Interface request processing method and computing device

Abstract

Embodiments of the present application provide an interface request processing method and a computing device. The method comprises: obtaining an interface call request sent by a terminal, the interface call request being used to request to call a target API; determining an actual value of a multi-dimensional permission control parameter according to the interface call request; determining an effective value of the multi-dimensional permission control parameter, and determining an initial matching result of the interface call request based on the effective value and the actual value of the multi-dimensional permission control parameter; if the initial matching result is a matching success, determining a permission matching result based on a mapping relationship between the multi-dimensional permission control parameter and version information according to the actual value of the multi-dimensional permission control parameter and a target version, the permission matching result being used to indicate whether the terminal has a permission to call the API of the target version; and processing the interface call request according to the permission matching result. The method can guarantee the efficiency and security of multi-version API interface call permission management.

Description

Technical Field

[0001] This application relates to the field of computing technology, and in particular to an interface request processing method and a computing device. Background Technology

[0002] In enterprise-level systems, there are often multiple iterative versions of the same Application Programming Interface (API). In some scenarios, different iterative versions of this API may have different access control requirements.

[0003] In related technologies, access control systems can assign roles to users and bind API permissions to roles, implementing basic permission management based on a role-based access control (RBAC) model. For example, an administrator role can access all API versions, while a developer role can only call test environment APIs.

[0004] However, this access control system struggles to handle the complex permission requirements of API calls in multi-version scenarios, resulting in low efficiency and insufficient security in permission management during API calls. Summary of the Invention

[0005] This application provides an interface request processing method and a computing device, which can ensure the efficiency and security of multi-version API interface call permission management.

[0006] In a first aspect, embodiments of this application provide an interface request processing method, the method comprising:

[0007] Get the API call request sent by the terminal. The API call request is used to request the API of the target version.

[0008] Based on the API call request, determine the actual values ​​of the multi-dimensional access control parameters;

[0009] Determine the effective values ​​of the multidimensional permission control parameters, and perform matching processing between the effective values ​​and actual values ​​of the multidimensional permission control parameters to obtain the initial matching results of the interface call request;

[0010] If the initial matching result is successful, the permission matching result is determined based on the actual values ​​of the multidimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules of the multidimensional permission control parameters and the version information; the permission matching result is used to indicate whether the terminal has the permission to call the API of the target version;

[0011] Based on the permission matching results, process the API call request.

[0012] In the above technical solution, preliminary matching of API call requests using multi-dimensional permission control parameters can solve the problems of insufficient matching accuracy and security caused by a single dimension. Furthermore, by setting up a preliminary matching verification step, the compliance of the API call request can be quickly identified, and non-compliant API call requests can be filtered out. On the one hand, this avoids performing subsequent version permission matching operations on non-compliant API call requests, which helps reduce redundant consumption of computing resources; on the other hand, it can improve the processing efficiency of API call requests, achieving millisecond-level permission verification response and ensuring high availability and reliability of the API interface. In addition, by establishing a dynamic mapping relationship between API versions and permission control rules of multi-dimensional permission control parameters, permission policies can be configured independently for each version. Based on the actual values ​​of the multi-dimensional permission control parameters corresponding to the API call request and the target version, permission matching processing of the API call request can be performed quickly and accurately based on this mapping relationship to determine whether the terminal has permission to call the target version of the API, thus solving the permission adaptation problem when multiple versions coexist. In summary, the above technical solution can ensure the efficiency and security of multi-version API interface call permission management.

[0013] In one possible implementation, the multi-dimensional access control parameters include M dimensions of access control parameters, where M is an integer greater than 1; the effective values ​​and actual values ​​of the multi-dimensional access control parameters are matched to obtain the initial matching result of the interface call request, including:

[0014] Determine the i-th dimension from among the M dimensions according to their priority order.

[0015] The actual value of the permission control parameter of the i-th dimension is matched with the corresponding effective value to obtain the i-th matching result for the i-th dimension.

[0016] i is sequentially selected from 1, 2, ... until the i-th matching result is a failed match or i is M. The initial matching result is determined based on the i-th matching result.

[0017] In the above technical solution, based on the priority order of M dimensions and the valid values ​​of each permission control parameter, the actual values ​​of the multi-dimensional permission control parameters can be checked in layers to quickly eliminate mismatched interface call requests. This avoids performing subsequent version permission matching operations on these mismatched interface call requests, which helps reduce redundant consumption of computing resources and improves the interface response efficiency of these interface call requests.

[0018] In one possible implementation, if the i-th dimension includes N access control parameters, where N is an integer greater than 1; the actual values ​​of the access control parameters of the i-th dimension are matched with their corresponding effective values ​​to obtain the i-th matching result for the i-th dimension, including:

[0019] Based on the priority order of the N access control parameters, determine the j-th access control parameter among the N access control parameters;

[0020] The actual value of the j-th permission control parameter is matched with the corresponding effective value to obtain the j-th matching result corresponding to the j-th permission control parameter;

[0021] j takes the values ​​1, 2, ..., until the j-th matching result is a failed match or j takes the value N. The i-th matching result is then determined based on the j-th matching result.

[0022] In the above technical solution, when there are multiple permission control parameters in a certain dimension, the actual values ​​of these multiple permission control parameters are subjected to layered verification based on their priority order and the valid values ​​of each permission control parameter. This allows for the rapid exclusion of mismatched interface call requests, avoiding the need to perform subsequent version permission matching operations on these mismatched interface call requests. This helps reduce redundant consumption of computing resources and improves the interface response efficiency of these interface call requests.

[0023] In one possible implementation, determining the initial matching result based on the i-th matching result includes:

[0024] If i is less than or equal to M and the i-th matching result is a failed match, then the initial matching result is determined to be a failed match.

[0025] If i equals M and the i-th matching result is a successful match, then the initial matching result is determined to be a successful match.

[0026] In the above technical solution, the initial matching result of the interface call request can be determined to be a successful match only after all M dimensions have been successfully matched. This helps to ensure the security of multi-version API interface call permission management.

[0027] In one possible implementation, the M dimensions include a spatial dimension and a temporal dimension, wherein,

[0028] The spatial dimension takes precedence over the temporal dimension.

[0029] The access control parameters for the spatial dimension include at least one of the following: role type, business type, or terminal type;

[0030] Time-based access control parameters include at least one of the following: API version lifecycle time information and time period type.

[0031] In the above technical solution, permission control parameters in spatial and temporal dimensions can be deeply integrated to form multi-dimensional permission control parameters. Subsequent permission matching processing can be carried out through these multi-dimensional permission control parameters, which can solve the problems of insufficient matching accuracy and security caused by a single dimension. It can also cover the differentiated permission management needs of API versions in complex scenarios.

[0032] In one possible implementation, the API call request is processed based on the permission matching result, including:

[0033] If the permission matching result indicates that the terminal has permission to call the target version of the API, generate a command to allow the call;

[0034] According to the allowed call instructions, the API of the target version is invoked to process the interface call request, obtain the processing result, and generate a call success log;

[0035] Send the processing result to the terminal.

[0036] In the above technical solution, when the permission matching result is successful, an allow call instruction can be generated, and the target version of the API can be called based on the allow call instruction to process the interface call request, thereby achieving accurate adaptation between the interface call request and the API version and ensuring the security of permission management; at the same time, a corresponding traceable call success log is generated for the allow call instruction to facilitate subsequent verification and processing.

[0037] In one possible implementation, the API call request is processed based on the permission matching result, including:

[0038] If the permission matching result indicates that the terminal does not have permission to call the target version of the API, a call denial instruction is generated;

[0039] Based on the call denial instruction, an error message and a call failure log are generated; the error message is used to indicate permission errors.

[0040] Send error indication information to the terminal.

[0041] In the above technical solution, a denial instruction can be generated when the permission matching result fails, so as to ensure the security of permission management; at the same time, a corresponding traceable call failure log is generated for the denial instruction to facilitate subsequent verification and processing.

[0042] In one possible implementation, determining the actual value of the multi-dimensional access control parameters based on the interface call request includes:

[0043] Based on the authentication information in the API call request, the API call request is validated to obtain the validation result;

[0044] If the verification result is successful, extract the actual value of the multi-dimensional permission control parameter from the interface call request, or determine the actual value of the multi-dimensional permission control parameter based on the user information corresponding to the authentication information.

[0045] In the above technical solution, the API call request can be verified based on the authentication information in the API call request before the permission matching process is performed, and API call requests that fail the verification are rejected, which helps to ensure the security of the API.

[0046] In one possible implementation, the method further includes:

[0047] In the case of API version updates, determine the differences in permission information between the updated version and the historical version of the API;

[0048] Based on the mapping relationship, the first sub-mapping relationship between the historical version and the permission control rules of the multi-dimensional permission control parameters is determined;

[0049] Based on the differential permission information, the first sub-mapping relationship is updated to obtain the second sub-mapping relationship between the updated version and the multi-dimensional permission control parameters;

[0050] Add a second sub-mapping relationship to the mapping relationship.

[0051] In the above technical solution, by establishing a dynamic mapping relationship between API version information and permission control rules of multi-dimensional (such as time dimension and space dimension) permission control parameters, permission policies can be configured independently for each version, realizing a smooth transition of permissions during version iteration and solving the permission adaptation problem when multiple versions coexist.

[0052] Secondly, embodiments of this application provide an interface request processing apparatus, comprising:

[0053] The acquisition module is used to acquire the API call request sent by the terminal. The API call request is used to request to call the target version of the API.

[0054] The processing module is used to determine the actual values ​​of the multi-dimensional permission control parameters based on the interface call request.

[0055] The processing module is also used to determine the effective value of the multi-dimensional permission control parameters, and to match the effective value and the actual value of the multi-dimensional permission control parameters to obtain the initial matching result of the interface call request.

[0056] The processing module is also used to determine the permission matching result if the initial matching result is a successful match, based on the actual value of the multidimensional permission control parameters and the target version, and based on the mapping relationship between the permission control rules of the multidimensional permission control parameters and the version information; the permission matching result is used to indicate whether the terminal has the permission to call the API of the target version;

[0057] The processing module is also used to process interface call requests based on the permission matching results.

[0058] The interface request processing apparatus provided in this application embodiment can execute the technical solution shown in any of the first aspects, and its beneficial effects are similar, so it will not be described again here.

[0059] In one possible implementation, the multi-dimensional access control parameters include access control parameters in M ​​dimensions, where M is an integer greater than 1; the processing module is specifically used for:

[0060] Determine the i-th dimension from among the M dimensions according to their priority order.

[0061] The actual value of the permission control parameter of the i-th dimension is matched with the corresponding effective value to obtain the i-th matching result for the i-th dimension.

[0062] i is sequentially selected from 1, 2, ... until the i-th matching result is a failed match or i is M. The initial matching result is determined based on the i-th matching result.

[0063] In one possible implementation, if the i-th dimension includes N permission control parameters, where N is an integer greater than 1; the processing module is further configured to:

[0064] Based on the priority order of the N access control parameters, determine the j-th access control parameter among the N access control parameters;

[0065] The actual value of the j-th permission control parameter is matched with the corresponding effective value to obtain the j-th matching result corresponding to the j-th permission control parameter;

[0066] j takes the values ​​1, 2, ..., until the j-th matching result is a failed match or j takes the value N. The i-th matching result is then determined based on the j-th matching result.

[0067] In one possible implementation, the processing module is further configured to:

[0068] If i is less than or equal to M and the i-th matching result is a failed match, then the initial matching result is determined to be a failed match.

[0069] If i equals M and the i-th matching result is a successful match, then the initial matching result is determined to be a successful match.

[0070] In one possible implementation, the M dimensions include a spatial dimension and a temporal dimension, wherein,

[0071] The spatial dimension takes precedence over the temporal dimension.

[0072] The access control parameters for the spatial dimension include at least one of the following: role type, business type, or terminal type;

[0073] Time-based access control parameters include at least one of the following: API version lifecycle time information and time period type.

[0074] In one possible implementation, the processing module is further configured to:

[0075] If the permission matching result indicates that the terminal has permission to call the target version of the API, generate a command to allow the call;

[0076] According to the allowed call instructions, the API of the target version is invoked to process the interface call request, obtain the processing result, and generate a call success log;

[0077] Send the processing result to the terminal.

[0078] In one possible implementation, the processing module is further configured to:

[0079] If the permission matching result indicates that the terminal does not have permission to call the target version of the API, a call denial instruction is generated;

[0080] Based on the call denial instruction, an error message and a call failure log are generated; the error message is used to indicate permission errors.

[0081] Send error indication information to the terminal.

[0082] In one possible implementation, the processing module is further configured to:

[0083] Based on the authentication information in the API call request, the API call request is validated to obtain the validation result;

[0084] If the verification result is successful, extract the actual value of the multi-dimensional permission control parameter from the interface call request, or determine the actual value of the multi-dimensional permission control parameter based on the user information corresponding to the authentication information.

[0085] In one possible implementation, the processing module is further configured to:

[0086] In the case of API version updates, determine the differences in permission information between the updated version and the historical version of the API;

[0087] Based on the mapping relationship, the first sub-mapping relationship between the historical version and the permission control rules of the multi-dimensional permission control parameters is determined;

[0088] Based on the differential permission information, the first sub-mapping relationship is updated to obtain the second sub-mapping relationship between the updated version and the multi-dimensional permission control parameters;

[0089] Add a second sub-mapping relationship to the mapping relationship.

[0090] Thirdly, embodiments of this application provide a computing device, including: a processor and a memory; the processor and the memory are coupled;

[0091] Memory is used to store program instructions;

[0092] The processor is used to execute program instructions to perform the methods shown in any of the first aspects.

[0093] The computing device provided in the embodiments of this application can execute the technical solutions shown in any of the first aspects, and its beneficial effects are similar, so they will not be described again here.

[0094] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions that, when executed by a computer, implement the method as described in any of the first aspects.

[0095] The computer-readable storage medium provided in the embodiments of this application can perform the technical solutions shown in any of the first aspects, and its beneficial effects are similar, so they will not be described again here.

[0096] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method as described in any of the first aspects.

[0097] The computer program product provided in the embodiments of this application can execute the technical solutions shown in any of the first aspects, and its beneficial effects are similar, so they will not be described again here.

[0098] The interface request processing method and computing device provided in this application, after obtaining an interface call request, can determine the actual value of multi-dimensional permission control parameters based on the interface call request. By using the valid and actual values ​​of the multi-dimensional permission control parameters, it can quickly identify whether the interface call request is compliant and filter out non-compliant interface call requests. This avoids performing subsequent version permission matching operations on non-compliant interface call requests, helps reduce redundant consumption of computing resources, and improves the processing efficiency of interface call requests. If the initial matching result is successful, the permission matching result can be determined based on the actual value of the multi-dimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules of the multi-dimensional permission control parameters and version information. Based on the permission control result, differentiated processing is performed on the interface call request to solve the permission adaptation problem when multiple versions coexist. In summary, this method can ensure the efficiency and security of multi-version API interface call permission management. Attached Figure Description

[0099] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0100] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0101] Figure 2 This is a schematic diagram of the software architecture of the interface request processing system provided in the embodiments of this application;

[0102] Figure 3 One of the flowcharts illustrating the interface request processing method provided in the embodiments of this application;

[0103] Figure 4 A second flowchart illustrating the interface request processing method provided in this application embodiment;

[0104] Figure 5 The third flowchart illustrating the interface request processing method provided in this application embodiment;

[0105] Figure 6 This is a schematic diagram of the structure of the interface request processing device provided in the embodiments of this application;

[0106] Figure 7 This is a schematic diagram of the hardware structure of a computing device provided in an embodiment of this application.

[0107] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0108] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0109] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of the technical solutions in the embodiments of this application. However, it does not mean that the applicant has used or necessarily used such solutions.

[0110] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0111] It should be noted that in the embodiments of this application, the term "at least one" refers to one or more, and "more than one" refers to two or more.

[0112] Below, to facilitate understanding of the interface request processing method provided in the embodiments of this application, in conjunction with... Figure 1 The application scenarios of the embodiments of this application will be described.

[0113] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. Please refer to [link / reference]. Figure 1 The terminal sends an interface call request to the computing device, which can request to call the target version of the API.

[0114] The API may include multiple versions, including the target version. The computing device may use the interface request processing method provided in this application embodiment to perform permission matching processing on the interface call request, obtain the permission matching result corresponding to the interface call request, and determine whether the terminal has permission to call the target version of the API through the permission matching result.

[0115] The computing device can store the effective values ​​of multi-dimensional permission control parameters. These parameters can include M dimensions, with each dimension containing at least one parameter, where M can be an integer greater than 1. After receiving an API call request, the computing device can determine the actual values ​​of the multi-dimensional permission control parameters based on the request, and then match the effective and actual values ​​to obtain the initial matching result of the API call request.

[0116] If the initial matching result is a failure, the request to call the interface will be refused and an error message will be generated.

[0117] If the initial matching result is successful, the computing device can also determine the permission matching result based on the actual value of the multidimensional permission control parameters and the target version, and based on the mapping relationship between the permission control rules of the multidimensional permission control parameters and the version information; and perform differentiated processing on the interface call request based on the difference in the permission matching result.

[0118] If the permission matching result indicates that the terminal has the permission to call the target version of the API, the API of the target version is called to process the interface call request normally and return the processing result.

[0119] If the permission matching result indicates that the terminal does not have permission to call the target version of the API, the request to call the interface will be rejected and an error message will be generated.

[0120] In this embodiment, multi-dimensional permission control parameters are used to perform preliminary matching of API call requests, addressing the issues of insufficient matching accuracy and security caused by a single dimension. Furthermore, by setting up a preliminary matching verification step, the compliance of the API call request can be quickly identified, and non-compliant API call requests can be filtered out. On the one hand, this avoids performing subsequent version permission matching operations on non-compliant API call requests, reducing redundant consumption of computing resources; on the other hand, it improves the processing efficiency of API call requests, achieving millisecond-level permission verification responses and ensuring high availability and reliability of the API interface.

[0121] If the initial matching result is successful, the permission matching result can be determined based on the actual values ​​of the multi-dimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules of the multi-dimensional permission control parameters and version information. This matching result then determines whether the terminal has the permission to call the target version of the API. In this process, this method can establish a dynamic mapping relationship between the API version and the permission control rules of the multi-dimensional permission control parameters. This supports independent configuration of permission policies for each version, facilitating a smooth transition of permissions during API version iteration, solving the permission adaptation problem when multiple versions coexist, and achieving fine-grained permission control for multiple API versions. Furthermore, by constructing this mapping relationship, the "disconnect" between API version management and permission control can be resolved, avoiding permission chaos caused by version iteration.

[0122] In summary, this method can achieve both high efficiency and security optimization in multi-version API interface call permission management.

[0123] This application also provides an interface request processing system, which will be discussed below in conjunction with... Figure 2 The software architecture of the interface request processing system will be described.

[0124] Figure 2 This is a schematic diagram of the software architecture of the interface request processing system provided in an embodiment of this application. Please refer to [link / reference]. Figure 2 The interface request processing system may include the following modules: a World Wide Web (Web) client, an API design and management module, an API gateway, an authentication module, a permission management module, an API version management module, and a detection and log verification management module. The Web client can run on a terminal, while the API design and management modules, API gateway, authentication module, permission management module, API version management module, and detection and log verification management module can run on a computing device.

[0125] The computing device can also run an API version metadata database (DB), a spatiotemporal rule base, and a permission verification log base.

[0126] like Figure 2 As shown, the permission management module may include a spatiotemporal fusion API version control engine, which may include four modules: a spatial dimension control module, a time dimension control module, an API version association module, and a spatiotemporal permission matching engine. These four modules will be described in detail below.

[0127] (1) Spatial Dimension Control Module

[0128] The spatial dimension control module enables user access control. Based on the RBAC model, it can assign differentiated API version access permissions to different user roles. For example, computing devices can use the spatial dimension control module to classify user roles into administrators, developers, testers, external collaborators, etc., and configure the range of accessible API versions for each role.

[0129] The spatial dimension control module can also implement business module permission management. It can vertically divide API version permissions according to business type (such as business domain or business function module). Each business type (such as each business domain or each business function module) can be configured with an independent version permission policy.

[0130] The spatial dimension control module also enables terminal type permission management, allowing for differentiated permission control based on the terminal type calling each API. Terminal types can include web devices, mobile devices (OS1 / OS2), mini-programs, third-party systems, etc. For example, computing devices can use the spatial dimension control module to restrict mobile devices to only calling lightweight API versions and prohibit low-security terminals from accessing sensitive API versions, thereby improving the compatibility between terminal types and API versions.

[0131] (2) Time dimension control module

[0132] The time dimension control module can manage the lifecycle time of API versions. It can configure complete lifecycle time information for the permissions of each API version. This lifecycle time information can include the effective time and the expiration time, or it can also include the effective period (or "effective time interval").

[0133] The time-based control module also supports advance configuration and automatic activation of API version permissions. When the API version expires, the time-based control module can automatically revoke the API version permissions and trigger a notification mechanism.

[0134] The time-based control module enables differentiated time-period permission control for API versions. The time-period type can be peak or off-peak hours, or weekday or non-weekday hours. Computing devices can use this module to implement peak-hour rate limiting for each API version. Dynamic permission rate limiting strategies are implemented during peak traffic periods, controlling the call frequency of each API version through thresholds for Transactions Per Second (TPS) or Requests Per Second (RPS).

[0135] The time-dimensional control module allows for the configuration of differentiated QPS (or TPS) thresholds based on time period type. For example, during peak periods such as 10:00-12:00 and 18:00-20:00, the QPS threshold for this API version is configured to 500, while during off-peak periods, the QPS threshold for this API version is relaxed to 1000.

[0136] (3) API version association module

[0137] The API version association module enables version-permission mapping management. Computing devices can use this module to build a mapping relationship between API version information and multi-dimensional permission control rules (such as a many-to-many mapping relationship between API version and spatiotemporal dimension permission control rules), configuring a unique permission policy combination for each API version.

[0138] The API version association module also enables version iteration permission adaptation management. During API version upgrades, it automatically adapts permission policies, identifies interface differences between old and new API versions, and adaptively adjusts the mapping relationships created during the process. The API version association module supports incremental permission configuration, adjusting permission control rules only for newly added or changed interface functions, while retaining compatible permission settings. For example, when an API version is upgraded from v1 to v2, the basic permissions of v1 are automatically migrated to v2, and permission configurations for v2-specific functions are added.

[0139] (4) Spatiotemporal permission matching engine

[0140] The spatiotemporal permission matching engine can include a real-time verification executor and a spatiotemporal permission matcher.

[0141] The real-time validation executor can be used to transform rule matching results into specific permission decisions, returning "allow call" or "deny call" instructions to the API gateway.

[0142] The spatiotemporal permission matcher can be used to receive rule inputs in both spatial and temporal dimensions, and construct a comprehensive rule set by combining API version information with the mapping relationship between multidimensional permission control parameters.

[0143] In some embodiments, the spatiotemporal permission matcher can use an optimized pattern matching algorithm (such as the RETE algorithm) to achieve efficient rule matching. It can quickly compare the request context (user role, terminal type, current time, call version, etc.) in the interface call request with the above-mentioned comprehensive rule set to locate the applicable permission policy.

[0144] For example, the RETE algorithm can implement hierarchical filtering rules based on "spatial dimension → time dimension → version dimension," configuring dedicated filtering nodes for each dimension. It prioritizes filtering static attributes such as user role, terminal type, and business type, quickly eliminating obviously mismatched API call requests. In this process, this hierarchical filtering rule can make the matching path more focused, reducing invalid matching paths by more than 60%.

[0145] The spatiotemporal permission matcher can introduce time window filters to achieve accurate and efficient matching of various time conditions such as effective time and time period range (including peak periods). It also accelerates the matching process of time intervals through timestamp indexing technology, so as to achieve efficient management of multi-version API permissions in the time dimension.

[0146] In some embodiments, a new API version matching node can be added to the computing device. This API version matching node can achieve cross-version rule compatibility matching through version number semantic parsing (such as major version number and minor version number).

[0147] The technical solutions of the embodiments of this application will be described in detail below with specific examples. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0148] Figure 3 This is one of the flowcharts illustrating the interface request processing method provided in the embodiments of this application. This method can be applied to, for example... Figure 1 In the computing device shown. Please see Figure 3 The method may include the following steps:

[0149] S301. Obtain the interface call request sent by the terminal.

[0150] An API call request is used to request the invocation of the target version of the API.

[0151] An API call request may include authentication information and version information. The authentication information is used to verify the identity of the terminal, and the version information is used to indicate the target version.

[0152] For example, authentication information can be a token, and version information can be a version number.

[0153] An API can have multiple versions, which can include the target version.

[0154] This step can be performed by a computing device; for example, a computing device can receive interface call requests sent by a terminal through an API gateway.

[0155] S302. Determine the actual values ​​of the multi-dimensional permission control parameters based on the interface call request.

[0156] In some embodiments, the actual values ​​of multidimensional permission control parameters can be extracted from the API call request.

[0157] In some embodiments, the interface call request can be validated based on the authentication information in the interface call request to obtain a validation result; if the validation result is successful, the actual value of the multidimensional permission control parameter can be extracted from the interface call request, or the actual value of the multidimensional permission control parameter can be determined based on the user information corresponding to the authentication information.

[0158] Optionally, if the verification result is that the verification fails, the computing device may reject the interface call request.

[0159] This step can be performed by a computing device. For example, the computing device can perform the above steps through an API gateway and an identity authentication module. The API gateway of the computing device can send authentication information from the interface call request to the identity authentication module. The identity authentication module can perform identity verification processing on the terminal based on the authentication information to obtain the verification result. If the verification result is successful, the module returns the user information corresponding to the interface call request to the API gateway. The API gateway can then determine the actual values ​​of the multi-dimensional access control parameters based on this user information.

[0160] In some embodiments, if the verification result is successful, the API gateway can also parse the interface call request to obtain the actual values ​​of the multi-dimensional permission control parameters.

[0161] In this embodiment of the application, before performing permission matching processing on the interface call request, the interface call request can be verified based on the authentication information in the interface call request, and the interface call request that fails the verification can be rejected, which helps to ensure the security of the API.

[0162] In practical applications, different business scenarios may have different API version requirements. For example, new businesses may need to call feature-rich, high-version APIs, while traditional businesses rely on stable, low-version APIs. Different user roles (such as administrators, developers, and external partners) may also have different API version requirements. For example, administrators may have access to all API versions, while developers may only be able to call APIs in the test environment. Furthermore, API version calls must meet compliance requirements, such as access restrictions on certain API versions during specific time periods (e.g., peak traffic periods) and permission isolation for different terminal types (e.g., web, mobile, and third-party systems). For example, computing devices can manage API access permissions through gateway rules; or by deploying an independent time-based scheduling system, APIs can be time-based for task triggering and permission control. Therefore, this application embodiment can combine the differentiated permission requirements for API versions based on user groups, business scenarios, time periods, and terminal types to set multi-dimensional permission control parameters, thereby achieving fine-grained management of API version permissions.

[0163] In some embodiments, the multidimensional access control parameters may include access control parameters of M dimensions, where M is an integer greater than 1. The M dimensions may include spatial dimensions and temporal dimensions, wherein the priority of the spatial dimensions precedes that of the temporal dimensions; the access control parameters of the spatial dimensions include at least one of the following: role type, business type, or terminal type; the access control parameters of the temporal dimensions include at least one of the following: API version lifecycle time information, time period type.

[0164] For example, the role type can be administrator, developer, tester, or external collaborator.

[0165] Business types can be categorized based on business domains or business function modules.

[0166] For example, the terminal type can be a web terminal, a mobile terminal, a mini-program, or a third-party system.

[0167] Lifecycle time information may include the effective date and the expiration date; and / or, the lifecycle time information may include the effective period. For example, API version 1's effective date is 1:00 AM on 1:00 AM on 1:00 AM on 1:00 AM on 1:00 AM on 1:00 AM on 1:00 AM on 2:00 AM on 1 ...

[0168] For example, the time period type can be peak time or off-peak time.

[0169] In this embodiment of the application, the computing device can deeply integrate the permission control parameters in the spatial and temporal dimensions to form multi-dimensional permission control parameters, so as to perform subsequent permission matching processing through the multi-dimensional permission control parameters. This can solve the problems of insufficient matching accuracy and security caused by a single dimension, and can also cover the differentiated permission management needs of API versions in complex scenarios.

[0170] S303. Determine the effective value of the multi-dimensional permission control parameter, and perform matching processing between the effective value and the actual value of the multi-dimensional permission control parameter to obtain the initial matching result of the interface call request.

[0171] In some embodiments, the computing device may store the effective values ​​of multidimensional permission control parameters; or, the computing device may retrieve the effective values ​​of multidimensional permission control parameters from a database.

[0172] In some embodiments, the multidimensional permission control parameters may include permission control parameters of multiple dimensions. The computing device can perform hierarchical matching processing on the actual values ​​of the multidimensional permission control parameters according to the priority order of the multiple dimensions and the effective values ​​of each permission control parameter to obtain the initial matching result of the interface call request.

[0173] The initial matching result can be either a successful match or a failed match.

[0174] If the initial matching result is a successful match, you can continue to step S304.

[0175] If the initial matching result is a failure, the API call request can be filtered to avoid performing subsequent version permission matching operations on non-compliant API call requests, which helps reduce redundant consumption of computing resources.

[0176] S304. If the initial matching result is a successful match, the permission matching result is determined based on the actual value of the multidimensional permission control parameters and the target version, according to the mapping relationship between the permission matching rules of the multidimensional permission control parameters and the version information.

[0177] The permission matching result is used to indicate whether the terminal has permission to call the target version of the API.

[0178] The permission matching rules and version information of multidimensional permission control parameters can be a one-to-one mapping relationship, a one-to-many mapping relationship, or a many-to-many mapping relationship.

[0179] Permission matching rules can be used to determine whether a terminal has permission to call the target version of the API and to specify the constraints when making the call.

[0180] This step can be performed by a computing device. For example, a computing device can perform this step through a spatiotemporal fusion API version engine. The spatiotemporal fusion API version engine can determine the permission matching rules for the multidimensional permission control parameters corresponding to the target version based on this mapping relationship, and perform permission matching processing on the actual values ​​of the multidimensional permission control parameters according to the permission matching rules to obtain the permission matching result.

[0181] In this embodiment, the computing device can deeply integrate spatial and temporal access control rules to construct a complete access control model that defines "who calls which version at what time and in what way." The computing device can execute step S304 through this complete access control model to achieve accurate access matching for multiple API versions. This solves the problems of insufficient matching accuracy and security caused by a single dimension, and can cover the differentiated access management needs of API versions in complex scenarios.

[0182] In some embodiments, the method further includes the following steps: in the case of an API version update, determining the difference permission information between the updated version and the historical version of the API; determining a first sub-mapping relationship between the historical version and the permission control rules of the multidimensional permission control parameters based on the mapping relationship; updating the first sub-mapping relationship based on the difference permission information to obtain a second sub-mapping relationship between the updated version and the multidimensional permission control parameters; and adding the second sub-mapping relationship to the mapping relationship.

[0183] For example, in an API version canary release scenario, an Enterprise Resource Planning (ERP) migration tool platform plans to release data migration interface v2.0 (supporting API-to-API data migration) to replace the stable v1.0 version (which only supports database-to-database migration). Since this process involves adding new features, a canary release model can be used to configure permission rules in stages to ensure a seamless transition. The specific implementation process is as follows:

[0184] Phase 1 (Internal Testing, 3 days):

[0185] Version: Only v2.0 test environment is available;

[0186] Role: Limited to "Migration Testing Team";

[0187] Time: Available from 9:00 to 18:00 daily; automatically disabled at other times (to avoid problems when unattended at night).

[0188] 2. Phase Two (Small-scale user verification, 7 days):

[0189] Version: v2.0 official environment;

[0190] Role: Limited to "Migrating New Feature Verification Team";

[0191] Time: No time restrictions.

[0192] 3. Phase Three (Full Release, 15 Days):

[0193] Version: v2.0 is fully released; v1.0 retains access permissions.

[0194] Roles: Users with existing v1.0 permissions will automatically gain v2.0 permissions, while retaining the v1.0 access point.

[0195] In this method, by establishing a dynamic mapping relationship between API version information and permission control rules of multi-dimensional (such as time dimension and space dimension) permission control parameters, permission policies can be configured independently for each version, realizing a smooth transition of permissions during version iteration and solving the permission adaptation problem when multiple versions coexist.

[0196] S305. Process the interface call request based on the permission matching result.

[0197] In some embodiments, if the permission matching result is used to indicate that the terminal has permission to call the target version of the API, a call permission instruction is generated; according to the call permission instruction, the target version of the API is called to process the interface call request, the processing result is obtained, and a call success log is generated; the processing result is sent to the terminal.

[0198] In some embodiments, if the permission matching result is used to indicate that the terminal does not have permission to call the target version of the API, a call denial instruction is generated; based on the call denial instruction, error indication information and call failure log are generated; the error indication information is used to indicate permission errors; and the error indication information is sent to the terminal.

[0199] In some embodiments, this step can be performed by a computing device. For example, the computing device can send permission matching results to the API gateway through the spatiotemporal fusion API version engine, or send permission control instructions corresponding to the permission matching results to the API gateway.

[0200] If the permission matching result indicates that the terminal has permission to call the target version of the API, or if the permission control instruction is a permission call instruction, the computing device can trigger the API version management module to process the interface call request through the API gateway. The computing device can send a call request to the API service module through the API version management module. This call request is used to call the target version of the API to process the interface call request and obtain the processing result. The computing device can also send this processing result to the API gateway through the API version management module. The computing device can generate a call success log through the API gateway and send this call success log to the detection and log verification management module, as well as send a success response message to the terminal's web interface. This success response message can include the processing result.

[0201] If the permission matching result indicates that the terminal does not have permission to call the target version of the API, or the permission control instruction is a denial instruction, the computing device can generate a call failure log through the API gateway and send the call failure log to the detection and log verification management module, as well as send error indication information to the terminal's web interface. The error indication information is used to indicate permission errors.

[0202] In this embodiment of the application, for multi-version API call scenarios, precise permission control instructions can be generated based on permission matching results, thereby performing differentiated processing on interface call requests based on permission control instructions, which is beneficial to improving the flexibility and security of permission management; at the same time, a traceable log is generated for each permission control instruction to facilitate subsequent verification and processing.

[0203] The interface request processing method provided in this application, after obtaining an interface call request, can determine the actual value of multi-dimensional permission control parameters based on the interface call request. By using the valid and actual values ​​of the multi-dimensional permission control parameters, it can quickly identify whether the interface call request is compliant and filter out non-compliant interface call requests. If the initial matching result is successful, it can determine the permission matching result based on the actual value of the multi-dimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules of the multi-dimensional permission control parameters and version information. Based on the permission control result, it can perform differentiated processing on the interface call request. In summary, this method can ensure the efficiency and security of multi-version API interface call permission management.

[0204] Multidimensional access control parameters can include M dimensions of access control parameters, where M is an integer greater than 1. Below, we will combine... Figure 4 The method provides a detailed explanation of the process of "matching the effective value and the actual value of the multi-dimensional permission control parameter to obtain the initial matching result of the interface call request".

[0205] Figure 4This is a second flowchart illustrating the interface request processing method provided in the embodiments of this application. This method can be applied to, for example... Figure 1 In the computing device shown. Please see Figure 4 The method may include the following steps:

[0206] S401. Initialize i to 1.

[0207] S402. Determine the i-th dimension among the M dimensions according to the priority order among the M dimensions.

[0208] Where i takes the values ​​1, 2, ..., and M is an integer greater than 1.

[0209] In some embodiments, the computing device may store the priority order among M dimensions configured by the user based on permission matching requirements.

[0210] In some embodiments, the M dimensions include spatial and temporal dimensions, with the spatial dimension having a higher priority than the temporal dimension. In this case, if i is 1, the first dimension is the spatial dimension.

[0211] S403. Match the actual value of the permission control parameter of the i-th dimension with the corresponding effective value to obtain the i-th matching result corresponding to the i-th dimension.

[0212] The result of the i-th match can be either a successful match or a failed match.

[0213] In some embodiments, if the i-th dimension includes N permission control parameters, where N is an integer greater than 1; step S403 may further include the following sub-steps:

[0214] S4031. Initialize j to 1.

[0215] S4032. Determine the j-th permission control parameter from among the N permission control parameters according to their priority order.

[0216] Where j takes the values ​​1, 2, ... in sequence.

[0217] In some embodiments, the computing device may store the priority order of N permission control parameters in various dimensions configured by the user based on permission matching requirements.

[0218] S4033. Match the actual value of the j-th permission control parameter with the corresponding effective value to obtain the j-th matching result corresponding to the j-th permission control parameter.

[0219] The result of the j-th match can be either a successful match or a failed match.

[0220] In some embodiments, the effective value can be a single numerical value. If the actual value of the j-th permission control parameter is the same as this numerical value, then the j-th matching result is determined to be a successful match; otherwise, the j-th matching result is determined to be a failed match.

[0221] In some embodiments, the effective value can also indicate an effective range. If the actual value of the j-th permission control parameter is within this effective range, then the j-th matching result is determined to be a successful match; otherwise, the j-th matching result is determined to be a failed match.

[0222] S4034. Determine whether the j-th matching result is a successful match.

[0223] If so, execute S4035;

[0224] If not, proceed with S4037.

[0225] S4035. Determine whether j is less than N.

[0226] If so, execute S4036;

[0227] If not, proceed with S4037.

[0228] S4036, Update j to j+1.

[0229] S4037. Based on the j-th matching result, determine the i-th matching result.

[0230] In some embodiments, if j is less than or equal to N and the j-th matching result is a failed match, the i-th matching result is determined to be a failed match; if j is equal to N and the j-th matching result is a successful match, the i-th matching result is determined to be a successful match.

[0231] S404. Determine whether the i-th matching result is a successful match.

[0232] If so, execute S405;

[0233] If not, proceed with S407.

[0234] S405. Determine whether i is less than M.

[0235] If so, execute S406;

[0236] If not, proceed with S407.

[0237] S406, Update i to i+1.

[0238] After completing step S406, step S402 can be executed.

[0239] S407. Determine the permission matching result based on the i-th matching result.

[0240] In some embodiments, if i is less than or equal to M and the i-th matching result is a failed match, the initial matching result is determined to be a failed match; if i is equal to M and the i-th matching result is a successful match, the initial matching result is determined to be a successful match.

[0241] The interface request processing method provided in this application can perform hierarchical verification of the actual values ​​of multi-dimensional permission control parameters based on the priority order of M dimensions and the valid values ​​of each permission control parameter. When there are multiple permission control parameters in a certain dimension, hierarchical verification can also be performed on the actual values ​​of these multiple permission control parameters based on their priority order and the valid values ​​of each permission control parameter. Through these steps, mismatched interface call requests can be quickly excluded, avoiding subsequent version permission matching operations for these mismatched interface call requests. This helps reduce redundant consumption of computing resources and improves the interface response efficiency of these interface call requests.

[0242] Figure 5 This is the third flowchart illustrating the interface request processing method provided in the embodiments of this application. The method can be... Figure 1 The computing device and terminal interact as shown. Please refer to [link / reference]. Figure 5 The method may include the following steps:

[0243] S501, The terminal sends an interface call request to the API gateway of the computing device.

[0244] The terminal can send interface call requests to the API gateway of the computing device through the web interface.

[0245] API call requests may include authentication information (such as a token) and version information (such as the version number of the target version).

[0246] S502. The API gateway of the computing device responds to the interface call request and sends an authentication request to the authentication module.

[0247] An authentication request may include authentication information (such as a token).

[0248] S503, the identity authentication module of the computing device responds to the identity authentication request, verifies the authentication information of the interface call request, and obtains the verification result.

[0249] The verification result can be either successful or failed.

[0250] If the verification result is successful, proceed to step S504; if the verification result is unsuccessful, filter the request to call the interface.

[0251] S504. If the authentication module of the computing device passes the verification, it sends user information to the API gateway.

[0252] User information can be used to indicate the actual values ​​of multidimensional access control parameters.

[0253] After receiving user information, the API gateway can determine the actual values ​​of multi-dimensional access control parameters based on that information.

[0254] S505, the API gateway of the computing device sends a spatiotemporal permission verification request message to the spatiotemporal fusion API version control engine.

[0255] The spatiotemporal permission verification request message may include the actual values ​​of multidimensional permission control parameters.

[0256] S506 The spatiotemporal fusion API version control engine of the computing device responds to the spatiotemporal permission verification request message, performs permission matching processing on the interface call request, and obtains the permission matching result.

[0257] The spatiotemporal fusion API version control engine can determine the effective value of multidimensional permission control parameters and match the effective value and actual value of the multidimensional permission control parameters to obtain the initial matching result of the interface call request. If the initial matching result is successful, the permission matching result is determined based on the actual value of the multidimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules of the multidimensional permission control parameters and the version information.

[0258] Permission matching results can be used to indicate whether the terminal has permission to call the target version of the API.

[0259] It should be noted that the specific execution process of this step can be referred to the specific execution process of steps S303 and S304, and will not be repeated here.

[0260] S507. If the permission matching result indicates that the terminal has permission to call the target version of the API, the spatiotemporal fusion API version control engine of the computing device sends permission approval information to the API gateway.

[0261] This permission is indicated by a message that the terminal has the authority to invoke the target version of the API. The message includes the target version.

[0262] S508, the API gateway of the computing device sends a version routing selection message to the version management module.

[0263] The version routing message includes the target version.

[0264] S509. The version management module of the computing device responds to the version routing selection message by sending an API call request message to the API service module.

[0265] The API call request message includes the target version.

[0266] S510, the API service module of the computing device calls the target version of the API to process the interface call request and obtain the processing result.

[0267] S511, The API service module of the computing device sends the processing result to the version management module.

[0268] S512, The version management module of the computing device sends a version routing response message to the API gateway.

[0269] The version routing response message includes the processing result.

[0270] S513. The API gateway of the computing device responds to the version routing response message and generates a call success log.

[0271] S514. The API gateway of the computing device sends a call success log to the inspection and log verification management module.

[0272] The computing device inspection and log verification management module can store the successful call log.

[0273] S515, The API gateway of the computing device sends a success response message to the terminal.

[0274] Optionally, the API gateway of the computing device sends a success response message to the web client in the terminal, which may include the processing result of the interface call request.

[0275] S516. If the permission matching result indicates that the terminal does not have permission to call the target version of the API, the spatiotemporal fusion API version control engine of the computing device sends a permission denial indication message to the API gateway.

[0276] This permission denial message can be used to indicate that the API call request is denied, along with the reason for the denial.

[0277] S517. The API gateway of the computing device generates a call failure log in response to the permission denial indication information.

[0278] S518, The API gateway of the computing device sends a call failure log to the inspection and log verification management module.

[0279] The computing device inspection and log verification management module can store the call failure log.

[0280] S519. The API gateway of the computing device sends error indication information to the terminal.

[0281] Error message indicates a permission error.

[0282] The interface request processing method provided in this application can set a unified interface call request entry point to ensure the consistency and accuracy of permission verification for different API interfaces. Furthermore, after obtaining the interface call request, the actual value of the multi-dimensional permission control parameters can be determined based on the request. By using the valid and actual values ​​of the multi-dimensional permission control parameters, the compliance of the interface call request can be quickly identified, and non-compliant requests can be filtered out. If the initial matching result is successful, the permission matching result can be determined based on the actual value of the multi-dimensional permission control parameters and the target version, according to the mapping relationship between the permission control rules and version information of the multi-dimensional permission control parameters. Based on the permission control result, differentiated processing can be performed on the interface call request. Through the above methods, this approach can achieve fine-grained permission control for multiple API versions, ensuring the efficiency and security of multi-version API interface call permission management.

[0283] This application provides a method for fine-grained API version permission control based on spatiotemporal dimension fusion of an interface platform. It solves the technical problem that traditional RBAC models only support spatial dimension permission control. Through a spatiotemporal dual-dimensional fusion mechanism, it achieves multi-dimensional permission management based on "user role + business type + terminal type + time information + API version". In this process, a rule matching engine can be built based on an optimized RETE algorithm, combined with a rule indexing mechanism and caching strategy, to achieve millisecond-level permission verification response, ensuring high availability and high reliability of the API interface platform.

[0284] The following section describes the application scenarios of the API version permission fine-grained control method based on the spatiotemporal dimension fusion of the interface platform.

[0285] (1) Scenario of parallel operation of multiple API versions

[0286] This method is applicable to scenarios where multiple versions of an enterprise-level API platform provide services simultaneously. For example, a platform may maintain both v1 (stable) and v2 (enhanced) API versions. This method allows configuring an access control rule for v1 version that allows only internal administrators to access it on weekdays, and configuring a rule for v2 version that allows external third parties to access it between 9:00 and 21:00, with a peak QPS limit of 500, thus achieving differentiated operation of API versions.

[0287] (2) API version canary release scenario

[0288] During the gray-scale release of the new version API, the following permission control rules can be configured based on the method provided in the embodiments of this application: initially, only test roles are allowed to call the new version during a specified time period; the permission scope is gradually expanded according to gray-scale feedback, and access is opened to users of specific terminal types; finally, after the full release is completed, the permission reclamation process of the old version is automatically triggered to ensure that the version transition is safe and controllable.

[0289] (3) Temporary API permission authorization scenario

[0290] This method supports the granting and revocation of temporary permissions for various API versions. For example, if a third-party partner needs to temporarily call a specific version of the API for data integration, a temporary permission rule can be configured with "validity period of 7 days, access from 9:00 to 17:00 daily, and QPS limit of 100". After the expiration, the API version will automatically expire and a verification log will be recorded, without the need for manual intervention.

[0291] Figure 6 This is a schematic diagram of the interface request processing device provided in an embodiment of this application. Please refer to... Figure 6 The interface request processing device 10 can be applied in a computing device and may include:

[0292] The acquisition module 11 is used to acquire the interface call request sent by the terminal. The interface call request is used to request to call the target version of the API.

[0293] Processing module 12 is used to determine the actual values ​​of the multi-dimensional permission control parameters based on the interface call request;

[0294] The processing module 12 is also used to determine the effective value of the multi-dimensional permission control parameters, and to perform matching processing on the effective value and the actual value of the multi-dimensional permission control parameters to obtain the initial matching result of the interface call request;

[0295] The processing module 12 is also used to determine the permission matching result if the initial matching result is a successful match, based on the actual value of the multidimensional permission control parameter and the target version, and based on the mapping relationship between the permission control rules of the multidimensional permission control parameter and the version information; the permission matching result is used to indicate whether the terminal has the permission to call the API of the target version;

[0296] Processing module 12 is also used to process interface call requests based on permission matching results.

[0297] The interface request processing apparatus provided in this application embodiment can execute the interface request processing method as shown in the above embodiment, and its beneficial effects are similar, so they will not be described again here.

[0298] In one possible implementation, the multidimensional access control parameters include access control parameters in M ​​dimensions, where M is an integer greater than 1; the processing module 12 is specifically used for:

[0299] Determine the i-th dimension from among the M dimensions according to their priority order.

[0300] The actual value of the permission control parameter of the i-th dimension is matched with the corresponding effective value to obtain the i-th matching result for the i-th dimension.

[0301] i is sequentially selected from 1, 2, ... until the i-th matching result is a failed match or i is M. The initial matching result is determined based on the i-th matching result.

[0302] In one possible implementation, if the i-th dimension includes N permission control parameters, where N is an integer greater than 1; the processing module 12 is further configured to:

[0303] Based on the priority order of the N access control parameters, determine the j-th access control parameter among the N access control parameters;

[0304] The actual value of the j-th permission control parameter is matched with the corresponding effective value to obtain the j-th matching result corresponding to the j-th permission control parameter;

[0305] j takes the values ​​1, 2, ..., until the j-th matching result is a failed match or j takes the value N. The i-th matching result is then determined based on the j-th matching result.

[0306] In one possible implementation, the processing module 12 is further configured to:

[0307] If i is less than or equal to M and the i-th matching result is a failed match, then the initial matching result is determined to be a failed match.

[0308] If i equals M and the i-th matching result is a successful match, then the initial matching result is determined to be a successful match.

[0309] In one possible implementation, the M dimensions include a spatial dimension and a temporal dimension, wherein,

[0310] The spatial dimension takes precedence over the temporal dimension.

[0311] The access control parameters for the spatial dimension include at least one of the following: role type, business type, or terminal type;

[0312] Time-based access control parameters include at least one of the following: API version lifecycle time information and time period type.

[0313] In one possible implementation, the processing module 12 is further configured to:

[0314] If the permission matching result indicates that the terminal has permission to call the target version of the API, generate a command to allow the call;

[0315] According to the allowed call instructions, the API of the target version is invoked to process the interface call request, obtain the processing result, and generate a call success log;

[0316] Send the processing result to the terminal.

[0317] In one possible implementation, the processing module 12 is further configured to:

[0318] If the permission matching result indicates that the terminal does not have permission to call the target version of the API, a call denial instruction is generated;

[0319] Based on the call denial instruction, an error message and a call failure log are generated; the error message is used to indicate permission errors.

[0320] Send error indication information to the terminal.

[0321] In one possible implementation, the processing module 12 is further configured to:

[0322] Based on the authentication information in the API call request, the API call request is validated to obtain the validation result;

[0323] If the verification result is successful, extract the actual value of the multi-dimensional permission control parameter from the interface call request, or determine the actual value of the multi-dimensional permission control parameter based on the user information corresponding to the authentication information.

[0324] In one possible implementation, the processing module 12 is further configured to:

[0325] In the case of API version updates, determine the differences in permission information between the updated version and the historical version of the API;

[0326] Based on the mapping relationship, the first sub-mapping relationship between the historical version and the permission control rules of the multi-dimensional permission control parameters is determined;

[0327] Based on the differential permission information, the first sub-mapping relationship is updated to obtain the second sub-mapping relationship between the updated version and the multi-dimensional permission control parameters;

[0328] Add a second sub-mapping relationship to the mapping relationship.

[0329] Figure 7 This is a schematic diagram of the hardware structure of a computing device provided in an embodiment of this application. Please refer to [link / reference]. Figure 7The computing device 20 can be the computing device in the above method embodiments. The computing device 20 may include a processor 21 and a memory 22, which are coupled together. The processor 21 and the memory 22 can communicate; for example, the processor 21 and the memory 22 communicate via a communication bus 23.

[0330] Memory 22 is used to store program instructions;

[0331] The processor 21 is used to execute program instructions to perform the technical solution as shown in the above method embodiments.

[0332] Optionally, the computing device 20 may also include a communication interface, which may include a transmitter and / or a receiver.

[0333] Optionally, the processor mentioned above can be a CPU, or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0334] This application provides a computer-readable storage medium storing computer-executable instructions; when executed by a processor, the computer-executable instructions are used to implement the interface request processing method shown in the above embodiments.

[0335] This application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it causes the computer to perform the interface request processing method shown in the above embodiment.

[0336] All or part of the steps in the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above-described method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0337] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0338] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0339] These computer program instructions may also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0340] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of this application, and are not intended to limit them. Although the embodiments of this application have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. An interface request processing method, characterized in that, include: Obtain the interface call request sent by the terminal, the interface call request being used to request the invocation of the target version of the application programming interface (API); Based on the interface call request, determine the actual values ​​of the multi-dimensional permission control parameters; The effective value of the multi-dimensional permission control parameter is determined, and the effective value and actual value of the multi-dimensional permission control parameter are matched to obtain the initial matching result of the interface call request. If the initial matching result is a successful match, the permission matching result is determined based on the actual value of the multidimensional permission control parameter and the target version, according to the mapping relationship between the permission control rules of the multidimensional permission control parameter and the version information. The permission matching result is used to indicate whether the terminal has permission to call the target version of the API; The interface call request is processed based on the permission matching result.

2. The method according to claim 1, characterized in that, The multidimensional access control parameters include access control parameters in M ​​dimensions, where M is an integer greater than 1; The effective and actual values ​​of the multi-dimensional permission control parameters are matched to obtain the initial matching result of the interface call request, including: Based on the priority order among the M dimensions, determine the i-th dimension among the M dimensions; The actual value of the permission control parameter of the i-th dimension is matched with the corresponding effective value to obtain the i-th matching result corresponding to the i-th dimension; The i is sequentially taken as 1, 2, ..., until the i-th matching result is a matching failure, or the i is taken as M, and the initial matching result is determined based on the i-th matching result.

3. The method according to claim 2, characterized in that, If the i-th dimension includes N permission control parameters, where N is an integer greater than 1; the actual values ​​of the permission control parameters of the i-th dimension are matched with their corresponding effective values ​​to obtain the i-th matching result for the i-th dimension, including: Based on the priority order of the N permission control parameters, determine the j-th permission control parameter among the N permission control parameters; The actual value of the j-th permission control parameter is matched with the corresponding effective value to obtain the j-th matching result corresponding to the j-th permission control parameter; The j takes values ​​of 1, 2, ..., until the j-th matching result is a failed match or the j takes the value N. The i-th matching result is determined based on the j-th matching result.

4. The method according to claim 2 or 3, characterized in that, Determining the initial matching result based on the i-th matching result includes: If i is less than or equal to M and the i-th matching result is a failed match, then the initial matching result is determined to be a failed match. If i equals M and the i-th matching result is a successful match, then the initial matching result is determined to be a successful match.

5. The method according to any one of claims 2-4, characterized in that, The M dimensions include spatial dimensions and temporal dimensions, wherein, The spatial dimension has a higher priority than the temporal dimension. The access control parameters for the spatial dimension include at least one of the following: role type, business type, or terminal type; The time-dimensional permission control parameters include at least one of the following: the lifecycle time information of the API version and the time period type.

6. The method according to any one of claims 1-5, characterized in that, Based on the permission matching result, the interface call request is processed, including: If the permission matching result indicates that the terminal has permission to call the target version of the API, a command to allow the call is generated; According to the allowed call instruction, the API of the target version is invoked to process the interface call request, the processing result is obtained, and a call success log is generated; The processing result is sent to the terminal.

7. The method according to any one of claims 1-5, characterized in that, Based on the permission matching result, the interface call request is processed, including: If the permission matching result indicates that the terminal does not have permission to call the target version of the API, a call denial instruction is generated; Based on the denied call instruction, an error indication message and a call failure log are generated; the error indication message is used to indicate a permission error; The error indication information is sent to the terminal.

8. The method according to any one of claims 1-7, characterized in that, Based on the interface call request, determine the actual values ​​of the multi-dimensional permission control parameters, including: Based on the authentication information in the interface call request, the interface call request is verified to obtain the verification result; If the verification result is successful, the actual value of the multi-dimensional permission control parameter is extracted from the interface call request, or the actual value of the multi-dimensional permission control parameter is determined based on the user information corresponding to the authentication information.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: In the event of an API version update, determine the differences in permission information between the updated version and the historical version of the API; Based on the mapping relationship, a first sub-mapping relationship is determined between the historical version and the permission control rules of the multi-dimensional permission control parameters; Based on the differential permission information, the first sub-mapping relationship is updated to obtain the second sub-mapping relationship between the updated version and the multi-dimensional permission control parameters; Add the second sub-mapping relationship to the mapping relationship.

10. A computing device, characterized in that, include: Processor and memory; The processor and the memory are coupled; The memory is used to store program instructions; The processor is used to execute the program instructions to implement the method as described in any one of claims 1 to 9.

Images