摘要
随着企业业务的不断公开化和轻量化,应用程序编程接口(Application Programming Interface,API)技术得到了广泛发展和应用,为业务对接、系统调用提供了灵活性和创新性。与此同时,API的应用带来了一系列潜在的安全问题。与传统的Web安全相比,API安全更为复杂,是一个交叉方向上的新生安全问题。基于开放式Web应用程序安全项目(Open Web Application Security Project,OWASP)提出API面临的10大安全风险,对风险进行分析归类,结合用户与API服务交互的过程,提出了一种API安全防御策略模型及其实现方法。通过4道防护架构,一定程度上解决访问控制安全、消息内容安全、流量传输安全与控制以及审计与可视化安全4个方面的安全风险。
With the continuous openness and lightweight of enterprise business,Application Programming Interface(API)technology has been widely developed and applied.However,the application of API brings a series of potential security problems,which are more complex than traditional Web security,and are a new security problem in the cross direction.Based on the Open Web Application Security Project(OWASP)API Security Top 10,this paper analyzes and classifies the API risks from the perspective of enterprise security,and proposes corresponding API security defense strategy model and implementation method.
作者
刘凯宇
LIU Kaiyu(China UnionPay Co.,Ltd.,Shanghai 201201,China)
出处
《通信电源技术》
2023年第4期147-149,共3页
Telecom Power Technology
