JP2018029241A - API system and data encryption method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently guarantee security to data included in an API request or an API response.SOLUTION: An enabler device 10 registers, in an API gateway device 20, an encryption key for encrypting data included in an API request addressed to the enabler device 10 (step S101). An application of an application device 30 acquires the encryption key registered in the API gateway device 20 (step S102), and encrypts data included in the API request with the encryption key (step S103).SELECTED DRAWING: Figure 5

Description

  The present invention relates to a technique for encrypting data included in an API request or an API response.

  Currently, an API providing system has been devised in which functions constituting a service are separated and made into parts with as small a granularity as possible and the functions are provided as an API (Application Program Interface). Such an API providing system includes, for example, a plurality of enabler devices that provide each function used by an application, and an API gateway device that provides an API for each function.

  The API providing system is provided to an application developer, and the application developer develops an application using the API using the API providing system. Therefore, the API gateway device includes a developer portal site function.

  Here, the operation of the developed application will be outlined. For example, when an application using the function a provided by the enabler device A is developed, the application transmits an API request for requesting the function a to the API gateway device. The API gateway device transfers the API request to the enabler device A having the function a requested by the API request via the corresponding API. Thereafter, the enabler device A provides the function a included in the enabler device A to the requesting application device in response to the received API request.

Japanese Patent No. 4902633 Japanese Patent No. 5309364

  The API request transmitted from the application to the API gateway device includes, for example, a function ID for identifying the requested function, an API key for authenticating the application, and confidential data such as personal information regarding the user of the application. May be. For example, when the enabler device A provides a function a for managing an address book for each user and the enabler device B provides a function b for making / disconnecting a phone call, the telephone number of the other party to be contacted is obtained from the address book. When an application for making a telephone call is developed, the application includes the telephone number of the other party in the API request and transmits it to the API gateway apparatus. In addition to the API request, the API response transmitted from the API gateway device to the application may include confidential data.

  However, at present, a mechanism for sharing an encryption key for confidential data transmitted and received between an application that is an API user and the API providing system has not been established. Therefore, the encryption key must be managed and distributed independently between the application and the API providing system. In Patent Documents 1 and 2, a system similar to the API providing system is devised, but the mechanism is not mentioned.

  The present invention has been made in view of the above circumstances, and an object thereof is to efficiently secure security for data included in an API request or an API response.

  In order to solve the above problems, an API system according to claim 1 includes an enabler device that provides a function in response to an API request, an API gateway device that provides an API of the enabler device, and an application that transmits the API request. In the API system including the application device, the enabler device includes a registration unit that registers an encryption key for encrypting data included in the API request addressed to the API device in the API gateway device, The API gateway device includes a transmission unit that transmits the encryption key registered in the API gateway device to the application in response to an access from the application, and the application uses the encryption key received from the API gateway device to execute an API. Rikue Comprising an encryption unit for encrypting the data to be included in the bets, and summarized in that.

  An API system according to claim 2 comprises: an enabler device that provides a function in response to an API request; an API gateway device that provides an API of the enabler device; and an application device that includes an application that transmits the API request. In the provided API system, the application includes a registration unit that registers an encryption key for encrypting an API response addressed to itself or data included in the API request in the API gateway device. A transmission unit configured to transmit to the enabler device the encryption key registered in response to an access from the enabler device; the enabler device receives an API response or an A with the encryption key received from the API gateway device; Comprising an encryption unit for encrypting the data to be included in the I request and summarized in that.

  A data encryption method according to claim 3 is an enabler device that provides a function in response to an API request, an API gateway device that provides an API of the enabler device, and an application device that includes an application that transmits the API request; In the data encryption method performed by the API system comprising: the enabler device, executing the step of registering in the API gateway device an encryption key for encrypting data included in the API request addressed to the enabler device, The API gateway device is caused to execute a step of transmitting the encryption key registered in the API gateway device to the application in response to an access from the application, and the application uses the encryption key received from the API gateway device to execute A The data to be included in I requested to execute a step of encrypting, and summarized in that.

  The data encryption method according to claim 4 is an enabler device that provides a function in response to an API request, an API gateway device that provides an API of the enabler device, and an application device that includes an application that transmits the API request; In the data encryption method performed by the API system comprising: the application executes the step of registering in the API gateway device an encryption key for encrypting data included in the API response or API request addressed to the application. The API gateway device is caused to execute a step of transmitting the encryption key registered in the API gateway device to the enabler device in response to an access from the enabler device, and before the enabler device has received the API gateway device from the API gateway device. To perform the step of encrypting the data to be included in the API response or API requests encryption key, and summarized in that.

  ADVANTAGE OF THE INVENTION According to this invention, security can be efficiently ensured with respect to the data included in an API request or an API response.

It is a figure which shows the whole structure of an API system. It is a figure which shows the functional block structure of the enabler apparatus which concerns on 1st Embodiment. It is a figure which shows the functional block structure of the API gateway apparatus which concerns on 1st Embodiment. It is a figure which shows the functional block structure with which the application of the application apparatus which concerns on 1st Embodiment is provided. It is a figure which shows operation | movement of the data encryption method which concerns on 1st Embodiment. It is a figure which shows the functional block structure with which the application of the application apparatus which concerns on 2nd Embodiment is provided. It is a figure which shows the functional block structure of the API gateway apparatus which concerns on 2nd Embodiment. It is a figure which shows the functional block structure of the enabler apparatus which concerns on 2nd Embodiment. It is a figure which shows operation | movement of the data encryption method which concerns on 2nd Embodiment.

  The present invention is characterized in that the API gateway device has a function of paying out an encryption key for encrypting API request or API response data. Thereby, it is not necessary to independently manage and distribute the encryption key between the application and the API providing system, and the security of the API response data can be efficiently secured. Hereinafter, an embodiment for carrying out the present invention will be described with reference to the drawings.

<First Embodiment>
In the first embodiment, a method for encrypting API request data transmitted from an application to an API providing system will be described.

  FIG. 1 is a diagram showing an overall configuration of an API system according to the first embodiment. The API system 1 includes an enabler device 10, an API providing system including an API gateway device 20, and an application device 30.

  The enabler device 10 is a device that provides a function provided in response to an API request. Specifically, it is composed of at least one enabler device such as an enabler device 10 that provides the function a and an enabler device 10 that provides a function n different from the function a. For example, the enabler device A provides a function a of a database for managing an address book (address, name, telephone number, ID of a predetermined service, etc.) for each user, and the enabler device B has a function b for making / disconnecting a call. The enabler device C provides a function c for transmitting a message.

  FIG. 2 is a diagram showing a functional block configuration of the enabler device 10 according to the present embodiment. The enabler device 10 according to the present embodiment includes a key information storage unit 101, an encryption key registration unit 102, an API request, in addition to the existing function (a function that provides a function provided by itself according to an API request). A receiving unit 103 and a data decoding unit 104 are provided.

  The key information storage unit 101 has a function of storing a pair of previously generated encryption key and decryption key.

  The encryption key registration unit 102 has a function of reading an encryption key from the key information storage unit 101 and registering the encryption key in the API gateway device 20 in order to encrypt data included in the API request addressed to itself. .

  The API request receiving unit 103 has a function of receiving an API request transmitted from an application of the application device 30 via the API gateway device 20.

  The data decryption unit 104 acquires data (= encrypted confidential data) from the API request received by the API request reception unit 103, and decrypts the decryption key corresponding to the encryption key registered in the API gateway device 20. Is read from the key information storage unit 101, and the encrypted secret data is decrypted with the decryption key.

  Next, the API gateway device 20 will be described. The API gateway device 20 is a device that provides the API of the enabler device 10, and an endpoint for an application to call each API is implemented. For example, in the case of the above example, the API gateway device 20 has an API (API of the enabler device A) that performs registration / acquisition / change / deletion of information in the address book, and an API (API of the enabler device B) that performs call origination / disconnection. ), An API for transmitting a message (API of the enabler device C) is provided to the application, and the API request transmitted from the application is transferred to the corresponding enabler device 10 via the corresponding API.

  FIG. 3 is a diagram showing a functional block configuration of the API gateway device 20 according to the present embodiment. The API gateway device 20 according to the present embodiment includes an encryption key reception unit 201, an encryption key storage unit 202, an encryption key transmission unit 203, an API request reception unit 204, an API request transmission unit 205, It is configured with.

  The encryption key receiving unit 201 has a function of receiving the encryption key transmitted from the enabler device 10 by the registration process in the enabler device 10.

  The encryption key storage unit 202 has a function of storing the encryption key received by the encryption key receiving unit 201 in association with the ID of the source enabler device 10.

  The encryption key transmission unit 203 has a function of transmitting a corresponding encryption key to the application in response to an access from the application.

  The API request receiving unit 204 has a function of receiving an API request transmitted from an application.

  The API request transmission unit 205 has a function of transmitting an API request via the corresponding API to the enabler device 10 having the function requested by the API request after the API request reception unit 204 receives the API request.

  Note that the API gateway device 20 unifies and manages the APIs of the plurality of enabler devices 10 as described above in order to improve convenience when an application accesses the plurality of enabler devices 10. Therefore, in order to present to the developer what kind of API can be used during application development, the API gateway device 20 is registered with documents describing the specifications and usage of each API. .

  Next, the application device 30 will be described. The application device 30 is a terminal including an application that transmits an API request and receives an API response. Here, the application is an application developed by using each API using an API providing system (here, one or more enabler devices 10 and an API gateway device 20) as described in the background art. For example, in the case of the above example, the telephone number of the other party to be contacted is acquired from the address book using the function a of the enabler apparatus A, the telephone call is performed using the function b of the enabler apparatus B, and the enabler apparatus C This is an application for sending a message using the function c.

  FIG. 4 is a diagram illustrating a functional block configuration included in an application of the application apparatus 30 according to the present embodiment. This application includes an encryption key acquisition unit 301, a key information storage unit 302, and a data storage unit 303 in addition to the above existing functions (functions that provide services using each function of one or more enabler devices 10). And a data encryption unit 304 and an API request transmission unit 305.

  The encryption key acquisition unit 301 has a function of acquiring an encryption key registered by the enabler device 10 having a function requested by the API request from the API gateway device 20 before transmitting the API request.

  The key information storage unit 302 has a function of storing the encryption key acquired by the encryption key acquisition unit 301.

  The data storage unit 303 has a function of storing data (secret data such as personal information) included in the API request.

  The data encryption unit 304 has a function of reading the encryption key from the key information storage unit 302 and encrypting the data included in the API request with the encryption key when transmitting the API request including the data.

  The API request transmission unit 305 has a function of transmitting an API request including the data encrypted by the data encryption unit 304 to the API gateway device 20.

  Next, a data encryption method performed by the API system according to this embodiment will be described. FIG. 5 is a diagram showing the operation of the data encryption method according to the present embodiment. In the present embodiment, data included in the API request is encrypted.

  First, in step S101, the enabler device 10 registers in the API gateway device 20 an encryption key for encrypting data included in the API request addressed to itself.

  Next, in step S <b> 102, the application of the application device 30 acquires the encryption key registered by the enabler device 10 having the function requested by the API request from the API gateway device 20 before transmitting the API request. At this time, the API gateway device 20 performs a process of paying out to the application an encryption key corresponding to the ID of the corresponding enabler device 10 in addition to the API key for authenticating the application.

  Next, in step S103, the application of the application device 30 encrypts data to be included in the API request with the encryption key acquired from the API gateway device 20.

  Next, in step S104, the application of the application device 30 includes the data encrypted with the encryption key in the body part of the API request and transmits the data to the API gateway device 20.

  Next, in step S105, after receiving the API request from the application, the API gateway device 20 transmits the API request to the enabler device 10 having the function requested by the API request via the corresponding API.

  Finally, in step S <b> 106, the enabler device 10 receives the API request from the API gateway device 20, acquires encrypted data from the API request, and uses the encrypted key registered in the API gateway device 20. The encrypted data is decrypted with the corresponding decryption key.

  That is, according to the present embodiment, the enabler device 10 registers an encryption key for encrypting data to be included in an API request addressed to the API gateway device 20. The encryption key registered in itself is transmitted to the application in response to the access, and the application encrypts the data included in the API request with the encryption key received from the API gateway device 20.

  That is, the API gateway device 20 has a function of issuing an encryption key for encrypting data, and the application encrypts the data of the API request with the encryption key issued by the API gateway device 20. And the API providing system (here, the enabler device 10 and the API gateway device 20) need not independently manage and distribute the encryption key, and efficiently secure the security of the API request data. Can do.

<Second Embodiment>
In the second embodiment, a method of encrypting API response or API request data transmitted from the API providing system to the application will be described. The overall configuration of the API system according to the present embodiment is the same as the overall configuration shown in FIG.

  FIG. 6 is a diagram illustrating a functional block configuration included in an application of the application apparatus 30 according to the present embodiment. This application is configured to further include an encryption key registration unit 306, an API response reception unit 307, and a data decryption unit 308 in addition to the functional units described in the first embodiment.

  The key information storage unit 302 has a function of storing a pair of previously generated encryption key and decryption key.

  The encryption key registration unit 306 has a function of reading the encryption key from the key information storage unit 302 and registering the encryption key in the API gateway device 20 in order to encrypt the data included in the API response addressed to itself. .

  The API request transmission unit 305 has a function of transmitting an API request.

  The API response receiving unit 307 has a function of receiving an API response transmitted from the enabler device 10 via the API gateway device 20.

  The data decryption unit 308 acquires data (= encrypted confidential data) from the API response received by the API response reception unit 307, and decrypts the decryption key corresponding to the encryption key registered in the API gateway device 20. Is read out from the key information storage unit 302, and the encrypted secret data is decrypted with the decryption key.

  The data storage unit 303 has a function of storing the secret data decrypted by the data decryption unit 308.

  FIG. 7 is a diagram showing a functional block configuration provided in the API gateway device 20 according to the present embodiment. The API gateway device 20 according to the present embodiment is configured to further include an API response receiving unit 206 and an API response transmitting unit 207 in addition to the functional units described in the first embodiment.

  The encryption key receiving unit 201 has a function of receiving an encryption key transmitted from an application through registration processing in the application.

  The encryption key storage unit 202 has a function of storing the encryption key received by the encryption key receiving unit 201 in association with the ID of the transmission source application.

  The encryption key transmission unit 203 has a function of transmitting a corresponding encryption key to the enabler device 10 in response to an access from the enabler device 10.

  The API request receiving unit 204 has a function of receiving an API request transmitted from an application.

  The API request transmission unit 205 has a function of transmitting an API request via the corresponding API to the enabler device 10 having the function requested by the API request after the API request reception unit 204 receives the API request.

  The API response receiving unit 206 has a function of receiving an API response transmitted from the enabler device 10.

  The API response transmitting unit 207 has a function of transmitting the API response to the corresponding application after the API response receiving unit 206 receives the API response.

  FIG. 8 is a diagram showing a functional block configuration of the enabler device 10 according to the present embodiment. The enabler device 10 according to the present embodiment includes an encryption key acquisition unit 105, a data storage unit 106, a data encryption unit 107, and an API response transmission unit in addition to the functional units described in the first embodiment. 108.

  The encryption key acquisition unit 105 has a function of acquiring, from the API gateway device 20, an encryption key registered by a transmission destination application that transmits the API response before transmitting the API response.

  The key information storage unit 101 has a function of storing the encryption key acquired by the encryption key acquisition unit 105.

  The API request receiving unit 103 has a function of receiving an API request transmitted from an application via the API gateway device 20.

  The data storage unit 106 has a function of storing data (secret data such as personal information) to be included in the API response.

  The data encryption unit 107 has a function of reading an encryption key from the key information storage unit 302 and encrypting data included in the API response with the encryption key when transmitting the API response including data.

  The API response transmission unit 108 has a function of transmitting an API response including the data encrypted by the data encryption unit 107 to the API gateway device 20.

  Next, a data encryption method performed by the API system according to this embodiment will be described. FIG. 9 is a diagram showing the operation of the data encryption method according to the present embodiment. In the present embodiment, data included in the API response is encrypted.

  First, in step S <b> 201, the application of the application apparatus 30 registers an encryption key for encrypting data included in the API response addressed to the application apparatus 30 in the API gateway apparatus 20.

  Next, in step S <b> 202, the enabler device 10 acquires an encryption key registered by the transmission destination application that transmits the API response from the API gateway device 20 before transmitting the API response. At this time, the API gateway device 20 performs processing for paying out the encryption key corresponding to the ID of the corresponding application to the enabler device 10.

  Next, in step S <b> 203, the application of the application device 30 transmits an API request to the API gateway device 20.

  Next, in step S204, after receiving the API request from the application, the API gateway device 20 transmits the API request to the enabler device 10 having the function requested by the API request via the corresponding API.

  Next, in step S <b> 205, after receiving the API request from the API gateway device 20, the enabler device 10 encrypts data included in the API response with the encryption key acquired from the API gateway device 20.

  Next, in step S206, the enabler device 10 includes the data encrypted with the encryption key in the body part of the API response and transmits the data to the API gateway device 20.

  Next, in step S207, the API gateway device 20 receives the API response from the application, and then transmits the API response to the application that transmitted the API request.

  Finally, in step 208, the application of the application device 30 receives the API response from the API gateway device 20, acquires encrypted data from the API response, and registers the encrypted data registered in the API gateway device 20. The encrypted data is decrypted with a decryption key corresponding to the key.

  That is, according to the present embodiment, the application registers the encryption key for encrypting the data included in the API response addressed to itself in the API gateway device 20, and the API gateway device 20 receives from the enabler device 10. The encryption key registered in itself is transmitted to the enabler device 10 in response to the access, and the enabler device 10 encrypts the data included in the API response with the encryption key received from the API gateway device 20.

  That is, the API gateway device 20 has a function of issuing an encryption key for encrypting data, and the enabler device 10 encrypts the data of the API response with the encryption key issued by the API gateway device 20. It is no longer necessary to manage and distribute the encryption key between the application and the API providing system (here, the enabler device 10 and the API gateway device 20), and the security of the API response data is efficiently secured. can do.

  It is possible to combine the first embodiment and the second embodiment. As a result, the API request and API response data are both encrypted, so that the data security level can be increased.

  In the second embodiment, the method of encrypting the API response data transmitted from the enabler device 10 to the application has been described. On the other hand, as a signal transmitted from the enabler device 10 to the application, there is an API request such as a notification request in addition to the API response. Therefore, in the second embodiment, the API request data transmitted from the enabler device 10 to the application may be encrypted.

  Finally, the enabler device 10, the API gateway device 20, and the application device 30 described in the present embodiment can be realized by a computer (information processing device) including a CPU, a memory, a hard disk, and the like. It is also possible to create a program for causing a computer to function as the enabler device 10, the API gateway device 20, and the application device 30, and a storage medium for the program.

DESCRIPTION OF SYMBOLS 1 ... API system 10 ... Enabler apparatus 101 ... Key information storage part 102 ... Encryption key registration part 103 ... API request reception part 104 ... Data decryption part 105 ... Encryption key acquisition part 106 ... Data storage part 107 ... Data encryption Reference numeral 108 ... API response transmission unit 20 ... API gateway device 201 ... Encryption key reception unit 202 ... Encryption key storage unit 203 ... Encryption key transmission unit 204 ... API request reception unit 205 ... API request transmission unit 206 ... API response reception 207 ... API response transmission unit 30 ... Application device 301 ... Encryption key acquisition unit 302 ... Key information storage unit 303 ... Data storage unit 304 ... Data encryption unit 305 ... API request transmission unit 306 ... Encryption key registration unit 307 ... API response receiver 308: Data decoding unit

Claims (4)

In an API system comprising: an enabler device that provides a function in response to an API request; an API gateway device that provides an API of the enabler device; and an application device that includes an application that transmits the API request.
The enabler device is
A registration unit for registering an encryption key for encrypting data included in an API request addressed to the API request to the API gateway device;
The API gateway device
A transmission unit that transmits the encryption key registered in itself according to access from the application to the application;
The application is
An encryption unit that encrypts data to be included in an API request with the encryption key received from the API gateway device;
An API system characterized by this. In an API system comprising: an enabler device that provides a function in response to an API request; an API gateway device that provides an API of the enabler device; and an application device that includes an application that transmits the API request.
The application is
A registration unit that registers an API response addressed to itself or an encryption key for encrypting data included in the API request in the API gateway device;
The API gateway device
A transmission unit that transmits the encryption key registered to the enabler device in response to access from the enabler device;
The enabler device is
An encryption unit that encrypts data included in an API response or API request with the encryption key received from the API gateway device;
An API system characterized by this. Data encryption performed by an API system including an enabler device that provides a function in response to an API request, an API gateway device that provides an API of the enabler device, and an application device that includes an application that transmits the API request In the method
In the enabler device,
Registering an encryption key for encrypting data to be included in an API request addressed to the API gateway device;
In the API gateway device,
Sending the encryption key registered to itself in response to access from the application to the application;
In the application,
Encrypting data to be included in an API request with the encryption key received from the API gateway device;
A data encryption method for an API system. Data encryption performed by an API system including an enabler device that provides a function in response to an API request, an API gateway device that provides an API of the enabler device, and an application device that includes an application that transmits the API request In the method
In the application,
Registering an API response addressed to itself or an encryption key for encrypting data included in the API request in the API gateway device;
In the API gateway device,
Sending the encryption key registered to itself in response to access from the enabler device to the enabler device;
In the enabler device,
Encrypting data included in an API response or API request with the encryption key received from the API gateway device;
A data encryption method for an API system.

Images