Adding an Application Asset

Scenarios

A financial enterprise deploys its core service system in a Huawei Cloud VPC and uses the NAT gateway to centrally receive external API access requests. It needs to securely manage all data transmitted through APIs, including intercepting attack requests such as SQL injection, dynamically masking sensitive customer information (such as ID card numbers and bank card numbers) in responses, and injecting tracing watermarks into returned data for post-event source tracing. API data security protection is deployed in reverse proxy mode to ensure that all API traffic passes the security check, implementing closed-loop data security control in external service scenarios.

Solution Architecture

Figure 1 shows the deployment architecture and data flow of API data security protection. After external requests are sent to the VPC through the NAT gateway, the API data security protection module performs security check and then forwards the requests to the backend cloud application service group.

Direct Access to Applications

Before connecting to the proxy, enter the original URL (http://172.16.35.53:8182) of the application in the address box of the browser, as shown in Figure 2.

Figure 2 Direct access to applications

Adding an Application Asset

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Assets > Services.
3. Click Add in the upper right corner. In the dialog box displayed, specify parameters by referring to Table 2.

   Table 2 Parameters

   Parameter	Description
   Automatically Filled	Copy the original URL of the application server to this text box and click Identify to let the system intelligently identify and set parameters.
   Service Name	The name of an application service.
   Server-Website Address	Enter the address that the client user accesses and bind it to the application protocol. If you enter a domain name (for example, example.com), you do not need to enter a port number. After the configuration, guests access application assets through the domain name proxy. If you enter a domain name, you need to modify the mapping between the domain name and IP address so that the domain name can be resolved to the IP address for API data security protection. Generally, you can modify the mapping between the domain name and IP address in the DNS service. If no DNS is available or during the test, you can modify the hosts file on the client to resolve the domain name to the IP address for API data security protection. If you enter an IP address, enter the IP address and proxy port for API data security protection. You can enter any idle port ranging from 1 to 65535. After the configuration, guests can use the combination of IP address plus port to access application assets.
   Server-Protocol	Select the proxy protocol of the API data security protection server. If you select https, you need to select a certificate from the certificate drop-down list.
   Certificate	If the application protocol is set to https, select a certificate from the certificate drop-down list. You need to upload the certificate on the certificate management page in advance. For details, see Certificate Management.
   Access Path	Proxy path, which is the prefix of the URL for the client access.
   Origin Protocol	Select the origin server protocol, that is, the protocol used by the original address of the application.
   Origin Address	Type of the origin server address. It can be an IP address or domain name. If you select IP, enter the original IP address of the application server, for example, 172.16.35.53 and port shown in the figure. If you select Domain Name, enter the origin domain name of the application server.
   DNS Server	If you select a domain name as the origin server address, enter the DNS address of the proxy server.
   Server IP	If the origin server address is a domain name, you can enter the server IP address without entering the DNS address.
   Origin Path	Prefix of the origin server URL.
   Load Balance Strategy	Select the load balancing policy for proxy access. If there are multiple origin server addresses, the proxy access will be distributed across the servers based on the configured load balancing policy.
   Authorization Status	Whether to enable the application proxy service.
   Advanced Config	If the origin server application system has advanced authentication, you can configure the host, referer, origin, and content-encoding parameters in the application request header and configure the maximum request body to restrict the sending.

4. After the configuration is complete, click OK to save the application asset.

Verifying the Proxy Configuration

Enter the domain name/IP address (for example, example.com) in the address box of the browser. If the page similar to Figure 3 is displayed, the application is accessed via the proxy.