API access control method and apparatus, device, storage medium and program product

Abstract

The present application relates to the technical field of API access control. Provided in the embodiments of the present application are an API access control method and apparatus, a device, a storage medium and a program product, which are applied to a proxy server. The API access control method comprises: separately creating an API-protection level mapping table and a user role-user level mapping table; functioning as a proxy of an application authentication interface, creating a key-user role mapping table, and returning key information to a client; and receiving a key carried by the client when calling a service function interface, and, on the basis of the key, the API-protection level mapping table, the user role-user level mapping table and the key-user role mapping table, performing API access control on the client. The embodiments of the present application deeply decouple a permission control function from an application service function, so as to achieve shift-left security control, thus effectively improving the emergency handling and rapid adaptation capabilities of service systems when facing complex network attacks and constantly-changing services thereof.

Description

API access control method and device, equipment, storage medium and program product

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202411313359.4, filed on September 20, 2024, and entitled "API access control method and device, equipment, storage medium and program product", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of API access control, and in particular to an API access control method and device, equipment, storage medium and program product. BACKGROUND

[0004] As a core component of software systems, Application Programming Interface (API) has become the cornerstone of modern application architecture. API abstracts the functionality of an application, allowing clients to easily call these functions and implement complex business logic and operations. Due to its ease of construction and maintenance, developers can quickly develop and deploy new features while improving the scalability and flexibility of the application. With the widespread application of microservices architecture, cloud computing, big data and Internet of Things, API plays an increasingly important role in the application, and almost every core function of modern applications relies on the implementation of API.

[0005] However, due to the widespread application and open nature of API, they have become the main target of attackers. The business functions carried by API often have a high degree of sensitivity, which may involve user personal data, financial information, enterprise internal resources and other critical assets. Therefore, how to effectively control the access of API has become an important issue to protect sensitive business functions and data security.

[0006] Currently, most API access control solutions are integrated in the backend of the application, which is difficult to adapt to the rapidly changing business needs and difficult to respond quickly to security incidents.

[0007] SUMMARY

[0008] The present application aims to at least solve one of the problems existing in the prior art, and provides an API access control method and device, equipment, storage medium and program product.

[0009] In one aspect of the present application, an API access control method is provided, which is applied to a proxy server.

[0010] The API access control method comprises:

[0011] An API-protection level mapping table and a user role-user level mapping table are respectively created.

[0012] An agent application authentication interface is created, a key-user role mapping table is created, and key information is returned to the client.

[0013] The key carried by the client when calling a business function interface is received, and the client is subjected to API access control according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0014] Optionally, the agent application authentication interface is created, the key-user role mapping table is created, and the key information is returned to the client, and the method comprises the following steps.

[0015] The return value of the application authentication interface is modified, and the user role information of a user who successfully passes authentication is added to a corresponding authentication response.

[0016] The authentication response is intercepted, and the user role information in the authentication response is obtained.

[0017] A random value is generated, the random value is encoded, the encoded random value is used as a key corresponding to the user role information, and the key is written into the key-user role mapping table.

[0018] The authentication response is modified, the user role information in the authentication response is replaced with the key corresponding to the user role information, and the modified authentication response is returned to the client.

[0019] Optionally, the key carried by the client when calling a business function interface is received, and the client is subjected to API access control according to the key and the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table, and the method comprises the following steps.

[0020] An API calling request sent by the client is received, and the API calling request carries a client IP address and a key.

[0021] determining whether the client IP address is in the blacklist, if yes, directly discarding the API call request; if no, querying the protection level of the current API corresponding to the API call request according to the API-protection level mapping table, if the protection level of the current API is a preset level, forwarding the API call request to the current API, if the protection level of the current API is not the preset level, obtaining the key in the API call request, querying the user role corresponding to the obtained key according to the key-user role mapping table, and performing API access control according to the user role.

[0022] Optionally, the API access control according to the user role comprises:

[0023] querying the user level corresponding to the user role according to the user role-user level mapping table;

[0024] comparing the user level corresponding to the user role with the protection level of the current API, if the user level corresponding to the user role is greater than or equal to the protection level of the current API, forwarding the API call request to the current API.

[0025] Optionally, the establishment of the blacklist comprises:

[0026] recording the API access times of the client in a unit time, if the API access times are higher than a preset threshold, adding the client IP address corresponding to the client to the blacklist.

[0027] Optionally, the creation of the API-protection level mapping table and the user role-user level mapping table respectively comprises:

[0028] creating the API-protection level mapping table and the user role-user level mapping table respectively according to the sensitivity of the API and the permission of the system role.

[0029] Another aspect of the present application provides an API access control device applied to a proxy server.

[0030] The API access control device comprises:

[0031] a first creation module configured to create an API-protection level mapping table and a user role-user level mapping table respectively;

[0032] a second creation module configured to create a key-user role mapping table through a proxy application authentication interface and return key information to a client;

[0033] The control module is configured to receive the key carried by the client when invoking the service function interface, and perform API access control on the client according to the key, the API-protection level mapping table, the user role-user level mapping table and the key-user role mapping table.

[0034] In another aspect of the present application, an electronic device is provided, comprising:

[0035] at least one processor; and

[0036] a memory in communication with the at least one processor; wherein

[0037] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the API access control method described above.

[0038] In another aspect of the present application, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the API access control method described above.

[0039] In another aspect of the present application, a computer program product is provided, which comprises a computer program, and the computer program is executed by a processor to implement the API access control method described above.

[0040] The present application has the following beneficial effects relative to the prior art:

[0041] 1. Two permission control means of role-based access control and protection level-based access control are provided, and the permission control has high configuration flexibility.

[0042] 2. Based on the proxy configuration file, the hot deployment capability is provided, and the emergency response can be quickly performed. The existing other access control frameworks usually implement and maintain the permission control logic in the application code, and once the unauthorized access problem is encountered, not only the rectification process is time-consuming, but also the business cannot be operated during the rectification. When the unauthorized access security problem is encountered, the operation and maintenance personnel only need to modify the proxy configuration file to change the API access control permission in real time according to the present application, and during the emergency disposal process, the application does not need to be offline for rectification, and the operation of the business function will not be affected.

[0043] 3. The access control is highly decoupled from the business function, which not only can intercept security risks in advance to realize the left shift of security, but also effectively reduces the load pressure of the application backend.

[0044] 4. The present application has very high applicability, and the deployment implementation is independent of the application system architecture and the development language. BRIEF DESCRIPTION OF DRAWINGS

[0045] One or more embodiments are illustrated by way of example in the drawings and are described herein in connection with the embodiments presented. The embodiments disclosed herein are not intended to be exhaustive or to limit the claims to the precise form disclosed. The drawings are not necessarily to scale, and the embodiments disclosed herein can be used in conjunction with other embodiments even though they can not be numerically described or explicitly contended in the application. The same or similar reference numbers in different drawings can represent the same or similar elements.

[0046] FIG. 1 is a flowchart of an API access control method according to an embodiment of the present application;

[0047] FIG. 2 is a flowchart of an API access control method according to another embodiment of the present application;

[0048] FIG. 3 is a structural diagram of an API access control device according to another embodiment of the present application;

[0049] FIG. 4 is a structural diagram of an electronic device according to another embodiment of the present application. DETAILED DESCRIPTION

[0050] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the drawings. However, those skilled in the art can understand that in the embodiments of the present application, many technical details are proposed in order to make the readers better understand the present application. However, the technical solutions claimed by the present application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific embodiments of the present application. The embodiments can be combined and referenced with each other without contradiction.

[0051] One embodiment of the present application relates to an API access control method applied to a proxy server, and the flowchart is shown in FIG. 1, which includes:

[0052] In step S110, an API-protection level mapping table and a user role-user level mapping table are respectively created.

[0053] Specifically, the purpose of step S110 is to provide a basis for API access control by creating an API-protection level mapping table and a user role-user level mapping table. The API-protection level mapping table is used to identify the protection level corresponding to each API, so that appropriate security protection measures are taken for each API according to the corresponding protection level. The user role-user level mapping table is used to identify the user level corresponding to each user role, so that the permission management and access control of each user role are performed according to the corresponding user level.

[0054] For example, step S110 includes: creating an API-protection level mapping table and a user role-user level mapping table according to the sensitivity of the API and the permissions of the system role, respectively.

[0055] Specifically, the sensitivity of the API usually depends on the environment, data type and security measures of the access and use of the API. According to the sensitivity of the API, the API can be divided into different protection levels. Generally, the higher the sensitivity of the API, the higher the corresponding protection level. For example, when the sensitivity of the API is 0, 1, 2, 3, etc., respectively, the protection level of the corresponding API can be set to 0, 1, 2, 3, etc., respectively, wherein the larger the number, the higher the corresponding sensitivity or protection level. Of course, in addition to using numbers to identify the protection level of the API, other forms can also be used to identify the protection level of the API. For example, the protection level of the API can be identified by letters, such as A, B, C, D, etc. from low to high. For another example, the protection level of the API can also be identified by words, such as low, medium, high, highest, etc. from low to high.

[0056] Different system roles are usually assigned different permissions. For example, the administrator role is usually assigned all permissions, and the ordinary user role is usually assigned part of the permissions. Therefore, step S110 can determine the user level corresponding to the user role according to how many permissions the user role is assigned, such as the more permissions assigned, the larger the user level corresponding to the user role. For example, when 0, 1, 2, 3 are used to represent different user levels, for the ordinary user role, the corresponding user level can be any one of 0, 1, 2, and for the administrator role, the corresponding user level can be 3, that is, the administrator role usually corresponds to the highest user level, and the user level corresponding to the ordinary user role is usually lower than the user level corresponding to the administrator role. Similar to the protection level of the API, the user level can be identified by numbers, letters, words and other forms, which is not limited by the embodiment.

[0057] The embodiment can integrate the protection level of the API, the user role and the corresponding user level into the API access control process by creating an API-protection level mapping table and a user role-user level mapping table according to the sensitivity of the API and the permissions of the system role, respectively, thereby improving the flexibility of API access control.

[0058] Step S120, the proxy application authentication interface creates a key-user role mapping table and returns the key information to the client.

[0059] Specifically, step S120 is mainly used for returning the key information to the client by creating the key-user role mapping table, so as to provide the basis for identifying the user role of the client for subsequent API access. The key-user role mapping table is used to identify the user role corresponding to each key.

[0060] Step S130 receives the key carried by the client when calling the business function interface, and performs API access control on the client according to the key, the API-protection level mapping table, the user role-user level mapping table, and the key-user role mapping table.

[0061] Specifically, step S130 first needs to determine the user role corresponding to the client based on the key carried by the client when calling the business function interface and based on the key-user role mapping table, then determine the user level corresponding to the client based on the user role of the client and based on the user role-user level mapping table, and determine the protection level of the API required to be accessed by the client based on the API-protection level mapping table, and then perform API access control on the client based on the user level corresponding to the client and the protection level of the API required to be accessed by the client.

[0062] Specifically, step S120 includes: modifying the return value of the application authentication interface, so that the corresponding API adds the user role information of the successful authentication to the corresponding authentication response; intercepting the authentication response to obtain the user role information therein; generating a random value and encoding the random value, taking the encoded random value as the key corresponding to the user role information, and writing the key into the key-user role mapping table; modifying the authentication response to replace the user role information therein with the key corresponding to the user role information, and returning the modified authentication response to the client.

[0063] Specifically, before accessing the API, the client usually needs to log in and authenticate through the application authentication interface to verify the identity of the client. When the client is successfully authenticated, step S120 can modify the return value of the application authentication interface, so that the API that is successfully authenticated adds the user role information of the client to the authentication response. The proxy server replaces the user role information in the authentication response with the key obtained by encoding the random value, returns the key information to the client, writes the user role information corresponding to the client, the key, and the mapping relationship between them into the key-user role mapping table, and completes the creation of the key-user role mapping table.

[0064] By creating the key-user role mapping table by using the authentication response and returning the key to the client, the present embodiment can effectively protect the data privacy and ensure the security of key transmission and storage.

[0065] The step S130 includes, for example, receiving an API calling request sent by the client, the API calling request carrying a client IP address and a key; determining whether the client IP address is in a blacklist, if yes, directly discarding the API calling request; if no, querying a protection level of a current API corresponding to the API calling request according to an API-protection level mapping table, if the protection level of the current API is a preset level, forwarding the API calling request to the current API, if the protection level of the current API is not the preset level, obtaining the key in the API calling request, querying a user role corresponding to the obtained key according to a key-user role mapping table, and performing API access control according to the user role.

[0066] Specifically, the preset level can be set according to actual needs. For example, the preset level can be set as level 0 (default value), indicating that the protection level of the corresponding API is the lowest, and all user roles can access, at this time, if the level of the current API required by the API calling request is level 0, the API calling request can be directly forwarded to the current API.

[0067] The key carried by the API calling request can be set in the header of the API calling request, at this time, the step S130 can directly obtain the key in the API calling request from the header of the API calling request.

[0068] The embodiment can further improve data security and prevent security risks by using the client IP address and the key carried by the API calling request to implement API access control.

[0069] The API access control according to the user role includes, for example, querying a user level corresponding to the user role according to a user role-user level mapping table; comparing the user level corresponding to the user role with the protection level of the current API, if the user level corresponding to the user role is greater than or equal to the protection level of the current API, forwarding the API calling request to the current API.

[0070] Specifically, if the user level corresponding to the user role is greater than or equal to the protection level of the current API, it indicates that the user role has the right to access the current API, and the API calling request corresponding to the user role can be directly forwarded to the current API. If the user level corresponding to the user role is less than the protection level of the current API, it indicates that the user role has no right to access the current API, and the API calling request corresponding to the user role can be directly discarded.

[0071] By comparing the user level corresponding to the user role with the protection level of the current API, when the user level corresponding to the user role is greater than or equal to the protection level of the current API, the API calling request corresponding to the user role is forwarded to the current API, which can further improve the data security and ensure that only authorized user roles can access the corresponding API.

[0072] For example, the establishment of the blacklist includes: recording the API access times of the client in a unit time, and if the API access times are higher than a preset threshold, the client IP address corresponding to the client is added to the blacklist.

[0073] Specifically, considering that the attacker may crack the key through the blasting method, therefore, the embodiment records the API access times of the same client IP address in a unit time to determine whether the client IP address needs to be added to the blacklist, if the API access times of a certain client IP address in a unit time are higher than a preset threshold, the client IP address may be an IP address used by the attacker, and the client IP address needs to be added to the blacklist.

[0074] The API access control method provided by the embodiment of the application has the following beneficial effects compared with the prior art:

[0075] 1. Two permission control means of role-based access control and protection level-based access control are provided, and the permission control has high configuration flexibility.

[0076] 2. Based on the proxy configuration file, the hot deployment capability is provided, and the emergency response can be quickly performed. The existing other access control framework usually implements and maintains the permission control logic in the application code, once the unauthorized access problem is encountered, not only the rectification process is time-consuming, but also the business cannot be operated during the rectification. When the unauthorized access security problem is encountered, the operation and maintenance personnel only need to modify the proxy configuration file to change the API access control permission in real time, and during the emergency disposal process, the application does not need to be offline for rectification, and the operation of the business function will not be affected.

[0077] 3. The access control is highly decoupled from the business function, not only can the security hidden danger be intercepted in advance to realize the left shift of security, but also the load pressure of the application backend is effectively reduced.

[0078] 4. The application has high applicability, and the deployment implementation is independent of the application system architecture and the development language.

[0079] In order for those skilled in the art to better understand the above embodiments, a specific example is described below.

[0080] An API access control method applied to a proxy server. As shown in FIG. 2, the proxy server is in communication connection with an application client and an application server respectively, and the proxy server is further provided with an authentication interface and a service interface. The authentication interface is used to control the login authentication of the application client. The service interface is used to control the API access of the application client.

[0081] Taking the proxy server as an Nginx reverse proxy server as an example, assuming that there are three user roles in the application system, namely, a system administrator Admin, a teacher Teacher, and a student Student, and there are four APIs, namely, a system login login, an add user addUser, a set scores setScores, and a query scores queryScores. On this basis, the API access control method includes the following steps:

[0082] Step 1: First, create an API-protection level mapping table and a user role-user level mapping table according to the business requirements. Both mapping tables are stored in the form of configuration files. The file name of the API-protection level mapping table is api-protectionlevel.conf, and the file name of the user role-user level mapping table is role-level.conf.

[0083] The specific content of api-protectionlevel.conf is that the protection levels of query scores, set scores, and addUser are 1, 2, and 3 respectively, and the protection level of system login and other APIs is the default value 0. That is:

[0084] The specific content of role-level.conf is that the user levels of student, teacher, and system administrator are 1, 2, and 3 respectively, and the user level of other roles is the default value 0. That is:

[0085] Step 2: Modify the Nginx configuration file nginx.conf, and reference the two mapping tables created in step 1 in the configuration file as follows:

[0086] include / path / to / api-protectionlevel.conf

[0087] include / path / to / role-level.conf

[0088] Modify the application authentication interface return value, so that the API returns login authentication information in JSON, and returns the user role in the form of a field in the authentication information. Specifically, the name of the field is role.

[0089] In the configuration file, modify the proxy login interface login. In the proxy process, the following four steps are performed:

[0090] 1) Access the response body through the Lua script to read the role information. The specific implementation is as follows:

[0091] 2) Use OPENSSL to create a 24-byte random value and encode it through BASE64.

[0092] 3) Modify the response header and add a key field with the value of the encoded random value obtained in the previous step. That is:

[0093] local function generate_random_base64()

[0094] Use OPENSSL to create a 24-byte random value and BASE64 encode it

[0095] 4) Store the key-role mapping table role-key.conf with the role information as the VALUE and the above encoded random value, i.e., the key field, as the KEY. That is:

[0096] Step 3: Use Nginx to proxy other APIs and configure API access control policies. For example, perform fuzzy authentication based on the level for the query score API: users with a role level higher than the protection level of the API can query the score. Perform accurate authentication based on the user role for the add user API: only users with the administrator role admin can access the corresponding API. The specific implementation is as follows:

[0097] Next, the client only needs to add role_key in the header of the API call request (curl xxx-H role_key "B5kpW5fO5OjX23H9+RnXQw=="), and the Nginx reverse proxy server can perform API access control based on the API call request. For example, when the client requests / queryScores API as a student, the Nginx pre-set variable $http_role_key is the value of the role_key in the header of the API call request "B5kpW5fO5OjX23H9+RnXQw==", and then according to the key-role mapping table, $role_name can be automatically parsed as student, and further according to the role-level mapping table, $role_level can be automatically parsed as 1, and similarly, $protection_level can be automatically parsed as 1. After comparison, the user role level corresponding to the student role is equal to the protection level of the / queryScores API, so the authentication is passed and the client is allowed to access the / queryScores API as a student. When the student role accesses / addUser, $role_name is automatically parsed as student, and since the user role corresponding to $role_name is not equal to admin, the access is rejected.

[0098] Another embodiment of the present application relates to an API access control device applied to a proxy server, as shown in FIG. 3, the API access control device comprises a first creation module 310, a second creation module 320 and a control module 330.

[0099] The first creation module 310 is used to create an API-protection level mapping table and a user role-user level mapping table respectively.

[0100] The second creation module 320 is used to create a key-user role mapping table by proxying an authentication interface, and returns key information to the client.

[0101] The control module 330 is used to receive a key carried by the client when calling a business function interface, and performs API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table and the key-user role mapping table.

[0102] The specific implementation method of the API access control device provided by the embodiment of the present application can be referred to the API access control method provided by the embodiment of the present application, which will not be described here.

[0103] The API access control device provided by the embodiment of the present application has the following beneficial effects compared with the prior art:

[0104] 1. Provide two permission control means of role-based access control and protection level-based access control, and the permission control has high configuration flexibility.

[0105] 2. Based on the proxy configuration file, it has hot deployment capability and can quickly respond to emergencies. Other existing access control frameworks usually implement and maintain permission control logic in application code. Once unauthorized access problems occur, not only is the rectification process time-consuming, but also the business cannot run during the rectification period. When the unauthorized access security problem occurs, the operation and maintenance personnel only need to modify the proxy configuration file to change the API access control permission in real time, and during the emergency disposal process, the application does not need to be offline for rectification, and the operation of the business function will not be affected.

[0106] 3. The access control is highly decoupled from the business function, which not only can intercept security risks in advance to realize security left shift, but also effectively reduces the load pressure of the application backend.

[0107] 4. It has very high applicability, and its deployment implementation is independent of the application system architecture and development language.

[0108] Another embodiment of the application relates to an electronic device, as shown in FIG. 4, comprising:

[0109] at least one processor 401; and,

[0110] a memory 402 in communication with the at least one processor 401; wherein,

[0111] The memory 402 stores instructions executable by the at least one processor 401, and the instructions are executed by the at least one processor 401 to enable the at least one processor 401 to perform the API access control method described in the above embodiments.

[0112] Wherein, the memory and the processor are connected in a bus mode, the bus can include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripheral devices, voltage stabilizers and power management circuits, which are well known in the art, and therefore, they will not be further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements such as multiple receivers and transmitters, which provide a unit for communicating with various other devices on the transmission medium. The data processed by the processor is transmitted on the wireless medium through the antenna, and optionally, the antenna also receives data and transmits the data to the processor.

[0113] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. The memory can be used to store data used by the processor in performing operations.

[0114] Another embodiment of the present application relates to a computer readable storage medium, storing a computer program, which, when executed by a processor, implements the API access control method in the above embodiments.

[0115] That is, a person skilled in the art can understand that all or part of the steps of the method in the above embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium and includes a plurality of instructions for causing a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes. Alternatively, the readable storage medium is a non-transitory readable storage medium.

[0116] Another embodiment of the present application relates to a computer program product, including a computer program, which, when executed by a processor, implements the API access control method in the above embodiments.

[0117] A person skilled in the art can understand that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes can be made in form and details without departing from the spirit and scope of the present application.

Claims

1. An API access control method characterized by, The application is applied to a proxy server; The API access control method comprises: respectively creating an API-protection level mapping table and a user role-user level mapping table; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; 2. The API access control method of claim 1, wherein, The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client; The proxy application authentication interface creates a key-user role mapping table and returns key information to the client.

3. The API access control method of claim 1, wherein, The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client.

4. The API access control method of claim 3, wherein, The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client.

5. The API access control method of claim 3, wherein, The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client.

6. The API access control method according to any one of claims 1 to 5, characterized by, The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and returns key information to the client. The proxy application authentication interface creates a key-user role mapping table and According to the sensitivity of the API and the permission of the system role, an API-protection level mapping table and a user role-user level mapping table are respectively created.

7. An API access control apparatus characterized by comprising: The application is applied to a proxy server. The API access control device comprises: A first creation module is configured to create an API-protection level mapping table and a user role-user level mapping table. A second creation module is configured to create a key-user role mapping table by proxying an application authentication interface and return key information to a client. A control module is configured to receive a key carried by the client when calling a business function interface, and perform API access control on the client according to the key and the API-protection level mapping table, the user role-user level mapping table and the key-user role mapping table.

8. An electronic device, comprising: Comprise: At least one processor; And The memory is in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the API access control method in any one of claims 1 to 6.

9. A computer readable storage medium storing a computer program, characterized in that, The computer program is executed by the processor to implement the API access control method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the API access control method in any one of claims 1 to 6.

Images