CN114978590B - API safety protection method, equipment and readable storage medium - Google Patents

Abstract

The application discloses an API safety protection method, equipment and a readable storage medium.A safety server receives a service request which is initiated by a request end equipment and requests to call a target API deployed on a service server, updates a target record corresponding to the target API in an analysis table according to the service request, and judges whether the updated target record triggers an attack judgment rule or not. And if the target record triggers the attack judgment rule, processing the service request according to the strategy indicated by the attack judgment rule. By adopting the scheme, the security server improves the security protection capability of the target API by analyzing the service request in real time, avoids the attack request from bypassing the protection strategy and illegally calling the target API, reduces the influence of the attack flow aiming at the target API on the service, and achieves the aim of improving the service security. Moreover, due to real-time analysis, hysteresis of the traditional protection means for analyzing the service log can be avoided.

Description

API security protection method, device and readable storage medium

Technical Field

The present application relates to the field of network security technology, and in particular to an API security protection method, device, and readable storage medium.

Background Art

At present, with the diversification and complexity of Internet applications, application service has become a significant trend, and more and more applications provide application programming interfaces (Application Programming Interface, API) for demanders to call.

In order to facilitate API calls by demanders, APIs are usually simple and open. However, these features of APIs also provide malicious hackers with multiple ways to access company data, and can even be used to cause large-scale business interruptions. When providing API call services to the outside world, in order to prevent APIs from being maliciously attacked and affecting business, it is often necessary to perform security protection on the APIs. Common API security protection methods include: protection methods based on token verification, protection methods that limit the frequency of API calls, and protection methods that analyze business logs.

It has been verified that the above protection measures are unable to intercept some attack requests, causing these attack requests to bypass the protection strategy and illegally call the API, threatening business security.

Summary of the invention

The present application provides an API security protection method, device and readable storage medium, which improves the security protection capability of the API by real-time analysis of business behavior flows, reduces the number of illegal API calls, and thus achieves the purpose of improving business security.

In a first aspect, an embodiment of the present application provides an API security protection method, which is applied to a security server, and the method includes:

Receive a service request initiated by a requesting end device, wherein the service request is used to request to call a target API provided by a service server;

Update the analysis table according to the service request, so that the target record corresponding to the target domain name in the analysis table records the latest value of each analysis factor in the multiple analysis factors of the target API, and the target domain name is the domain name contained in the target URL corresponding to the target API;

Determining whether the target record triggers an attack judgment rule for the target domain name;

When the target record triggers the attack judgment rule, the service request is processed according to the policy indicated by the attack judgment rule.

In a second aspect, an embodiment of the present application provides an API security protection method, which is applied to a policy server, and the method includes:

Receive indication information, where the indication information is used to indicate that when a service request for calling a target API is an attack request, a condition is met by a latest value of each analysis factor among a plurality of analysis factors recorded in a target record of a target domain name, where the target domain name is a domain name contained in a target URL corresponding to the target API;

Generate an attack judgment rule according to the indication information;

The attack determination rule is sent to a security server.

In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method described in various possible implementation methods of the first aspect or the second aspect above.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement the methods described in various possible implementation methods of the first aspect or the second aspect above.

The API security protection method, device and readable storage medium provided in the embodiment of the present application, after the security server receives the service request initiated by the request end device and requests to call the target API deployed on the service server, it updates the target record corresponding to the target API in the analysis table according to the service request, and determines whether the updated target record triggers the attack judgment rule. If the target record triggers the attack judgment rule, the service request is processed according to the strategy indicated by the attack judgment rule. With this scheme, the security server improves the security protection capability of the target API by analyzing the service request in real time, avoids the attack request bypassing the protection strategy and illegally calling the target API, reduces the impact of the attack traffic against the target API on the service, and achieves the purpose of improving the security of the service. Moreover, since it is a real-time analysis, it can avoid the lag of the traditional protection means of analyzing the service log. At the same time, when the service request is an attack request, only the service request is processed, rather than processing multiple service requests from the IP dimension, session dimension, etc., so the phenomenon of incorrectly blocking normal service requests will not occur, and the scope of influence of security protection is better controlled.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of the network architecture of the API security protection method provided in an embodiment of the present application;

FIG2 is a flow chart of an API security protection method provided in an embodiment of the present application;

FIG3 is another flow chart of the API security protection method provided in an embodiment of the present application;

FIG4 is a schematic diagram of a configuration interface in the API security protection method provided in an embodiment of the present application;

FIG5 is a schematic diagram of an API safety protection device provided in an embodiment of the present application;

FIG. 6 is a schematic diagram of another API safety protection device provided in an embodiment of the present application

FIG. 7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the objectives, technical solutions and advantages of the present application more clear, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

Application Programming Interface (API) is a set of predefined functions that encapsulate service capabilities into APIs for access by demanders. APIs are flexible and open in calling, and are widely used in high-tech industries such as video media and IoT applications. However, while APIs provide convenience to developers, they also face security threats. However, most of the current security protection measures are aimed at web pages, and there is a clear lack of security awareness and measures for APIs. Hackers take advantage of the simple and open nature of APIs to maliciously access company business data and even cause large-scale business interruptions. With the increase in the amount of data that APIs are responsible for transmitting and the increase in sensitivity, attacks on APIs have become more and more complex and frequent, seriously affecting the security of business data.

Currently, security protection measures for APIs include: protection measures based on token verification, protection measures that limit the frequency of API calls, protection measures that analyze business logs, etc.

The protection method based on token verification refers to: verifying the legitimacy of business requests for API access by negotiating tokens. However, many enterprises open APIs directly to end users, such as most web APIs. It is difficult to verify such end-user APIs by negotiating tokens with users. Even if authentication is possible, the negotiated tokens are often reused, thereby bypassing the verification of security policies.

In the protection method of limiting the frequency of API calls, the number of API accesses is limited based on the client's IP address, client session, and other dimensions that can mark the uniqueness of the client. However, since the access frequencies of different users vary, if the limit threshold is set too small, it is very likely to accidentally hurt the access of normal users; if the threshold is set too large, it will lead to the omission of attack requests, so that some attack requests bypass the verification of security policies.

In the protection method of analyzing business logs, historical business logs are analyzed, abnormal clients are identified according to the specified abnormal judgment rules, and subsequent business requests of the client are processed. However, due to the lag in the analysis of historical business logs, some attack requests are missed, and timeliness cannot be guaranteed. Moreover, after the abnormal client is identified, the abnormal client may no longer have any attack behavior.

Based on the above, it can be seen that existing API security protection measures are unable to intercept some attack requests, resulting in these attack requests bypassing the protection strategy and illegally calling the API, threatening business security.

Based on this, the embodiments of the present application provide an API security protection method, device and readable storage medium, which improve the security protection capability of the API by real-time analysis of business behavior flows, reduce the number of illegal API calls, and thus achieve the purpose of improving business security.

FIG1 is a schematic diagram of the network architecture of the API security protection method provided in the embodiment of the present application. Referring to FIG1 , the network architecture includes: a security server 11, a policy server 12, a business server 13, a request end device 14, and a configuration end device 15. A network connection is established between the security server 11 and the policy server 12, and between the security server 11 and the request end device 14. A network connection is established between the configuration end device 15 and the policy server 12.

The security server 11 can be hardware or software. When the security server 11 is hardware, it can be a single server or a distributed server cluster composed of multiple servers. When the security server 11 is software, it can be multiple software modules or a single software module, etc., which is not limited by the embodiments of the present application. Similarly, the policy server 12 and the business server 13 can also be software or hardware, which is not limited by the embodiments of the present application.

In the architecture shown in FIG1 , the security server 11, the policy server 12, and the business server 13 are three physically independent servers. In actual implementation, any two or all of the three servers may also be logically independent servers, that is, they may be deployed on the same physical machine. For example, the security server 11 and the policy server 12 are deployed on the same physical machine, and the business server 13 is deployed on another physical machine. For another example, the security server 11, the policy server 12, and the business server 13 are deployed on the same physical machine.

The requesting end device 14 is a device that initiates a service request, and may be a mobile phone, tablet computer, personal computer, e-book reader, laptop computer, desktop computer, etc., which is installed with an Android operating system, a Microsoft operating system, a Symbian operating system, a Linux operating system, or an Apple iOS operating system, or may be a server, etc. When the requesting end device 14 is software, it may be installed in the hardware devices listed above. In this case, the requesting end device 14 may be, for example, multiple software modules or a single software module, etc., which is not limited in the embodiments of the present application.

The configuration end device 15 is used to provide a configuration interface for the operation and maintenance personnel to configure the protection path, trigger conditions, etc. on the configuration interface. The configuration end device 15 generates indication information based on the input of the operation and maintenance personnel on the configuration interface and sends it to the policy server 12. The policy server 12 generates attack judgment rules according to the indication information and sends them to the security server 11. The configuration end device 15 can also be software or hardware, and it can be the same device as the request end device 14 or an independent device.

The security server 11 can be built on a cloud platform such as a content delivery network (CDN) and is used to perform attack verification on the service request of the target API. It can be composed of one or more security servers. The service request initiated by the request end device 14 reaches the security server 11 first. The security server 11 analyzes the service request in real time based on the attack judgment rules and handles the attack request.

The policy server 12 is a server for managing attack judgment rules, setting attack judgment rules according to actual business, and sending the attack judgment rules to the security server 11 for execution by the security server 11. One or more APIs are deployed on the business server 13, which can provide API call services to the outside world and is the server that actually responds to business requests.

When the requesting end device 14 initiates a service request to call the target API on the service server 13, the security server 11 intercepts the service request, analyzes the service request and updates the target record in the analysis table, and then determines whether the target record triggers the attack judgment rule. If the attack judgment rule is triggered, it means that the service request is an attack request, and the security server 11 processes the service request according to the policy indicated by the judgment rule. If the service request is a legitimate service request, the security server 11 forwards the service request to the service server 13, so that the requesting end device 14 calls the target API.

It should be understood that the number of security servers 11, policy servers 12, business servers 13, request end devices 14, and configuration end devices 15 in FIG1 is only for illustration. In actual implementation, any number of security servers 11, policy servers 12, business servers 13, request end devices 14, and configuration end devices 15 may be deployed according to actual needs.

Below, based on the network architecture shown in Figure 1, the API security protection method provided by the embodiment of the present application is described in detail. For example, please refer to Figure 2. Figure 2 is a flow chart of the API security protection method provided by the embodiment of the present application. This embodiment is described from the perspective of a security server. This embodiment includes:

201. Receive a service request initiated by a requesting end device, where the service request is used to request to call a target API provided by a service server.

In the embodiment of the present application, one or more APIs are deployed on a service server. The target API refers to the API in the one or more APIs that is requested to be called by the requesting end device.

After the requesting device initiates a service request, the security server intercepts the service request initiated by the requesting device, so that the service request initiated by the requesting device reaches the security server first.

202. Update the analysis table according to the business request so that the target record corresponding to the target domain name in the analysis table records the latest value of each analysis factor in the multiple analysis factors of the target API, and the target domain name is the domain name contained in the target URL corresponding to the target API.

In the embodiment of the present application, the API and the URL are one-to-one corresponding, and different APIs correspond to different URLs. The URL corresponding to the target API is referred to as the target URL, and the domain name corresponding to the target URL is referred to as the target domain name. When the security server receives a service request for the first time, if the URL corresponding to the service request does not contain the target domain name in the analysis table, a record is created in the analysis table, and the initial values of each analysis factor in the record are initialized.

A domain name has multiple analysis factors, which form an analysis factor set. The analysis factor sets of different domain names may or may not have intersections. Each record in the analysis table is used to record the latest value of each analysis factor among the multiple analysis factors of a domain name. The analysis factor of the target domain name includes at least one of the following factors: the target API domain name, granularity, the number of requests for the custom uniform resource locator URL, the number of requests for other URLs, the total number of requests or the validity period, wherein the other URL refers to a URL containing the target domain name but not the target URL or the custom URL, and the validity period is used to indicate the validity period of the target record. Among them, the granularity is, for example, IP, header, cookie, session, etc. By adopting this solution, the analysis factors of each domain name can be flexibly defined, and the analysis factors of different domain names can be different, so as to realize customized and precise security protection of the API.

The security server pre-builds an analysis table, which is initially empty. Each time the security server receives a service request, it determines whether the service request hits a record in the analysis table. If it hits a record, the record is used as the target record, and the target record is updated according to the information carried by the service request. Updating the target record means updating the current value of each analysis factor in the target record to the latest value. During the update process, the security server parses the service request to obtain the change amount corresponding to each analysis factor in the multiple analysis factors. Afterwards, the target record is updated according to the change amount corresponding to each analysis factor, so that the target record records the latest value of each analysis factor.

If the business request cannot hit an existing record in the analysis table, and the business request contains any one of the multiple analysis factors of the target domain name, the security server creates the target record in the analysis table and initializes each of the multiple analysis factors according to the business request. For example, please refer to Table 1. Table 1 illustrates an analysis table in the API security protection method provided in an embodiment of the present application.

Table 1

Before the security server receives the current service request, the records in the analysis table are shown in Table 1. There are already two records in the analysis table, and the domain names of the two records are example1 and example2. Taking the record corresponding to the domain name example1 as an example, the analysis factors include domain name, statistical granularity, number of requests for URLa, number of requests for other URLs, total number of requests, and validity period. The current values are: example1, IP, 1, 0, 1, 60.

After the security server receives the service request, assuming that the domain name of the service request is example1 and hits the record corresponding to example1, the security server takes this record as the target record and updates it. For example, if the service request carries an IP address and the URL corresponding to the service request is URLa, after the target record is updated, the analysis table is shown in Table 2.

Table 2

Assume that the domain name corresponding to the service request received by the security server is example3, and there is no record corresponding to the domain name in the analysis table. At this time, the security server creates a new record in the analysis table, and initializes the newly created record as the target record. For example, if the service request carries an IP, and the URL corresponding to the service request is URLc, after the target record is updated, the analysis table is shown in Table 3.

Table 3

For example, if the target URL corresponding to the target API is http://example.com/booking HTTP/1.1, then the target domain name is example.com, and initially, the analysis table is empty. Assume that the security server receives a service request, and the service request is: 1.1.1.1[22/Nov/2021:18:19:36+0800]"POST http://example.com/booking HTTP/1.1", which means that the IP of the requesting device is 1.1.1.1, the time when the security server receives the service request is 18:19:36 on November 22, 2021 (22/Nov/2021:18:19:36), the receiving port is 0800, the request method is POST, and the target URL is http://example.com/booking HTTP/1.1. The security server creates and initializes the target record, and the initialized target record is shown in Table 4.

Table 4

Among them, the statistical granularity and validity period are obtained from the attack judgment rules corresponding to the target API. Each subsequent time a business request is received, if the domain name contained in the URL corresponding to the business request is example.com, the record is used as the target record and updated. For example, a business request received by the security server is: 1.1.1.1[22/Nov/2021:18:19:37+0800]"POST http://example.com/booking HTTP/1.1", then the number of target URL requests increases by 1, the total number of requests increases by 1, and the number of other URL requests remains unchanged. The difference between the receiving time points of the two URLs is 1 second, and the validity period is reduced by 1 second. The updated target record is shown in Table 5.

Table 5

With this solution, when the target record does not exist in the analysis table, the target record is generated and initialized. When the target record exists in the analysis table, the existing target record in the analysis table is updated to ensure that each API has only one record in the analysis table, thereby ensuring the accuracy of API security protection.

203. Determine whether the target record triggers the attack judgment rule of the target domain name. If the target record triggers the attack judgment rule, execute step 204; if the target record does not trigger the attack judgment rule of the target domain name, execute step 205.

In an embodiment of the present application, the security server pre-receives the attack judgment rule issued by the policy server for the target domain name. Each time the security server receives a service request and updates the analysis table, it determines whether the target record in the analysis table triggers the attack judgment rule. The attack judgment rule can be a set of one or more conditions. If the latest value of each analysis factor in the target record meets the attack judgment rule, it means that the target record triggers the attack judgment rule, indicating that the service request is an attack request. If the latest value of one or more analysis factors in the target record does not meet the attack judgment rule, it means that the target record does not trigger the attack judgment rule, indicating that the service request is a normal request.

204. Process the service request according to the strategy indicated by the attack determination rule.

In the embodiment of the present application, the attack judgment rule also indicates the processing strategy of the attack request. When the target record corresponding to a service request triggers the attack judgment rule, that is, when a service request is an attack request, the security server handles the service request according to the strategy indicated by the attack judgment rule. For example, if the strategy indicated by the attack judgment rule is blocking, the security server blocks the service request, that is, does not forward the service request to the service server. For another example, if the strategy indicated by the attack judgment rule is monitoring, the security server forwards the service request to the service server and monitors the service request in real time.

At present, in a multi-user single-exit or Network Address Translation (NAT) environment, a user group shares the same exit IP. Among them, the user group includes multiple request-side devices. If the handling is based on IP granularity, when a service request is an attack request, the security server determines the IP of the request-side device that initiated the attack request and blocks all service requests from the IP. Obviously, this security protection measure will block some normal service requests. In order to prevent this situation, in an embodiment of the present application, when the security server determines that a service request is an attack, it only handles the service request.

205. Forward the service request to the service server.

When the target record corresponding to a service request does not trigger the attack judgment rule, it means that the service request is not an attack request. At this time, the security server forwards the service request to the business server, so that the business server responds to the service request. For example, the business server responds to the service request based on the internal business function of the target API. With this solution, the security server does not process normal service requests, but directly forwards them to the business server to ensure uninterrupted service.

The API security protection method provided in the embodiment of the present application is that after the security server receives the service request initiated by the request end device and requests to call the target API deployed on the service server, it updates the target record corresponding to the target domain name in the analysis table according to the service request, and determines whether the updated target record triggers the attack judgment rule. If the target record triggers the attack judgment rule, the service request is processed according to the strategy indicated by the attack judgment rule. With this scheme, the security server improves the security protection capability of the target API by analyzing the service request in real time, avoids the attack request bypassing the protection strategy and illegally calling the target API, reduces the impact of the attack traffic against the target API on the service, and achieves the purpose of improving the security of the service. Moreover, since it is a real-time analysis, the lag of the traditional protection means of analyzing the service log can be avoided. At the same time, when the service request is an attack request, only the service request is processed, rather than processing multiple service requests from the IP dimension, session dimension, etc., so the phenomenon of incorrectly blocking normal service requests will not occur, and the scope of influence of security protection is better controlled.

FIG3 is another flow chart of the API security protection method provided by an embodiment of the present application. This embodiment is described from the perspective of a policy server. This embodiment includes:

301. Receive instruction information.

Among them, the indication information is used to indicate that when the business request requesting to call the target API is an attack request, the latest value of each analysis factor in the multiple analysis factors recorded in the target record of the target domain name meets the conditions, and the target domain name is the domain name contained in the target URL corresponding to the target API.

Exemplarily, for the target domain name, the operation and maintenance personnel request a configuration interface through the configuration terminal device, and then configure the analysis factors, the conditions that the latest value of each analysis factor meets when the business request is an attack request, etc. through the configuration interface.

Since one or more APIs are often deployed on a business server, for each API that requires security protection, the configuration-end device can request the configuration interface corresponding to the target domain name and generate instruction information based on the input of the operation and maintenance personnel, thereby enabling the policy server to generate attack judgment rules for each API that requires security protection. Different APIs have different attack judgment rules, thereby achieving customization of the attack judgment rules.

302. Generate an attack determination rule according to the indication information.

After receiving the indication information, the policy server generates an attack determination rule that can be identified by the security server according to the indication information.

303. Send the attack determination rule to a security server.

Correspondingly, the security server receives the attack judgment rule.

In the API security protection method provided by the embodiment of the present application, the policy server generates attack judgment rules based on the indication information of the configuration terminal device and sends them to the security server, and the security server judges in real time whether the service request for calling the target API is an attack request based on the attack judgment rules. With this solution, the policy server generates corresponding attack judgment rules for the APIs that need security protection, which is highly flexible and realizes personalized security protection for different APIs.

FIG4 is a schematic diagram of a configuration interface in the API security protection method provided in an embodiment of the present application. Referring to FIG4 , when the configuration end device requests to configure attack judgment rules for the target domain name, the policy server sends a data stream for displaying the configuration interface to the configuration end device, and the configuration end device renders the configuration interface based on the data stream. Afterwards, the configuration end device generates indication information based on the input of the operation and maintenance personnel on the configuration interface and sends it to the policy server. Since the configuration interface shown in FIG4 is used to configure attack judgment rules for the target domain name, the target domain name and target URL are known. Therefore, the indication information carries the target domain name.

Please refer to FIG4. The configuration interface is at least used to configure the trigger conditions. The trigger conditions are used to set the conditions that the latest values of each analysis factor meet when the target record triggers the attack judgment rule. The analysis factors include the number of custom URL requests, the number of other URL requests, the total number of requests, etc. The number of custom URLs can be one or more, and the number of other URLs can also be one or more. In FIG4, only three trigger conditions are listed in the trigger conditions. In practice, more options can be set according to needs, or an add button can be set for users to add automatically. For example, when there are multiple custom URLs, the trigger conditions in FIG4 can also include other conditions in addition to 1-3. FIG4 shows some input boxes and selection boxes. The rectangular box containing a small triangle refers to the selection box. When the operation and maintenance personnel click the small triangle, a drop-down menu will be displayed on the configuration interface for the user to select. The input box allows the operation and maintenance personnel to enter specific values, URLs, etc. Below, the three trigger conditions in FIG4 are described in detail.

Trigger condition 1: total number of requests. Input box 3 is used to enter a specific value, such as 0, 1, etc.

Trigger condition 2: other URL request times, input box 4 is used to enter a specific value, such as 0, 1, etc. Other URLs refer to URLs other than custom URLs.

Trigger condition 3: Customize the number of URL requests. The options listed in the drop-down menu of selection box 3 are, for example, complete URL and regular expression. When the operation and maintenance personnel selects complete URL, input box 5 is used to enter one or more complete URLs, and input box 6 is used to enter specific values, such as 1, 2, etc. When the operation and maintenance personnel selects regular expression, input box 5 is used to enter the regular expression, and input box 6 is used to enter the specific value.

Please refer to Figure 4 again. Optionally, through the configuration interface, you can also configure the validity period and statistical granularity. The statistical granularity is used to indicate the statistical basis of the target record, and the validity period is used to indicate the validity period of the target record. In Figure 4, input box 2 is used to enter the validity period, such as 60 seconds, 90 seconds, 120 seconds, indicating that after the attack judgment strategy is sent to the security server, once the security server establishes the target record, the validity period of the target record is 60 seconds, etc. The options listed in the drop-down menu of selection box 2 include IP, header, cookie, session, etc., indicating whether the target record is counted according to IP granularity or header granularity.

This solution can achieve the purpose of accurately generating target records by setting the validity period and statistical granularity.

Optionally, please refer to Figure 4 again. Through the configuration interface, you can also configure the protection path and processing actions. Among them, the protection path indicates the protection method, which includes full-site protection of the target domain name or protection according to business type. The options listed in the drop-down menu of selection box 1 include full site or business type. If the full site is selected, it means security protection according to the business domain name, that is, attack judgment is performed on all business requests containing the target domain name. At this time, the operation and maintenance personnel do not need to enter in input box 1.

If the business type is selected, it means that security protection is performed according to the business type, that is, security protection is performed on a certain type of business under the target domain name. At this time, the operation and maintenance personnel enter some protected URLs or regular expressions in the input box 1. Among them, the protected URL is exactly the same, partially the same, or completely different from the custom URL or other URL in the trigger condition.

Please refer to Figure 4. The drop-down menu of the processing strategy provides options such as monitoring and blocking. When the operation and maintenance personnel configure the protection path and processing strategy, the configuration end device sends these configurations to the policy server through instruction information, and the policy server determines the protection method according to the protection path. When the protection method is protection according to the business type, the protected URL is determined according to the protection path. Afterwards, based on the protected URL, the conditions met by the latest values of each analysis factor and the processing strategy, the attack judgment rule is generated and sent to the security server.

By adopting this solution, by configuring the protection path and processing strategy, when the target record updated by the security server triggers the attack judgment rule, it continues to determine whether the URL corresponding to the business request is a protected URL. If the URL corresponding to the business request is a received URL, the business request is intercepted to improve the efficiency of API security protection.

Optionally, when the upper protection path indicates that security protection is to be performed on the target domain name according to the business type, the indication information further carries at least one URL or at least one regular expression.

Exemplarily, when the indication information indicates a URL or a regular expression, it indicates that the security server is required to perform security protection on the target domain name according to the business type. The security server determines the protected URL according to the URL or regular expression indicated by the indication information. The URL or regular expression indicated by the indication information is input through the input box 1 in FIG. 4 .

With this solution, when the security server determines that the updated target record triggers the attack judgment rule, it continues to determine whether the URL corresponding to the business request is a protected URL. If the URL corresponding to the business request is a protected URL, the business request is intercepted to improve the efficiency of API security protection.

Optionally, in the above embodiment, the policy server will generate an attack judgment rule based on the indication information and send the attack judgment rule to the security server. The security server determines the multiple analysis factors based on the attack judgment rule, and creates and initializes the target record after receiving the service request containing the target domain name for the first time. Subsequently, the service request initiated by the requesting end device is analyzed in real time. After the target record is updated according to the service request, if the target record meets all the conditions contained in the attack judgment rule, the service request is intercepted according to the attack rule. With this solution, the security server accurately determines multiple analysis factors through the attack judgment rule, thereby improving the effectiveness of security protection for the API.

Below, taking the target URL corresponding to the target API as http://example.com/booking as an example, the above API security protection method is described in detail.

First example:

When the protection mode is protection by business type and the attack judgment rule indicates that the protected URL is http://example.com/booking, the difference between normal user behavior and attack behavior is as follows: Before initiating access to http://example.com/booking, normal users will also call three other APIs. For the sake of clarity, the URLs of the other three APIs are represented as URL1, URL2, and URL3, and the target URL of the target API is represented as URL4. URL1 is http://example.com/login, URL2 is http://example.com/searching, URL3 is http://example.com/adding, and URL4 is http://example.com/booking.

Please refer to Figure 4. Based on the configuration interface shown in Figure 4, the operation and maintenance personnel input as follows: select the entire site based on selection box 1, enter 60 in input box 2, select IP based on selection box 2, and select block for processing action. Custom URLs include: URL1, URL2, URL3, and URL4. Assuming that condition 3 is used to set URL4, select the complete URL based on selection box 3, enter the complete URL4 in input box 5, enter 1 in input box 6, and the values of input box 3 and input box 4 are 1 respectively. The operation and maintenance personnel set URL1, URL2, or URL3 by adding trigger conditions.

The configuration end device generates indication information based on the input of the operation and maintenance personnel in the configuration interface and sends it to the policy server. The policy server generates attack judgment rules based on the indication information. The attack judgment rules include 10 conditions:

1) API URL to be protected: http://example.com/booking

2) Validity period: 60 seconds

3) Statistical granularity: IP

4) Number of requests to URL1: The number of requests to http://example.com/login is less than 1

5) Number of URL2 requests: http://example.com/searching Number of requests is less than 1

6) URL3 request count: http://example.com/adding request count is less than 1

7) URL4 request count: http://example.com/booking request count is greater than 1

8) Other URL request times: Other request times are less than 1

9) Total number of requests: The total number of requests is greater than 1

10) Action: Interception

Afterwards, the policy server sends the above attack judgment rules to the security server. The security server determines the multiple analysis factors according to the attack judgment rules, and creates and updates the target record after receiving the service request containing the target domain name for the first time. The service request initiated by the requesting device is subsequently analyzed in real time. When a requesting device initiates URL1, URL2, URL3 and URL4 in sequence, that is, a requesting device accesses normally, the behavior of the requesting device is as follows:

1.1.1.1[22/Nov/2021:18:19:36+0800]"POST http://example.com/loginHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:37+0800]"POST http://example.com/searchingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:38+0800]"POST http://example.com/addingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:39+0800]"POST http://example.com/bookingHTTP/1.1"

When the requesting device initiates the first service request, since there is no relevant record in the analysis table, the security server creates and initializes the target record in the analysis table. The initialized target record is shown in Table 6.

Table 6

Please refer to Table 6. The statistical granularity of the target record is 1.1.1.1 and the validity period is 60 seconds. Although the number of requests for URL2 and URL3 respectively meet the conditions 5) and 6) of the above attack judgment rules, the number of requests for URL1, URL4 and the total number of requests do not meet the above conditions 4), 7) and 9 respectively. Therefore, this business request is a legitimate request, and the security server does not do anything with the request, but directly forwards it to the business server.

When the requesting end device initiates the second service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 7.

Table 7

Please refer to Table 7. Although the number of requests for URL3 meets the condition 6) included in the above attack judgment rule, the number of requests for URL1, URL2, URL4 and the total number of requests do not meet the above conditions 4), condition 5), condition 7) and condition 9 respectively. Therefore, this business request is a legitimate request, and the security server does not do anything with the request, but directly forwards it to the business server.

When the requesting end device initiates the third service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 8.

Table 8

Please refer to Table 8, since the number of requests for URL1, URL2, URL3, URL4 and the total number of requests do not meet the above conditions 4), 5), 6), 7) and 9 respectively, the business request is a legitimate request, and the security server does not take any action on the request, but directly forwards it to the business server.

When the requesting end device initiates the fourth service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 9.

Table 9

Please refer to Table 9, since the number of requests for URL1, URL2, URL3, URL4 and the total number of requests do not meet the above conditions 4), 5), 6), 7) and 9 respectively, the business request is a legitimate request, and the security server does not take any action on the request, but directly forwards it to the business server.

In addition, since the inclusion is based on the business type and target domain name, in the examples shown in Tables 6 to 8 above, the URL corresponding to the business request is not a protected URL. Therefore, even if Tables 6 to 8 trigger the attack judgment rule, the security server will not block these business requests as attack requests.

When a requesting device only accesses URL4, that is, a requesting device is an attacking device, the behavior of the requesting device is as follows:

2.2.2.2[22/Nov/2021:18:19:36+0800]"POST http://example.com/bookingHTTP/1.1"

2.2.2.2[22/Nov/2021:18:19:37+0800]"POST http://example.com/bookingHTTP/1.1"

2.2.2.2[22/Nov/2021:18:19:38+0800]"POST http://example.com/bookingHTTP/1.1"

2.2.2.2[22/Nov/2021:18:19:39+0800]"POST http://example.com/bookingHTTP/1.1"

When the requesting end device initiates the first service request, since there is no relevant record in the analysis table, the security server creates and initializes the target record in the analysis table. The initialized target record is shown in Table 10.

Table 10

Please refer to Table 10. The statistical granularity of the target record is 2.2.2.2, and the validity period is 60 seconds. Although the number of requests for URL1, URL2, and URL3 respectively meet the conditions 4), 5), and 6) of the above attack judgment rules, the number of requests for URL4 and the total number of requests do not meet the above conditions 7) and 9 respectively. Therefore, this business request is a legitimate request, and the security server does not do anything with the request, but directly forwards it to the business server.

When the requesting end device initiates the second service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 11.

Table 11

Please refer to Table 11. Since the number of requests for URL1, URL2, URL3, URL4 and the total number of requests respectively meet the above conditions 4), 5), 6), 7) and 9). Therefore, the target record triggers the attack judgment rule, and the service request is an attack request. The security server intercepts the service request and does not send the service request to the service server.

When the requesting end device initiates the third service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 12.

Table 12

Please refer to Table 12. Since the number of requests for URL1, URL2, URL3, URL4 and the total number of requests respectively meet the above conditions 4), 5), 6), 7) and 9). Therefore, the target record triggers the attack judgment rule, and the service request is an attack request. The security server intercepts the service request and does not send the service request to the service server.

When the requesting end device initiates the fourth service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 13.

Table 13

Please refer to Table 13. Since the number of requests for URL1, URL2, URL3, URL4 and the total number of requests respectively meet the above conditions 4), 5), 6), 7) and 9). Therefore, the target record triggers the attack judgment rule, and the service request is an attack request. The security server intercepts the service request and does not send the service request to the service server.

Second example:

When the protection mode is protection by business type and the attack judgment rule indicates the protected URL http://example.com/booking, the attack judgment rule contains the following conditions:

1) API URL to be protected: http://example.com/booking

2) Validity period: 60 seconds

3) Statistical granularity: IP

4) Number of requests to URL1: The number of requests to http://example.com/login is less than 1

5) URL2 request count: http://example.com/searching request count is greater than 1

6) URL3 request count: http://example.com/adding request count is less than 1

7) URL4 request count: http://example.com/booking request count is greater than 1

8) Other URL request times: Other request times are less than 1

9) Total number of requests: The total number of requests is greater than 1

10) Action: Interception

The difference between this attack judgment rule and the first example mentioned above is that condition 5 is different.

The requesting device initiated a total of 5 service requests, namely:

1.1.1.1[22/Nov/2021:18:19:37+0800]"POST http://example.com/searchingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:38+0800]"POST http://example.com/searchingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:39+0800]"POST http://example.com/bookingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:40+0800]"POST http://example.com/bookingHTTP/1.1"

1.1.1.1[22/Nov/2021:18:19:41+0800]"POST http://example.com/searchingHTTP/1.1".

When the requesting device initiates the first service request, since there is no relevant record in the analysis table, the security server creates and initializes the target record in the analysis table. The initialized target record does not trigger the attack judgment rule.

When the requesting end device initiates the second service request, since the target record exists in the analysis table, the security server updates the target record. The updated target record is shown in Table 14.

Table 14

In Table 14, although the number of requests for URL2 meets the above condition 5), the number of requests for URL1, URL3, URL4 and the total number of requests do not meet the above conditions 4), 6), 7) and 9 respectively. Therefore, this service request is a legitimate request, and the security server does not do anything with the request, but directly forwards it to the service server.

Similarly, when the requesting device initiates the third service request, the updated target record does not trigger the attack judgment rule.

When the requesting device initiates the fourth service request, the updated target record is as shown in Table 15.

Table 15

Since the URL corresponding to the fourth service request is URL http://example.com/booking, the URL corresponding to the service request is a protected URL, and Table 15 triggers the attack judgment rule, the security server intercepts the fourth service request.

When the requesting device initiates the fifth service request, the updated target record is as shown in Table 16.

Table 16

Although Table 16 triggers the attack judgment rule, the URL corresponding to the fifth service request is URL http://example.com/searching, which is not a protected URL. Therefore, the security server does not intercept the fifth service request, but forwards it to the service server.

Assuming that in the second example, the protection mode is the whole-station protection mode, since Table 16 triggers the attack judgment rule, the security server needs to intercept the fifth service request.

Optionally, in the above embodiment, the security server determines whether the target record is valid according to the validity period indicated by the attack judgment rule. When the target record is invalid, the target record is deleted from the analysis table.

For example, please refer to the above tables, the validity period is 60 seconds. From the creation of the target record, the target record enters a countdown, and the validity period decreases by 1 second for every 1 second that passes. The security server monitors the validity period, and when the validity period is 0, the security server deletes the target record.

This solution allows for flexible adjustment of the target API's analysis factors by setting a validity period and monitoring the target records based on the validity period, which is highly flexible.

The following are device embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

Fig. 5 is a schematic diagram of an API security protection device provided in an embodiment of the present application. The API security protection device 500 comprises: a transceiver module 51, an update module 52, a determination module 53 and a processing module 54.

The transceiver module 51 is used to receive a service request initiated by a requesting end device, wherein the service request is used to request to call a target API provided by a service server;

An updating module 52, configured to update the analysis table according to the service request, so that the target record corresponding to the target domain name in the analysis table records the latest value of each analysis factor in the multiple analysis factors of the target API, wherein the target domain name is the domain name contained in the target URL corresponding to the target API;

A determination module 53, used to determine whether the target record triggers an attack judgment rule of the target domain name;

The processing module 54 is used to process the service request according to the strategy indicated by the attack judgment rule when the target record triggers the attack judgment rule.

In a feasible implementation, the update module 52 is used to parse the business request to obtain the change amount corresponding to each analysis factor among the multiple analysis factors when the target record exists in the analysis table; and update the target record according to the change amount corresponding to each analysis factor, so that the target record records the latest value of each analysis factor.

In a feasible implementation, the update module 52 is used to create the target record in the analysis table and initialize each of the multiple analysis factors according to the business request when the target record does not exist in the analysis table and the business request contains any one of the multiple analysis factors.

In a feasible implementation, the determination module 53 is used to determine whether the latest value of each analysis factor among the multiple analysis factors recorded in the target record satisfies the attack judgment rule; if the latest value of each analysis factor among the multiple analysis factors satisfies the attack judgment rule, it is determined that the target record triggers the attack judgment rule.

In a feasible implementation, the transceiver module 51 is further used to receive the attack judgment rule sent by the policy server before the update module 52 updates the analysis table according to the service request, and the attack judgment rule is used to indicate the condition that the latest value of each analysis factor in the multiple analysis factors meets when the service request is an attack request;

The processing module 54 is further configured to determine the multiple analysis factors according to the attack determination rule.

In a feasible implementation, the multiple analysis factors include at least one of the following factors: the target domain name, granularity, number of requests for a custom uniform resource locator URL, number of requests for other URLs, total number of requests or validity period, wherein the other URL refers to a URL that contains the target domain name but is not the target URL or the custom URL, and the validity period is used to indicate the validity period of the target record.

In a feasible implementation, the transceiver module 51 is further configured to send the service request to the service server when the target record does not trigger the attack judgment rule.

In a feasible implementation, the processing module 54 is further configured to determine whether the target record is valid according to the validity period indicated by the attack determination rule; when the target record is invalid, delete the target record from the analysis table.

In a feasible implementation, the processing module 54 is used to determine a protection method according to the protection path when the attack judgment rule also indicates a protection path, and the protection method includes full-site protection of the target domain name or protection according to business type; when the protection method is protection according to business type, determine the protected URL according to the protection path; determine whether the URL corresponding to the business request is a protected URL; when the URL corresponding to the business request is any one of the protected URLs, process the business request according to the strategy indicated by the attack judgment rule.

The API security protection device provided in the embodiment of the present application can execute the actions of the security server in the above embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

Fig. 6 is a schematic diagram of another API safety protection device provided in an embodiment of the present application. The API safety protection device 600 comprises: a receiving module 61, a processing module 62 and a sending module 63.

A receiving module 61, configured to receive indication information, wherein the indication information is used to indicate that when a service request for calling a target API is an attack request, a condition is met by the latest value of each analysis factor in a plurality of analysis factors recorded in a target record of a target domain name, wherein the target domain name is a domain name contained in a target URL corresponding to the target API;

A processing module 62, configured to generate an attack determination rule according to the indication information;

The sending module 63 is used to send the attack judgment rule to the security server.

In a feasible implementation, the indication information also carries a statistical granularity and a validity period of the target record, the statistical granularity is used to indicate any one of IP, header, session, and cookie, and the validity period is used to indicate the validity period of the target record.

In a feasible implementation, the indication information also carries a protection path and a processing strategy. The processing module 62 is used to determine a protection method based on the protection path, and the protection method includes full-site protection of the target domain name or protection according to business type; when the protection method is protection according to business type, the protected URL is determined according to the protection path; the attack judgment rule is generated according to the protected URL, the conditions met by the latest values of the analysis factors and the processing strategy.

In a feasible implementation, when the protection path indicates that security protection is to be performed on the target domain name according to the business type, the indication information further carries at least one URL or at least one regular expression.

The API security protection device provided in the embodiment of the present application can execute the actions of the policy server in the above embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

FIG7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. As shown in FIG7 , the electronic device 700 is, for example, the control center or anti-attack node mentioned above, and the electronic device 700 includes:

Processor 71 and memory 72;

The memory 72 stores computer instructions;

The processor 71 executes the computer instructions stored in the memory 72, so that the processor 71 executes the above control center to implement the protection method for traffic attacks; or, the processor 71 executes the above anti-attack node to implement the protection method for traffic attacks.

The specific implementation process of the processor 71 can be found in the above-mentioned method embodiment. Its implementation principle and technical effects are similar, and will not be repeated here in this embodiment.

Optionally, the electronic device 700 further includes a communication component 73 , wherein the processor 71 , the memory 72 and the communication component 73 may be connected via a bus 74 .

An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement an API security protection method implemented by a security server or a policy server.

An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements an API security protection method implemented by a security server or a policy server.

Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims (14)

1. An API security protection method, characterized in that it is applied to a security server, and the method comprises: Receive a service request initiated by a requesting end device, wherein the service request is used to request to call a target API provided by a service server; Update the analysis table according to the business request, so that the target record corresponding to the target domain name in the analysis table records the latest value of each analysis factor in the multiple analysis factors of the target API, the target domain name is the domain name contained in the target URL corresponding to the target API, and the analysis table is used to store multiple records, and different records correspond to domain names corresponding to different APIs; Determining whether the target record triggers an attack judgment rule for the target domain name; When the target record triggers the attack judgment rule, processing the service request according to the strategy indicated by the attack judgment rule; The determining whether the target record triggers an attack judgment rule of the target domain name includes: Determining whether the latest value of each analysis factor among the multiple analysis factors recorded in the target record satisfies the attack judgment rule; If the latest value of each analysis factor in the multiple analysis factors satisfies the attack judgment rule, it is determined that the target record triggers the attack judgment rule. 2. The method according to claim 1, characterized in that updating the analysis table according to the service request comprises: When the target record exists in the analysis table, parsing the business request to obtain a change amount corresponding to each analysis factor in the multiple analysis factors; The target record is updated according to the change amount corresponding to each analysis factor, so that the target record records the latest value of each analysis factor. 3. The method according to claim 1, wherein updating the analysis table according to the service request comprises: When the target record does not exist in the analysis table and the service request includes any one of the multiple analysis factors, the target record is created in the analysis table and each of the multiple analysis factors is initialized according to the service request. 4. The method according to any one of claims 1 to 3, characterized in that before updating the analysis table according to the service request, it also includes: receiving the attack judgment rule sent by the policy server, wherein the attack judgment rule is used to indicate a condition that the latest value of each analysis factor in the multiple analysis factors meets when the service request is an attack request; The plurality of analysis factors are determined according to the attack judgment rule. 5. The method according to any one of claims 1 to 3, characterized in that: The multiple analysis factors include at least one of the following factors: the target domain name, granularity, number of requests for a custom uniform resource locator URL, number of requests for other URLs, total number of requests or validity period, wherein the other URL refers to a URL that contains the target domain name but is not the target URL or the custom URL, and the validity period is used to indicate the validity period of the target record. 6. The method according to any one of claims 1 to 3, further comprising: When the target record does not trigger the attack judgment rule, the service request is sent to the service server. 7. The method according to any one of claims 1 to 3, further comprising: Determining whether the target record is valid according to the validity period indicated by the attack judgment rule; When the target record is invalid, the target record is deleted from the analysis table. 8. The method according to any one of claims 1 to 3, characterized in that when the target record triggers the attack judgment rule, processing the service request according to the strategy indicated by the attack judgment rule comprises: When the attack judgment rule further indicates a protection path, determining a protection method according to the protection path, the protection method including performing full site protection on the target domain name or protection according to business type; When the protection mode is protection according to business type, determining the protected URL according to the protection path; Determine whether the URL corresponding to the service request is a protected URL; When the URL corresponding to the service request is any one of the protected URLs, the service request is processed according to the policy indicated by the attack judgment rule. 9. An API security protection method, characterized in that it is applied to a policy server, and the method comprises: Receive indication information, where the indication information is used to indicate that when a service request for calling a target API is an attack request, a condition is met by a latest value of each analysis factor in a plurality of analysis factors recorded in a target record of a target domain name, where the target domain name is a domain name included in a target URL corresponding to the target API, and the target record is stored in an analysis table of a security server, where the analysis table is used to store a plurality of records, and different records correspond to domain names corresponding to different APIs; Generate an attack judgment rule according to the indication information; The attack judgment rule is sent to the security server so that after the security server receives the service request initiated by the requesting device and fine-tunes the target record corresponding to the target domain name in the analysis table, it determines whether the latest value of each analysis factor among the multiple analysis factors recorded in the target record satisfies the attack judgment rule; if the latest value of each analysis factor among the multiple analysis factors satisfies the attack judgment rule, it is determined that the target record triggers the attack judgment rule. 10. The method according to claim 9 is characterized in that the indication information also carries the statistical granularity and the validity period of the target record, the statistical granularity is used to indicate any one of IP, header, session, and cookie, and the validity period is used to indicate the validity period of the target record. 11. The method according to claim 9, characterized in that generating an attack judgment rule according to the indication information comprises: When the indication information also carries a protection path and a processing strategy, a protection mode is determined according to the protection path, and the protection mode includes performing full site protection on the target domain name or protection according to business type; When the protection mode is protection according to business type, determining the protected URL according to the protection path; The attack judgment rule is generated according to the protected URL, the conditions met by the latest values of the analysis factors, and the processing strategy. 12. The method according to claim 11 is characterized in that when the protection path indicates that security protection is performed on the target domain name according to the business type, the indication information also carries at least one URL or at least one regular expression. 13. An electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 12. 14. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.