client, it combines the parameter information according to pre-set combination rules to generate corresponding first encrypted information. The first encrypted information is used to verify the second encrypted information, thereby confirming whether the client requesting access is legitimate. If legitimate, the first and second encrypted information should be identical and match. The combination rules can be set according to different needs. For example, they can combine parameters of a fixed type in a fixed order, such as `request time + request content + visitor ID`. Alternatively, one or more parameter information can appear multiple times in the combination, such as `request time + request content + visitor ID + request time`.
[0047] In one possible implementation, the application module acquires the parameter information transmitted by the client, including:
[0048] The application module obtains the third encrypted information transmitted by the client and decrypts the third encrypted information according to the digital certificate to obtain parameter information.
[0049] In the embodiments described in this specification, the interface engine is also configured with a digital certificate issued by a DNS domain name management authority. With this certificate, network transmissions related to the interface engine are encrypted to prevent information from being obtained and leaked by third parties due to plaintext transmission. Therefore, data transmitted from the client is automatically encrypted into third-party encrypted information by the digital certificate. After obtaining the third-party encrypted information, the application module needs to decrypt it according to the digital certificate to obtain the actual parameter information.
[0050] S203. After the first encrypted information and the second encrypted information are matched, the application module sends the parameter information to the agent module.
[0051] In the embodiments described in this specification, the application module compares the first encrypted information with the second encrypted information to determine if they match. If the client is a legitimate terminal, the first encrypted information calculated according to the combination rules should be consistent with the second encrypted information transmitted by the client. If they do not match, the client is considered illegitimate, and the application module will isolate and clear the parameter information, and will not transmit it to the proxy module. If they match, the application module will send the parameter information to the proxy module, enabling the proxy module to invoke the corresponding business system based on the parameter information.
[0052] In one possible implementation, before the application module sends the parameter information to the proxy module, it further includes:
[0053] The application module verifies the legitimacy of the client based on the visitor ID.
[0054] In the embodiments described in this specification, the visitor ID can be understood as an ID assigned to the client. This client ID is assigned when the client registers with the interface engine, and each client ID should have access permissions to at least one business system. The application module will use this to verify the legitimacy of the visitor ID, that is, to determine whether the client ID is a searchable registration ID and whether the client ID has access permissions to any business system. Only after verification as legitimate will the application module send the parameter information to the proxy module.
[0055] In one possible implementation, before the application module sends the parameter information to the proxy module, it further includes:
[0056] The application module verifies the access permissions of the visitor ID for the request method name.
[0057] In the embodiments described in this specification, the request method name is used to represent the requested interface service. Different clients may have different access permissions for the same business system's functional services. This permission is assigned when the client applies for interface registration with the interface engine, based on the identity information filled in by the client and the business system's review information for the client. That is, the access permission for the corresponding request method name is assigned to the visitor ID registered by the client. Before sending the parameter information to the proxy module, the application module will determine whether the visitor ID in the parameter information has access permission for the request method name in the parameter information. If it does not have the corresponding access permission, the parameter information will not be sent.
[0058] S204. The proxy module determines the business system based on the parameter information and retrieves the call information from the preset database based on the request method name.
[0059] The preset database stores a mapping relationship between different request method names and call information, including service address, service parameters, call method, and request parameters.
[0060] In the embodiments described in this specification, the proxy module can determine the business system to be accessed based on the request content and request method name in the parameter information. Simultaneously, the proxy module pre-sets a database storing the mapping relationship between request method names and call information. The proxy module queries this database based on the request method name to obtain the corresponding call information. Based on this call information, the proxy module can determine the corresponding service address, service parameters, specific call method, and specific request parameters of the business system, so that it can perform the specific call process accordingly. Here, the service address is the access address of the requested service in the business system; the service parameters are the functional parameters of the service function to be called in the business system; the call method is the call format of the service function, such as JSON, XML, GET, POST, etc.; and the request parameters are the parameters required when making specific business requests to the service based on the request content. Furthermore, to improve access speed, the pre-set database storing the mapping relationship can be a high-speed in-memory database like Redis, to improve the speed of retrieving this call information from Redis each time a client accesses the system.
[0061] S205. The proxy module makes actual application calls to the business system based on the request content and call information.
[0062] In the embodiments of this specification, after determining the call information, the proxy module can call the corresponding service in the business system according to the call information, and call the specific application data required from the service according to the request content, thereby realizing the process of calling the actual application of the business system.
[0063] S206. The proxy module returns the application data to the application module.
[0064] In the embodiments described in this specification, after the proxy module retrieves application data, it returns the application data to the application module. The application module also generates a call log based on the returned application data and the visitor ID, which is recorded and saved for later traceability management.
[0065] In one possible implementation, returning the invoked application data to the application module includes:
[0066] After the proxy module de-identifies the application data it calls, it returns the application data to the application module.
[0067] In the embodiments described in this specification, the proxy module will also perform desensitization processing on the application data returned by the actual application of the business system, such as replacing mobile phone numbers and house numbers with asterisks, before returning the desensitized application data to the application module.
[0068] S207. The application module returns the application data to the client.
[0069] In the embodiments described in this specification, after receiving the application data returned by the proxy module, the application module returns the application data to the client to complete the entire process of the client making application calls to the business system through the interface engine. In this way, the interface engine only needs to bind a digital certificate and an encrypted public IP address for each client and business system to make interface calls. There is no need to apply for additional digital certificates and public IP addresses for different clients and business systems, saving significant data resources. Furthermore, the processing of different calling methods for various business system interfaces is integrated into the interface engine, eliminating the need for the client to focus on the specific calling method of the business system. This makes the client's interface calling mode unified and easier to manage.
[0070] See Figure 3 , Figure 3 This is a flowchart illustrating another interface information management method for an interface engine provided in this application embodiment. In this application embodiment, the method is applied to an interface engine, which includes an application module and a proxy module, and includes:
[0071] S301, Client Call Interface Engine.
[0072] In the embodiments of this specification, step 301 can be referred to step 201, and will not be repeated here.
[0073] S302. The application module obtains the encrypted private key stored in the interface engine, and combines the encrypted private key, request time, request content, visitor number and request method name according to the preset combination rules to obtain the first encrypted information.
[0074] In the embodiments described in this specification, the interface engine also stores an encrypted private key. This encrypted private key is stored separately by the client and the interface engine, and they remain consistent; it is not transmitted as a parameter. After the application module obtains its own stored encrypted private key, it combines the secret encrypted private key with the time request time, the body request content, the clientCode visitor ID, and the method request name according to a preset combination rule. The resulting string is the first encrypted information, sign. As an example, the combination rule could be sign = Encrypt(secret, time, clientCode, body, method, secret).
[0075] S303. The application module calculates the time difference between the request time and the current server time. After the time difference is less than a preset difference and the first encrypted information matches the second encrypted information, the application module sends the parameter information to the proxy module.
[0076] In the embodiments described in this specification, the application module also verifies the interval between the actual server time and the client request time to prevent the interface engine from being brute-forced. Specifically, the application module obtains the current server time and calculates the time difference between it and the request time in the parameter information. Considering the different hosts and network transmission time, a certain time error is allowed and is used as a preset difference, generally set to 1-3 minutes. As long as the time difference is less than the preset difference, it is considered that the request time is approximately the same as the actual server time, and the time verification passes. In addition, when the client transmits parameter information, the request time must also be included as one of the parameters. In this way, after the combination rule also includes the request time as one of the signature information of the first encrypted information, each request, even if the parameters are the same, will have different first encrypted information due to the different times. This, together with the time difference calculated from the current server time, forms a double verification. Both conditions must be met to pass the verification and ensure the legitimacy of the client.
[0077] S304. The proxy module determines the business system based on the parameter information and retrieves the call information from the preset database based on the request method name.
[0078] The preset database stores a mapping relationship between different request method names and call information, including service address, service parameters, call method, and request parameters.
[0079] In the embodiments of this specification, step 304 can be referred to step 204, and will not be repeated here.
[0080] S305. The proxy module performs actual application calls to the business system based on the request content and call information.
[0081] In the embodiments of this specification, step 305 can be referred to step 205, and will not be repeated here.
[0082] S306. The proxy module returns the application data to the application module.
[0083] In the embodiments of this specification, step 306 can be referred to step 206, and will not be repeated here.
[0084] S307. When the waiting time is less than the preset time, the application module returns the application data to the client.
[0085] The waiting time is the time the application module waits after sending the parameter information to the agent module.
[0086] In the embodiments described in this specification, after the application module sends the parameter information to the proxy module, it will start timing the waiting period, and the background parameters will be configured with a timeout period as a preset duration. Only if the application data returned by the proxy module is received within the preset duration is the application call considered to have not timed out, and the result will be returned to the client at this time. Otherwise, it will be considered a timeout exception and needs to be reprocessed.
[0087] In one possible implementation, the method further includes:
[0088] When the waiting time is not less than the preset time, an alert message is generated based on the visitor ID and the request content, and a warning is sent to the preset management terminal based on the alert message.
[0089] In the embodiments of this specification, in order to ensure the security of application data and avoid request timeouts caused by problems in the data processing process due to abnormal parameter information, after each request timeout, the application module will also generate a warning message based on the visitor number and request content, and send it to the management terminal used by the administrator for early warning, so as to remind the administrator to manually verify the client and confirm whether there are any problems with the client's source and the content data requested for access.
[0090] Those skilled in the art will clearly understand that the technical solutions of the embodiments of this application can be implemented by means of software and / or hardware. In this specification, "unit" and "module" refer to software and / or hardware capable of independently completing or cooperating with other components to complete a specific function, wherein the hardware may be, for example, a Field-Programmable Gate Array (FPGA), an Integrated Circuit (IC), etc.
[0091] Each processing unit and / or module in the embodiments of this application can be implemented by an analog circuit that implements the functions described in the embodiments of this application, or by software that executes the functions described in the embodiments of this application.
[0092] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.
[0093] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.
[0094] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0095] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.
[0096] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of embodiments of this disclosure upon considering the specification and practicing the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.
Claims
1. A method for managing interface information in an interface engine, characterized in that, Applied to an interface engine, the interface engine including an application module and a proxy module, the method includes: When a client calls the interface engine, the application module obtains the parameter information transmitted by the client, and combines at least two of the parameter information based on a preset combination rule to obtain the first encrypted information. The parameter information includes the request time, request content, visitor number, request method name, and the second encrypted information. After the first encrypted information and the second encrypted information are matched, the application module sends the parameter information to the proxy module; The proxy module determines the business system based on the parameter information, and after querying the call information in the preset database according to the request method name, it performs the actual application call on the business system according to the request content and the call information, and returns the application data of the call to the application module. The preset database stores the mapping relationship between different request method names and call information. The call information includes service address, service parameters, call method and request parameters. The application module returns the application data to the client.
2. The method according to claim 1, characterized in that, The application module obtains the parameter information transmitted by the client, including: The application module obtains the third encrypted information transmitted by the client and decrypts the third encrypted information according to the digital certificate to obtain parameter information.
3. The method according to claim 1, characterized in that, The first encrypted information is obtained by combining at least two types of parameter information based on a preset combination rule, including: The application module obtains the encrypted private key stored in the interface engine, and combines the encrypted private key, request time, request content, visitor number and request method name according to the preset combination rules to obtain the first encrypted information.
4. The method according to claim 1, characterized in that, After the first encrypted information and the second encrypted information are matched, the application module sends the parameter information to the proxy module, including: The application module calculates the time difference between the request time and the current server time. After the time difference is less than a preset difference and the first encrypted information matches the second encrypted information, the application module sends the parameter information to the proxy module.
5. The method according to claim 1, characterized in that, Before the application module sends the parameter information to the proxy module, it also includes: The application module verifies the legitimacy of the client based on the visitor ID.
6. The method according to claim 1, characterized in that, Before the application module sends the parameter information to the proxy module, it also includes: The application module verifies the access permissions of the visitor ID for the request method name.
7. The method according to claim 1, characterized in that, The step of returning the invoked application data to the application module includes: After the proxy module de-identifies the application data it calls, it returns the application data to the application module.
8. The method according to claim 1, characterized in that, The application module returns the application data to the client, including: When the waiting time is less than a preset time, the application module returns the application data to the client. The waiting time is the time the application module waits after sending the parameter information to the proxy module.
9. The method according to claim 8, characterized in that, The method further includes: When the waiting time is not less than the preset time, an alert message is generated based on the visitor ID and the request content, and a warning is sent to the preset management terminal based on the alert message.
10. A computer-readable storage medium having a computer program stored thereon, the computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform the steps of the method as claimed in any one of claims 1-9.