Software compliance detection method and device

Abstract

The present application discloses a method and device for detecting software compliance, which belongs to the field of communications. The method comprises: obtaining a specification file and an original configuration file corresponding to the target software; when there is at least one configuration item among M configuration items whose actual configuration data does not conform to the standard configuration data of the at least one configuration item, generating an update configuration file according to the specification file, and saving the correspondence between the software identifier, the first effective identifier, the original configuration file and the update configuration file of the target software, wherein the first effective identifier is used to indicate that the configuration file currently in effect for the target software is the update configuration file. The present application can improve the efficiency and accuracy of repairing configuration data, and realize the recovery of configuration data.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a method and device for detecting software compliance. Background Art

[0002] The host has several application software installed, and the host provides services to the outside by running the application software. For example, the host has database software installed, and the host provides data storage or data access services to the outside by running the database software. Each application software generally has multiple configurable attributes, such as the account format requirements and password strength requirements of the database software.

[0003] A configuration file corresponding to the application software is also stored in the host, and the configuration file includes configuration data of multiple configuration items corresponding to the application software. The application software needs to read the configuration data of the configuration items in the configuration file during operation, and runs based on the read configuration data. For example, for database software, the configuration file corresponding to the database software includes configuration items such as account format requirements and password strength requirements. Assume that the account format requirement for configuration data is "account is a combination of letters or numbers", and the password strength requirement for configuration data is "password is a six-digit number". In this way, when the database software displays the registration interface to the user, the account format requirement for configuration data and the password strength requirement for configuration data are displayed in the registration interface, so that the user can register according to the requirements of the two configuration items.

[0004] However, there may be configuration data of some configuration items in the configuration file corresponding to the software. When the software runs based on the configuration data of some items, there may be security risks, which may make the software vulnerable to attack or intrusion, etc., so the current software has great security risks when running. For example, the configuration data of the password strength requirement of the above-mentioned database software is "the password is a six-digit number". Obviously, the security level of the password registered according to the requirements of the configuration data is low, resulting in the registered password being easily cracked, so there is a great security risk. In order to solve this problem, the technicians currently manually modify the configuration data of the configuration items, but manual modification is inefficient and prone to modification errors. Summary of the invention

[0005] The present application provides a software compliance detection method and device to improve the efficiency and accuracy of repairing configuration data, and to restore configuration data when it is necessary to restore to the configuration data before the repair. The technical solution is as follows:

[0006] In the first aspect, the present application provides a method for detecting software compliance, in which: a specification file and an original configuration file corresponding to the target software are obtained, the specification file includes standard configuration data corresponding to M configuration items of the target software, and the original configuration file includes actual configuration data corresponding to M configuration items of the target software, where M is an integer greater than 0. In the case where the actual configuration data of at least one configuration item among the M configuration items does not match the standard configuration data of at least one configuration item, an updated configuration file is generated according to the specification file, the updated configuration file includes updated configuration data corresponding to the M configuration items, wherein the content of the original configuration file remains unchanged, and the configuration data of at least one configuration item between the original configuration file and the updated configuration file is different. The correspondence between the software identifier of the target software, the first effective identifier, the original configuration file, and the updated configuration file is saved, and the first effective identifier is used to indicate that the configuration file currently in effect for the target software is the updated configuration file.

[0007] By obtaining the specification file and the original configuration file of the target software, generating an updated configuration file according to the specification file, and indicating that the currently effective configuration file of the target software is the updated configuration file through the first effective identifier, the configuration data is automatically repaired, and the efficiency and accuracy of repairing the configuration data are improved. Since the content of the original configuration file remains unchanged, and the corresponding relationship between the software identifier of the target software, the first effective identifier, the original configuration file and the updated configuration file is saved, when it is necessary to restore to the configuration data before the repair, it is only necessary to modify the effective identifier in the corresponding relationship so that the effective identifier indicates that the currently effective configuration file is the original configuration file, thereby realizing the restoration of the configuration data.

[0008] In a possible implementation, a first modification command is received, the first modification command is used to request to replace the configuration file currently in effect of the target software, and the first modification command includes the software identifier of the target software. According to the software identifier of the target software, the first effective identifier in the corresponding relationship is replaced with the second effective identifier, and the second effective identifier is used to indicate that the configuration file currently in effect of the target software is the original configuration file, so that the configuration data accessed during the operation of the target software is restored to the configuration data before the repair, thereby realizing the recovery of the configuration data.

[0009] In another possible implementation, a configuration file access request initiated by a target process is intercepted, the configuration file access request includes a software identifier of the target software, and the target process is generated after the target software is run. According to the software identifier of the target software and the corresponding relationship, the currently effective configuration file is obtained, and the currently effective configuration file is the original configuration file or the updated configuration file. The configuration file access request is located to the currently effective configuration file, so as to provide the target process with the configuration data of the configuration items included in the currently effective configuration file. Since the configuration file access request can be intercepted, the configuration file access request is located to the currently effective configuration file, and the currently effective configuration file is the original configuration file or the updated configuration file, that is, the configuration data that can be controlled to be accessed by the target process is the updated configuration data after repair or the configuration data restored to before repair.

[0010] In another possible implementation, the corresponding relationship is queried according to the software identifier of the target software; if the corresponding relationship includes a first effective identifier, the updated configuration file is obtained from the corresponding relationship as the currently effective configuration file; if the corresponding relationship includes a second effective identifier, the original configuration file is obtained from the corresponding relationship as the currently effective configuration file. Since the currently effective configuration file is determined based on the effective identifier in the corresponding relationship, the configuration file accessed by the target process can be controlled by modifying the effective identifier in the corresponding relationship, so that the configuration data accessed by the target process can be controlled based on the effective identifier to be the updated configuration data after the repair or the configuration data restored to the configuration data before the repair.

[0011] In another possible implementation, a hook dynamic link library is loaded into the target process, and the hook dynamic link library is used to intercept the configuration file access request initiated by the target process, thereby enabling the configuration file access request initiated by the target process to be intercepted.

[0012] In another possible implementation, the original configuration file is mirrored to obtain a shadow file having the same content as the original configuration file. According to the specification file and the shadow file, at least one first-category target configuration item is determined, and the actual configuration data of each target configuration item in the at least one first-category target configuration item does not match the standard configuration data. A target configuration item is selected from the at least one first-category target configuration item, and the following operations are performed on the selected target configuration item until each target configuration item in the at least one first-category target configuration item is processed, thereby obtaining an updated configuration file: for the selected target configuration item, the actual configuration data of the selected target configuration item in the shadow file is modified according to the standard configuration data of the selected target configuration item in the specification file. Since the configuration data in the mirrored shadow file is modified according to the specification file, automatic repair of the configuration data is achieved, and the content in the original configuration file is guaranteed to remain unchanged.

[0013] In another possible implementation, the update configuration file is output, and a second modification command is received, the second modification command includes configuration data of at least one second-category target configuration item, and the at least one second-category target configuration item is a part of the M configuration items. A target configuration item is selected from the at least one second-category target configuration item, and the following operations are performed on the selected target configuration item until each target configuration item in the at least one second-category target configuration item is processed; for the selected target configuration item, the actual configuration data of the selected target configuration item is modified in the original configuration file to the configuration data of the selected target configuration item included in the second modification command, and the updated configuration data of the selected target configuration item is modified in the update configuration file to the configuration data of the selected target configuration item included in the second modification command. In this way, after the update configuration file is automatically repaired and obtained, if it does not meet the modification requirements of the technician, the configuration data of at least one second-category target configuration item manually modified by the technician can be obtained, and then the original configuration file and the update configuration file are synchronously modified to achieve manual repair.

[0014] In a second aspect, the present application provides a software compliance detection device, which is used to execute the method in the first aspect or any possible implementation of the first aspect. Specifically, the device includes a unit for executing the method in the first aspect or any possible implementation of the first aspect.

[0015] In a third aspect, the present application provides a software compliance detection device, the device comprising: a processor, a memory, and a transceiver. The processor, the memory, and the transceiver may be connected via a bus system. The memory is used to store one or more programs, and the processor is used to execute one or more programs in the memory, so that the detection device completes the method in the first aspect or any possible implementation of the first aspect.

[0016] In a fourth aspect, the present application provides a computer-readable storage medium, in which program code is stored. When the computer-readable storage medium is run on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0017] In a fifth aspect, the present application provides a computer program product comprising program codes, which, when executed on a computer, enables the computer to execute the above-mentioned first aspect or any possible implementation of the first aspect.

[0018] In a sixth aspect, the present application provides a chip comprising a memory device and a processing device, wherein the memory device is used to store computer instructions, and the processing device is used to call and run the computer instructions from the memory device to execute the method in the above-mentioned first aspect and any possible implementation of the above-mentioned first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of a network architecture provided in an embodiment of the present application;

[0020] Figure 2 This is a schematic diagram of a host structure provided by an embodiment of the present application;

[0021] Figure 3 It is a flow chart of a software compliance detection method provided in an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of a detection interface provided in an embodiment of the present application;

[0023] Figure 5 is a schematic diagram of a selection interface provided in an embodiment of the present application;

[0024] Figure 6 is a flow chart of another software compliance detection method provided in an embodiment of the present application;

[0025] Figure 7 is a flow chart of a method for running software provided in an embodiment of the present application;

[0026] Figure 8 It is a schematic diagram of a hook dynamic link library and an interface library provided in an embodiment of the present application;

[0027] Fig. 9 It is a schematic diagram of the structure of a software compliance detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The traditional method of manually modifying the configuration data of some configuration items by technicians not only has low modification efficiency and is prone to modification errors, but also makes it difficult to restore the original configuration data if the technicians are not satisfied with the modified configuration. To this end, an embodiment of the present application provides a method for detecting software compliance. Software compliance checking refers to the process of detecting the current actual configuration data of the target software to determine whether it meets the preset configuration standard requirements, and performing subsequent correction processing on the configuration data that does not meet the configuration standard requirements. The correction processing includes prompting the user to modify the configuration data, modifying the configuration data to meet the configuration standard requirements, etc., thereby improving the security of the software.

[0029] The implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0030] See also Figure 1, the embodiment of the present application provides a network architecture, which includes: a host 100 and a control terminal 200. Optionally, the host 100 and the control terminal 200 can be two different physical devices, and a network connection is established between the host 100 and the control terminal 200.

[0031] The host 100 includes at least one software and a configuration file corresponding to each software. These software include but are not limited to software with configuration files such as Nginx, Apache, Tomcat or Mysql. For a software, the host 100 saves the configuration file corresponding to the software when installing the software. For the sake of convenience, one of the software is used as an example. In this embodiment, the software used as an example is called the target software, and the configuration file of the target software before being processed by the detection method provided by the present application is called the original configuration file of the target software. The original configuration file includes the actual configuration data corresponding to M configuration items of the target software, where M is an integer greater than 0.

[0032] When the host 100 runs the target software, it reads the program code of the target software to generate a process. In the embodiment of the present application, the process generated by reading the program code of the target software is referred to as the target process. The host 100 generates the target process after running the target software. During the running of the target process, the target process may need to read the actual configuration data of the configuration item from the original configuration file corresponding to the target software, and run the target software based on the read actual configuration data.

[0033] Optionally, the target software is software with original configuration files such as Nginx, Apache, Tomcat or Mysql. Nginx is a lightweight web server / reverse proxy server and email proxy server software. Apache is a web server software. Tomcat is an open source web application server software, which is a lightweight application server software. Mysql is a lightweight database management system.

[0034] For example, taking the target software as Nginx, when the host 100 installs Nginx, the original configuration file corresponding to Nginx is also saved. The configuration items included in the original configuration file are port, communication protocol, protocol version and / or log file path, etc. Assume that the actual configuration data of the port included in the original configuration file is port number 2, the actual configuration data of the communication protocol is the secure sockets layer (SSL) protocol, the actual configuration data of the protocol version is V3, and the actual configuration data of the log file path is route1. Among them, V3 is the version number of the SSL protocol, and route1 is the storage path of the log file.

[0035] When the host 100 runs the Nginx software, a target process is generated. During the running of the Nginx software, the target process needs to read the port number 2, the communication protocol "SSL protocol" and the protocol version V3 of the port from the original configuration file, and provide services to the outside world based on the V3 version of the SSL protocol through the port corresponding to the port number 2, and / or, when the target process needs to record logs, it reads the log file path route1 from the original configuration file and records the log based on route1.

[0036] It should be noted that: for the target software in the host 100, there may be actual configuration data of some configuration items in the original configuration file corresponding to the target software. When the target software uses the actual configuration data of the configuration items to run, the target software may have a great security risk. To this end, the technician sends a detection command to the host through the control terminal 200.

[0037] The host 100 receives the detection command and performs a compliance detection on the target software. Optionally, the detection process is summarized as follows: obtaining the specification file and the original configuration file of the target software, wherein the specification file includes the standard configuration data corresponding to the M configuration items of the target software. In the case where the actual configuration data of at least one configuration item among the M configuration items does not conform to the standard configuration data of the at least one configuration item, an updated configuration file is generated according to the specification file, wherein the updated configuration file includes the updated configuration data corresponding to the M configuration items, wherein the content of the original configuration file remains unchanged, and the configuration data of at least one configuration item between the original configuration file and the updated configuration file is different, and the updated configuration file is sent to the control terminal 200.

[0038] The control terminal 200 receives the update configuration file and outputs the update configuration file. Optionally, the technician confirms the update configuration data corresponding to each configuration item in the update configuration file, or manually modifies the update configuration data corresponding to some configuration items in the update configuration file. In the case where the technician manually modifies the content in the update configuration file, the control terminal 200 also sends the manually modified content to the host 100, so that the host 100 synchronously modifies the original configuration file and the update configuration file of the target software. The host 100 also saves the software identification of the target software, the first effective identification, the correspondence between the original configuration file and the update configuration file, and the first effective identification is used to indicate that the configuration file currently in effect for the target software is the update configuration file. Optionally, for the detailed implementation of the above-mentioned target software compliance detection process, refer to the subsequent Figure 3 The illustrated embodiment will not be described in detail herein.

[0039] Alternatively, see Figure 1 The host 100 includes at least one first processor 101 , a first bus system 102 , a first memory 103 and at least one first transceiver 104 .

[0040] The at least one first processor 101, the first memory 103 and the at least one first transceiver 104 are connected via a first bus system 102. The first memory 103 includes a host-side program, at least one software and an original configuration file corresponding to each software.

[0041] Optionally, the at least one first processor 101 calls a software from the first memory 103, starts a target process, and uses the target process to run the called software. And,

[0042] Optionally, the at least one first processor 101 calls and runs the host-side program to perform the above-mentioned target software compliance detection process. That is, the at least one first processor 101 receives the detection command sent by the control end 200 through the at least one first transceiver 104, performs the above-mentioned operations of obtaining the specification file and the original configuration file of the target software, and generating the update configuration file of the target software, and sends the update configuration file to the control end through the at least one first transceiver 104, and also performs the above-mentioned operations of synchronously modifying the original configuration file and the update configuration file based on the manual modification of the technician, saving the software identification of the target software, the first effective identification, and the corresponding relationship between the original configuration file and the update configuration file, etc.

[0043] Optionally, the first processor 101 is a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0044] Optionally, the first bus system 102 includes a channel for transmitting information between the components.

[0045] Optionally, the first transceiver 104 is used to communicate with other devices or communication networks, for example, to communicate with the control end 200 .

[0046] Optionally, the first memory 103 is a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. Optionally, the first memory 103 exists independently and is connected to the first processor 101 through a bus. Alternatively, the first memory 103 and the first processor 101 are integrated together.

[0047] In a specific implementation, as an embodiment, the first processor 101 includes one or more CPUs, such as Figure 1 CPU0 and CPU1 in.

[0048] In a specific implementation, as an embodiment, the host 100 includes a plurality of first processors, such as Figure 1The first processor 101 and the first processor 107 in the embodiment of the present invention are shown in FIG. 1 . Optionally, each of these processors is a single-CPU processor or a multi-CPU processor. Optionally, the first processor here refers to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0049] Alternatively, see Figure 1 The control end 200 includes at least one second processor 201, a second bus system 202, a second memory 203, at least one second transceiver 204, an input device 205 and an output device 206.

[0050] The at least one second processor 201, the second memory 203, the at least one second transceiver 204, the input device 205 and the output device 206 are connected via the second bus system 202, and the second memory 203 includes a control end program.

[0051] Optionally, the at least one second processor 201 calls and runs the control end program from the second memory 203 to perform the above-mentioned operation of triggering the host 100 to perform the target software compliance detection. That is, the at least one second processor 201 receives the detection command triggered by the technician through the input device 205, sends the detection command to the host 100 through the at least one second transceiver 204 and receives the update configuration file sent by the host 100, and outputs the update configuration file through the output device 206, etc.

[0052] Optionally, the second processor 201 is a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0053] Optionally, the second bus system 202 includes a channel for transmitting information between the components.

[0054] Optionally, the second transceiver 204 is used to communicate with other devices or communication networks, for example, with the host 100 .

[0055] Optionally, the second memory 203 is a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. Optionally, the second memory 203 exists independently and is connected to the second processor 201 through a bus. Alternatively, the second memory 203 and the second processor 201 are integrated together.

[0056] In a specific implementation, as an embodiment, the second processor 201 includes one or more CPUs, such as Figure 1 CPU0 and CPU1 in.

[0057] In a specific implementation, as an embodiment, the control terminal 200 includes a plurality of second processors, for example Figure 1 The second processor 201 and the second processor 207 in the embodiment of the present invention are as follows. Optionally, each of these processors is a single-CPU processor or a multi-CPU processor. Optionally, the second processor 203 here refers to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0058] Optionally, the input device 105 is a mouse, keyboard, microphone or touch screen, and the output device 106 is a display screen, a monitor, a speaker or a printer.

[0059] exist Figure 1 In the network architecture shown, the control terminal 200 is a separate device, and the control terminal 200 and the host 100 communicate through the network. In a possible implementation, the control terminal 200 is a software function module running in the host 100. Figure 2In addition to at least one first processor 101, a first bus system 102, a first memory 103 and at least one first transceiver 104, the host 100 also includes an input device 105 and an output device 106. The first memory 103 also stores a control terminal program.

[0060] Optionally, the at least one first processor 101 calls and runs the control-side program to implement operations such as receiving a detection command triggered by a technician through the input device 105, and calls and runs the host-side program to implement operations such as generating an update configuration file and outputting the update configuration file through the output device 206. The detailed implementation process will be described later. Figure 6 The embodiment shown is described, and no detailed introduction is given here. In this case, the control end program and the host end program are coordinated and cooperated through the communication mechanism between processes.

[0061] Optionally, when the control terminal 200 and the host 100 are two different devices, the control terminal 200 is a terminal device, for example, the control terminal 200 is a computer or a mobile phone, and the host 100 is a mobile phone, a computer or a server. Or,

[0062] Optionally, when the control end 200 is a client running on the host 100, the host 100 is a mobile phone, a computer or a server.

[0063] See also Figure 3 , the present application embodiment provides a method for detecting software compliance. In this embodiment, Figure 1 The network architecture shown in FIG. 1 is described as an example, that is, the network architecture includes two devices, the control terminal and the host. In fact, in Figure 2 When the software compliance detection method provided in the embodiment of the present application is applied in the scenario shown, the principle is basically similar, except that the communication method between the control end and the host end is different. Figure 3 The software compliance detection method shown includes steps 301 to 305 .

[0064] Step 301: The control terminal sends a detection command to the host, where the detection command includes a software identifier of at least one software to be detected.

[0065] In this step, the technician needs to detect the original configuration files corresponding to one or more software installed in the host. For a software installed in the host, the technician needs to detect the actual configuration data corresponding to each configuration item included in the original configuration file corresponding to the software. At this time, the technician can trigger the control end to display a detection interface, and the technician enters the software identification of the one or more software to be detected in the detection interface.

[0066] Optionally, the detection interface includes an input box and a confirmation button. The technician enters the software identifier of at least one software installed in the host in the input box, and then clicks the confirmation button, so that the confirmation button triggers a confirmation command. The control end triggers the confirmation command when detecting that the confirmation button is clicked, reads the software identifier of the at least one software from the input box included in the detection interface, and provides the host with a detection command including the software identifier of the at least one software. Or,

[0067] Optionally, the detection interface includes selection buttons and confirmation buttons corresponding to the software installed in the host. The technician selects at least one selection button corresponding to the software in the detection interface, and then clicks the confirmation button, so that the confirmation button triggers a confirmation command. The control end triggers the confirmation command when detecting that the confirmation button is clicked, reads the software identifier of the at least one selected software from the detection interface, and sends a detection command including the software identifier of the at least one software to the host.

[0068] For example, see Figure 4 , the control end displays a detection interface, which includes a selection button corresponding to Nginx, Apache, Tomcat, and MySQL installed in the host, as well as a confirmation button. Assume that the technician selects the selection button corresponding to Nginx and the selection button corresponding to Apache, and clicks the confirmation button. The control end detects the confirmation command triggered by the confirmation button, and then Figure 4 The detection interface shown reads the selected software identifiers "nginx" of Nginx and "apache" of Apache, and sends a detection command including "nginx" and "apache" to the host.

[0069] Optionally, the software identifier of the software is the name of the software or the storage path of the software in the host, etc.

[0070] Optionally, the detection command also includes a specification file of each software in the at least one software. For the specification file of one software in the at least one software, the specification file includes standard configuration data corresponding to at least one configuration item of the software. Optionally, for one configuration item in the at least one configuration item, the standard configuration data of the configuration item is a data or a data range, etc. And for the original configuration file corresponding to the software, the original configuration file includes actual configuration data corresponding to at least one configuration item of the software, and the actual configuration data of the configuration item is a data.

[0071] For example, suppose that the Nginx specification file includes the standard configuration data of the port as a data range, which is "a port number greater than or equal to 1 and less than or equal to 3", and the data range can also be called the port number range; the standard configuration data of the communication protocol is a data, which is "SSL protocol"; the standard configuration data of the protocol version is also a data range, which includes three versions: V4, V5, and V6, and the data range can also be called the version number range; the standard configuration data of the log file path is a data, which is route2. The original Nginx configuration file includes the actual configuration data of the port as "port number 2", the actual configuration data of the communication protocol as "SSL protocol", the actual configuration data of the protocol version as "V3", and the actual configuration data of the log file path as "route1".

[0072] Optionally, for the specification file of the software, the specification file also includes a comparison method and a repair method corresponding to each configuration item of the software.

[0073] For the configuration item, the comparison method corresponding to the configuration item is used to compare whether the actual configuration data of the configuration item is consistent with the standard configuration data of the configuration item.

[0074] In the case where the standard configuration data of the configuration item is a data, when the standard configuration data of the configuration item and the actual configuration data are equal, it means that the actual configuration data of the configuration item is consistent with the standard configuration data, otherwise, the actual configuration data of the configuration item is inconsistent with the standard configuration data. Or,

[0075] In the case where the standard configuration data of the configuration item is a data range, when the actual configuration data of the configuration item is within the data range, it means that the actual configuration data of the configuration item is consistent with the standard configuration data, otherwise, the actual configuration data of the configuration item is inconsistent with the standard configuration data.

[0076] For the configuration item, the repair method corresponding to the configuration item is used to modify the actual configuration data of the configuration item to be consistent with the standard configuration data of the configuration item.

[0077] Optionally, the comparison method corresponding to the configuration item is a function or a class, and the repair method corresponding to the configuration item is a function or a class.

[0078] In the specification file, each configuration item may correspond to a comparison method, or there may be multiple configuration items corresponding to one comparison method. Also, in the specification file, each configuration item may correspond to a repair method, or there may be multiple configuration items corresponding to one repair method.

[0079] Optionally, the specification file of the software is inputted to the control terminal by the technician in advance, and the control terminal stores the correspondence between the software identifier of the software and the specification file. Thus, in this step, after the control terminal obtains the software identifier of at least one software to be detected, it obtains the specification file of each software to be detected from the correspondence between the software identifier and the specification file according to the software identifier of each software to be detected.

[0080] Step 302: The host receives the detection command, and obtains the specification file and the original configuration file of each software according to the software identification of each software to be detected included in the detection command.

[0081] In this step, the detection command includes the software identification of each software to be detected, and the host obtains the original configuration file of each software from the local according to the software identification of each software.

[0082] Optionally, the specification file of each software is obtained by the following two methods:

[0083] The first method: the detection command includes the specification file of each software to be detected, so the host obtains the specification file of each software to be detected from the detection command.

[0084] In the second mode, the host computer stores the correspondence between the software identifier and the specification file, and any record in the correspondence includes the software identifier of a software installed in the host computer and the specification file of the software. Therefore, the host computer obtains the specification file of each software to be detected from the correspondence between the software identifier and the specification file according to the software identifier of each software to be detected included in the detection command.

[0085] Optionally, for a software installed in the host, the technician inputs the specification file of the software into the host in advance, and the host saves the software identifier of the software and the specification file of the software in correspondence with each other in the correspondence relationship between the software identifier and the specification file.

[0086] Step 303: The host obtains the detection result of the target software according to the specification file and the original configuration file of the target software. The detection result includes the comparison result between the original configuration data and the standard configuration data corresponding to each configuration item of the target software. The target software is one of the at least one software to be detected.

[0087] In this step, for the sake of convenience, a software to be detected is called target software. It is assumed that the specification file of the target software includes standard configuration data corresponding to M configuration items of the target software, and the original configuration file of the target software includes actual configuration data corresponding to M configuration items of the target software, where M is an integer greater than 0.

[0088] Select one configuration item from the M configuration items of the target software, and perform the following operations on the selected configuration item until all the M configuration items of the target software are processed, thereby obtaining the detection result of the target software:

[0089] For the selected configuration item, the standard configuration data and comparison method of the selected configuration item are read from the specification file of the target software, and the standard configuration data may be a data or a data range. The actual configuration data of the selected configuration item is read from the original configuration file of the target software, and the standard configuration data and the actual configuration data of the selected configuration item are compared through the comparison method to obtain the comparison result of the selected configuration item, and the comparison result of the selected configuration item is whether the actual configuration data of the selected configuration item is consistent with the standard configuration data.

[0090] Optionally, when the standard configuration data of the selected configuration item is a single data, when the standard configuration data of the selected configuration item is compared to be the same as the actual configuration data, it indicates that the actual configuration data of the selected configuration item is consistent with the standard configuration data; when the standard configuration data of the selected configuration item is compared to be different from the actual configuration data, it indicates that the actual configuration data of the selected configuration item is inconsistent with the standard configuration data. When the standard configuration data of the selected configuration item is a data range, when the standard configuration data of the selected configuration item is compared to be within the data range, it indicates that the actual configuration data of the selected configuration item is consistent with the standard configuration data; when the standard configuration data of the selected configuration item is compared to be not within the data range, it indicates that the actual configuration data of the selected configuration item is inconsistent with the standard configuration data.

[0091] For each other software to be detected, the execution operation of the target software is processed as described above to obtain the detection result of each other software.

[0092] For example, for Nginx, the original configuration file of Nginx includes that the actual configuration data of the port is port number 2, the actual configuration data of the communication protocol is SSL protocol, the actual configuration data of the protocol version is V3, and the actual configuration data of the log file path is route 1. The specification file of Nginx includes that the standard configuration data of the port is "a port number greater than or equal to 1 and less than or equal to 3", the standard configuration data of the communication protocol is SSL protocol, the standard configuration data of the protocol version includes the version number range of "V4, V5 and V6", and the standard configuration data of the log file path is route 2.

[0093] For the port, the port number 2 is read from the original configuration file, and the port number range is read from the specification file as "a port number greater than or equal to 1 and less than or equal to 3". It is compared that the port number 2 is within the port number range, and the comparison result of the port is that the actual configuration data is consistent with the standard configuration data. For the communication protocol, the SSL protocol is read from the original configuration file, and the SSL protocol is also read from the specification file. The comparison result of the communication protocol is that the actual configuration data is consistent with the standard configuration data. For the log file path, the log file path read from the configuration file is route1, and the log file path read from the specification file is route2. The comparison result of the log file is that the actual configuration data does not match the standard configuration data. For the protocol version, the protocol version read from the original configuration file is V3, and the version number range read from the specification file is "V4, V5 and V6". It is compared that the protocol version V3 is not within the version number range, and the comparison result of the protocol version is that the actual configuration data is inconsistent with the standard configuration data.

[0094] Therefore, the detection results of Nginx include that the actual configuration data of the port is consistent with the standard configuration data, the actual configuration data of the communication protocol is consistent with the standard configuration data, the actual configuration data of the log file path is inconsistent with the standard configuration data, and the actual configuration data of the protocol version is inconsistent with the standard configuration data.

[0095] Process Apache according to the above operations performed on Nginx to obtain the detection results of Apache.

[0096] Step 304: When the actual configuration data of at least one configuration item among the M configuration items of the target software does not conform to the standard configuration data of the at least one configuration item, the host generates an update configuration file according to the specification file of the target software, and the update configuration file includes the update configuration data corresponding to the M configuration items respectively.

[0097] In this step, the content in the original configuration file of the target software remains unchanged, and the updated configuration data corresponding to the M configuration items in the updated configuration file of the target software are respectively consistent with the standard configuration data corresponding to the M configuration items in the specification file of the target software.

[0098] Optionally, before executing this step, the host sends the detection result of each software to be detected to the control terminal, the control terminal receives the detection result of each software, and outputs the detection result of each software. The output detection result includes the detection result of the target software. In the case that the actual configuration data of at least one configuration item in the detection result of the target software does not match the standard configuration data of the at least one configuration item, the technician may select a repair method for the configuration item of the target software in the control terminal, and the repair method is automatic repair or manual repair.

[0099] Optionally, the control end obtains the repair method selected by the technician. If the repair method is automatic repair, the control end sends an automatic repair command to the host, and the automatic repair command includes the software identifier of the target software. The host receives the automatic repair command and starts to perform the operation of this step. Among them, the technician may choose to automatically repair multiple software, that is, the automatic repair command may include software identifiers corresponding to multiple software.

[0100] For example, after the host obtains the detection results of Nginx and Apache, it sends the detection results of Nginx and Apache to the control end. The control end receives the detection results of Nginx and Apache and displays the following: Figure 5 The selection interface shown includes the detection results of Nginx, the detection results of Apache and two selection buttons corresponding to each software. Among them, one selection button is a selection button corresponding to the automatic method, and the other selection button is a selection button corresponding to the manual method. For Nginx, the repair method selected by the technician is the automatic repair method. The control end sends an automatic repair command to the host, and the automatic repair command includes the software identifier "nginx" of Nginx.

[0101] Optionally, in this step, the update configuration file of the target software is operated through the following 3041 to 3043, and the operations of 3041 to 3043 are:

[0102] 3043: Mirror the original configuration file of the target software to obtain a shadow file having the same content as the original configuration file of the target software.

[0103] In this step, the host receives the automatic repair command, obtains the original configuration file of the target software from the local according to the software identifier of the target software included in the automatic repair command, and copies the original configuration file of the target software to obtain a shadow file.

[0104] 3043: Determine, according to the detection result of the target software, at least one first-category target configuration item, wherein actual configuration data of each target configuration item in the at least one first-category target configuration item does not match standard configuration data.

[0105] 3043: Select a target configuration item from the at least one first-category target configuration item, and perform the following operations on the selected target configuration item until all target configuration items in the at least one first-category target configuration item are processed, thereby obtaining an updated configuration file.

[0106] For the selected target configuration item, the actual configuration data of the selected target configuration item in the shadow file is modified according to the standard configuration data of the selected target configuration item in the specification file.

[0107] Optionally, during implementation, standard configuration data and a repair method of the selected target configuration item are obtained from the specification file of the target software, and the actual configuration data of the selected target configuration item is modified in the shadow file through the repair method based on the standard configuration data of the selected target configuration item.

[0108] Optionally, in a case where the standard configuration data of the selected target configuration item is one data, the actual configuration data of the selected target configuration item is modified to the actual configuration data in the shadow file.

[0109] Optionally, in the case where the standard configuration data of the selected target configuration item is a data range, the actual configuration data of the selected target configuration item is modified to a data in the data range in the shadow file. Optionally, for example, a data is randomly selected from the reference data range or an intermediate data is selected, and the actual configuration data of the selected target configuration item is modified to the selected data in the shadow file.

[0110] For example, for Nginx, according to the detection result of Nginx, it is determined that the configuration items that are different from the standard configuration data include the log file path and the protocol version. The actual configuration data of the log file path obtained from the specification file of Nginx is "route2" and the repair method of the log file path. Through the repair method, the actual configuration data "route1" of the log file path is modified to route2 in the shadow file. The actual configuration data of the protocol version obtained from the specification file of Nginx is a version number range including V4, V5 and V6 and a repair method for the protocol version. The version number V5 is selected from the version number range. Through the repair method, the actual configuration data V3 of the protocol version is modified to V5 in the shadow file. In this way, an update configuration file of the Nginx software is obtained, and the update configuration data of the port includes the update configuration data of port number 2, the update configuration data of the communication protocol is the SSL protocol, the update configuration data of the protocol version is V5, and the update configuration data of the log file path is route2.

[0111] Optionally, the host outputs the update configuration file of the target software, so that the technician can confirm whether the update configuration data of each configuration item in the update configuration file meets the technician's requirements.

[0112] During implementation, the host sends the update configuration file of the target software to the control terminal, and the control terminal receives the update configuration file and outputs the update configuration file, for example, the control terminal displays the update configuration file, prints the update configuration file, or plays the update configuration file using a speaker.

[0113] Optionally, the technician finds that the updated configuration data of a certain type of configuration item in the update configuration file does not meet his own requirements, and chooses to directly modify the configuration data of this type of configuration item. For the sake of convenience, this type of configuration item is called the second type of target configuration item. The control end obtains the configuration data of each target configuration item in at least one second type of target configuration item modified by the technician, and sends a second modification command to the host, the second modification command including the software identifier of the target software and the configuration data of at least one second type of target configuration item.

[0114] The host receives the second modification command, selects a target configuration item from the at least one second-category target configuration item, and performs the following operations on the selected target configuration item until the target configuration items in the at least one second-category target configuration item are processed;

[0115] For the selected target configuration item, the actual configuration data of the selected target configuration item in the original configuration file of the target software is modified to the configuration data of the selected target configuration item contained in the second modification command, and the updated configuration data of the selected target configuration item in the updated configuration file of the target software is modified to the configuration data of the selected target configuration item contained in the second modification command.

[0116] Next, the host starts to execute the following step 305.

[0117] Optionally, the technician finds that the updated configuration data of a certain configuration item in the updated configuration file meets his / her own requirements, triggering the control end to send a confirmation command to the host. The host receives the confirmation command and then starts to perform the following step 305.

[0118] Optionally, after the control end displays the detection results of each software to be detected, for the target software, if there is a situation in the detection results of the target software where the actual configuration data of a certain type of configuration item does not match the standard configuration data of the type of configuration item, the technician may choose to manually repair the configuration item of the target software in the control end. For the sake of convenience, this type of configuration item is referred to as a third-type target configuration item. The control end obtains the configuration data of each target configuration item in at least one third-type target configuration item modified by the technician, and sends a manual repair command to the host, the manual repair command including the software identifier of the target software and the configuration data of at least one third-type target configuration item.

[0119] The host receives the manual repair command, selects a target configuration item from the at least one third-category target configuration item, and performs the following operations on the selected target configuration item until the target configuration items in the at least one third-category target configuration item are processed;

[0120] For the selected target configuration item, the actual configuration data of the selected target configuration item is modified in the original configuration file of the target software to the configuration data of the selected target configuration item contained in the manual repair command.

[0121] Step 305: The host saves the corresponding relationship between the software identifier of the target software, the first effective identifier, the original configuration file of the target software, and the updated configuration file of the target software.

[0122] In this step, the host computer stores two configuration files corresponding to the target software, one of which is the original configuration file and the other is the original configuration file. The first validation identifier is used to indicate that the configuration file currently in effect for the target software is an updated configuration file. In this way, when the target software is running, the target software can be controlled to access the updated configuration file through the first validation identifier. The detailed implementation process will be described later. Figure 7 The embodiments shown are described in detail and will not be described in detail here.

[0123] Optionally, during the operation of the target software, if the technician needs to replace the currently effective configuration file of the target software, the technician can trigger the control end to send a first modification command to the host, the first modification command is used to request to replace the currently effective configuration file of the target software, and the first modification command includes the software identifier of the target software. The host receives the first modification command, and according to the software identifier of the target software included in the first modification command, obtains the first effective identifier from the corresponding relationship between the software identifier of the target software, the effective identifier, the original configuration file of the target software and the updated configuration file of the target software, and replaces the first effective identifier with the second effective identifier, the second effective identifier is used to indicate that the currently effective configuration file of the target software is the original configuration file.

[0124] In an embodiment of the present application, when the host receives a detection command including the software identification of at least one software to be detected, the specification file and the original configuration file of each software are obtained. For one of the at least one software (referred to as the target software), the specification file of the target software includes the standard configuration data corresponding to the M configuration items of the target software, and the original configuration file of the target software includes the actual configuration data of the M configuration items of the target software. In the case where the actual configuration data of at least one configuration item in the M configuration items of the target software does not conform to the standard configuration data of the at least one configuration item, an update configuration file is generated according to the specification file of the target software, and the update configuration file includes the update configuration data of the M configuration items, and the original configuration file remains unchanged at this time, so that the configuration data of the target software can be automatically repaired based on the specification file of the target software, thereby improving the repair efficiency and accuracy. The host also saves the corresponding relationship between the software identification of the target software, the first effective identification, the original configuration file of the target software, and the updated configuration file of the target software, and the first effective identification is used to indicate that the configuration file currently in effect of the target software is the updated configuration file. In this way, when the target software is running, the configuration data of the configuration items in the updated configuration file can be provided to the target software according to the first effective identifier in the corresponding relationship, thus ensuring that the configuration data after the automatic repair of the target software can take effect. In addition, when the technician needs to replace the configuration file, the host receives the modification command and replaces the first effective identifier in the corresponding relationship with the second effective identifier. The second effective identifier is used to indicate that the configuration file currently in effect for the target software is the original configuration file, thus ensuring that the configuration file accessed by the target software is rolled back to the original configuration file, so that the target software can access the configuration data in the original configuration file.

[0125] See also Figure 6 The present application embodiment provides a method for detecting software compliance, which is applied to Figure 2 The hosts shown include:

[0126] Step 401: The host obtains a software identifier of at least one software to be detected.

[0127] In this step, the technician can trigger the host to display a detection interface, and input the software identification of one or more software to be detected in the detection interface. The host obtains the software identification of one or more software to be detected from the detection interface.

[0128] Optionally, the host displays the detection interface and obtains the detailed implementation process of the software to be detected, see Figure 3 The relevant contents of the control end in step 301 of the illustrated embodiment will not be described in detail here.

[0129] Step 402: The host obtains the specification file and the original configuration file of each software according to the software identification of each software to be detected.

[0130] Optionally, the host obtains the software specification file and the original configuration file for detailed implementation process, see Figure 3 The relevant contents in step 302 of the illustrated embodiment will not be described in detail here.

[0131] Step 403: The same as step 303, which will not be described in detail here.

[0132] Step 404: When the actual configuration data of at least one configuration item among the M configuration items of the target software does not conform to the standard configuration data of the at least one configuration item, the host generates an update configuration file according to the specification file of the target software, and the update configuration file includes the update configuration data corresponding to the M configuration items respectively. The target software is one of the at least one software to be detected, and M is an integer greater than 0.

[0133] Optionally, for detailed implementation of the host generating and updating the configuration file, see Figure 3 The relevant contents in step 304 of the illustrated embodiment will not be described in detail here.

[0134] Before executing this step, the host directly outputs the detection result of the target software. In this way, the technician can select the repair method for the configuration item of the target software on the host, which is automatic repair or manual repair. The host obtains the repair method, and if the repair method is automatic repair, this step is executed. If it is manual repair, the host directly displays the original configuration file of the target software to allow the technician to modify the actual configuration data of the configuration item in the original configuration file, and then directly save the modified original configuration file.

[0135] Optionally, after generating the update configuration file, the host directly outputs the update configuration file so that the technician can confirm whether the update configuration data of each configuration item in the update configuration file meets the technician's requirements. When implemented, the host can display the update configuration file, print the update configuration file, or play the update configuration file using a speaker.

[0136] Optionally, if the technician finds that the updated configuration data of a certain type of configuration item in the updated configuration file does not meet his own requirements, he directly modifies the configuration data of this type of configuration item. For the sake of convenience, this type of configuration item is called the second type of target configuration item. The host obtains the configuration data of each target configuration item in at least one second type of target configuration item modified by the technician, and then synchronously modifies the original configuration file and the updated configuration file of the target software. For the detailed modification process, see Figure 3 The relevant contents in step 304 of the illustrated embodiment will not be described in detail here.

[0137] Step 405: The same as step 305, which will not be described in detail here.

[0138] In an embodiment of the present application, the host displays a detection interface, obtains the software identification of at least one software to be detected through the detection interface, and then obtains the specification file and original configuration file of each software to be detected. For one of the at least one software (referred to as the target software), when the actual configuration data of at least one configuration item in the M configuration items of the target software does not conform to the standard configuration data of the at least one configuration item, an update configuration file is generated according to the specification file of the target software, and the update configuration file includes the update configuration data of the M configuration items, and the original configuration file remains unchanged at this time, so that the configuration data of the target software can be automatically repaired based on the specification file of the target software, improving the repair efficiency and accuracy, and the host also directly outputs the update configuration file, which is convenient for the technician to confirm. In addition, the host also saves the corresponding relationship between the software identification of the target software, the first effective identification, the original configuration file of the target software and the update configuration file of the target software, and the first effective identification is used to indicate that the configuration file currently in effect of the target software is the update configuration file. In this way, when the target software is running, the configuration data of the configuration items in the update configuration file can be provided to the target software according to the first effective identification in the corresponding relationship, so as to ensure that the configuration data after the automatic repair of the target software can take effect. In addition, when the technician needs to replace the configuration file, the host receives the modification command and replaces the first effective identifier in the corresponding relationship with the second effective identifier. The second effective identifier is used to indicate that the configuration file currently in effect for the target software is the original configuration file. This ensures that the configuration file accessed by the target software is rolled back to the original configuration file, so that the target software can access the actual configuration data in the original configuration file.

[0139] See also Figure 7 , the present application embodiment provides a method for running software, the method is applied to Figure 1 The host or Figure 2 The host shown, optionally, in this method the software is the above Figure 3 or Figure 6 The target software in the embodiment shown includes:

[0140] Step 501: The host loads a hook dynamic link library to a target process, where the target process is a process that runs a target software. The hook dynamic link library is used to intercept a configuration file access request initiated by the target process.

[0141] The target software is installed on the host. When the host needs to run the target software, it first starts the target process and uses the target process to run the target software.

[0142] In this step, when the target process is started, the host loads the hook dynamic link library to the target process. The hook dynamic link library is a dynamic link library in the host's operating system.

[0143] The host's operating system includes an interface library, which includes interfaces such as read, write, and open. These interfaces are used by the target process to access files. Assume that if the interface library is loaded into the target process, when the target process runs the target software, if it needs to access the configuration file, it calls the read interface from the interface library and passes the file identifier of the configuration file to the read interface. The file identifier includes the software identifier of the target software and the file type of the configuration file. That is, the target process initiates a configuration file access request and reads the content in the configuration file through the read interface.

[0144] In this step, the hook dynamic link library is set with the same interface name as each interface in the interface library, that is, the hook dynamic link library also includes interfaces such as read, write and open. However, the read, write and open interfaces included in the hook dynamic link library are not used to access files, but to obtain the file identifier passed in by the target process. In this step, the hook dynamic link library is loaded to the target process without loading the interface library, so that the access request initiated by the target process can be intercepted using the interface in the hook dynamic link library.

[0145] For example, see Figure 8 Taking Nginx as an example, the interface library of the host operating system is libc.so, and the file identifier of the Nginx configuration file is nginx.conf. This file identifier is the file identifier of the original configuration file of Nginx, and this file identifier includes the software identifier "nginx" of Nginx and the file type "conf". libc.so includes read, write, and open, and the hook dynamic link library also includes read, write, and open. However, the read function, write function, and open function included in libc.so are different from the read function, write function, and open function also included in the hook dynamic link library.

[0146] The host loads the hook dynamic link library into the target process running Nginx. When Nginx needs to access nginx.conf, it calls read from the hook dynamic link library and transmits the file identifier "nginx.conf" of the configuration file to read. The read notifies the host's operating system of the file identifier "nginx.conf" of the configuration file. In this way, the host can determine that the target process needs to access the configuration file of the target software based on the file identifier "nginx.conf" of the configuration file, thereby intercepting the configuration file access request initiated by the target process.

[0147] Step 502: The host intercepts a configuration file access request initiated by the target process through a hook dynamic link library. The access request includes a software identifier of the target software.

[0148] When the target process runs the target software, if it needs to access a file, it will call an interface from the hook dynamic link library in the target process and pass the file identifier of the file to the interface. The host obtains the file identifier of the file through the interface, thereby intercepting the access request initiated by the target process. The file identifier includes the software identifier of the target software and the file type of the file. When the file type is the configuration file of the target software, it is determined that a configuration file access request has been intercepted.

[0149] If it is determined that the intercepted access request is not a configuration file access request, the host calls the interface from the interface library, passes the file identifier to the interface, and provides the interface to the target process. In this way, the target process obtains the content of the file corresponding to the file identifier through the interface.

[0150] Step 503: The host obtains the currently effective configuration file of the target software according to the software identifier of the target software included in the configuration file access request, and the corresponding relationship between the software identifier, the effective identifier, the original configuration file, and the updated configuration file.

[0151] In this step, the host obtains the corresponding effective identifier from the corresponding relationship among the software identifier, the effective identifier, the original configuration file, and the updated configuration file according to the software identifier of the target software. If the obtained effective identifier is the first effective identifier, the updated configuration file of the target software is obtained from the corresponding relationship as the currently effective configuration file; if the obtained effective identifier is the second effective identifier, the original configuration file of the target software is obtained from the corresponding relationship as the currently effective configuration file.

[0152] Step 504: The host locates the configuration file access request to the currently effective configuration file, thereby providing the target process with configuration data of the configuration items included in the currently effective configuration file.

[0153] The host calls the interface for reading files (read) from the interface library of the operating system, transmits the file identifier of the currently effective configuration file to the interface, and provides the interface to the target process to locate the configuration file access request to the currently effective configuration file, so that the target process reads the configuration data from the currently effective configuration file through the interface.

[0154] For example, see Figure 8 , assuming that the file identifier of the Nginx update configuration file is update.nginx.conf, and the host obtains the Nginx current effective configuration file as the update configuration file. The host calls the interface "read" from libc.so, passes the file identifier "update.nginx.conf" to the interface "read", and provides the interface "read" to the target process, so that the target process reads the configuration data from the update configuration file through the interface "read".

[0155] In an embodiment of the present application, since the hook dynamic link library is loaded into the target process running the target software, the host can intercept the configuration file access request initiated by the target process through the hook dynamic link library. The host then obtains the corresponding effective identifier from the corresponding relationship between the software identifier, the effective identifier, the original configuration file and the updated configuration file according to the identifier of the target software included in the configuration file access request, obtains the configuration file currently in effect for the target software according to the effective identifier, and locates the configuration file access request to the currently effective configuration file. Since the currently effective configuration file of the target software is obtained through the effective identifier, when the effective identifier indicates that the currently effective configuration file is an updated configuration file, it is ensured that the automatically repaired updated configuration file can take effect, and the configuration data in the updated configuration file can be used by the target process. If it is necessary to roll back the effective configuration file to the original configuration file, it can be achieved by modifying the effective identifier.

[0156] See also Fig. 9 The present application embodiment provides a software compliance detection device 600, which can be applied to a host in any of the above embodiments, for example, the device 600 can be applied to Figure 1 , Figure 2 , Figure 3 , Figure 6 or Figure 7 The host of the embodiment includes:

[0157] Processing unit 601 is used to obtain the specification file and original configuration file corresponding to the target software, the specification file includes standard configuration data corresponding to M configuration items of the target software, and the original configuration file includes actual configuration data corresponding to M configuration items of the target software, where M is an integer greater than 0.

[0158] The processing unit 601 is further configured to generate an updated configuration file according to the specification file if actual configuration data of at least one configuration item among the M configuration items does not conform to standard configuration data of the at least one configuration item, wherein the updated configuration file includes updated configuration data corresponding to the M configuration items respectively, wherein the content of the original configuration file remains unchanged, and configuration data of at least one configuration item between the original configuration file and the updated configuration file is different;

[0159] The storage unit 602 is used to store the software identifier of the target software, the first effective identifier, the correspondence between the original configuration file and the updated configuration file, wherein the first effective identifier is used to indicate that the configuration file currently effective in the target software is the updated configuration file.

[0160] Optionally, the processing unit 601 obtains the detailed implementation process of the original configuration file and the specification file, see Figure 3 Step 302 of the illustrated embodiment or Figure 6 The relevant content of step 402 in the illustrated embodiment. For the detailed implementation process of the processing unit 601 generating the update configuration file, see Figure 3 Step 304 of the illustrated embodiment or Figure 6 The relevant content in step 404 of the illustrated embodiment.

[0161] Optionally, the apparatus 600 further includes: a first receiving unit 603,

[0162] A first receiving unit 603 is used to receive a first modification command, where the first modification command is used to request to replace a configuration file currently in effect for the target software, and the first modification command includes a software identifier of the target software;

[0163] The processing unit 601 is further configured to replace the first effective identifier in the corresponding relationship with a second effective identifier according to the software identifier of the target software, wherein the second effective identifier is used to indicate that the configuration file currently in effect for the target software is the original configuration file.

[0164] Optionally, the detailed implementation process of the processing unit 601 replacing the effective identification is as follows: Figure 3 Step 305 of the illustrated embodiment or Figure 6 The relevant content in step 405 of the illustrated embodiment.

[0165] Optionally, the processing unit 601 is further configured to:

[0166] intercepting a configuration file access request initiated by a target process, the configuration file access request including a software identifier of the target software, and the target process is generated after the target software is run;

[0167] According to the software identifier of the target software and the corresponding relationship, a currently effective configuration file is obtained, where the currently effective configuration file is an original configuration file or an updated configuration file;

[0168] The configuration file access request is located at the currently effective configuration file, thereby providing the target process with configuration data of the configuration items included in the currently effective configuration file.

[0169] Optionally, the detailed implementation process of the processing unit 601 intercepting the configuration file access request initiated by the target process is as follows: Figure 7 The relevant content in step 502 of the illustrated embodiment.

[0170] Optionally, for a detailed implementation process of the processing unit 601 locating the configuration file access request to the currently effective configuration file, see Figure 7 The relevant content in step 504 of the illustrated embodiment.

[0171] Optionally, the processing unit 601 is configured to:

[0172] Query the corresponding relationship according to the software identifier of the target software;

[0173] If the corresponding relationship includes the first effective identifier, obtaining the updated configuration file from the corresponding relationship as the currently effective configuration file;

[0174] If the corresponding relationship includes the second validity identifier, the original configuration file is obtained from the corresponding relationship as the currently valid configuration file.

[0175] Optionally, the processing unit 601 is further configured to:

[0176] Load the hook dynamic link library into the target process. The hook dynamic link library is used to intercept the configuration file access request initiated by the target process.

[0177] Optionally, the processing unit 601 is further configured to:

[0178] Mirror the original configuration file to obtain a shadow file with the same content as the original configuration file;

[0179] Determine, according to the specification file and the shadow file, at least one first-category target configuration item, wherein actual configuration data of each target configuration item in the at least one first-category target configuration item does not match standard configuration data;

[0180] Select a target configuration item from at least one first-category target configuration item, and perform the following operations on the selected target configuration item until each target configuration item in the at least one first-category target configuration item is processed, thereby obtaining an updated configuration file:

[0181] For the selected target configuration item, the actual configuration data of the selected target configuration item in the shadow file is modified according to the standard configuration data of the selected target configuration item in the specification file.

[0182] Optionally, the apparatus 600 further includes a second receiving unit 604,

[0183] The processing unit 601 is further used to output an update configuration file;

[0184] A second receiving unit 604 is configured to receive a second modification command, where the second modification command includes configuration data of at least one second-category target configuration item, where the at least one second-category target configuration item is a part of the M configuration items;

[0185] The processing unit 601 is further configured to select a target configuration item from the at least one second-category target configuration item, and perform the following operations on the selected target configuration item until each target configuration item in the at least one second-category target configuration item is processed;

[0186] For the selected target configuration item, the actual configuration data of the selected target configuration item in the original configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command, and the updated configuration data of the selected target configuration item in the updated configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command.

[0187] Optionally, the first receiving unit 603 and the second receiving unit 604 are two different units or the same unit.

[0188] Optionally, the processing unit 601 completes the detailed implementation process of processing at least one second-type target configuration item, see Figure 3 The relevant content in step 304 of the illustrated embodiment.

[0189] In the embodiment of the present application, since the processing unit obtains the specification file and the original configuration file of the target software, generates an updated configuration file according to the specification file, and indicates that the configuration file currently in effect for the target software is the updated configuration file through the first effective identifier, the configuration data is automatically repaired, and the efficiency and accuracy of repairing the configuration data are improved. Since the content of the original configuration file remains unchanged, and the storage unit stores the corresponding relationship between the software identifier of the target software, the first effective identifier, the original configuration file, and the updated configuration file, when it is necessary to restore to the configuration data before the repair, it is only necessary to modify the effective identifier in the corresponding relationship so that the effective identifier indicates that the configuration file currently in effect is the original configuration file, thereby enabling the restoration of the configuration data.

[0190] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0191] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting software compliance, characterized in that: The method comprises: Obtain a specification file and an original configuration file corresponding to the target software, wherein the specification file includes standard configuration data corresponding to M configuration items of the target software, and the original configuration file includes actual configuration data corresponding to the M configuration items of the target software, where M is an integer greater than 0; In a case where actual configuration data of at least one configuration item among the M configuration items does not conform to standard configuration data of the at least one configuration item, generating an updated configuration file according to the specification file, the updated configuration file including updated configuration data corresponding to the M configuration items respectively, wherein the content of the original configuration file remains unchanged, and configuration data of at least one configuration item between the original configuration file and the updated configuration file is different; saving a software identifier of the target software, a first validation identifier, a correspondence between the original configuration file and the updated configuration file, wherein the first validation identifier is used to indicate that the configuration file currently in effect for the target software is the updated configuration file; receiving a first modification command, the first modification command being used to request replacement of a configuration file currently in effect for the target software, the first modification command including a software identifier of the target software; According to the software identifier of the target software, the first validity identifier in the corresponding relationship is replaced with a second validity identifier, where the second validity identifier is used to indicate that the configuration file currently in effect for the target software is the original configuration file.

2. The method according to claim 1, characterized in that After the software identifier of the target software, the first validation identifier, the original configuration file and the corresponding relationship between the original configuration files are saved, the method further includes: intercepting a configuration file access request initiated by a target process, wherein the configuration file access request includes a software identifier of the target software, and the target process is generated after the target software is run; According to the software identifier of the target software and the corresponding relationship, acquiring the currently effective configuration file, wherein the currently effective configuration file is the original configuration file or the updated configuration file; The configuration file access request is located at the currently effective configuration file, thereby providing the target process with configuration data of the configuration items included in the currently effective configuration file.

3. The method according to claim 2, characterized in that The acquiring the currently effective configuration file according to the software identifier of the target software and the corresponding relationship includes: Querying the corresponding relationship according to the software identification of the target software; If the corresponding relationship includes the first validity identifier, obtaining the updated configuration file from the corresponding relationship as the currently valid configuration file; If the corresponding relationship includes the second validity identifier, the original configuration file is obtained from the corresponding relationship as the currently valid configuration file.

4. The method according to claim 2, characterized in that Before intercepting the configuration file access request initiated by the target process, the method further includes: A hook dynamic link library is loaded into the target process, wherein the hook dynamic link library is used to intercept a configuration file access request initiated by the target process.

5. The method according to any one of claims 1 to 4, characterized in that: Before generating the update configuration file according to the specification file, the method further includes: Mirroring the original configuration file to obtain a shadow file with the same content as the original configuration file; The step of generating an update configuration file according to the specification file includes: Determine, according to the specification file and the shadow file, at least one first-category target configuration item, wherein actual configuration data of each target configuration item in the at least one first-category target configuration item does not match standard configuration data; Selecting a target configuration item from the at least one first-category target configuration item, and performing the following operations on the selected target configuration item until each target configuration item in the at least one first-category target configuration item is processed, thereby obtaining the update configuration file: For the selected target configuration item, the actual configuration data of the selected target configuration item in the shadow file is modified according to the standard configuration data of the selected target configuration item in the specification file.

6. The method according to any one of claims 1 to 4, characterized in that: After the updating configuration file is generated according to the specification file, the method further includes: Output the update configuration file, receive a second modification command, the second modification command includes configuration data of at least one second-category target configuration item, the at least one second-category target configuration item is a part of the M configuration items; Selecting a target configuration item from the at least one second-category target configuration item, and performing the following operations on the selected target configuration item until each target configuration item in the at least one second-category target configuration item is processed; For the selected target configuration item, the actual configuration data of the selected target configuration item in the original configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command, and the updated configuration data of the selected target configuration item in the updated configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command.

7. A software compliance detection device, characterized in that: The device comprises: A processing unit, configured to obtain a specification file and an original configuration file corresponding to the target software, wherein the specification file includes standard configuration data corresponding to M configuration items of the target software, and the original configuration file includes actual configuration data corresponding to the M configuration items of the target software, where M is an integer greater than 0; The processing unit is further configured to generate an updated configuration file according to the specification file if actual configuration data of at least one configuration item among the M configuration items does not conform to standard configuration data of the at least one configuration item, wherein the updated configuration file includes updated configuration data corresponding to the M configuration items respectively, wherein the content of the original configuration file remains unchanged, and configuration data of at least one configuration item between the original configuration file and the updated configuration file is different; a storage unit, configured to store a software identifier of the target software, a first validation identifier, a correspondence between the original configuration file and the updated configuration file, wherein the first validation identifier is used to indicate that the configuration file currently in effect for the target software is the updated configuration file; A first receiving unit, configured to receive a first modification command, wherein the first modification command is used to request replacement of a configuration file currently in effect for the target software, and the first modification command includes a software identifier of the target software; The processing unit is further configured to replace the first validity identifier in the corresponding relationship with a second validity identifier according to the software identifier of the target software, wherein the second validity identifier is used to indicate that the configuration file currently in effect for the target software is the original configuration file.

8. The device according to claim 7, characterized in that The processing unit is further used for: intercepting a configuration file access request initiated by a target process, wherein the configuration file access request includes a software identifier of the target software, and the target process is generated after the target software is run; According to the software identifier of the target software and the corresponding relationship, acquiring the currently effective configuration file, wherein the currently effective configuration file is the original configuration file or the updated configuration file; The configuration file access request is located at the currently effective configuration file, thereby providing the target process with configuration data of the configuration items included in the currently effective configuration file.

9. The device according to claim 8, characterized in that The processing unit is used for: Querying the corresponding relationship according to the software identification of the target software; If the corresponding relationship includes the first validity identifier, obtaining the updated configuration file from the corresponding relationship as the currently valid configuration file; If the corresponding relationship includes the second validity identifier, the original configuration file is obtained from the corresponding relationship as the currently valid configuration file.

10. The device according to claim 8, characterized in that The processing unit is further used for: A hook dynamic link library is loaded into the target process, wherein the hook dynamic link library is used to intercept a configuration file access request initiated by the target process.

11. The device according to any one of claims 7 to 10, characterized in that The processing unit is further used for: Mirroring the original configuration file to obtain a shadow file with the same content as the original configuration file; Determine, according to the specification file and the shadow file, at least one first-category target configuration item, wherein actual configuration data of each target configuration item in the at least one first-category target configuration item does not match standard configuration data; Selecting a target configuration item from the at least one first-category target configuration item, and performing the following operations on the selected target configuration item until each target configuration item in the at least one first-category target configuration item is processed, thereby obtaining the update configuration file: For the selected target configuration item, the actual configuration data of the selected target configuration item in the shadow file is modified according to the standard configuration data of the selected target configuration item in the specification file.

12. The device according to any one of claims 7 to 10, characterized in that The device also includes a second receiving unit; The processing unit is further configured to output the update configuration file; The second receiving unit is configured to receive a second modification command, where the second modification command includes configuration data of at least one second-category target configuration item, where the at least one second-category target configuration item is a part of the M configuration items; The processing unit is further configured to select a target configuration item from the at least one second-category target configuration item, and perform the following operations on the selected target configuration item until each target configuration item in the at least one second-category target configuration item is processed; For the selected target configuration item, the actual configuration data of the selected target configuration item in the original configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command, and the updated configuration data of the selected target configuration item in the updated configuration file is modified to the configuration data of the selected target configuration item contained in the second modification command.

13. A computer program product, characterized in that The computer program product comprises program codes, and when a computer runs the program codes, the computer is caused to perform the method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, and when the program codes are executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 6.

Images