CN115495255A - Service interface securely invokes methods, devices, equipment and storage media - Google Patents

Abstract

The invention provides a service interface safe calling method, a device, equipment and a storage medium, wherein an encrypted channel is established between a service provider and a service caller, the safe calling of a service interface is carried out in the encrypted channel, and the service interface safe calling method comprises the following steps: receiving a service interface calling request sent by a service calling party; generating an identity authentication request aiming at least one identity attribute in the target digital identity according to the service interface calling request; sending the identity authentication request to the service calling party, and receiving an identity certificate sent by the service calling party according to the identity authentication request; and verifying the identity certificate, and returning a service interface calling result to the service calling party according to a verification result. The invention can ensure the safety of the access of the service interface and effectively avoid the attack of the service interface.

Description

Service interface securely invokes methods, devices, equipment and storage media

technical field

The invention relates to the field of information security, in particular to a method for securely invoking a service interface, a device for securely invoking a service interface, electronic equipment and a non-transitory computer-readable storage medium.

Background technique

"Network service" refers to some service-oriented software modules based on distributed programs that run on the network. Network services are usually provided by many application programming interfaces (Application Programming Interface, API for short). Commonly used service interfaces, that is, API calling methods, in order to ensure the security of interface access, user names and passwords are usually configured for legal users of the interface. However, this way of ensuring the security of interface access is low in security, and the interface is easy to be attacked.

Contents of the invention

The present invention provides a method, device, device and storage medium for securely invoking a service interface, which are used to solve the defects in the prior art that the security of the service interface access is low and the service interface is vulnerable to attacks, so as to ensure the security of the service interface access , to effectively prevent the service interface from being attacked.

In the first aspect, the present invention provides a method for securely calling a service interface, which is applied to a service provider, and an encrypted channel is established between the service provider and the service caller, and the secure call to the service interface is in the encrypted channel To carry out, the safe call method of the service interface includes:

Receive the service interface call request sent by the service caller;

Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request;

Send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request;

The identity certificate is verified, and the result of calling the service interface is returned to the service caller according to the verification result.

According to a method for securely invoking a service interface provided by the present invention, an identity verification request for at least one identity attribute in the target digital identity is generated according to the service interface invocation request, including:

Determine an identity verification strategy according to the service interface call request; the identity verification strategy includes: at least one identity attribute in the target digital identity and a way to authenticate the at least one identity attribute;

generating the identity verification request according to the identity verification policy;

Verification of said identification, including:

The identity certificate is verified according to the determined identity certificate method, and the verification result is obtained.

According to a service interface security calling method provided by the present invention, the identity certificate is verified, and the result of the service interface call is returned to the service caller according to the verification result, including:

Determine whether the identity certificate is valid;

If the identity certificate is valid, based on at least one identity attribute of the target digital identity, according to the service interface information carried in the service interface call request, call the corresponding version of the service interface to provide services, and obtain the result of the service interface call;

Returning the result of the service interface call to the service caller;

If the identity certificate is invalid, return the information that the service interface call fails to the service caller.

According to a method for securely invoking a service interface provided by the present invention, before generating an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request, the method further includes:

Judging whether the service interface information carried in the service interface call request in the identity verification proposal is legal;

If the service interface information carried in the service interface call request is legal, generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface call request;

If the service interface information carried in the service interface call request is not legal, return information that the service interface call fails to the service caller.

In the second aspect, the present invention provides a method for securely invoking a service interface, which is applied to a service caller, and an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is in the encrypted channel To carry out, the safe call method of the service interface includes:

Send a service interface call request to the service provider;

receiving an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request;

generating an identity certificate according to the identity verification request, and sending the identity certificate to the service provider;

The service interface call result returned by the service provider according to the verification result of the identity certificate is received.

In the third aspect, the present invention also provides a device for securely invoking a service interface, which is applied to a service provider, and an encrypted channel is established between the service provider and the service caller, and the secure invocation of the service interface is performed on the encrypted channel In the process, the device for securely invoking the service interface includes:

The first communication module is configured to receive a service interface call request sent by a service caller;

A first processing module, configured to generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request;

The first communication module is further configured to send the identity verification request to the service caller, and receive an identity certificate generated by the service caller according to the identity verification request;

The first processing module is further configured to verify the identity certificate;

The first communication module is further configured to return a service interface call result to the service caller according to the verification result.

In the fourth aspect, the present invention also provides a device for securely invoking a service interface, which is applied to a service caller, and an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed on the encrypted channel In the process, the device for securely invoking the service interface includes:

The second communication module is configured to send a service interface call request to the service provider; receive an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request;

A second processing module, configured to generate an identity certificate according to the identity verification request;

The second communication module is further configured to send the identity certificate to the service provider; and receive the service interface call result returned by the service provider according to the verification result of the identity certificate.

In the fifth aspect, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor, when the processor executes the program, any of the above-mentioned first aspects can be realized. A step of securely invoking a method of the service interface, or a step of implementing the method of securely invoking the service interface according to any one of the above-mentioned second aspect.

In the sixth aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for safely invoking the service interface described in any one of the above-mentioned first aspects is implemented. or implement the steps of securely invoking the service interface method as described in any one of the second aspect above.

The service interface security calling method, device, equipment and storage medium provided by the present invention establish an encrypted channel between the service provider and the service caller, and make a secure call to the service interface in the encrypted channel, and receive the service caller's According to the service interface call request, generate an authentication request for at least one identity attribute in the target digital identity, send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request , verify the identity certificate, and return the result of the service interface call to the service caller according to the verification result; use at least one identity attribute in the digital identity held by the service caller to prove to the service provider through the service caller that he has The digital identity issued by the issuer of the digital identity enables the service caller to gain the trust of the service provider and access the corresponding service interface, which can ensure the security of the service interface access and effectively prevent the service interface from being attacked.

Description of drawings

In order to more clearly illustrate the present invention or the technical solutions in the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are the present invention. For some embodiments of the invention, those skilled in the art can also obtain other drawings based on these drawings without creative effort.

Fig. 1 is a schematic flow diagram of a method for safely invoking a service interface provided by the present invention;

Fig. 2 is a schematic structural diagram of a digital identity system provided by the present invention;

Fig. 3 is a schematic flow diagram of some embodiments of the service interface security calling method provided in Fig. 1;

Fig. 4 is a schematic flow diagram of another method for securely invoking a service interface provided by the present invention;

Fig. 5 is a schematic flow chart of an application scenario of a method for securely invoking a service interface provided by the present invention;

Fig. 6 is a schematic structural diagram of a device for safely invoking a service interface provided by the present invention;

Fig. 7 is a schematic structural diagram of another device for safely invoking a service interface provided by the present invention;

Fig. 8 is a schematic structural diagram of an electronic device provided by the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention , but not all examples. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

The method for safely invoking a service interface of the present invention will be described below in conjunction with FIGS. 1-5 .

Please refer to Fig. 1. Fig. 1 is a schematic flow diagram of a method for securely invoking a service interface provided by the present invention. The method for securely invoking a service interface shown in Fig. 1 is applied to a service provider and can be executed by a device for securely invoking a service interface. An encrypted channel is established between the service provider and the service caller, for example, through Secure Sockets Layer (Secure SocketsLayer, SSL for short), Transport Layer Security (Transport Layer Security, TLS for short) or Hypertext Transfer Security Protocol (Hypertext Transfer Security). Text Transfer Protocol over SecureSocket Layer, referred to as HTTPS) etc. to establish an encrypted channel, the embodiment of the present invention does not limit the protocol type for implementing the encrypted channel, the service caller and the service provider can exchange public keys through the encrypted channel, and the service interface The secure call is carried out in an encrypted channel, as shown in Figure 1, the secure call method of the service interface includes at least:

101. Receive a service interface invocation request sent by a service caller.

In the embodiment of the present invention, the service interface call request sent by the service caller to the service provider may carry the called service interface information, for example, the name of the service interface, the parameter name and value of the service interface, etc. The content of the service interface information carried in the interface call request is not limited, and the service provider can call the corresponding service interface to provide services according to the service interface information carried in the received service interface call request. Optionally, the service caller can integrate the service interface call request into the identity verification proposal, send the integrated identity verification proposal to the service provider, and the service provider can receive the integrated identity verification proposal, and obtain the service interface call request from it .

102. Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface call request.

In the embodiment of the present invention, the digital identity is a digitally encrypted identity certificate. As shown in Figure 2, the digital identity has the following characteristics:

(1) Each digital identity has an issuer and a holder. The issuer is the giver of the digital identity and the source of the digital identity. The holder is the object described by the digital identity and the owner of the digital identity. Digital identity represents the specific trust of the issuer in the holder;

(2) Each digital identity conforms to a certain digital identity specification, and each digital identity specification has a unique identifier. The identifier of the digital identity specification is obtained by the specification maker registering the digital identity specification with the trust intermediary, and its ownership belongs to the specification formulation party;

(3) Each digital identity specification can contain a variety of different data formats, and each digital identity must conform to a specific data format, so it must also belong to the data specification to which the data format belongs; the data format of a digital identity is used to describe For the relevant information of the holder of the digital identity, such as name, security level, etc., one or more digital identities in different data formats can be used for different application scenarios; each data format has a unique identifier, and each data The identification of the format is obtained by registering the data format with the trust intermediary by the party that formulates the data specification to which it belongs, and the content of each digital identity must refer to the identification of the data format adopted;

(4) Each digital identity has a corresponding data source; the data source is a binary group composed of the issuer of the digital identity and the data format. Each data source has a unique identifier. The identity is obtained by the issuer of the digital identity by registering the data source in the trust intermediary before generating the digital identity, and the content of each digital identity must refer to the identity of the data source used;

(5) The trust intermediary can be an organization that specializes in providing trust services, or it can be a public infrastructure such as blockchain;

(6) After issuing the digital identity, the issuer can send the issued digital identity to the holder through various communication methods, and the holder stores the digital identity obtained from the issuer;

(7) The holder of a digital identity can hold multiple digital identities from multiple data sources at the same time, and each digital identity can serve different purposes;

(8) The digital identity is used by the holder to prove to the verifier that he has the specific trust granted by the issuer, and the verifier can choose to trust the holder of the digital identity based on the trust in the issuer;

(9) The verifier and issuer of the digital identity can be the same party.

In the embodiment of the present invention, the service caller is the holder of the digital identity, and the service caller may obtain all the digital identities required for accessing the service interface before calling the service interface. The service provider is the verifier of the digital identity, and it can also be the issuer of the digital identity, or the issuer of the digital identity can be a third party other than the service provider and the service caller. The digital identity exists to perform the trust required to perform service interface calls.

In the embodiment of the present invention, after receiving the service interface call request from the service caller, the service provider can obtain the context information of the service interface call according to the service interface call request, for example, the name of the service interface, the name of the service caller , the time of invoking the service interface, etc., according to the context information of the invocation of the service interface, an identity verification request for at least one identity attribute in the target digital identity of the service caller is generated. Optionally, the target digital identity may include one of the following: a digital identity conforming to a specific digital identity specification, a digital identity conforming to a specific data format, a digital identity from a specific issuer, and a digital identity from a specific data source; the target digital identity At least one identity attribute in the identity can be determined according to the content of the target digital identity, for example, identity attributes such as name and address; the embodiment of the present invention does not limit the type of the target digital identity and the type of at least one identity attribute in the target digital identity .

Optionally, the generated authentication request may be an authentication request for an identity attribute in a target digital identity of the service caller; or, it may be an authentication request for multiple identity attributes in a target digital identity of the service caller or an identity verification request for multiple identity attributes in multiple target digital identities of the service caller; this is not limited in this embodiment of the present invention.

In the embodiment of the present invention, each time the service interface is called, the service provider can generate a service-specific An identity verification request for at least one identity attribute in different target digital identities of the caller; or, an identity verification request for different types and/or quantities of identity attributes in the same target digital identity of the service caller can also be generated; This is not limited.

103. Send an identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request.

In the embodiment of the present invention, after the service provider generates an identity verification request for at least one identity attribute in the target digital identity of the service caller, it can send the generated identity verification request to the service caller, and the service caller receives the service After the provider sends an authentication request for at least one identity attribute in the target digital identity according to the service interface call request, it can query the target digital identity from the digital identity stored in the local database according to the authentication request. After identity, obtain at least one identity attribute corresponding to the target digital identity, and generate an identity certificate for at least one identity attribute obtained according to the identity verification request. After generating the identity certificate, the service caller will send the service provider the The generated identity certificate, the service provider will receive the identity certificate sent by the service caller according to the authentication request.

If the service caller finds multiple target digital identities that meet the authentication request in the local database according to the authentication request for at least one identity attribute in the target digital identity, the service caller can automatically select and generate according to the pre-established rules One or more target digital identities of identity certificates are used to generate identity certificates; or one or more target digital identities for generating identity certificates can be selected to generate identity certificates through manual intervention in an interactive manner; the embodiments of the present invention address No limit.

For example, the obtained at least one identity attribute may be the identity attribute encrypted by the issuer's private key of the target digital identity, and the service caller can use the private key of the service caller to pair the obtained issuer's private key The encrypted identity attribute is encrypted to obtain an identity certificate, which is an identity attribute encrypted by both the private key of the service caller and the private key of the issuer of the target digital identity.

104. Verify the identity certificate, and return the service interface call result to the service caller according to the verification result.

In the embodiment of the present invention, after receiving the identity certificate generated by the service caller according to the identity verification request, the service provider can verify the received identity certificate. For example, when the identity certificate can be When the private key and the private key of the issuer of the target digital identity encrypt the identity attribute, the encrypted identity attribute can be decrypted according to the public key of the service caller and the public key of the issuer of the digital identity to obtain the corresponding identity attribute , so as to realize the verification of the identity certificate. After obtaining the verification result of the identity certificate, the service provider can determine whether to call the corresponding service interface to provide services for the service caller according to the verification result of the identity certificate. The caller returns the result of the service interface call.

The method for securely invoking a service interface provided by the present invention establishes an encrypted channel between the service provider and the service caller, performs a secure call to the service interface in the encrypted channel, and receives the service interface call request sent by the service caller, according to Service interface call request, generate an identity verification request for at least one identity attribute in the target digital identity, send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request, and verify the identity certificate, And return the result of the service interface call to the service caller according to the verification result; using at least one identity attribute in the digital identity held by the service caller, through the service caller to prove to the service provider that he has a digital identity issued by the issuer The digital identity of the service caller can obtain the trust of the service provider and access the corresponding service interface, which can ensure the security of the service interface access and effectively prevent the service interface from being attacked.

Please refer to FIG. 3. FIG. 3 is a schematic flow diagram of some embodiments of the service interface security invocation method provided in FIG. 1. As shown in FIG. 3, the service interface security invocation method at least includes:

301. Receive an identity verification proposal sent by a service caller.

In the embodiment of the present invention, the service caller sends the identity verification proposal integrated with the service interface call request to the service provider, and the service provider receives the identity verification proposal integrated with the service interface call request. In addition to the service interface call request, the identity verification proposal of the request may also include the identity attributes that the service caller voluntarily discloses, for example, the name and other identity attributes of the service caller. The types of identity attributes that are voluntarily disclosed are not limited. According to the identity attributes contained in the identity verification proposal, the identity attributes that generate the identity verification request can be determined, that is, when generating the identity verification request, you can select Identity attributes to generate authentication requests.

302. Determine whether the service interface information carried in the service interface call request in the identity verification proposal is legal.

If the service interface information carried in the service interface call request is legal, go to 303 ; if the service interface information carried in the service interface call request is not legal, go to 308 .

In the embodiment of the present invention, after the service provider receives the identity verification proposal integrated with the service interface call request, it can parse out the service interface information carried in the service interface call request, for example, the name of the service interface, the parameter name of the service interface, and value, etc., and check the legality of the parsed service interface information to determine whether the service interface information carried in the service interface call request in the identity verification proposal is legal, for example, check whether the service interface exists and whether the parameters of the service interface are legal range, etc., and get the check result.

303. Generate an identity verification request for at least one identity attribute in the target digital identity according to the identity verification proposal.

In the embodiment of the present invention, the service provider checks the validity of the service interface information, and the obtained check results may include check success and check failure. If the service interface information carried in the service interface call request is legal, the result of the legality check is that the check is successful, indicating that the service interface information meets the basic legality requirements, for example, the service interface exists, and the parameters of the service interface conform to the legal value range interval etc., generate an authentication request for at least one identity attribute in the target digital identity according to the identity authentication proposal. If the service interface information carried in the service interface call request is not legal, the legality check result is a check failure, indicating that the service interface information does not meet the basic legal requirements, for example, the service interface does not exist and/or the service interface If the parameter does not conform to the legal value range interval, etc., the service interface call failure information will be returned to the service caller. Optionally, the information about the failure to call the service interface may include a reason for the failure to call the service interface, for example, the interface does not exist and/or the parameters are wrong.

In some optional examples, when an authentication request for at least one identity attribute in the target digital identity is generated according to the authentication proposal, the identity authentication strategy may be determined according to the service interface call request, wherein the identity authentication strategy may be Including: at least one identity attribute in the target digital identity and the method of identifying at least one identity attribute. The method of identifying at least one identity attribute may include direct identification of identity information, which may also be called data verification, and zero-knowledge proof, and then generate an authentication request according to the authentication policy.

In the embodiment of the present invention, the service provider can determine different authentication strategies according to different service interfaces, different service callers, different service interface call times, etc. each time the service interface is called. At least one of the target digital identity included in the identity verification policy, the type and/or quantity of the identity attributes of the target digital identity, and the manner of identity verification may be different, which is not limited in the embodiment of the present invention.

Optionally, at least one identity attribute of the target digital identity in the authentication policy may be selected from the following digital identities held by the service caller: digital identities conforming to specific digital identity specifications, and the digital identities are not limited to specific Data format and issuer; digital identity conforming to a specific data format, the digital identity specification and data format of the digital identity are fixed, and the data source is not limited, that is, the issuer; digital identity from a specific issuer, the issuer of the digital identity is fixed , does not limit the digital identity specification and data format; digital identity from a specific data source, the issuer of the digital identity, digital identity data specification and data format are fixed.

304. Send an identity verification request to the service caller, and receive the identity certificate sent by the service caller according to the identity verification request.

In some optional examples, when the authentication request is generated by the authentication policy, the service caller can query the target digital identity in the local database according to the authentication request after receiving the authentication request from the service provider , and obtain at least one identity attribute in the target digital identity, and generate an identity certificate for at least one identity attribute according to the identity certificate method specified in the identity verification request. Optionally, if the service caller encounters a problem in the process of querying or generating the identity certificate, the service caller will return an error message to the service provider. Optionally, the service provider can set a response time limit for the identity verification request. If the process of generating the identity certificate by the service caller exceeds the response time limit, the service provider determines that the identity verification fails.

305. Determine whether the identity certificate is valid.

If the identity certificate is valid, execute 306; if the identity certificate is invalid, execute 308.

In some optional examples, when the identity verification request is generated by the identity verification policy, after receiving the identity certificate sent by the service caller, the service provider can, according to the identity verification method determined by the identity verification policy, The identity certificate is verified to determine whether the identity certificate is valid. For example, when the identity verification method is data verification, the identity certificate returned by the service caller to prove that he holds a digital identity that meets the requirements of the service provider can be a value obtained according to at least one corresponding identity attribute, and the value can be It is obtained by encrypting the identity attribute with the private key of the service caller and the private key of the issuer of the target digital identity. The service provider can decrypt the encrypted identity attributes through the service caller's public key and the digital identity issuer's public key to verify the identity certificate. For example, when the identity proof method is zero-knowledge proof, the identity proof that the service caller returns to prove that he holds a digital identity that meets the requirements of the service provider can be based on the zero-knowledge proof request constructed by the service provider, for The relationship between the value corresponding to at least one identity attribute and the preset value range, such as greater than or less than, where the value corresponding to at least one identity attribute can be obtained through the private key of the service caller and the private key of the issuer of the target digital identity. The key is obtained after encrypting the identity attribute. The service provider can verify the identity certificate through the relationship between the value corresponding to at least one identity attribute returned by the service caller and the preset value range, so that the service caller can, without disclosing specific identity information, Obtain the trust of the service provider, taking into account the privacy of the service caller and the security of the service interface.

306. Based on the target digital identity, according to the service interface information carried in the service interface call request, call the corresponding version of the service interface to provide the service, and obtain the result of the service interface call.

In the embodiment of the present invention, when the service provider calls the service interface to provide services according to the service interface information carried in the service interface call request, it can call different versions of the service based on the identity attributes of the target digital identity that generates the identity verification request. interface provides services.

307. Return the result of calling the service interface to the service caller.

In the embodiment of the present invention, the service provider verifies the identity certificate, and the obtained verification results may include verification success and verification failure. If the identity certificate is valid, the verification result of the identity certificate is successful, indicating that the service caller holds a digital identity that meets the requirements of the service provider, and the service provider has the trust required for the service provider to perform service interface calls, allowing The service interface information carried in the interface call request calls the corresponding service interface to provide services, and returns the result of the service interface call to the service caller. Optionally, the service provider may attach the result of the service interface call to the identity verification confirmation message, and return it to the service caller at the same time as the identity verification confirmation message.

308. Return information that the service interface call fails to the service caller.

If the identity certificate is invalid, the verification result of the identity certificate is a verification failure, indicating that the service caller does not hold a digital identity that meets the requirements of the service provider, and the service provider does not have the trust required for the service provider to perform service interface calls. It is not allowed to call the corresponding service interface to provide services according to the service interface information carried in the service interface call request, and return the failure information of the service interface call to the service caller. Optionally, the information about the service interface invocation failure may include the cause of the service interface invocation failure, for example, authentication failure and the like.

Please refer to FIG. 4. FIG. 4 is a schematic flow diagram of another service interface security invocation method provided by the present invention. The service interface security invocation method shown in FIG. 4 is applied to a service caller and can be executed by a service interface security invocation device. Establish an encrypted channel between the service caller and the service provider, for example, establish an encrypted channel through protocols such as SSL, TLS, or HTTPS. The embodiment of the present invention does not limit the protocol type for implementing the encrypted channel. The provider can exchange public keys, and the secure call to the service interface is carried out in an encrypted channel, as shown in Figure 4, the secure call method of the service interface includes at least:

401. Send a service interface invocation request to the service provider.

402. Receive an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request.

403. Generate an identity certificate according to the identity verification request, and send the identity certificate to the service provider.

404. Receive the service interface call result returned by the service provider according to the verification result of the identity certificate.

In the embodiment of the present invention, for descriptions of 401 , 402 , 403 , and 404 , refer to descriptions of 101 , 102 , 103 , and 104 in FIG. 1 , so details are not repeated here.

Please refer to FIG. 5. FIG. 5 is a schematic flow diagram of an application scenario of the service interface safe calling method provided by the present invention. As shown in FIG. 5, the specific process of the service interface safe calling method is as follows:

The service caller sends an authentication proposal to the service provider. The content of the authentication proposal includes the name of the service interface, the parameter names and values of the service interface, and the identity attributes voluntarily disclosed by the service caller.

After receiving the identity verification proposal, the service provider analyzes the name of the service interface contained in the service interface call request, the parameter name and value of the service interface, etc., and performs a legality check. If the legality check fails, return the service interface call failure information to the service caller.

If the legality check is passed, the service provider returns an authentication request to the service caller. The identity verification request can be based on one or more identity attributes of the target digital identity for data verification or zero-knowledge proof generation.

After receiving the identity verification request, the service caller queries the target digital identity from the digital identity stored in the local data, generates an identity certificate according to the identity verification request, and returns the generated identity verification request to the service provider.

After receiving the identity certificate, the service provider verifies the identity certificate, and after confirming that the identity certificate is valid, executes the function of the corresponding service interface.

After the service provider finishes executing the function of the service interface, it attaches the execution result to the verification confirmation message and returns it to the service caller.

The boundary point locating device provided by the present invention is described below, and the boundary point locating device described below and the boundary point locating method described above may refer to each other correspondingly.

Please refer to Fig. 6. Fig. 6 is a schematic structural diagram of a service interface secure calling device provided by the present invention. The service interface safe calling device shown in Fig. 6 is applied to a service provider and can be used to execute the service interface safe calling method in Fig. 1 , establish an encrypted channel between the service provider and the service caller, for example, establish an encrypted channel through protocols such as SSL, TLS or HTTPS, the embodiment of the present invention does not limit the protocol type for implementing the encrypted channel, and the service caller and The service provider can exchange public keys, and the secure call to the service interface is carried out in an encrypted channel, as shown in Figure 6, the device for secure call of the service interface includes at least:

The first communication module 610 is configured to receive a service interface call request sent by a service caller.

The first processing module 620 is configured to generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface call request.

The first communication module 610 is further configured to send an identity verification request to the service caller, and receive an identity certificate generated by the service caller according to the identity verification request.

The first processing module 620 is also configured to verify the identity certificate.

The first communication module 610 is further configured to return the result of calling the service interface to the service caller according to the verification result.

Optionally, the first processing module 620 is configured to determine an identity verification strategy according to the service interface call request; the identity verification strategy includes: at least one identity attribute in the target digital identity and an identity certificate for at least one identity attribute method; generate an identity verification request according to the identity verification strategy; verify the identity certificate according to the determined identity certificate method, and obtain the verification result.

Optionally, the first processing module 620 is configured to determine whether the identity certificate is valid; if the identity certificate is valid, based on the at least one identity attribute, according to the service interface information carried in the service interface call request, call the service interface of the corresponding version to provide Service, get the result of calling the service interface.

The first communication module 610 is configured to return the result of the service interface call to the service caller; if the identity certificate is invalid, return the service interface call failure information to the service caller.

Optionally, the first processing module 620 is also used to judge whether the service interface information carried in the service interface call request in the identity verification proposal is legal; if the service interface information carried in the service interface call request is legal, according to the service interface call request, generating an authentication request for at least one identity attribute in the target digital identity;

The first communication module 610 is further configured to return information that the service interface call fails to the service caller if the service interface information carried in the service interface call request is not legal.

Please refer to FIG. 7. FIG. 7 is a schematic structural diagram of another service interface security call device provided by the present invention. The service interface security call device shown in FIG. 7 is applied to a service provider and can be used to execute the service interface security call of FIG. Method, establish an encrypted channel between the service provider and the service caller, for example, establish an encrypted channel through protocols such as SSL, TLS or HTTPS, the embodiment of the present invention does not limit the protocol type for implementing the encrypted channel, and the service caller through the encrypted channel The public key can be exchanged with the service provider, and the secure call to the service interface is carried out in an encrypted channel, as shown in Figure 7, the device for secure call of the service interface includes at least:

The second communication module 710 is configured to send a service interface call request to the service provider; receive an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request.

The second processing module 720 is configured to generate an identity certificate according to the identity verification request.

The second communication module 710 is also configured to send the identity certificate to the service provider; and receive the service interface call result returned by the service provider according to the verification result of the identity certificate.

Optionally, the second processing module 720 is also configured to query the target digital identity in the local database according to the identity verification request, and obtain at least one identity attribute in the target digital identity; for at least one identity attribute, according to the identity verification request Proof of identity is generated in the manner specified in Proof of Identity.

FIG. 8 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 8, the electronic device may include: a processor (processor) 810, a communication interface (Communications Interface) 820, a memory (memory) 830, and a communication bus 840, Wherein, the processor 810 , the communication interface 820 , and the memory 830 communicate with each other through the communication bus 840 . The processor 810 can call the logic instructions in the memory 830 to execute the service interface security call method, when the service interface security call method is applied to the service provider, an encrypted channel is established between the service provider and the service caller, and the service The secure calling of the interface is carried out in an encrypted channel, and the safe calling methods of the service interface include:

Receive the service interface call request sent by the service caller;

Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request;

Send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request;

Verify the identity certificate, and return the result of the service interface call to the service caller according to the verification result;

When the service interface secure calling method is applied to the service caller, an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed in the encrypted channel. The service interface secure calling method includes:

Send a service interface call request to the service provider;

receiving an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request;

generating an identity certificate according to the identity verification request, and sending the identity certificate to the service provider;

The service interface call result returned by the service provider according to the verification result of the identity certificate is received.

In addition, the above logic instructions in the memory 830 may be implemented in the form of software functional units and when sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

On the other hand, the present invention also provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer When executing, the computer can execute the service interface security call method provided by the above methods. When the service interface security call method is applied to the service provider, an encrypted channel is established between the service provider and the service caller, and the service interface The secure call is carried out in an encrypted channel, and the secure call methods of the service interface include:

Receive the service interface call request sent by the service caller;

Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request;

Send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request;

Verify the identity certificate, and return the result of the service interface call to the service caller according to the verification result;

When the service interface secure calling method is applied to the service caller, an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed in the encrypted channel. The service interface secure calling method includes:

Send a service interface call request to the service provider;

receiving an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request;

generating an identity certificate according to the identity verification request, and sending the identity certificate to the service provider;

The service interface call result returned by the service provider according to the verification result of the identity certificate is received.

In yet another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the service interface security call method provided by the above methods. When the service interface secure invocation method is applied to the service provider, an encrypted channel is established between the service provider and the service caller, and the secure invocation of the service interface is performed in the encrypted channel. The service interface secure invocation method includes:

Receive the service interface call request sent by the service caller;

Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request;

Send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request;

Verify the identity certificate, and return the result of the service interface call to the service caller according to the verification result;

When the service interface secure calling method is applied to the service caller, an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed in the encrypted channel. The service interface secure calling method includes:

Send a service interface call request to the service provider;

receiving an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request;

generating an identity certificate according to the identity verification request, and sending the identity certificate to the service provider;

The service interface call result returned by the service provider according to the verification result of the identity certificate is received.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A method for securely invoking a service interface, characterized in that it is applied to a service provider, and an encrypted channel is established between the service provider and the service caller, and the secure call to the service interface is carried out in the encrypted channel , the safe call method of the service interface includes: Receive the service interface call request sent by the service caller; Generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request; Send the identity verification request to the service caller, and receive the identity certificate issued by the service caller according to the identity verification request; The identity certificate is verified, and the result of calling the service interface is returned to the service caller according to the verification result. 2. The service interface security calling method according to claim 1, characterized in that, according to the service interface calling request, an identity verification request for at least one identity attribute in the target digital identity is generated, including: Determine an identity verification strategy according to the service interface call request; the identity verification strategy includes: at least one identity attribute in the target digital identity and a way to authenticate the at least one identity attribute; generating the identity verification request according to the identity verification policy; Verification of said identification, including: The identity certificate is verified according to the determined identity certificate method, and the verification result is obtained. 3. The service interface secure calling method according to claim 1 or 2, characterized in that, verifying the identity certificate, and returning the result of calling the service interface to the service caller according to the verification result, including: Determine whether the identity certificate is valid; If the identity certificate is valid, based on at least one identity attribute of the target digital identity, according to the service interface information carried in the service interface call request, call the corresponding version of the service interface to provide services, and obtain the result of the service interface call; Returning the result of the service interface call to the service caller; If the identity certificate is invalid, return the information that the service interface call fails to the service caller. 4. The service interface security calling method according to claim 3, characterized in that, according to the service interface calling request, before generating an identity verification request for at least one identity attribute in the target digital identity, further comprising: Judging whether the service interface information carried in the service interface call request in the identity verification proposal is legal; If the service interface information carried in the service interface call request is legal, generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface call request; If the service interface information carried in the service interface call request is not legal, return information that the service interface call fails to the service caller. 5. A method for securely invoking a service interface, characterized in that it is applied to a service caller, and an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed in the encrypted channel , the safe call method of the service interface includes: Send a service interface call request to the service provider; receiving an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request; generating an identity certificate according to the identity verification request, and sending the identity certificate to the service provider; The service interface call result returned by the service provider according to the verification result of the identity certificate is received. 6. The service interface security calling method according to claim 5, characterized in that generating an identity certificate according to the identity verification request comprises: querying the target digital identity in a local database according to the identity verification request, and acquiring the at least one identity attribute in the target digital identity; For the at least one identity attribute, the identity certificate is generated according to the manner of the identity certificate specified in the identity verification request. 7. A device for securely invoking a service interface, characterized in that it is applied to a service provider, and an encrypted channel is established between the service provider and the service caller, and the secure call to the service interface is performed in the encrypted channel , the device for securely invoking the service interface includes: The first communication module is configured to receive a service interface call request sent by a service caller; A first processing module, configured to generate an identity verification request for at least one identity attribute in the target digital identity according to the service interface invocation request; The first communication module is further configured to send the identity verification request to the service caller, and receive an identity certificate generated by the service caller according to the identity verification request; The first processing module is further configured to verify the identity certificate; The first communication module is further configured to return a service interface call result to the service caller according to the verification result. 8. A device for securely invoking a service interface, characterized in that it is applied to a service caller, and an encrypted channel is established between the service caller and the service provider, and the secure call to the service interface is performed in the encrypted channel , the device for securely invoking the service interface includes: The second communication module is configured to send a service interface call request to the service provider; receive an identity verification request for at least one identity attribute in the target digital identity sent by the service provider according to the service interface call request; A second processing module, configured to generate an identity certificate according to the identity verification request; The second communication module is further configured to send the identity certificate to the service provider; and receive the service interface call result returned by the service provider according to the verification result of the identity certificate. 9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor according to claim 1 is implemented when executing the program. The step of safely invoking the method of the service interface described in any one of claims 4 to 4, or the step of implementing the method of safely invoking the service interface described in claim 5 or 6. 10. A non-transitory computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it implements the service interface security calling method according to any one of claims 1 to 4 steps, or realize the steps of safely invoking the service interface method according to claim 5 or 6.

Images