Open API Security Protocol design under the condition of non-secure transport protocol

This article considers the security issue of Open API calls without the use of secure transport protocols.

• • Role definitions
  • Processing flow
    • Caller message Sending Process
    • Publisher message Ingestion Process
    • Call results return process
  • Code Design
    • Caller Code Design
    • Publisher Code Design

Liu Hailong
Weibo: [http://weibo.com/liuhailong2008]
Blog: [HTTP://BLOG.CSDN.NET/STATIONXP]

Role definitions

• Publisher: publisher of the Open API.
• Caller: The caller of the Open API.

Processing process caller message sending process

1. Generate a UUID, called _seed .
2. To _seed use your own private key to sign, get _sign , provide to the publisher authentication identity.
3. The _seed public key of the publisher is encrypted and obtained _key .
4. Use _seed symmetric encryption of messages to _msg get ciphertext _msgx .
5. will be _sign``_key``_msgx stitching, Base64 compression (optional), get _body .
6. Send _body , execute API call.

Publisher message Ingestion Process

1. Get _body , split into,, _sign _key _msgx .
2. The caller's uri public key is found by calling into the registry _invkerpk .
3. Use _invkerpk decryption _sign to get _seed1 .
4. Use your own private key to uncover _key , get _seed2 .
5. Match _seed1 and _seed2 , if consistent, be confirmed _seed ; otherwise the process ends.
6. Use _seed the to _msgx decrypt to get the plaintext message.

Call results return process

1. Returns the result as a pre-set message code.
2. Transmitted in a secure manner, the public key of the caller is used for encryption.

Code Design Caller Code Design

interface Invoker{    void setEndPoint(InvokerEndPoint endPoint);    /**    * 通过调用EndPoint实现。    */    Response get(String api,Object…params);    Response post(String api,Object…params); } interface InvokerEndPoint{    /** 装饰模式 */ interface SecurityInvokerEndPoint{    Response invoke(Request request); }

Publisher Code Design

 interface OpenApiFilter{    void setEndPoint(ExportEndPoint endPoint);    /**    * 通过调用EndPoint实现。    */    HttpServletResponse process(HttpServletRequest request); } interface ExportEndPoint{    /** 装饰模式 */ interface SecurityExportEndPoint{    Response export(Request request); } interface ExportHandler{    Response handle(Object...args); }

Open API Security Protocol design under the condition of non-secure transport protocol