WO2022100155A1 - 接口授权监控方法、装置、计算机设备和存储介质 - Google Patents

接口授权监控方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2022100155A1
WO2022100155A1 PCT/CN2021/109542 CN2021109542W WO2022100155A1 WO 2022100155 A1 WO2022100155 A1 WO 2022100155A1 CN 2021109542 W CN2021109542 W CN 2021109542W WO 2022100155 A1 WO2022100155 A1 WO 2022100155A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
interface
identifier
limit
deduction
Prior art date
Application number
PCT/CN2021/109542
Other languages
English (en)
French (fr)
Inventor
梁党卫
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2022100155A1 publication Critical patent/WO2022100155A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H04L67/025—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP] for remote control or remote monitoring of applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Definitions

  • the present application relates to the technical field of artificial intelligence, and in particular, to an interface authorization monitoring method, apparatus, computer equipment and storage medium.
  • APIs are widely used because they provide applications and developers with the ability to access a set of routines without having to access the source code or understand the details of the inner workings.
  • the application program interface is provided through the interface service open platform.
  • the interface service open platform allows the service provider to register the service to the cloud gateway in the form of an open interface, and after publishing to the interface market, the service can be provided externally.
  • the inventors realized that the conventional technology has a problem that the usage of the interface authorization cannot be monitored.
  • an interface authorization monitoring method, apparatus, computer device and storage medium are provided.
  • An interface authorization monitoring method includes:
  • the interface call request carries the application identifier, the interface identifier and the sender identifier;
  • An interface authorization monitoring device includes:
  • the receiving module is used to receive the interface call request, and the interface call request carries the application program identifier, the interface identifier and the sender identifier;
  • the query module is used to query the preset authorization limit cache according to the interface ID and the sender ID when the authorization relationship verification is passed according to the application program identifier and the interface identifier, and obtain the authorization limit information set;
  • the deduction verification module is used to verify the deduction of the authorized quota according to the set of authorized quota information.
  • the processing module is used to return a prompt for allowing API calls when the authorization limit deduction verification is passed.
  • a computer device comprising a memory and one or more processors, the memory having computer-readable instructions stored therein, the computer-readable instructions, when executed by the processor, cause the one or more processors to execute The following steps:
  • the interface call request carries the application identifier, the interface identifier and the sender identifier;
  • One or more computer-readable storage media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the following steps:
  • the interface call request carries the application identifier, the interface identifier and the sender identifier;
  • the above interface authorization monitoring method, device, computer equipment and storage medium by receiving an interface call request, the interface call request carries the application program identifier, the interface identifier and the sender identifier, when the authorization relationship verification is passed according to the application program identifier and the interface identifier. , query the preset authorization limit cache according to the interface identifier and the sender identifier, obtain the authorization limit information set, and perform the authorization limit deduction verification according to the authorization limit information set. In the whole process, by querying the preset authorization limit cache according to the interface ID and the sender ID, the corresponding authorization limit information set can be obtained, and then the authorization limit deduction verification can be performed by using the authorization limit information set, and the interface can be verified through the authorization limit deduction verification. Monitoring of authorized usage.
  • FIG. 1 is an application scenario diagram of an interface authorization monitoring method according to one or more embodiments
  • FIG. 2 is a schematic flowchart of an interface authorization monitoring method according to one or more embodiments
  • FIG. 3 is a schematic diagram of an interface authorization monitoring method according to one or more embodiments.
  • FIG. 4 is a schematic flowchart of an interface authorization monitoring method in another embodiment
  • FIG. 5 is a block diagram of an interface authorization monitoring apparatus according to one or more embodiments.
  • FIG. 6 is a block diagram of a computer device in accordance with one or more embodiments.
  • the interface authorization monitoring method provided by this application can be applied to the application environment shown in FIG. 1 .
  • the terminal 102 communicates with the server 104 through a network.
  • the terminal 102 sends an interface call request carrying the application program identifier and the interface identifier to the server 104, and the server 104 receives the interface call request.
  • the interface call request carries the application program identifier, the interface identifier and the sender identifier.
  • the authorization relationship verification is passed according to the application ID and the interface ID
  • the preset authorization limit cache is queried according to the interface ID and the sender ID to obtain the authorization limit information set, and the authorization limit deduction verification is performed according to the authorization limit information set.
  • the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers.
  • the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices, and the server 104 can be an independent server, or can provide cloud services, cloud databases, cloud computing, cloud Cloud servers for basic cloud computing services such as functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • cloud databases cloud computing
  • cloud Cloud servers for basic cloud computing services such as functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • CDN Content Delivery Network
  • an interface authorization monitoring method is provided, and the method is applied to the server in FIG. 1 as an example to illustrate, including the following steps:
  • Step 202 Receive an interface invocation request, where the interface invocation request carries the application identifier, the interface identifier, and the sender identifier.
  • the application identifier refers to an identifier of an application that has been created by the user.
  • the interface identifier refers to the identifier of the interface of the service that the user wants to obtain.
  • An interface invocation request refers to a request that a user wants to invoke an interface service.
  • the sender identifier refers to the identifier of the user who sends the API call request, and is used to distinguish the user. For example, the sender identifier may specifically refer to a token for distinguishing users, which is issued by the server in advance.
  • the terminal when a user wants to invoke an interface service through an application, the terminal sends an interface invocation request carrying the application identifier and the interface identifier to the server, and the server receives the interface invocation request carrying the application identifier and the interface identifier.
  • Step 204 when the authorization relationship verification is passed according to the application program identifier and the interface identifier, query the preset authorization limit cache according to the interface identifier and the sender identifier, and obtain the authorization limit information set.
  • the authorization limit refers to the available times of invocation of the authorization interface, which is determined according to the subscription parameters selected by the user when subscribing to the interface.
  • the preset authorization limit cache is used to store the interface authorization record, and the interface authorization record is used to record the authorization situation, including the authorization limit and the authorized service provider (here, the authorized service provider refers to the user).
  • the authorization quota information set refers to the collection of authorization quotas. Each time a user subscribes to an interface, an interface authorization record is generated, and the interface authorization record includes the authorization quota.
  • the authorization relationship when the authorization relationship is verified according to the application ID and the interface ID, it means that there is an authorization relationship between the application and the interface, and the call can be made.
  • the server will query the preset authorization amount according to the interface ID and the sender ID. Cache, obtain the authorization limit information set from the preset authorization limit cache, and further verify whether the interface call can be authorized through the authorization limit information set.
  • Step 206 Perform authorization limit deduction verification according to the authorization limit information set.
  • the server will perform authorization limit deduction verification according to each authorization limit in the authorization limit information set. Further, each authorization limit in the authorization limit information set has a priority, and the priority is determined according to the time limit of the authorization limit.
  • the authorization limit deduction verification is to verify whether there is an available authorization limit that can be deducted. Only when there is an available authorization limit that can be deducted, the server can determine that the interface call can be authorized.
  • step 208 when the authorization limit deduction verification is passed, a prompt for allowing the interface invocation is returned.
  • the authorization limit deduction verification when the authorization limit deduction verification is passed, it means that the interface call can be authorized at this time, and the server will return a prompt for allowing the interface call.
  • the interface call request carries an application identifier, an interface identifier and a sender identifier.
  • Query the preset authorization limit cache obtain the authorization limit information set, and perform authorization limit deduction verification according to the authorization limit information set.
  • the authorization limit deduction verification can be performed by using the authorization limit information set, and the interface can be realized through the authorization limit deduction verification. Monitoring of authorized usage.
  • the interface authorization monitoring method further includes:
  • the interface authorization record is generated according to the interface identifier and the authorization amount, and the interface authorization record is stored in the preset authorization amount cache.
  • the subscription parameter is used to represent the subscription method selected by the user, including the subscription time limit and the subscription authorization amount, and the subscription time limit refers to the subscription validity period.
  • the subscription period may be one year.
  • the subscription period may be six months.
  • An interface subscription request refers to a user's request to subscribe to an interface. When a user needs to subscribe to an interface, he or she will access the interface service open platform through a terminal, search and select an interface on the interface service open platform to subscribe to the interface. For example, the user will find the interface to be used through the display module corresponding to the server, choose to accept the authorization service, and complete the action of subscribing to the interface.
  • Subscription permission verification refers to verifying whether the user can subscribe, specifically, verifying whether the user has paid the subscription service fee.
  • the interface authorization record is used to record the interface subscription situation, which corresponds to the interface subscription request one by one.
  • the server first verifies the subscription permission of the interface subscription request to verify whether the user has the subscription permission.
  • the subscription authorization limit of the user interface determines the authorization limit, determines the authorization time limit according to the subscription time limit in the subscription parameters, generates the interface authorization record corresponding to the interface subscription request according to the interface ID, authorization limit and authorization time limit, records the user's interface subscription status, and records the interface authorization record. Store in the preset authorization limit cache.
  • the server includes a display module and an authorization management module.
  • the user wants to subscribe to an interface, he will search the interface to be used in the display module, choose to receive the authorization service, and complete the action of subscribing the interface.
  • the display module After subscribing to the interface, the display module will The subscription message will be broadcast to the authorization management module.
  • the authorization management module After receiving the subscription message, the authorization management module will generate an interface authorization record according to the subscription parameters in the subscription message, and store the interface authorization record in the preset authorization quota cache.
  • the interface authorization record takes the LICENSE_ID as the key, and is serialized and stored in the authorization quota cache.
  • Each interface authorization record has a unique identifier LICENSE_ID, which is subsequently used for binding with the application.
  • the subscription authority is verified according to the interface subscription request.
  • the authorization limit is determined according to the subscription parameters
  • the interface authorization record is generated according to the interface identifier and the authorization amount
  • the interface authorization record is stored in the preset authorization.
  • the quota cache can realize the acquisition and storage of the interface authorization record, so that the authorization quota can be deducted and verified according to the interface authorization record.
  • the interface authorization monitoring method further includes:
  • the application program-interface authorization relationship is generated according to the application program identifier and the interface identifier, and the application program-interface authorization relationship is stored in the preset authorization relationship cache.
  • the interface binding request refers to a request for binding an application program and an interface.
  • the preset authorization relationship cache is used to store the authorization relationship between each application program and each interface.
  • the server authenticates the sender of the interface binding request, and verifies whether the sender of the binding request can bind the application and the interface.
  • the server will generate the application-interface authorization relationship according to the application ID and the interface ID, so as to realize the binding of the application and the interface, and store the application-interface authorization relationship in the preset authorization relationship. in cache.
  • the authentication of the sender of the interface binding request refers to determining whether the sender of the binding request has subscribed to the interface corresponding to the interface identifier by querying the preset authorization limit cache, that is, verifying whether the sender of the interface binding request has Complete the authorized subscription.
  • the user can bind the subscribed interface authorization to the created application, and the authorization management module in the server generates the APP_API authorization relationship according to the binding relationship, and inserts the data into the pre-defined application.
  • the authorization management module in the server sets the APP_API authorization table, and use the APP_ID and API_ID as the keys, and store the LICENSE_ID in the redis cache (that is, the preset authorization relationship cache) in the form of a list.
  • the authorization management module in the server will mark the binding relationship as deleted (soft delete) according to the cancellation relationship selected by the user, and clear the cache.
  • the sender of the interface binding request is authenticated by receiving the interface binding request carrying the application identifier and the interface identifier, and when the authentication is passed, the application is generated according to the application identifier and the interface identifier.
  • -Interface authorization relationship storing the application program-interface authorization relationship in the preset authorization relationship cache can realize the acquisition and storage of the application program-interface authorization relationship, so that the authorization relationship can be verified according to the application program-interface authorization relationship.
  • the interface authorization monitoring method after receiving the interface invocation request, the interface authorization monitoring method further includes:
  • the target application-interface authorization relationship is an authorization relationship between an application program identifier and an interface identifier.
  • the preset authorization relationship cache is used to store the authorization relationship between each application program and each interface.
  • the server will query the preset authorization relationship cache according to the application program identifier and the interface identifier, and check whether the application program and the interface have an authorization relationship.
  • the target application program-interface authorization relationship exists in the preset authorization relationship cache, it means An authorization relationship exists between the application program and the interface.
  • the target application program-interface authorization relationship does not exist in the preset authorization relationship cache, it means that there is no authorization relationship between the application program and the interface.
  • the preset authorization relationship cache by querying the preset authorization relationship cache according to the application program identifier and the interface identifier, when there is a target application-interface authorization relationship in the preset authorization relationship cache, it is determined that the authorization relationship verification is passed, and the application program identifier and interface identification to achieve authorization relationship verification.
  • performing authorization limit deduction verification according to the authorization limit information set includes:
  • the authorization limit deduction is attempted in sequence according to the authorization limit deduction priority.
  • the time stamp carried by each authorization limit refers to the time limit corresponding to each authorization limit, that is, the authorization period of each authorization limit, and the deduction priority of the authorization limit with a shorter time limit is higher.
  • the authorization limit deduction priority refers to the priority of each authorization limit when it is deducted, which can be determined according to the time limit of each authorization limit.
  • the server sorts the authorization quotas according to the timestamps carried by the authorization quotas in the authorization quota information set, sorts the authorization quotas according to the distance between the timestamps and the current date, and ranks the timestamps closer to the current date in the front. Determine the authorization limit deduction priority, try the authorization limit deduction in sequence according to the authorization limit deduction priority, and verify the authorization limit deduction.
  • the authorization limit deduction priority is determined according to the timestamp carried by each authorization limit in the authorization limit information set, and the authorization limit deduction is attempted in turn according to the authorization limit deduction priority, so that the authorization limit deduction verification can be realized.
  • successively trying to deduct the authorization limit according to the authorization limit deduction priority includes:
  • the next priority authorization amount corresponding to the authorization amount to be deducted is determined according to the deduction priority of the authorization amount, the latest authorization amount to be deducted is obtained, and the ratio to be deducted is returned.
  • the steps of the authorization limit and the preset limit threshold are until the authorization limit deduction verification is passed or all the authorization limits in the authorization limit information set have been compared.
  • the interface authorization monitoring method before performing the authorization limit deduction verification according to the authorization limit information set, the interface authorization monitoring method further includes:
  • performing authorization limit deduction verification according to the authorization limit information set includes:
  • the REDIS command determines the priority of deduction of the authorization limit according to the timestamp carried by each authorization limit in the authorization limit information set, and tries to deduct the authorization limit in turn according to the priority of the authorization limit deduction.
  • the authorization limit to be deducted refers to the authorization limit with the highest priority in the deduction priority of the authorization limit.
  • the quota threshold refers to a preset threshold used to detect whether the quota deduction can be performed. For example, the quota threshold may be 0 specifically.
  • the server determines the authorization amount to be deducted according to the deduction priority of the authorization amount, and compares the authorization amount to be deducted with the preset amount threshold. If the quota is deducted, the server will determine that the authorized quota deduction verification is passed. When the authorization amount to be deducted is less than the preset amount threshold, it means that the deduction cannot be performed according to the authorization amount to be deducted at this time, and the server will determine the next priority corresponding to the authorization amount to be deducted according to the deduction priority of the authorization amount.
  • the priority of each authorization limit in the authorization limit information set may be determined according to the time when the interface authorization record corresponding to each authorization limit is stored in the preset authorization limit cache.
  • the server performs authorization limit deduction verification according to the authorization limit information set, it will determine the priority of each authorization limit in the authorization limit information set in the order of first-in, first-out, and try to deduct the authorization limit in turn. If the deduction is successful, the local Called, otherwise, try to deduct the authorization limit of the authorization limit of the next priority, and reject the request if all attempts fail.
  • this embodiment will execute the following REDIS commands and operations in sequence during the deduction process: 1> GET LICENSE_ID; 2> determine whether the authorization limit is greater than zero ; 3>SET LICENSE_ID. Because multiple REDIS commands cannot ensure atomicity, when multiple interface call requests execute 1>2> at the same time, all the deductions are allowed, but if the authorized limit reaches 1, over-deduction will occur; to avoid Overloading, in this embodiment, the LUA script is used to encapsulate the 1>2>3> operation into a REDIS command to ensure the atomicity of the operation, thereby avoiding authorization overtaking.
  • the authorization amount deduction verification can be realized according to the comparison result.
  • the interface authorization monitoring method further includes:
  • a new interface authorization record is generated according to the latest authorization quota and the interface identifier, and the new interface authorization record is updated to the preset authorization quota cache.
  • the server will count the number of deductions of the authorization limit, update the authorization limit according to the number of deductions of the authorization limit, obtain the latest authorization limit, and then generate a new interface authorization record according to the latest authorization limit and the interface ID, and authorize the new interface
  • the record is updated to the preset authorization limit cache to realize the update of the authorization limit.
  • the method of updating the authorization limit according to the number of deductions of the authorization limit may be: calculating the difference between the current authorization limit and the number of deductions of the authorization limit, and using the difference as the new authorization limit.
  • the calculation of the authorization limit includes real-time calculation and batch calculation.
  • real-time calculation is mainly involved, and the real-time calculation is mainly when the user subscribes to the authorization, binds the authorization and unbinds it, and summarizes the used limit and the remaining amount of each authorization in real time. quota, and update the authorization cache.
  • the server will also run batches for quota settlement every day, merge the authorization usage into the preset authorization database, generate daily settlement records, and update the preset authorization quota cache and preset authorization according to the timeliness
  • the relationship cache the data for the day of authorized usage can be directly obtained through the preset authorization relationship cache and the preset authorization limit cache.
  • T-1 day T refers to the current day
  • the number of deductions of the authorization limit is counted, the authorization limit is updated according to the number of deductions of the authorization limit, a new interface authorization record is generated according to the latest authorization limit and the interface identifier, and the new interface authorization record is updated to the preset authorization Quota cache, which can update the authorized quota.
  • a schematic diagram is used to illustrate the interface authorization monitoring method of the present application, wherein, as shown in Figure 3, the API authorization service refers to the server, and the API authorization service includes an authorization manager, an authorization checker, and an authorization cache. And the four modules of authorization limit calculation, the authorization cache is connected with the authorization database, and the authorization database can be an internal database of the server, or an external database.
  • the authorization database includes an APP table, an APP-API authorization table (that is, a preset authorization relationship cache), an API authorization table (that is, a preset authorization amount cache), and an API table.
  • the terminal When a user wants to subscribe to an interface service, the terminal will send an interface subscription request carrying the interface identifier and subscription parameters to the server. After the server receives the interface subscription request carrying the interface identifier and subscription parameters, it will pass the authorization manager according to the interface subscription request. Subscription authority verification. When the subscription authority verification is passed, the authorization limit is determined according to the subscription parameters, the interface authorization record is generated according to the interface identifier and the authorization limit, and the interface authorization record is stored in the preset authorization limit cache.
  • the terminal When a user wants to bind an application program and an interface, the terminal will send an interface binding request carrying the application program identifier and the interface identifier to the server. After the server receives the interface binding request carrying the application program identifier and the interface identifier, it will pass The authorization manager authenticates the sender of the interface binding request. When the authentication is passed, it generates an application-interface authorization relationship according to the application ID and the interface ID, and stores the application-interface authorization relationship in the preset authorization relationship cache.
  • the terminal When the user wants to call the interface (request API) for the application (APP1, APP2), the terminal will use the API gateway to send the interface call request to the server, and the interface call request carries the application identifier, the interface identifier and the sender identifier.
  • the server After the server receives the interface call request, it will query the preset authorization relationship cache through the authorization checker according to the application ID and the interface ID. When the target application-interface authorization relationship exists in the preset authorization relationship cache, it is determined that the authorization relationship verification is passed.
  • the authorization relationship verification when the authorization relationship verification is passed according to the application program identifier and the interface identifier, query the preset authorization limit cache according to the interface identifier and the sender identifier, and obtain the authorization limit information set, according to the time stamp carried by each authorization limit in the authorization limit information set. , determine the deduction priority of the authorization limit, determine the authorization limit to be deducted according to the priority of the authorization limit deduction, compare the authorization limit to be deducted and the preset limit threshold, and determine when the authorization limit to be deducted is greater than the preset limit threshold.
  • the authorization limit deduction verification is passed.
  • the authorization limit of the next priority corresponding to the authorization limit to be deducted is determined according to the deduction priority of the authorization limit, and the latest authorization to be deducted is obtained. Quota, return to the step of comparing the authorization quota to be deducted and the preset quota threshold, until the authorization quota deduction verification is passed or all the authorization quotas in the authorization quota information set have been compared, when the authorization quota deduction verification is passed, return to allow Interface call prompt.
  • the server After returning to the allowable interface call prompt, the server will calculate and count the number of deductions from the authorized quota based on the authorized quota, update the authorized quota according to the number of deductions from the authorized quota, and generate a new interface authorization record based on the latest authorized quota and the interface ID, and add the new interface to the new interface.
  • the authorization record is updated to the preset authorization limit cache.
  • FIG. 4 an embodiment is used to illustrate the interface authorization monitoring method of the present application, and the method includes the following steps:
  • Step 402 receiving an interface subscription request carrying an interface identifier and subscription parameters
  • Step 404 performing subscription permission verification according to the interface subscription request
  • Step 406 when the subscription authority verification is passed, determine the authorization limit according to the subscription parameters
  • Step 408 generating an interface authorization record according to the interface identifier and the authorization limit, and storing the interface authorization record in the preset authorization limit cache;
  • Step 410 receiving an interface binding request carrying an application identifier and an interface identifier
  • Step 412 authenticate the sender of the interface binding request
  • Step 414 when the identity verification is passed, generate an application-interface authorization relationship according to the application identifier and the interface identifier, and store the application-interface authorization relationship in the preset authorization relationship cache;
  • Step 416 receiving an interface call request, where the interface call request carries the application identifier, the interface identifier and the sender identifier;
  • Step 418 query the preset authorization relationship cache according to the application identifier and the interface identifier;
  • Step 420 when a target application-interface authorization relationship exists in the preset authorization relationship cache, determine that the authorization relationship verification is passed;
  • Step 422 when the authorization relationship verification is passed according to the application program identifier and the interface identifier, query the preset authorization limit cache according to the interface identifier and the sender identifier, and obtain the authorization limit information set;
  • Step 424 Determine the deduction priority of the authorization limit according to the timestamp carried by each authorization limit in the authorization limit information set;
  • Step 426 Determine the authorization amount to be deducted according to the authorization amount deduction priority
  • Step 428 compare the authorization amount to be deducted and the preset amount threshold, when the authorization amount to be deducted is greater than the preset amount threshold, jump to step 430, and when the authorization amount to be deducted is less than the preset amount threshold, jump to Step 432;
  • Step 430 determine that the authorization limit deduction verification is passed, and jump to step 434;
  • Step 432 Determine the next priority authorization amount corresponding to the authorization amount to be deducted according to the deduction priority of the authorization amount, obtain the latest authorization amount to be deducted, and return to the step of comparing the authorization amount to be deducted and the preset amount threshold, Until the authorization limit deduction verification is passed or each authorization limit in the authorization limit information set has been compared;
  • Step 434 when the authorization limit deduction verification is passed, a prompt for allowing the interface to be invoked is returned,
  • Step 436 count the number of deductions of the authorization limit
  • Step 438 update the authorized quota according to the number of deductions from the authorized quota.
  • step 440 a new interface authorization record is generated according to the latest authorization limit and the interface identifier, and the new interface authorization record is updated to the preset authorization limit cache.
  • AI Artificial Intelligence
  • digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • the basic technologies of artificial intelligence generally include technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation/interaction systems, and mechatronics.
  • Artificial intelligence software technology mainly includes computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning/deep learning.
  • steps in the flowcharts of FIG. 2 and FIG. 4 are shown in sequence according to the arrows, these steps are not necessarily executed in the sequence indicated by the arrows. Unless explicitly stated herein, the execution of these steps is not strictly limited to the order, and the steps may be executed in other orders. Moreover, at least a part of the steps in FIG. 2 and FIG. 4 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed and completed at the same time, but may be executed at different times. These sub-steps or The order of execution of the stages is also not necessarily sequential, but may be performed alternately or alternately with other steps or sub-steps of other steps or at least a portion of a stage.
  • an interface authorization monitoring device including: a receiving module 502, a query module 504, a deduction verification module 506 and a processing module 508, wherein:
  • a receiving module 502 configured to receive an interface calling request, where the interface calling request carries an application identifier, an interface identifier and a sender identifier;
  • the query module 504 is configured to query the preset authorization limit cache according to the interface identifier and the sender identifier when the authorization relationship verification is passed according to the application program identifier and the interface identifier, and obtain an authorization limit information set;
  • a deduction verification module 506 for performing authorization limit deduction verification according to the authorization limit information set
  • the processing module 508 is configured to return a prompt for allowing interface invocation when the authorization limit deduction verification is passed.
  • the above-mentioned interface authorization monitoring device receives an interface calling request, and the interface calling request carries an application identifier, an interface identifier and a sender identifier.
  • Query the preset authorization limit cache obtain the authorization limit information set, and perform authorization limit deduction verification according to the authorization limit information set.
  • the authorization limit deduction verification can be performed by using the authorization limit information set, and the interface can be verified through the authorization limit deduction verification. Monitoring of authorized usage.
  • the interface authorization monitoring device further includes an interface subscription module, and the interface subscription module is configured to receive an interface subscription request carrying an interface identifier and subscription parameters, and perform subscription authority verification according to the interface subscription request.
  • the authorization limit is determined according to the subscription parameters
  • the interface authorization record is generated according to the interface identifier and the authorization limit
  • the interface authorization record is stored in the preset authorization limit cache.
  • the interface authorization monitoring device further includes a binding module, and the binding module is configured to receive an interface binding request carrying an application identifier and an interface identifier, and authenticate the sender of the interface binding request.
  • the application program-interface authorization relationship is generated according to the application program identifier and the interface identifier, and the application program-interface authorization relationship is stored in the preset authorization relationship cache.
  • the interface authorization monitoring device has an authorization relationship verification module, and the authorization relationship verification module is configured to query the preset authorization relationship cache according to the application identifier and the interface identifier. When there is a target application-interface authorization in the preset authorization relationship cache When the relationship is established, it is determined that the authorization relationship verification is passed, and the target application program-interface authorization relationship is the authorization relationship between the application program identifier and the interface identifier.
  • the deduction verification module is further configured to determine the authorization limit deduction priority according to the timestamp carried by each authorization limit in the authorization limit information set, and try the authorization limit deduction in turn according to the authorization limit deduction priority .
  • the deduction verification module is further configured to determine the authorization amount to be deducted according to the deduction priority of the authorization amount, and compare the authorization amount to be deducted with the preset amount threshold. When the authorization amount to be deducted is greater than the predetermined amount When the quota threshold is set, it is determined that the authorization quota deduction verification has passed, and when the authorization quota to be deducted is less than the preset quota threshold, the authorization quota of the next priority corresponding to the authorization quota to be deducted is determined according to the deduction priority of the authorized quota, and the obtained For the latest authorization limit to be deducted, return to the step of comparing the authorization limit to be deducted with the preset limit threshold, until the authorization limit deduction verification is passed or the authorization limit in the authorization limit information set has been compared.
  • the deduction verification module is further configured to encapsulate the step of performing authorization limit deduction verification according to the authorization limit information set into a REDIS command.
  • the deduction verification module is further configured to execute the REDIS command, and the REDIS command implements determining the priority of deduction of the authorization limit according to the timestamp carried by each authorization limit in the authorization limit information set, and the priority of deduction according to the authorization limit Each level tries to deduct the authorized limit in turn.
  • the interface authorization monitoring device further includes a quota update module, and the quota update module is configured to count the number of deductions of the authorized quota, update the authorized quota according to the number of deductions of the authorized quota, and generate a new quota according to the latest authorized quota and the interface identifier.
  • Interface authorization record update the new interface authorization record to the preset authorization limit cache.
  • Each module in the above-mentioned interface authorization monitoring device may be implemented in whole or in part by software, hardware and combinations thereof.
  • the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
  • a computer device is provided, and the computer device may be a server, and its internal structure diagram may be as shown in FIG. 6 .
  • the computer device includes a processor, memory, a network interface, and a database connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes non-volatile or volatile storage media, internal memory.
  • the non-volatile or volatile storage medium stores an operating system, computer readable instructions and a database.
  • the internal memory provides an environment for the execution of the operating system and computer-readable instructions in the non-volatile storage medium.
  • the database of the computer device is used to store application program-interface authorization relationship data and interface authorization records.
  • the network interface of the computer device is used to communicate with an external terminal through a network connection.
  • the computer readable instructions when executed by a processor, implement a method for monitoring interface authorization.
  • FIG. 6 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer equipment to which the solution of the present application is applied. Include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.
  • a computer device includes a memory and one or more processors, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, causes the one or more processors to perform the following steps:
  • the interface call request carries the application identifier, the interface identifier and the sender identifier;
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the interface authorization record is generated according to the interface identifier and the authorization amount, and the interface authorization record is stored in the preset authorization amount cache.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the application program-interface authorization relationship is generated according to the application program identifier and the interface identifier, and the application program-interface authorization relationship is stored in the preset authorization relationship cache.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the target application-interface authorization relationship is an authorization relationship between an application program identifier and an interface identifier.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the authorization limit deduction is attempted in sequence according to the authorization limit deduction priority.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the next priority authorization amount corresponding to the authorization amount to be deducted is determined according to the deduction priority of the authorization amount, the latest authorization amount to be deducted is obtained, and the ratio to be deducted is returned.
  • the steps of the authorization limit and the preset limit threshold are until the authorization limit deduction verification is passed or all the authorization limits in the authorization limit information set have been compared.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the processor further implements the following steps when executing the computer-readable instructions:
  • the REDIS command determines the priority of deduction of the authorization limit according to the timestamp carried by each authorization limit in the authorization limit information set, and tries to deduct the authorization limit in turn according to the priority of the authorization limit deduction.
  • the processor further implements the following steps when executing the computer-readable instructions:
  • a new interface authorization record is generated according to the latest authorization quota and the interface identifier, and the new interface authorization record is updated to the preset authorization quota cache.
  • One or more computer-readable storage media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the following steps:
  • the interface call request carries the application identifier, the interface identifier, and the sender identifier;
  • the computer-readable storage medium may be non-volatile or volatile.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the interface authorization record is generated according to the interface identifier and the authorization amount, and the interface authorization record is stored in the preset authorization amount cache.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the application program-interface authorization relationship is generated according to the application program identifier and the interface identifier, and the application program-interface authorization relationship is stored in the preset authorization relationship cache.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the target application-interface authorization relationship is an authorization relationship between an application program identifier and an interface identifier.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the authorization limit deduction is attempted in sequence according to the authorization limit deduction priority.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the next priority authorization amount corresponding to the authorization amount to be deducted is determined according to the deduction priority of the authorization amount, the latest authorization amount to be deducted is obtained, and the ratio to be deducted is returned.
  • the steps of the authorization limit and the preset limit threshold are until the authorization limit deduction verification is passed or all the authorization limits in the authorization limit information set have been compared.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • the REDIS command determines the priority of deduction of the authorization limit according to the timestamp carried by each authorization limit in the authorization limit information set, and tries to deduct the authorization limit in turn according to the priority of the authorization limit deduction.
  • the computer-readable instructions when executed by the processor, further implement the following steps:
  • a new interface authorization record is generated according to the latest authorization quota and the interface identifier, and the new interface authorization record is updated to the preset authorization quota cache.
  • Nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM is available in various forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Road (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous chain Road (Synchlink) DRAM
  • SLDRAM synchronous chain Road (Synchlink) DRAM
  • Rambus direct RAM
  • DRAM direct memory bus dynamic RAM
  • RDRAM memory bus dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)

Abstract

本申请为一种接口授权监控方法、装置、计算机设备和存储介质，涉及人工智能技术领域，包括：接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；根据授权额度信息集合进行授权额度扣减验证；当授权额度扣减验证通过时，返回允许接口调用提示。

Description

接口授权监控方法、装置、计算机设备和存储介质
相关申请的交叉引用
本申请要求于2020年11月12日提交中国专利局，申请号为202011257441.1，申请名称为“接口授权监控方法、装置、计算机设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能技术领域，特别是涉及一种接口授权监控方法、装置、计算机设备和存储介质。
背景技术
随着计算机技术的发展，出现了应用程序接口。应用程序接口可提供应用程序与开发人员以访问一组例程的能力，而又无需访问源码，或理解内部工作机制的细节，因此得到了广泛应用。传统技术中，是通过接口服务开放平台提供应用程序接口的，接口服务开放平台允许服务方将服务以开放接口的方式注册到云网关，发布到接口市场后，即可对外提供服务。
然而，发明人意识到，传统技术存在无法监控接口授权的使用情况的问题。
发明内容
根据本申请公开的各种实施例，提供一种接口授权监控方法、装置、计算机设备和存储介质。
一种接口授权监控方法包括：
接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
根据授权额度信息集合进行授权额度扣减验证；及
当授权额度扣减验证通过时，返回允许接口调用提示。
一种接口授权监控装置包括：
接收模块，用于接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
查询模块，用于当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
扣减验证模块，用于根据授权额度信息集合进行授权额度扣减验证；及
处理模块，用于当授权额度扣减验证通过时，返回允许接口调用提示。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述一个或多个处理器执行以下步骤：
接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
根据授权额度信息集合进行授权额度扣减验证；及
当授权额度扣减验证通过时，返回允许接口调用提示。
一个或多个存储有计算机可读指令的计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：
接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
根据授权额度信息集合进行授权额度扣减验证；及
当授权额度扣减验证通过时，返回允许接口调用提示。
上述接口授权监控方法、装置、计算机设备和存储介质，通过接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合，根据授权额度信息集合进行授权额度扣减验证，当授权额度扣减验证通过时，返回允许接口调用提示。整个过程，通过根据接口标识以及发送方标识查询预设授权额度缓存，能够得到对应的授权额度信息集合，进而利用授权额度信息集合进行授权额度扣减验证，能够通过授权额度扣减验证实现对接口授权的使用情况的监控。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中接口授权监控方法的应用场景图；
图2为根据一个或多个实施例中接口授权监控方法的流程示意图；
图3为根据一个或多个实施例中接口授权监控方法的示意图；
图4为另一个实施例中接口授权监控方法的流程示意图；
图5为根据一个或多个实施例中接口授权监控装置的框图；
图6为根据一个或多个实施例中计算机设备的框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的接口授权监控方法，可以应用于如图1所示的应用环境中。终端102与服务器104通过网络进行通信。当用户需要进行接口调用时，通过终端102发送携带应用程序标识和接口标识的接口调用请求至服务器104，服务器104接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合，根据授权额度信息集合进行授权额度扣减验证，当授权额度扣减验证通过时，返回允许接口调用提示。其中，终端102可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器104可以用独立的服务器或者是多个服务器组成的服务器集群来实现。其中，终端102可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器104可以是独立的服务器，也可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。
在其中一个实施例中，如图2所示，提供了一种接口授权监控方法，以该方法应用于图1中的服务器为例进行说明，包括以下步骤：
步骤202，接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识。
其中，应用程序标识是指用户已创建的应用程序的标识。接口标识是指用户想要获取的服务的接口的标识。接口调用请求是指用户想要调用接口服务的请求。发送方标识是指发送接口调用请求的用户的标识，用于对用户进行区分。比如，发送方标识具体可以是指区分用户的令牌，由服务器事先下发。
具体的，当用户想要通过应用程序调用接口服务时，会通过终端发送携带应用程序标识和接口标识的接口调用请求至服务器，服务器会接收到携带应用程序标识和接口标识的接口调用请求。
步骤204，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合。
其中，授权额度是指授权接口调用的可用次数，根据用户在进行接口订阅时选择的订阅参数确定。预设授权额度缓存用于存储接口授权记录，接口授权记录用于记录授权情况，包括授权额度以及授权服务方，(此处授权服务方即是指用户)。授权额度信息集合是 指授权额度的集合，每次用户进行接口订阅的时候都会生成一条接口授权记录，接口授权记录中包括授权额度。
具体的，当根据应用程序标识和接口标识进行授权关系校验通过时，表示应用程序与接口之间是存在授权关系的，可以进行调用，服务器会根据接口标识以及发送方标识查询预设授权额度缓存，从预设授权额度缓存中获取授权额度信息集合，通过授权额度信息集合来进一步验证是否可以授权接口调用。
步骤206，根据授权额度信息集合进行授权额度扣减验证。
具体的，服务器会根据授权额度信息集合中各授权额度来进行授权额度扣减验证。进一步的，授权额度信息集合中各授权额度是有优先级的，优先级是根据授权额度的时效确定的，时效在前的授权额度的优先级高，需要被优先进行授权额度扣减。进行授权额度扣减验证即验证是否有可用的授权额度可以扣减，只有当有可用的授权额度可以扣减时，服务器才能确定可以授权接口调用。
步骤208，当授权额度扣减验证通过时，返回允许接口调用提示。
具体的，当授权额度扣减验证通过时，表示此时可以授权接口调用，服务器会返回允许接口调用提示。
上述接口授权监控方法，通过接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合，根据授权额度信息集合进行授权额度扣减验证，当授权额度扣减验证通过时，返回允许接口调用提示。整个过程，通过根据接口标识以及发送方标识查询预设授权额度缓存，能够得到对应的授权额度信息集合，进而利用授权额度信息集合进行授权额度扣减验证，能够通过授权额度扣减验证实现对接口授权的使用情况的监控。
在其中一个实施例中，接口授权监控方法还包括：
接收携带接口标识以及订阅参数的接口订阅请求；
根据接口订阅请求进行订阅权限验证；
当订阅权限验证通过时，根据订阅参数确定授权额度；及
根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存。
其中，订阅参数用于表征用户选择的订阅方式，包括订阅时效和订阅授权额度，订阅时效是指订阅有效期。比如，订阅时效具体可以是一年。又比如，订阅时效具体可以是六个月。接口订阅请求是指用户进行接口订阅的请求，当用户需要进行接口订阅时，会通过终端访问接口服务开放平台，在接口服务开放平台搜索并选择接口进行接口订阅。举例说明，用户会通过服务器对应的显示模块查找需要使用的接口，选择接受授权服务，完成订阅接口的动作。订阅权限验证是指验证用户是否可以订阅，具体的可以是对用户是否已支付订阅服务费用等进行验证。接口授权记录用于记录接口订阅情况，与接口订阅请求一一 对应。
具体的，在接收到携带接口标识以及订阅参数的接口订阅请求后，服务器首先会对接口订阅请求进行订阅权限验证，验证用户是否有订阅权限，当订阅权限验证通过时，服务器会根据订阅参数中的订阅授权额度确定授权额度，根据订阅参数中的订阅时效确定授权时效，根据接口标识、授权额度以及授权时效生成与接口订阅请求对应的接口授权记录，记录用户的接口订阅情况，将接口授权记录存储至预设授权额度缓存。
举例说明，服务器包括显示模块和授权管理模块，当用户想要进行接口订阅时，会在显示模块查找需要使用的接口，选择接收授权服务，完成订阅接口的动作，当订阅了接口之后，显示模块会广播订阅消息至授权管理模块，授权管理模块在接收到订阅消息之后，会根据订阅消息中的订阅参数生成接口授权记录，并将接口授权记录存储至预设授权额度缓存。其中，接口授权记录以LICENSE_ID为KEY，进行序列化后存储到授权额度缓存中，每条接口授权记录具有唯一的标识LICENSE_ID，后续用于和应用程序进行绑定。
在本实施例中，通过根据接口订阅请求进行订阅权限验证，当订阅权限验证通过时，根据订阅参数确定授权额度，根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存，能够实现对接口授权记录的获取和存储，从而可以根据接口授权记录进行授权额度扣减验证。
在其中一个实施例中，在将接口授权记录存储至预设授权额度缓存之后，接口授权监控方法还包括：
接收携带应用程序标识以及接口标识的接口绑定请求；
对接口绑定请求的发送方进行身份验证；及
当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
其中，接口绑定请求是指对应用程序和接口进行绑定的请求。预设授权关系缓存用于存储各应用程序与各接口之间的授权关系。
具体的，在接收到携带应用程序标识以及接口标识的接口绑定请求之后，服务器会对接口绑定请求的发送方进行身份验证，验证绑定请求的发送方是否可以对应用程序和接口进行绑定，当身份验证通过时，服务器会根据应用程序标识以及接口标识，生成应用程序-接口授权关系，以实现应用程序和接口的绑定，并将应用程序-接口授权关系存储至预设授权关系缓存中。其中，对接口绑定请求的发送方进行身份验证是指通过查询预设授权额度缓存，确定绑定请求的发送方是否已订阅接口标识对应的接口，即验证接口绑定请求的发送方是否已完成授权订阅。
举例说明，当用户已完成授权订阅后，用户可以将订阅的接口授权和已创建的应用程序进行绑定，服务器中的授权管理模块根据绑定关系，生成APP_API授权关系，并将数据插入到预设APP_API授权表中，并以APP_ID和API_ID作为KEY，以列表的形式将LICENSE_ID存储到redis缓存(即预设授权关系缓存)中，这样就是完成了授权过程， 用户也可以将绑定关系解除，服务器中的授权管理模块根据用户选择的解除关系，会将绑定关系标记为删除(软删除)，并将缓存清除。
在本实施例中，通过接收携带应用程序标识以及接口标识的接口绑定请求，对接口绑定请求的发送方进行身份验证，当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存，能够实现对应用程序-接口授权关系的获取和存储，从而可以根据应用程序-接口授权关系实现对授权关系的验证。
在其中一个实施例中，在接收接口调用请求之后，接口授权监控方法还包括：
根据应用程序标识和接口标识查询预设授权关系缓存；及
当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，目标应用程序-接口授权关系为应用程序标识和接口标识之间的授权关系。
其中，预设授权关系缓存用于存储各应用程序与各接口之间的授权关系。
具体的，服务器会根据应用程序标识和接口标识查询预设授权关系缓存，对应用程序以及接口是否有授权关系进行校验，当预设授权关系缓存中存在目标应用程序-接口授权关系时，表示应用程序以及接口之间存在授权关系，当预设授权关系缓存中不存在目标应用程序-接口授权关系时，表示应用程序以及接口之间不存在授权关系。
在本实施例中，通过根据应用程序标识和接口标识查询预设授权关系缓存，当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，能够根据应用程序标识和接口标识实现授权关系校验。
在其中一个实施例中，根据授权额度信息集合进行授权额度扣减验证包括：
根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
根据授权额度扣减优先级依次尝试授权额度扣减。
其中，各授权额度携带的时间戳是指各授权额度所对应的时效，即各授权额度的授权期限，期限较近的授权额度的扣减优先级越高。授权额度扣减优先级是指各授权额度在被扣减时的优先级，可根据各授权额度的时效确定。
具体的，服务器会根据授权额度信息集合中各授权额度携带的时间戳对各授权额度进行排序，根据时间戳距离当前日期的远近程度进行排序，将距离当前日期较近的时间戳排在前面，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减，进行授权额度扣减验证。
在本实施例中，通过根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减，能够实现授权额度扣减验证。
在其中一个实施例中，根据授权额度扣减优先级依次尝试授权额度扣减包括：
根据授权额度扣减优先级，确定待扣减授权额度；
比对待扣减授权额度和预设额度阈值；
当待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过；及
当待扣减授权额度小于预设额度阈值时，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对。
在其中一个实施例中，在根据授权额度信息集合进行授权额度扣减验证之前，接口授权监控方法还包括：
将根据授权额度信息集合进行授权额度扣减验证的步骤封装为一个REDIS命令。
在其中一个实施例中，根据授权额度信息集合进行授权额度扣减验证包括：
执行REDIS命令，REDIS命令实现根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减。
其中，待扣减授权额度是指授权额度扣减优先级中优先级最高的授权额度。额度阈值是指预先设置的用于检测是否可以进行额度扣减的阈值，比如，额度阈值具体可以是0。
具体的，服务器会根据授权额度扣减优先级，确定待扣减授权额度，比对待扣减授权额度和预设额度阈值，当待扣减授权额度大于预设额度阈值时，表示此时可以进行额度扣减，服务器会确定授权额度扣减验证通过。当待扣减授权额度小于预设额度阈值时，表示此时不可以根据待扣减授权额度进行额度扣减，服务器会根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，将下一优先级授权额度作为最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，继续根据最新的待扣减授权额度判断是否可以进行额度扣减，直到授权额度扣减验证通过(即可以进行额度扣减)或授权额度信息集合中各授权额度均已被比对(即都不能进行额度扣减)。
举例说明，授权额度信息集合中各授权额度的优先级可根据各授权额度对应的接口授权记录被存入预设授权额度缓存的时间确定。服务器在根据授权额度信息集合进行授权额度扣减验证时，会按照先入先出的顺序确定授权额度信息集合中各授权额度的优先级，依次尝试授权额度扣减，如果扣减成功，则允许本地调用，否则尝试对下一优先级的授权额度进行授权额度扣减，如果全部尝试失败，则拒绝请求。进一步的，针对在授权扣减的过程中可能出现的分布式并发问题，本实施例在扣减过程中会按顺序执行以下REDIS命令和操作：1>GET LICENSE_ID；2>判断授权额度是否大于零；3>SET LICENSE_ID。因为REDIS多条命令无法确保原子性，因此当多个接口调用请求同时执行1>2>时得到的都是允许减扣，但是如果授权额度至有1时，就会发生超扣现象；为避免超扣，本实施例采用LUA脚本将1>2>3>操作封装为一个REDIS命令，确保操作的原子性，从而避免授权超扣。
在本实施例中，通过根据授权额度扣减优先级，确定待扣减授权额度，比对待扣减授权额度和预设额度阈值，能够根据比对结果实现授权额度扣减验证。
在其中一个实施例中，在当授权额度扣减验证通过时，返回允许接口调用提示之后，接口授权监控方法还包括：
统计授权额度扣减次数；
根据授权额度扣减次数更新授权额度；及
根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
具体的，服务器会统计授权额度扣减次数，根据授权额度扣减次数去更新授权额度，得到最新的授权额度，再根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存，实现对授权额度的更新。其中，根据授权额度扣减次数去更新授权额度的方式可以为：计算当前授权额度与授权额度扣减次数的差值，将差值作为新的授权额度。
进一步的，授权额度计算包括实时计算和跑批计算，本实施例中主要涉及的是实时计算，实时计算主要是当用户订阅授权绑定授权和解绑时，实时汇总每条授权已使用额度和剩余额度，并更新授权缓存。考虑授权具有时效性，服务器还会每天跑批进行额度结算，将授权使用情况，合并到预设授权数据库中，生成每天的结算记录，并根据时效性，更新预设授权额度缓存和预设授权关系缓存，对于授权使用情况当天的数据可以通过预设授权关系缓存和预设授权额度缓存直接获取，对于T-1天(T是指当天)的授权使用情况，可以查询授权结算天表。
在本实施例中，通过统计授权额度扣减次数，根据授权额度扣减次数更新授权额度，根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存，能够实现对授权额度的更新。
如图3所示，通过一个示意图来说明本申请的接口授权监控方法，其中，如图3所示，API授权服务是指服务器，在API授权服务包括授权管理器、授权校验器、授权缓存以及授权额度计算四个模块，授权缓存与授权数据库连接，授权数据库具体可以为服务器内部数据库，也可以为外部数据库。授权数据库中包括APP表、APP-API授权表(即预设授权关系缓存)、API授权表(即预设授权额度缓存)以及API表。
当用户想要订阅接口服务时，会通过终端发送携带接口标识以及订阅参数的接口订阅请求至服务器，服务器接收携带接口标识以及订阅参数的接口订阅请求后，会通过授权管理器根据接口订阅请求进行订阅权限验证，当订阅权限验证通过时，根据订阅参数确定授权额度，根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存。
当用户想要绑定应用程序和接口的时候，会通过终端发送携带应用程序标识以及接口标识的接口绑定请求至服务器，服务器接收携带应用程序标识以及接口标识的接口绑定请求后，会通过授权管理器对接口绑定请求的发送方进行身份验证，当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
当用户想要为应用程序(APP1、APP2)调用接口(请求API)时，会通过终端利用 API网关发送接口调用请求至服务器，接口调用请求携带应用程序标识、接口标识以及发送方标识。服务器接收接口调用请求后，会通过授权校验器根据应用程序标识和接口标识查询预设授权关系缓存，当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合，根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级，确定待扣减授权额度，比对待扣减授权额度和预设额度阈值，当待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过，当待扣减授权额度小于预设额度阈值时，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对，当授权额度扣减验证通过时，返回允许接口调用提示。
在返回允许接口调用提示后，服务器会通过授权额度计算统计授权额度扣减次数，根据授权额度扣减次数更新授权额度，根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
如图4所示，通过一个实施例来说明本申请的接口授权监控方法，该方法包括以下步骤：
步骤402，接收携带接口标识以及订阅参数的接口订阅请求；
步骤404，根据接口订阅请求进行订阅权限验证；
步骤406，当订阅权限验证通过时，根据订阅参数确定授权额度；
步骤408，根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存；
步骤410，接收携带应用程序标识以及接口标识的接口绑定请求；
步骤412，对接口绑定请求的发送方进行身份验证；
步骤414，当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存；
步骤416，接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
步骤418，根据应用程序标识和接口标识查询预设授权关系缓存；
步骤420，当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过；
步骤422，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
步骤424，根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；
步骤426，根据授权额度扣减优先级，确定待扣减授权额度；
步骤428，比对待扣减授权额度和预设额度阈值，当待扣减授权额度大于预设额度阈值时，跳转至步骤430，当待扣减授权额度小于预设额度阈值时，跳转至步骤432；
步骤430，确定授权额度扣减验证通过，跳转至步骤434；
步骤432，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对；
步骤434，当授权额度扣减验证通过时，返回允许接口调用提示，
步骤436，统计授权额度扣减次数；
步骤438，根据授权额度扣减次数更新授权额度；及
步骤440，根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
需要说明的是，本申请实施例可以基于人工智能技术对相关的数据进行获取和处理。其中，人工智能(Artificial Intelligence，AI)是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。
人工智能基础技术一般包括如传感器、专用人工智能芯片、云计算、分布式存储、大数据处理技术、操作/交互系统、机电一体化等技术。人工智能软件技术主要包括计算机视觉技术、机器人技术、生物识别技术、语音处理技术、自然语言处理技术以及机器学习/深度学习等几大方向。
应该理解的是，虽然图2和图4的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2和图4中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在其中一个实施例中，如图5所示，提供了一种接口授权监控装置，包括：接收模块502、查询模块504、扣减验证模块506和处理模块508，其中：
接收模块502，用于接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
查询模块504，用于当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
扣减验证模块506，用于根据授权额度信息集合进行授权额度扣减验证；及
处理模块508，用于当授权额度扣减验证通过时，返回允许接口调用提示。
上述接口授权监控装置，通过接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识，当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合，根据授权额度信息集合进行授权额度扣减验证，当授权额度扣减验证通过时，返回允许接口调用提示。整个过程，通过根据接口标识以及发送方标识查询预设授权额度缓存，能够得到对应的授权额度信息集合，进而利用授权额度信息集合进行授权额度扣减验证，能够通过授权额度扣减验证实现对接口授权的使用情况的监控。
在其中一个实施例中，接口授权监控装置还包括接口订阅模块，接口订阅模块用于接收携带接口标识以及订阅参数的接口订阅请求，根据接口订阅请求进行订阅权限验证，当订阅权限验证通过时，根据订阅参数确定授权额度，根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存。
在其中一个实施例中，接口授权监控装置还包括绑定模块，绑定模块用于接收携带应用程序标识以及接口标识的接口绑定请求，对接口绑定请求的发送方进行身份验证，当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
在其中一个实施例中，接口授权监控装置授权关系验证模块，授权关系验证模块用于根据应用程序标识和接口标识查询预设授权关系缓存，当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，目标应用程序-接口授权关系为应用程序标识和接口标识之间的授权关系。
在其中一个实施例中，扣减校验模块还用于根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，扣减校验模块还用于根据授权额度扣减优先级，确定待扣减授权额度，比对待扣减授权额度和预设额度阈值，当待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过，当待扣减授权额度小于预设额度阈值时，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对。
在其中一个实施例中，扣减校验模块还用于将根据授权额度信息集合进行授权额度扣减验证的步骤封装为一个REDIS命令。
在其中一个实施例中，扣减校验模块还用于执行REDIS命令，REDIS命令实现根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，接口授权监控装置还包括额度更新模块，额度更新模块用于统计授权额度扣减次数，根据授权额度扣减次数更新授权额度，根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
关于接口授权监控装置的具体限定可以参见上文中对于接口授权监控方法的限定，在此不再赘述。上述接口授权监控装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在其中一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图6所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口和数据库。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性或易失性存储介质、内存储器。该非易失性或易失性存储介质存储有操作系统、计算机可读指令和数据库。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的数据库用于存储应用程序-接口授权关系数据以及接口授权记录。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种接口授权监控方法。
本领域技术人员可以理解，图6中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被处理器执行时，使得一个或多个处理器执行以下步骤：
接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
根据授权额度信息集合进行授权额度扣减验证；及
当授权额度扣减验证通过时，返回允许接口调用提示。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
接收携带接口标识以及订阅参数的接口订阅请求；
根据接口订阅请求进行订阅权限验证；
当订阅权限验证通过时，根据订阅参数确定授权额度；及
根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
接收携带应用程序标识以及接口标识的接口绑定请求；
对接口绑定请求的发送方进行身份验证；及
当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
根据应用程序标识和接口标识查询预设授权关系缓存；及
当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，目标应用程序-接口授权关系为应用程序标识和接口标识之间的授权关系。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
根据授权额度扣减优先级，确定待扣减授权额度；
比对待扣减授权额度和预设额度阈值；
当待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过；及
当待扣减授权额度小于预设额度阈值时，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
将根据授权额度信息集合进行授权额度扣减验证的步骤封装为一个REDIS命令。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
执行REDIS命令，REDIS命令实现根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，处理器执行计算机可读指令时还实现以下步骤：
统计授权额度扣减次数；
根据授权额度扣减次数更新授权额度；及
根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
一个或多个存储有计算机可读指令的计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：
接收接口调用请求，接口调用请求携带应用程序标识、接口标识以及发送方标识；
当根据应用程序标识和接口标识进行授权关系校验通过时，根据接口标识以及发送方标识查询预设授权额度缓存，得到授权额度信息集合；
根据授权额度信息集合进行授权额度扣减验证；及
当授权额度扣减验证通过时，返回允许接口调用提示。
其中，该计算机可读存储介质可以是非易失性，也可以是易失性的。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
接收携带接口标识以及订阅参数的接口订阅请求；
根据接口订阅请求进行订阅权限验证；
当订阅权限验证通过时，根据订阅参数确定授权额度；及
根据接口标识以及授权额度生成接口授权记录，将接口授权记录存储至预设授权额度缓存。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
接收携带应用程序标识以及接口标识的接口绑定请求；
对接口绑定请求的发送方进行身份验证；及
当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
根据应用程序标识和接口标识查询预设授权关系缓存；及
当预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，目标应用程序-接口授权关系为应用程序标识和接口标识之间的授权关系。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
根据授权额度扣减优先级，确定待扣减授权额度；
比对待扣减授权额度和预设额度阈值；
当待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过；及
当待扣减授权额度小于预设额度阈值时，根据授权额度扣减优先级确定与待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或授权额度信息集合中各授权额度均已被比对。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
将根据授权额度信息集合进行授权额度扣减验证的步骤封装为一个REDIS命令。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
执行REDIS命令，REDIS命令实现根据授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据授权额度扣减优先级依次尝试授权额度扣减。
在其中一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：
统计授权额度扣减次数；
根据授权额度扣减次数更新授权额度；及
根据最新的授权额度以及接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通 过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种接口授权监控方法，包括：
    接收接口调用请求，所述接口调用请求携带应用程序标识、接口标识以及发送方标识；
    当根据所述应用程序标识和所述接口标识进行授权关系校验通过时，根据所述接口标识以及所述发送方标识查询预设授权额度缓存，得到授权额度信息集合；
    根据所述授权额度信息集合进行授权额度扣减验证；及
    当授权额度扣减验证通过时，返回允许接口调用提示。
  2. 根据权利要求1所述的方法，其中，还包括：
    接收携带接口标识以及订阅参数的接口订阅请求；
    根据所述接口订阅请求进行订阅权限验证；
    当订阅权限验证通过时，根据所述订阅参数确定授权额度；及
    根据所述接口标识以及所述授权额度生成接口授权记录，将所述接口授权记录存储至预设授权额度缓存。
  3. 根据权利要求2所述的方法，其中，在所述将所述接口授权记录存储至预设授权额度缓存之后，所述方法还包括：
    接收携带应用程序标识以及接口标识的接口绑定请求；
    对所述接口绑定请求的发送方进行身份验证；及
    当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
  4. 根据权利要求1所述的方法，其中，在所述接收接口调用请求之后，所述方法还包括：
    根据所述应用程序标识和所述接口标识查询预设授权关系缓存；及
    当所述预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，所述目标应用程序-接口授权关系为所述应用程序标识和所述接口标识之间的授权关系。
  5. 根据权利要求1所述的方法，其中，所述根据所述授权额度信息集合进行授权额度扣减验证包括：
    根据所述授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
    根据所述授权额度扣减优先级依次尝试授权额度扣减。
  6. 根据权利要求5所述的方法，其中，所述根据所述授权额度扣减优先级依次尝试授权额度扣减包括：
    根据所述授权额度扣减优先级，确定待扣减授权额度；
    比对所述待扣减授权额度和预设额度阈值；
    当所述待扣减授权额度大于预设额度阈值时，确定授权额度扣减验证通过；及
    当所述待扣减授权额度小于预设额度阈值时，根据所述授权额度扣减优先级确定与所述待扣减授权额度对应的下一优先级授权额度，得到最新的待扣减授权额度，返回比对所述待扣减授权额度和预设额度阈值的步骤，直到授权额度扣减验证通过或所述授权额度信息集合中各授权额度均已被比对。
  7. 根据权利要求1所述的方法，其中，在所述当授权额度扣减验证通过时，返回允许接口调用提示之后，所述方法还包括：
    统计授权额度扣减次数；
    根据所述授权额度扣减次数更新授权额度；及
    根据最新的授权额度以及所述接口标识生成新的接口授权记录，将新的接口授权记录更新至预设授权额度缓存。
  8. 根据权利要求1所述的方法，其中，在所述根据所述授权额度信息集合进行授权额度扣减验证之前，所述方法还包括：
    将所述根据所述授权额度信息集合进行授权额度扣减验证的步骤封装为一个REDIS命令。
  9. 根据权利要求8所述的方法，其中，所述根据所述授权额度信息集合进行授权额度扣减验证包括：
    执行所述REDIS命令，所述REDIS命令实现根据所述授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级，根据所述授权额度扣减优先级依次尝试授权额度扣减。
  10. 一种接口授权监控装置，包括：
    接收模块，用于接收接口调用请求，所述接口调用请求携带应用程序标识、接口标识以及发送方标识；
    查询模块，用于当根据所述应用程序标识和所述接口标识进行授权关系校验通过时，根据所述接口标识以及所述发送方标识查询预设授权额度缓存，得到授权额度信息集合；
    扣减验证模块，用于根据所述授权额度信息集合进行授权额度扣减验证；及
    处理模块，用于当授权额度扣减验证通过时，返回允许接口调用提示。
  11. 一种计算机设备，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    接收接口调用请求，所述接口调用请求携带应用程序标识、接口标识以及发送方标识；
    当根据所述应用程序标识和所述接口标识进行授权关系校验通过时，根据所述接口标识以及所述发送方标识查询预设授权额度缓存，得到授权额度信息集合；
    根据所述授权额度信息集合进行授权额度扣减验证；及
    当授权额度扣减验证通过时，返回允许接口调用提示。
  12. 根据权利要求11所述的计算机设备，其中，所述处理器执行所述计算机可读指 令时还执行以下步骤：
    接收携带接口标识以及订阅参数的接口订阅请求；
    根据所述接口订阅请求进行订阅权限验证；
    当订阅权限验证通过时，根据所述订阅参数确定授权额度；及
    根据所述接口标识以及所述授权额度生成接口授权记录，将所述接口授权记录存储至预设授权额度缓存。
  13. 根据权利要求12所述的计算机设备，其中，所述处理器执行所述计算机可读指令时还执行以下步骤：
    接收携带应用程序标识以及接口标识的接口绑定请求；
    对所述接口绑定请求的发送方进行身份验证；及
    当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
  14. 根据权利要求11所述的计算机设备，其中，所述处理器执行所述计算机可读指令时还执行以下步骤：
    根据所述应用程序标识和所述接口标识查询预设授权关系缓存；及
    当所述预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，所述目标应用程序-接口授权关系为所述应用程序标识和所述接口标识之间的授权关系。
  15. 根据权利要求11所述的计算机设备，其中，所述处理器执行所述计算机可读指令时还执行以下步骤：
    根据所述授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
    根据所述授权额度扣减优先级依次尝试授权额度扣减。
  16. 一个或多个存储有计算机可读指令的计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    接收接口调用请求，所述接口调用请求携带应用程序标识、接口标识以及发送方标识；
    当根据所述应用程序标识和所述接口标识进行授权关系校验通过时，根据所述接口标识以及所述发送方标识查询预设授权额度缓存，得到授权额度信息集合；
    根据所述授权额度信息集合进行授权额度扣减验证；及
    当授权额度扣减验证通过时，返回允许接口调用提示。
  17. 根据权利要求16所述的存储介质，其中，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    接收携带接口标识以及订阅参数的接口订阅请求；
    根据所述接口订阅请求进行订阅权限验证；
    当订阅权限验证通过时，根据所述订阅参数确定授权额度；及
    根据所述接口标识以及所述授权额度生成接口授权记录，将所述接口授权记录存储至预设授权额度缓存。
  18. 根据权利要求17所述的存储介质，其中，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    接收携带应用程序标识以及接口标识的接口绑定请求；
    对所述接口绑定请求的发送方进行身份验证；及
    当身份验证通过时，根据应用程序标识以及接口标识，生成应用程序-接口授权关系，将应用程序-接口授权关系存储至预设授权关系缓存。
  19. 根据权利要求16所述的存储介质，其中，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    根据所述应用程序标识和所述接口标识查询预设授权关系缓存；及
    当所述预设授权关系缓存中存在目标应用程序-接口授权关系时，确定授权关系校验通过，所述目标应用程序-接口授权关系为所述应用程序标识和所述接口标识之间的授权关系。
  20. 根据权利要求16所述的存储介质，其中，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    根据所述授权额度信息集合中各授权额度携带的时间戳，确定授权额度扣减优先级；及
    根据所述授权额度扣减优先级依次尝试授权额度扣减。
PCT/CN2021/109542 2020-11-12 2021-07-30 接口授权监控方法、装置、计算机设备和存储介质 WO2022100155A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011257441.1 2020-11-12
CN202011257441.1A CN112104671B (zh) 2020-11-12 2020-11-12 接口授权监控方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2022100155A1 true WO2022100155A1 (zh) 2022-05-19

Family

ID=73785864

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/109542 WO2022100155A1 (zh) 2020-11-12 2021-07-30 接口授权监控方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN112104671B (zh)
WO (1) WO2022100155A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115994004A (zh) * 2023-03-22 2023-04-21 紫光同芯微电子有限公司 一种应用程序接口调用方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112104671B (zh) * 2020-11-12 2021-03-02 深圳壹账通智能科技有限公司 接口授权监控方法、装置、计算机设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107368736A (zh) * 2017-07-03 2017-11-21 青岛海信电器股份有限公司 信息访问方法、装置及计算机可读存储介质
CN109150805A (zh) * 2017-06-19 2019-01-04 亿阳安全技术有限公司 应用程序编程接口的安全管理方法和系统
US20190132324A1 (en) * 2017-10-31 2019-05-02 Microsoft Technology Licensing, Llc Remote locking a multi-user device to a set of users
CN111209060A (zh) * 2018-11-21 2020-05-29 中国移动通信集团广东有限公司 能力开发平台处理方法及装置
CN112104671A (zh) * 2020-11-12 2020-12-18 深圳壹账通智能科技有限公司 接口授权监控方法、装置、计算机设备和存储介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104636957B (zh) * 2015-02-04 2018-07-24 上海瀚之友信息技术服务有限公司 一种处理高并发数据请求的系统和方法
CN105262821A (zh) * 2015-10-29 2016-01-20 努比亚技术有限公司 接口管理装置和方法
US10268457B1 (en) * 2017-10-23 2019-04-23 International Business Machines Corporation Prospective voice user interface modality identification
CN110599277A (zh) * 2018-06-12 2019-12-20 北京京东尚科信息技术有限公司 一种库存扣减方法和装置
CN109194584B (zh) * 2018-08-13 2022-04-26 中国平安人寿保险股份有限公司 一种流量监控方法、装置、计算机设备及存储介质
CN109246092B (zh) * 2018-08-22 2021-08-10 北京旷视科技有限公司 接口管理方法、装置、系统、计算机可读存储介质
CN110188518A (zh) * 2019-05-29 2019-08-30 Oppo广东移动通信有限公司 参数配置方法、装置、终端及存储介质
CN110334499A (zh) * 2019-05-30 2019-10-15 深圳壹账通智能科技有限公司 接口权限管控方法、装置、计算机设备和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109150805A (zh) * 2017-06-19 2019-01-04 亿阳安全技术有限公司 应用程序编程接口的安全管理方法和系统
CN107368736A (zh) * 2017-07-03 2017-11-21 青岛海信电器股份有限公司 信息访问方法、装置及计算机可读存储介质
US20190132324A1 (en) * 2017-10-31 2019-05-02 Microsoft Technology Licensing, Llc Remote locking a multi-user device to a set of users
CN111209060A (zh) * 2018-11-21 2020-05-29 中国移动通信集团广东有限公司 能力开发平台处理方法及装置
CN112104671A (zh) * 2020-11-12 2020-12-18 深圳壹账通智能科技有限公司 接口授权监控方法、装置、计算机设备和存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115994004A (zh) * 2023-03-22 2023-04-21 紫光同芯微电子有限公司 一种应用程序接口调用方法及装置
CN115994004B (zh) * 2023-03-22 2023-08-29 紫光同芯微电子有限公司 一种应用程序接口调用方法及装置

Also Published As

Publication number Publication date
CN112104671B (zh) 2021-03-02
CN112104671A (zh) 2020-12-18

Similar Documents

Publication Publication Date Title
AU2018374912B2 (en) Model training system and method, and storage medium
WO2021073452A1 (zh) 基于区块链网络的数据处理方法、装置、电子设备及存储介质
US11611560B2 (en) Systems, methods, and apparatuses for implementing consensus on read via a consensus on write smart contract trigger for a distributed ledger technology (DLT) platform
CN108898389B (zh) 基于区块链的内容验证方法及装置、电子设备
CN109981679B (zh) 在区块链网络中执行事务的方法和装置
JP2022000757A5 (zh)
US20200013025A1 (en) Conditional deferred transactions for blockchain
CN110599213B (zh) 一种基于区块链网络的物品管理方法、装置及电子设备
CN110598434B (zh) 基于区块链网络的房屋信息处理方法、装置、电子设备及存储介质
WO2022100155A1 (zh) 接口授权监控方法、装置、计算机设备和存储介质
CN110769274B (zh) 基于区块链网络的直播信息处理方法、装置、电子设备及存储介质
CN110908786A (zh) 一种智能合约调用方法、装置及介质
CN111292174A (zh) 一种纳税信息处理方法、装置及计算机可读存储介质
CN112818014B (zh) 区块链数据解析方法、装置和电子设备
CN111460400A (zh) 一种数据处理方法、装置及计算机可读存储介质
CN111159657A (zh) 一种应用程序鉴权方法及系统
CN111597543A (zh) 基于区块链智能合约的广域进程访问权限认证方法及系统
CN111369354A (zh) 面向区块链应用的数据监控方法、装置及存储介质
CN113722114A (zh) 一种数据服务的处理方法、装置、计算设备及存储介质
CN114138849A (zh) 多租户数据权限控制方法、装置、计算机及可读存储介质
CN111817859A (zh) 基于零知识证明的数据共享方法、装置、设备及存储介质
CN116070191A (zh) 信息处理方法及其装置、存储介质、程序产品
CN117040930B (zh) 区块链网络的资源处理方法、装置、产品、设备和介质
CN113300852B (zh) 服务管理方法及平台、计算机设备及计算机可读存储介质
CN115310105A (zh) 基于区块链的资源请求的处理方法、装置和服务器

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 04.09.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21890686

Country of ref document: EP

Kind code of ref document: A1