Api signature verification method and device, and electronic equipment

Abstract

The application discloses an API signature verification method and device and electronic equipment, and the method comprises the following steps: receiving a routing request; reading a signature verification configuration from the metadata of the routing request by a signature verification filter; if the signature verification configuration enables a signature verification process, acquiring a signature verifier corresponding to the current routing request by the signature verification filter according to the configured algorithm type through a signature verification algorithm factory, all the signature verifiers implement a signature verification algorithm interface, and different signature verifiers adopt different signature verification algorithms; and calling a signature verification method of the determined signature verifier to complete the signature verification. The API signature verification method, device and electronic equipment provided by the application can solve the problem of strong coupling between algorithm implementation and signature verification rules.

Description

Technical Field

[0001] This application relates to the field of microservice architecture technology, and in particular to API signature verification methods, devices and electronic devices. Background Technology

[0002] In a microservice architecture, the API gateway serves as the unified entry point for the system, undertaking key responsibilities such as identity authentication and security verification. Among these, digital signature verification of requests is an important means of preventing request tampering and replay attacks.

[0003] Currently, mainstream Spring Cloud Gateway implementations of signature verification functionality typically suffer from the following problems:

[0004] Fixed algorithms and lack of flexibility: Existing signature verification solutions often only support a single signature algorithm (such as HMAC-SHA256). When business requirements change and other algorithms such as the national cryptographic standard SM2 / SM3 or RSA are needed, the gateway core code must be modified and redeployed, resulting in high development and maintenance costs, and failing to meet the differentiated security algorithm requirements of different customers or different business scenarios.

[0005] Coarse-grained configuration: Signature verification rules are typically global, making it impossible to configure independent signature verification strategies for different API paths, client IDs, or business domains. For example, internal service calls may only require simple signatures, while APIs for external partners require more stringent national cryptographic algorithms. Existing solutions struggle to achieve this level of fine-grained access control and security.

[0006] Poor scalability: When a new signature verification algorithm is needed, developers must have a deep understanding of the gateway's filtering mechanism and write complex custom filter code. The process is tedious and error-prone, which is not conducive to the long-term maintenance and rapid iteration of the system.

[0007] The root cause of these problems is that existing solutions tightly couple signature verification logic with specific algorithm implementations and routing rules, lacking an abstract, pluggable architecture to decouple these concerns. Summary of the Invention

[0008] The purpose of this invention is to provide an API signature verification method, apparatus, and electronic device that can solve the problem of strong coupling between algorithm implementation and signature verification rules.

[0009] This invention provides the following solution:

[0010] According to one aspect of the present invention, an API signature verification method is provided, the API signature verification method comprising:

[0011] Receive routing requests;

[0012] The signature verification filter reads the signature verification configuration from the metadata of the routed request;

[0013] If the signature verification process is enabled in the signature verification configuration, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory, based on the configured algorithm type. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms.

[0014] Call the verification function of the designated verification device to complete the verification.

[0015] Optionally, the signature verification function of a specific signature verifier is called to complete the signature verification, including:

[0016] Perform signature verification based on the context information encapsulated in the signature verification context object.

[0017] Optional contextual information includes: the original request body, the header / query parameter mapping to be verified, the key obtained from the configuration, and the expected signature value.

[0018] Optional, also includes:

[0019] Before receiving routing requests, the Spring container manages all objects that implement the signature verification algorithm interface.

[0020] Optional, also includes:

[0021] Before receiving routing requests, after the Spring container manages all objects that implement the signature verification algorithm interface, the signature verification algorithm factory establishes a mapping relationship between algorithm names and objects that implement the signature verification algorithm interface.

[0022] Optionally, depending on the configured algorithm type, the signature verification filter obtains the signature verification function corresponding to the current route request through the signature verification algorithm factory, including:

[0023] Based on the algorithm type specified in the configuration, find and return the corresponding signature verification algorithm interface implementation class instance from the Spring container;

[0024] Based on the found instances of the signature verification algorithm interface implementation class, construct the signature verification device.

[0025] Optionally, depending on the configured algorithm type, the signature verification filter obtains the signature verification unit corresponding to the current route request through the signature verification algorithm factory, and further includes:

[0026] Collect the headers, query parameters, and request body from the request.

[0027] Optionally, signature verification filters include: global signature verification filters and route-level signature verification filters.

[0028] According to a second aspect of the present invention, an API signature verification device is provided, the API signature verification device comprising:

[0029] The receiving module is used to receive routing requests;

[0030] The read module is used by the signature verification filter to read the signature verification configuration from the metadata of the route request;

[0031] The acquisition module is used to obtain the signature checker corresponding to the current route request through the signature checker algorithm factory and the signature checker filter if the signature checker configuration enables the signature checker process. All signature checkers implement the signature checker algorithm interface, and different signature checkers use different signature checker algorithms.

[0032] The calling module is used to invoke the signature verification function of a specific signature verifier to complete the signature verification.

[0033] According to three aspects of the present invention, an electronic device is provided, the electronic device comprising:

[0034] Processor, communication interface, memory, and communication bus.

[0035] The processor, communication interface, and memory communicate with each other through a communication bus.

[0036] The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the API signature verification method described above.

[0037] The above solution achieves the following beneficial technical effects:

[0038] High flexibility: By introducing the strategy pattern and factory pattern, the signature verification algorithm is abstracted into a pluggable component, enabling the gateway to dynamically support multiple signature verification algorithms without modifying the core code;

[0039] Fine-grained configurability: Deep integration of signature verification policies with Spring Cloud Gateway's route configuration allows each route rule to be independently bound to a set of signature verification configurations (including enabling status, algorithm used, key source, list of header / query parameters involved in signing, etc.), achieving fine-grained security management at the API level;

[0040] Excellent scalability: It provides a standard signature verification algorithm interface (SignatureAlgorithm). Any new signature verification algorithm only needs to implement this interface and register it in the Spring container to be automatically discovered and used by the gateway, which greatly reduces the cost of integrating new algorithms.

[0041] Enhancing system security and operational efficiency: Flexible configuration allows for matching the most suitable signature verification policies to APIs with different security levels, improving overall system security. Furthermore, policy adjustments and algorithm switching can be completed through configuration files, significantly improving operational efficiency and system agility. Attached Figure Description

[0042] Figure 1 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0043] Figure 2 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0044] Figure 3 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0045] Figure 4 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0046] Figure 5 This is a flowchart of the acquisition operation in the API signature verification method provided in one or more embodiments of the present invention;

[0047] Figure 6 This is a flowchart of the acquisition operation in the API signature verification method provided in one or more embodiments of the present invention;

[0048] Figure 7 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0049] Figure 8 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention;

[0050] Figure 9 This is a structural diagram of an API signature verification device provided in one or more embodiments of the present invention;

[0051] Figure 10 This is a structural diagram of an electronic device provided in one or more embodiments of the present invention. Detailed Implementation

[0052] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Figure 1This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 1 The API signature verification method includes the following steps:

[0054] S11 receives routing requests.

[0055] S12, the signature verification filter reads the signature verification configuration from the metadata of the route request.

[0056] S13. If the signature verification process is enabled in the signature verification configuration, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory according to the configured algorithm type. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms.

[0057] S14, call the verification function of the determined verification device to complete the verification.

[0058] As described above, in existing microservice architectures, the specific algorithm implementation code is tightly coupled with the specific signature verification algorithm. That is, the pre-built signature verification algorithms in a microservice architecture are very limited, typically only a few. Furthermore, a specific signature verification code corresponds to a single signature verification algorithm. This results in a very limited selection of signature verification algorithms that the server can provide.

[0059] In this configuration, different user requests are typically processed mechanically by one or more fixed signature verification algorithms. However, different user requests usually have different requirements for the signature verification process. For example, in some cases, users have high requirements for the reliability of the signature verification process, but not high requirements for its timeliness. In other cases, users require the signature verification process to not only have high reliability, but also better timeliness.

[0060] Furthermore, the requirements for the signature verification process vary depending on the network parameters. When network bandwidth is unlimited, users do not have high demands for the timeliness of the verification process. However, in scenarios with limited network bandwidth, the actual needs of users are entirely different.

[0061] Clearly, the existing microservice architecture cannot provide such differentiated services.

[0062] To address the aforementioned issues in existing microservice architectures, this embodiment provides a solution. This solution changes the current situation where the signature verification implementation code is tightly coupled with the specific signature verification algorithm. Instead, it implements the specific signature verification algorithm as a pluggable component, allowing for flexible selection of the verification algorithm based on the current request and network environment during the signature verification process, thus achieving a highly flexible request signature verification process.

[0063] The key to achieving this highly flexible signature verification process lies in the simultaneous use of the strategy pattern and the factory pattern. The strategy pattern encapsulates different algorithms into independent classes, making them interchangeable and thus decoupling the implementation code from the specific algorithms. The factory pattern encapsulates the process of creating concrete objects, providing users with an interface for creating concrete instantiated objects, allowing users to directly call this interface to create a usable instantiated object.

[0064] Another key element in achieving the highly flexible signature verification process described above lies in the object-oriented program architecture. In the dynamically configurable signature verification process provided in this embodiment, each selectable signature verification algorithm is implemented within an object-oriented program architecture. More specifically, each signature verification algorithm is implemented as a class within the object-oriented program architecture, and all classes corresponding to specific signature verification algorithms inherit from the same interface, namely the signature verification algorithm interface.

[0065] With the above object-oriented program architecture, upon receiving a specific routing request from the client, it is only necessary to refer to the configuration corresponding to the current routing request and call the factory pattern to select the most suitable signature verification algorithm for the current working condition. This makes the signature verification algorithm a pluggable component in the signature verification process, no longer tightly coupled with the specific implementation logic.

[0066] To execute the method process provided in this embodiment, a routing request must first be received from the client.

[0067] It should be understood that every routing request from a client must have corresponding operating parameters. For example, what kind of client operating system is the user using to make this routing request—is it made through a Wi-Fi access point, or through the client's own mobile network? Another example is whether the user is making the routing request through a browser on the client, or directly through an application installed on the client.

[0068] It should also be understood that the operational parameters of each routing request mentioned above can be collected in subsequent processing steps. Moreover, once these operational parameters are collected, they can be actually referenced during the processing of the routing request, potentially affecting the flexible configuration of the signature verification process.

[0069] After receiving the routing request sent by the client, the signature verification filter is invoked. Furthermore, by invoking the signature verification filter, the metadata corresponding to the routing request is read, and the configuration information useful for the subsequent signature verification process—that is, the signature verification configuration—is parsed from the metadata.

[0070] It is important to note that the signature verification configuration in this embodiment uses very fine-grained configuration parameters. It is precisely because of the fine-grained nature of these configuration parameters that the signature verification process derived from them is fine-grained and controllable. In other words, because the signature verification configuration itself is fine-grained and configurable, the signature verification process provided in this embodiment is fine-grained and controllable. Each API path can have an independent strategy.

[0071] In this embodiment, the signature verification filter that can be invoked can be not just a single instance, but multiple different implementations. For example, the invoked signature verification filter can be a global signature verification filter that executes globally adapted signature verification filtering rules. The invoked signature verification filter can also be a signature verification filter specifically configured for a particular route request or a specific type of route request, capable of executing signature verification filtering rules customized for that type of route request.

[0072] After completing the signature verification configuration, if the configuration parameter in the signature verification configuration is to start the signature verification process, then a signature verifier adapted to the current network environment and routing requests will be built using the factory pattern.

[0073] It is important to note that in this embodiment, all signature verifiers are implemented using an object-oriented architecture. This means that each signature verifier implements a signature verification algorithm interface. Moreover, each implementation of the signature verification algorithm interface corresponds to a specific signature verification algorithm.

[0074] The choice of which signature verification algorithm to build depends on the specific configuration parameters referenced in the engineering mode. In other words, the signature verification configuration read by the signature verification filter in the previous step determines the signature verification algorithm selected during the signature verification algorithm construction process.

[0075] The implementation of the factory pattern involves an object representing a signature verification algorithm factory. In other words, in this embodiment, the factory pattern is implemented through an object representing a signature verification algorithm factory.

[0076] Since each signature verifier is bound to a corresponding signature verification algorithm, once the signature verifier is built using the factory pattern, the dynamic selection of the signature verification algorithm is completed. This makes the signature verification process no longer a fixed process tightly coupled with the implementation code, but a signature verification process that can be flexibly configured according to the configuration parameters.

[0077] After completing the construction of the signature verification tool, the corresponding signature verification process is completed using the constructed signature verification tool.

[0078] Figure 2 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 2 The API signature verification method includes the following steps:

[0079] S21, Receive routing request.

[0080] S22, the signature verification filter reads the signature verification configuration from the metadata of the route request.

[0081] S23. If the signature verification configuration enables the signature verification process, then according to the configured algorithm type, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms.

[0082] S24, Perform signature verification based on the context information encapsulated in the signature verification context object.

[0083] This embodiment is based on the foregoing embodiments of the present invention and further illustrates the execution process of the API signature verification method.

[0084] It is important to emphasize in this embodiment that not only is the selection of the signature verification algorithm a flexible configuration process, but the execution of the signature verification algorithm can also be a flexible configuration and dynamic execution process.

[0085] In this embodiment, the execution process of the signature verification process is a signature verification process that references the signature verification context object.

[0086] The signature verification context object is an object that encapsulates various context parameters.

[0087] The context parameters encapsulated in the signature verification context object can include the original request body, the header / query parameter mapping to be verified, the key obtained from the configuration, and the expected signature value.

[0088] In the signature verification execution process of this embodiment, the context parameters encapsulated in the signature verification context object described above can be used to flexibly configure and select the actual signature verification process, making the signature verification execution process a flexible and configurable process as well.

[0089] For example, a user submits a routing request through the client. The microservice, by analyzing historical request data, discovers that the user who submitted the routing request is a frequent submitter. Further analysis of this user's historical request submissions reveals the signature value the user expects.

[0090] Therefore, in the current signature verification process, the signature value submitted by the user can be compared with this expected signature value. If they are the same, it means that the user's current behavior is exactly the same as the user's historical expectation, and the signature verification process is complete. If they are different, it means that the user's expected signature value may have changed, and further confirmation is required.

[0091] By effectively utilizing the contextual information described above, the actual signature verification process becomes configurable, enabling flexible configuration and execution of the signature verification process.

[0092] Figure 3 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 3 The API signature verification method includes the following steps:

[0093] S31, all objects that implement the signature verification algorithm interface are managed by the Spring container.

[0094] S32 receives routing requests.

[0095] S33, the signature verification filter reads the signature verification configuration from the metadata of the route request.

[0096] S34. If the signature verification configuration enables the signature verification process, then according to the configured algorithm type, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms.

[0097] S35, call the verification function of the determined verification device to complete the verification.

[0098] This embodiment is based on the foregoing embodiments of the present invention and further explains the execution process of the API signature verification method.

[0099] As described in the foregoing embodiments of this invention, in the technical solution of this invention, all objects executing the signature verification algorithm need to implement a virtual interface called the signature verification algorithm interface. Only after implementing the above interface can the object be found and have the opportunity to be executed in the subsequent signature verification process.

[0100] It's conceivable that the number of signature verification algorithms that a gateway might need is enormous, which means the number of objects implementing the signature verification algorithm interface could be staggering. This makes the effective management of these objects that implement the signature verification algorithm structure a significant challenge.

[0101] In this embodiment, the Spring container is used to achieve effective management of these objects.

[0102] Figure 4 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 4 The API signature verification method includes the following steps:

[0103] S41, all objects that implement the signature verification algorithm interface are managed by the Spring container.

[0104] S42, the signature verification algorithm factory establishes a mapping relationship between algorithm names and objects that implement the signature verification algorithm interface.

[0105] S43 receives routing requests.

[0106] S44, the signature verification filter reads the signature verification configuration from the metadata of the route request.

[0107] S45. If the signature verification process is enabled in the signature verification configuration, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory according to the configured algorithm type. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms.

[0108] S46, call the verification function of the determined verification device to complete the verification.

[0109] This embodiment is based on the foregoing embodiments of the present invention and further describes the execution process of the API signature verification method.

[0110] In the technical solution provided in this embodiment, before receiving the routing request, in addition to using the Spring container to manage the objects of the signature verification algorithm interface, it is also necessary to further establish the mapping relationship between the algorithm name and these objects.

[0111] It should be understood that the management performed by the Spring container is limited to the management of object lifecycles and cannot establish a mapping relationship between algorithm names and these objects. Without establishing a corresponding mapping relationship, it is impossible to perform an effective lookup of the object corresponding to the algorithm name.

[0112] In this embodiment, a signature verification algorithm factory is used to establish a mapping relationship between algorithm names and corresponding objects. After establishing the above mapping relationship, as long as a specific algorithm name is known, the corresponding object can be quickly found based on the established mapping relationship.

[0113] Moreover, since the establishment of this correspondence is completed by the signature verification algorithm factory, it means that this mapping relationship resides in memory. Therefore, the search of the above mapping relationship does not involve complex read and write operations and can be completed by accessing the memory address space, which is very efficient.

[0114] Figure 5 This is a flowchart of the acquisition operation in the API signature verification method provided in one or more embodiments of the present invention. See also Figure 5 Based on the configured algorithm type, the signature verification algorithm factory and the signature verification filter obtain the signature verification device corresponding to the current route request, including the following operation steps:

[0115] S51, based on the algorithm type specified in the configuration, finds and returns the corresponding signature verification algorithm interface implementation class instance from the Spring container.

[0116] S52, construct a signature verifier based on the found signature verification algorithm interface implementation class instance.

[0117] This embodiment is based on the foregoing embodiments of the present invention and further illustrates the execution process of the acquisition operation during the execution of the API signature verification method.

[0118] In this embodiment, the acquisition of the signature verification device is completed in two steps.

[0119] First, the algorithm type specified in the configuration needs to be read. Then, based on the read algorithm type, the Spring container needs to find the instance of the signature verification algorithm interface implementation class corresponding to that algorithm type.

[0120] After finding an instance of the signature verification algorithm interface implementation class, the corresponding signature verifier is constructed based on the found instance of the signature verification algorithm implementation class.

[0121] The construction of the signature verification tool is accomplished by calling the corresponding signature verification tool constructor.

[0122] Figure 6 This is a flowchart of the acquisition operation in the API signature verification method provided in one or more embodiments of the present invention. See also Figure 6 Based on the configured algorithm type, the signature verification algorithm factory and the signature verification filter obtain the signature verification device corresponding to the current route request, including the following operation steps:

[0123] S61, based on the algorithm type specified in the configuration, finds and returns the corresponding signature verification algorithm interface implementation class instance from the Spring container.

[0124] S62, construct a signature verifier based on the found signature verification algorithm interface implementation class instance.

[0125] S63 collects the headers, query parameters, and request body from the request.

[0126] This embodiment is based on the foregoing embodiments of the present invention, and further provides the execution process of the API signature verification method.

[0127] In the technical solution provided in this embodiment, the acquisition operation in the API signature verification method not only includes the instance search and signature verification device construction operations in the aforementioned embodiments, but also further includes the request information collection operation.

[0128] During the process of obtaining the signature verification tool, not only are the steps of instance lookup and signature verification tool construction performed, but the action of collecting request information items is also performed. This allows for more reference information to be provided for the construction of context information during the subsequent signature verification process, resulting in more comprehensive context information.

[0129] Figure 7 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 7 The API signature verification method includes the following steps:

[0130] S701, the client sends an HTTP request to Spring Cloud Gateway.

[0131] S702: Spring Cloud Gateway performs route matching for HTTP requests and determines whether signature verification is required. If signature verification is required, execute S703; otherwise, execute S704.

[0132] S703, ConfigurableSignatureGatewayFilter reads the signature verification configuration from the request's metadata.

[0133] S704, directly forward the request.

[0134] S705, the SignatureAlgorithmFactory is called by the ConfigurableSignatur eGatewayFilter to construct the signature verifier corresponding to the current route request.

[0135] S706, Select the signature verification algorithm.

[0136] S707 executes the HMAC-SHA256 signature verification algorithm.

[0137] S708 executes the SM2 signature verification algorithm.

[0138] S709, execute the RSA signature verification algorithm.

[0139] S710, visa verification successful.

[0140] S711 forwards the request to the downstream microservice.

[0141] S712 forwards the request to the configuration center.

[0142] Figure 8 This is a flowchart of an API signature verification method provided in one or more embodiments of the present invention. See also... Figure 8 The API signature verification method includes the following steps:

[0143] S81, the client sends a request to Spring Cloud Gateway.

[0144] S82, Spring Cloud Gateway performs route matching and invokes filters.

[0145] S83, ConfigurableSignatureGatewayFilter obtains signature verification algorithm instances.

[0146] S84, SignatureAlgorithmFactory returns the corresponding algorithm instance.

[0147] S85, ConfigurableSignatureGateway executes signature verification logic.

[0148] S86, if the signature verification is successful, the ConfigurableSignatureGatewayFilter will continue to forward the request to Spring CloudGateway.

[0149] S87, Spring Cloud Gateway forwards requests to downstream services.

[0150] S88, if signature verification fails, ConfigurableSignatureGatewayFilter will return error code 401.

[0151] It should be noted that in the above process, operations S86 and S87 are performed after successful signature verification, while operation S88 is performed after signature verification fails.

[0152] Figure 9 This is a structural diagram of an API signature verification device provided in one or more embodiments of the present invention. See also... Figure 9 The API signature verification device includes:

[0153] The receiving module 91 is used to receive routing requests.

[0154] The reading module 92 is used to read the signature verification configuration from the metadata of the route request by the signature verification filter.

[0155] The acquisition module 93 is used to obtain the signature checker corresponding to the current route request through the signature checker algorithm factory and the signature checker filter if the signature checker configuration enables the signature checker process. All signature checkers implement the signature checker algorithm interface, and different signature checkers use different signature checker algorithms.

[0156] Module 94 is used to call the verification function of the designated verification device to complete the verification.

[0157] It is worth noting that although only some basic functional modules are disclosed in the embodiments of this invention, it does not mean that the composition of this system is limited to the above-mentioned basic functional modules. On the contrary, what this embodiment intends to express is that, based on the above-mentioned basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with existing technology to form an infinite number of embodiments or technical solutions. That is to say, this system is open rather than closed. The fact that this embodiment only discloses a few basic functional modules should not be considered as the scope of protection of the claims of this invention being limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above device is described separately according to its functions as various units and modules. Of course, in implementing this invention, the functions of each unit and module can be implemented in one or more software and / or hardware.

[0158] like Figure 10 As shown, the present invention also provides an electronic device, including: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the API signature verification method.

[0159] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. For example... Figure 10 The structure shown in this embodiment of the invention includes an electronic device comprising one or more processors 1010 and a memory 1020; the processors 1010 in this electronic device may be one or more. Figure 10 Taking a processor 1010 as an example; memory 1020 is used to store one or more programs; the one or more programs are executed by the one or more processors 1010, so that the one or more processors 1010 implement the API signature verification method as described in any one of the embodiments of the present invention.

[0160] The electronic device may also include an input device 1030 and an output device 1040.

[0161] The processor 1010, memory 1020, input device 1030, and output device 1040 in this electronic device can be connected via a bus or other means. Figure 10 Taking the example of a connection between China and Israel via a bus.

[0162] The memory 1020 in this electronic device serves as a computer-readable storage medium, capable of storing one or more programs. These programs can be software programs, computer-executable programs, or modules, such as the program instructions / modules corresponding to the API signature verification method provided in this embodiment. The processor 1010 executes various functional applications and data processing of the electronic device by running the software programs, instructions, and modules stored in the memory 1020, thereby implementing the API signature verification method described in the above embodiment.

[0163] The memory 1020 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 1020 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 1020 may further include memory remotely located relative to the processor 1010, and these remote memories can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0164] Input device 1030 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the electronic device. Output device 1040 may include display devices such as a display screen.

[0165] The present invention also provides a computer-readable storage medium, comprising: storing a computer program executable by a vehicle, wherein when the computer program is run on the vehicle, the vehicle performs the steps of the API signature verification method.

[0166] Specifically, the computer storage medium in this embodiment of the invention can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be—but is not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An API signature verification method, characterized in that, The API signature verification method includes: Receive routing requests; The signature verification filter reads the signature verification configuration from the metadata of the routed request; If the signature verification process is enabled in the signature verification configuration, the signature verification filter obtains the signature verification device corresponding to the current route request through the signature verification algorithm factory, based on the configured algorithm type. All signature verification devices implement the signature verification algorithm interface, and different signature verification devices use different signature verification algorithms. Call the verification function of the designated verification device to complete the verification.

2. The method according to claim 1, characterized in that, Call the verification function of the designated verification device to complete the verification, including: Perform signature verification based on the context information encapsulated in the signature verification context object.

3. The method according to claim 2, characterized in that, The context information includes: the original request body, the header / query parameter mapping to be verified, the key obtained from the configuration, and the expected signature value.

4. The method according to claim 1, characterized in that, Also includes: Before receiving routing requests, the Spring container manages all objects that implement the signature verification algorithm interface.

5. The method according to claim 4, characterized in that, Also includes: Before receiving routing requests, after the Spring container manages all objects that implement the signature verification algorithm interface, the signature verification algorithm factory establishes a mapping relationship between algorithm names and objects that implement the signature verification algorithm interface.

6. The method according to any one of claims 1 to 5, characterized in that, Based on the configured algorithm type, the signature verification algorithm factory and the signature verification filter obtain the signature verification device corresponding to the current route request, including: Based on the algorithm type specified in the configuration, find and return the corresponding signature verification algorithm interface implementation class instance from the Spring container; Based on the found instances of the signature verification algorithm interface implementation class, construct the signature verification device.

7. The method according to claim 6, characterized in that, Based on the configured algorithm type, the signature verification algorithm factory and signature verification filter obtain the signature verification device corresponding to the current route request, which also includes: Collect the headers, query parameters, and request body from the request.

8. The method according to claim 1, characterized in that, Signature verification filters include: global signature verification filters and route-level signature verification filters.

9. An API signature verification device, characterized in that, The API signature verification device includes: The receiving module is used to receive routing requests; The read module is used by the signature verification filter to read the signature verification configuration from the metadata of the route request; The acquisition module is used to obtain the signature checker corresponding to the current route request through the signature checker algorithm factory and the signature checker filter if the signature checker configuration enables the signature checker process. All signature checkers implement the signature checker algorithm interface, and different signature checkers use different signature checker algorithms. The calling module is used to invoke the signature verification function of a specific signature verifier to complete the signature verification.

10. An electronic device, characterized in that, The electronic device includes: Processor, communication interface, memory, and communication bus. The processor, communication interface, and memory communicate with each other through a communication bus. The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the API signature verification method according to any one of claims 1 to 8.

Images