Application software RASP program update method, server, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a RASP program update method for application software, a server, an electronic device and a storage medium, and relates to the field of application security technology. The method includes: receiving a RASP program update instruction issued by a server control end; judging whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information; if so, obtaining the latest version of the RASP program engine package from the acquisition address; removing the currently running RASP program in the application software, releasing the resources associated with the currently running RASP program; inserting the latest version of the RASP program engine package into the class method of the application software. The present invention can complete the upgrade, repair and other business updates of the internal RASP program without restarting the application software, thereby avoiding the problem of application software business stopping due to RASP program updates.

Description

Technical Field

[0001] The present invention relates to the field of application security technology, and in particular to an update method, server, electronic device and storage medium of an application software RASP program. Background Art

[0002] Currently, most application software that integrates the existing RASP (Runtime application self-protection) needs to restart the application software (Application, sometimes also called application program in Chinese) when RASP upgrades or bug fixes are needed; taking products that use OpenRASP plug-ins as an example, when it needs to be upgraded, the RASP program engine needs to be manually upgraded the next time the application software is restarted, which may cause a brief business interruption of the application software. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a method, client, electronic device and storage medium for updating the RASP program inside application software, which can complete business updates such as upgrading and repairing the internal RASP program without restarting the application software, thereby avoiding the problem of application software business being stopped due to RASP program updates.

[0004] In order to achieve the above-mentioned invention object, the following technical scheme is adopted:

[0005] In a first aspect, an embodiment of the present invention provides a method for updating a RASP program of an application software, the method comprising the steps of: receiving a RASP program update instruction issued by a server control end; the update instruction carries the latest version of RASP program engine attribute information and an acquisition address maintained on the server control end; judging whether to update the currently running RASP program based on the latest version of RASP program engine attribute information and the currently running RASP program engine attribute information; if so, obtaining the latest version of the RASP program engine package from the acquisition address; removing the currently running RASP program in the application software and releasing resources associated with the currently running RASP program; and inserting the latest version of the RASP program engine package into a class method of the application software.

[0006] In combination with the first aspect, in a first implementation of the first aspect, the engine attribute information includes: an engine version number; the determining whether to update the currently running RASP program based on the engine attribute information of the latest version of the RASP program and the engine attribute information of the currently running RASP program includes: comparing the engine version number of the latest version of the RASP program with the engine version number of the currently running RASP program; if the engine version number of the latest version of the RASP program is greater than the engine version number of the currently running RASP program, determining to update the currently running RASP program.

[0007] In combination with the first aspect or the first implementation of the first aspect, in a second implementation of the first aspect, the engine attribute information includes: an engine version number and an engine package information summary value;

[0008] The determining whether to update the currently running RASP program based on the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information includes: comparing the latest version of the RASP program engine version number with the currently running RASP program engine version number, and comparing the latest version of the RASP program engine package information summary value with the currently running RASP program engine package information summary value; if the latest version of the RASP program engine version number is greater than the currently running RASP program engine version number, and the latest version of the RASP program engine package information summary value is consistent with the currently running RASP program engine package information summary value, then determining to update the currently running RASP program.

[0009] In combination with the first aspect, the first or second implementation of the first aspect, in the third implementation of the first aspect, after obtaining the latest version of the RASP program engine package from the acquisition address, the method also includes: determining whether the obtained latest version of the RASP program engine package is complete; if complete, updating according to the latest version of the RASP program engine package currently obtained.

[0010] In combination with the first aspect, the first, second or third implementation manner of the first aspect, in the fourth implementation manner of the first aspect, the removing of the currently running RASP program in the application software and releasing the resources associated with the currently running RASP program include: removing the custom class converter previously registered for the currently running RASP program in the RASP program host running environment; the RASP program host running environment is the virtual execution environment of the application software; traversing the instrumentation classes previously loaded in the method of inserting the currently running RASP program into the application software in the RASP program running environment, and rolling back all the loaded instrumentation classes to the original classes; releasing the resources associated with the currently running RASP program; the associated resources include: an instrumentation point manager, a class loader, and memory space occupied by the application software.

[0011] In combination with the first aspect, the first, second, third or fourth implementation manner of the first aspect, in the fifth implementation manner of the first aspect, the method of inserting the latest version of the RASP program engine package into the class of the application software includes: obtaining attribute information of the latest version of the RASP program engine package; the attribute information includes: engine package name and startup class; according to the engine package name and startup class, obtaining the top-level parent class loader and / or obtaining the system class loader of the current application software; identifying the top-level parent class loader and / or system class loader, and calling the top-level parent class loader and / or system class loader to load the engine class used to create the latest version of the RASP program; creating the latest version of the RASP program through the engine class.

[0012] In combination with the first aspect, any one of the first to fifth implementation modes of the first aspect, in the sixth implementation mode of the first aspect, the method of inserting the latest version of the RASP program engine package into the class of the application software also includes: after creating the latest version of the RASP program through the engine class, starting the latest version of the RASP program; obtaining all loaded classes in the RASP program host running environment, and determining whether the loaded class is a class to be inserted; if so, inserting the latest version of the RASP program into the corresponding class.

[0013] In combination with the first aspect, any one of the first to sixth implementations of the first aspect, in the seventh implementation of the first aspect, the latest version of the RASP program includes an attack detection algorithm, and the attack detection algorithm is used to detect whether a user request entering the application software processing process is a network security attack.

[0014] In a second aspect, an embodiment of the present invention further provides a server, including a host, on which application software is installed, and a RASP program is embedded in the application software. The RASP program accompanies the application software during its operation and is used to execute the update method of the RASP program of the application software described in any one of the first aspects for automatic upgrading and updating.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute the update method of the application software RASP program described in any one of the first aspects.

[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the update method of the application software RASP program described in any one of the first aspects.

[0017] The update method, server, electronic device and storage medium of the RASP program of the application software provided by the embodiment of the present invention include the following steps: receiving a RASP program update instruction issued by a server control end; judging whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information; if so, obtaining the latest version of the RASP program engine package from the acquisition address; removing the currently running RASP program in the application software and releasing the resources associated with the currently running RASP program; and inserting the latest version of the RASP program engine package into the class method of the application software. Through the above method steps, after receiving the RASP program update instruction issued by the server control end, it can be automatically determined whether an update is needed. After determining that an update is needed and obtaining the latest version of the RASP program engine package, the RASP program currently running in the application software is removed and the resources associated with the currently running RASP program are released. The application software can be restored to the state before the deployment of rasp. Therefore, a second installation and update can be performed without restarting the application software. The latest version of the RASP program engine package is inserted into the method of the class of the application software to automatically implement the business update of the RASP program in the application software, thereby avoiding the problem of application software business stopping due to the RASP program update. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of an embodiment of a method for updating an application software RASP program of the present invention;

[0020] Figure 2 A flowchart of another embodiment of a method for updating an application software RASP program of the present invention;

[0021] Figure 3 A flowchart of another embodiment of a method for updating an application software RASP program of the present invention;

[0022] Figure 4 A flowchart of another embodiment of a method for updating an application software RASP program of the present invention;

[0023] Figure 5 A flowchart of another embodiment of a method for updating an application software RASP program of the present invention;

[0024] Figure 6 A schematic block diagram of the architecture of a server embodiment provided by the present invention;

[0025] Figure 7 The figure is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. DETAILED DESCRIPTION

[0026] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0027] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The updating method of the application software RASP program provided in the embodiment of the present invention can be applied to a server, for example, a file server, a database server, an application program server, a WEB server, etc.

[0029] It should be noted that the method can be solidified in a certain manufactured product in the form of software, and when the user uses the product, the method flow of the present application can be reproduced.

[0030] Figure 1FIG. 1 is a flow chart of an embodiment of a method for updating an application software RASP program of the present invention; Figure 1 As shown, the updating method of the application software RASP program may include:

[0031] Step 110: Receive a RASP program update instruction issued by the server control end; the update instruction carries the attribute information and acquisition address of the latest version of the RASP program engine maintained on the server control end.

[0032] The full name of RASP is Runtime Application Self-protect, which is an application runtime self-protection program. It is deployed in application software to protect against attacks on the application software.

[0033] The server management and control end can be: a server management and control platform, for example, a cloud-controlled server management platform, which is a set of programs that control the operation of the server, the management and upgrade of software at different levels such as processing hardware, operating system and application software, and the resource management, performance maintenance and monitoring configuration of the system. IT administrators can observe the details of the hardware configuration of the remote system and monitor the usage and performance of key components such as processors, hard drives, and memory. Server management, deployment and software distribution functions can be expanded through optional additional products.

[0034] The server management and control end maintains basic information of the RASP program, for example, engine attribute information of the RASP program, and the engine package or the acquisition address of the engine package.

[0035] The RASP program is commonly known as a RASP probe (RASP Agent).

[0036] The RASP probe (RASP Agent) establishes a heartbeat connection with the server control end, and regularly sends and receives heartbeat packets sent by the server control end;

[0037] When the server management and control end maintains the latest version of the RASP program, the latest version of the RASP program update instruction is sent together with the heartbeat packet; for example, an upgrade field is added to the heartbeat packet, which may include: RASP probe (RASP program) ID, engine package attribute information, including configuration time, MD5, name, version, host host name, etc.

[0038] Before step 110, the maintenance personnel upload and maintain the engine on the cloud control server management platform:

[0039] When it is necessary to add new insertion points or increase or decrease or modify the detection algorithm in the RASP program, the maintenance personnel will upload the latest version of the RASP program engine package to the cloud control server management platform; check whether the file hash Md5 value of the currently uploaded RASP program engine package has been uploaded; if it has not been uploaded, then store the engine package in the cloud control server management platform; use the jarsigner-verify command to verify whether the uploaded engine package is complete, or verify whether the engine package is officially packaged and not modified by an untrusted third party; if it is complete or officially packaged, it is a trusted engine package; read the manifest metadata of the engine package, including: engine version, engine package name, startup class, packaging method, packaging time, Git version control related data, Git version control related data such as branch hash, commit, last committer name and email, packaging method and JDK version, etc.; store the above attribute information of the latest version of the RASP program engine together with the engine md5 in the database, ready to be sent to the server.

[0040] 120. Determine whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information.

[0041] According to the above latest version RASP program engine maintenance example, in some embodiments, the engine attribute information may include: engine version number.

[0042] See also Figure 2 As shown, the determining whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information (step 120) includes:

[0043] 121. Compare the version number of the latest RASP program engine with the version number of the currently running RASP program engine;

[0044] 122. If the latest version of the RASP program engine version number is greater than the currently running RASP program engine version number, determine to update the currently running RASP program.

[0045] In some other embodiments, the engine attribute information further includes: an engine packet message digest value (message-digest value), such as an MD5 (Message-digest algorithm 5) value.

[0046] See also Figure 3As shown, the determining whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information (step 120) includes:

[0047] 121′, comparing the version number of the latest RASP program engine with the version number of the currently running RASP program engine, and comparing the summary value of the latest RASP program engine package information with the summary value of the currently running RASP program engine package information;

[0048] 122'. If the latest RASP program engine version number is greater than the currently running RASP program engine version number, and the latest RASP program engine package information digest value is consistent with the currently running RASP program engine package information digest value, it is determined to update the currently running RASP program.

[0049] 130. If yes, obtain the latest version of the RASP program engine package from the acquisition address.

[0050] See also Figure 4 As shown, as an optional embodiment, after obtaining the latest version of the RASP program engine package from the acquisition address, the method also includes: step 135, determining whether the obtained latest version of the RASP program engine package is complete; step 136, if complete, updating according to the latest version of the RASP program engine package currently obtained.

[0051] In some embodiments, the engine attribute information includes: an engine package information digest value and a corresponding first information digest algorithm; the determining whether the latest version of the RASP program engine package is complete includes:

[0052] Read the latest version of the RASP program engine package content, and calculate the corresponding information digest value according to the first information digest algorithm; determine whether the calculated information digest value is consistent with the engine package information digest value carried in the update instruction; if they are consistent, determine that the latest version of the RASP program engine package currently obtained is complete.

[0053] 140. Remove the RASP program currently running in the application software, and release resources associated with the RASP program currently running.

[0054] Please see Figure 5 As shown, the removing of the currently running RASP program in the application software and releasing the resources associated with the currently running RASP program (step 140) includes:

[0055] 141. Remove the custom class transformer previously registered for the currently running RASP program in the RASP program host running environment; the RASP program host running environment is the virtual execution environment of the application software.

[0056] Specifically, you can use the removeTransformer method of the instrumentation technology to remove the custom Transformer that was previously registered.

[0057] In JAVA technology, using Instrumentation, developers can build an agent independent of the application to monitor and assist programs running on the JVM (Java Virtual Machine), and even replace and modify the definitions of certain classes.

[0058] It is understandable that once a transformer is registered with instrumentation, it will be called whenever a class is defined (ClassLoader.defineClass) or redefined (Instrumentation.redefineClasses). Therefore, in order to update the RASP program, it is necessary to remove the previously registered custom Transformer in order to release the resource and re-register the corresponding custom Transformer for the new RASP program.

[0059] 142. Traverse the Hook classes previously loaded in the RASP program running environment to insert the currently running RASP program into the method of the application software, and roll back all the loaded Hook classes to the original classes.

[0060] In this embodiment, by traversing all hooked classes, retransformClasses of the instrumentation technology can be used to roll back to the original class.

[0061] 143. Release resources associated with the currently running RASP program; the associated resources include: an insertion point manager, a class loader, and memory space occupied by the application software.

[0062] Through the above method steps, the resources of the original RASP program engine are released, such as the hook point manager, the ClassLoader (class loader) used for loading, the memory space occupied by the application software, etc., and restored to the original state before the RASP program is deployed. The RASP program engine can be hot updated without restarting the application software, thereby avoiding the problem of suspension of application software business due to restart.

[0063] 150. Insert the latest version of the RASP program engine package into the class method of the application software.

[0064] In the Java programming language, a class is an object-oriented (OOP) tool in the Java programming language, and is a blueprint or template for creating objects of the same type. In the Java programming language, a program can have multiple classes, and a class can have multiple methods (sometimes also called functions). Methods define the actions that objects of a class can perform; however, only one class requires a main method, which is the entry point of the application. According to the technical concept of the present invention, the RASP program can be inserted into any method of any class of the application software.

[0065] In some embodiments, the method of inserting the latest version of the RASP program engine package into the class of the application software (step 150) includes: obtaining attribute information of the latest version of the RASP program engine package; the attribute information includes: engine package name and startup class.

[0066] It can also include: the engine version listed above, packaging method, packaging time, Git version control related data, JDK version, etc.

[0067] In this embodiment, after loading the engine package (engine file), the metadata (Manifest) in the engine file can be read to obtain basic attribute information such as the engine package name and startup class.

[0068] According to the engine package name and startup class, obtain the top-level parent class loader and / or obtain the system class loader of the current application software.

[0069] According to the characteristics of JVM parent delegation, in this embodiment, by obtaining the top-level parent class loader and / or obtaining the system class loader (SystemClassLoader) of the current application software, a wider compatibility can be provided for class loading.

[0070] The top-level parent class loader and / or the system class loader are identified, and the top-level parent class loader and / or the system class loader are called to load the engine class used to create the latest version of the RASP program; the latest version of the RASP program is created through the engine class.

[0071] By using the above class loader or its wrapped custom loader, such as URLClassLoader), to load the engine, you can create the latest version of the RASP engine instance in the blueprint or template provided by the class.

[0072] Further, the method of inserting the latest version of the RASP program engine package into the class of the application software (step 150) further includes: after creating the latest version of the RASP program through the engine class, starting the latest version of the RASP program;

[0073] During the startup process, the engine is initialized first, including version information, logs, and initialization of the detection algorithm in the engine package, and the bytecode-like converter is initialized through the addTransformer method of the instrumentation technology.

[0074] Obtain all loaded classes in the RASP program host running environment, and determine whether the loaded class is a class to be plugged; if so, insert the latest version of the RASP program into the corresponding class.

[0075] The RASP program host operating environment is a virtual execution environment of the application software, such as JVM (Java virtual machine); all loaded classes in the current JVM are obtained through the getAllLoadedClasses method of the instrumentation technology (instrumentation technology framework).

[0076] In this embodiment, all loaded classes in the JVM can be traversed through the traversal algorithm. When it is determined that a class needs to be hooked, the retransform method of the instrumentation technology is called to insert the latest version of the RASP program into the corresponding class. Since the JVM is the virtual execution environment of the application software, inserting the latest version of the RASP program into the corresponding class in the JVM actually means inserting the latest version of the RASP program into the class of the application software.

[0077] In some embodiments, the latest version of the RASP program includes an attack detection algorithm, which is used to detect whether a user request entering the application software processing process is a network security attack.

[0078] In this embodiment, the RASP program containing the security detection algorithm code can be inserted into the entry and exit of the key method, such as the Main function, to achieve real-time self-protection of the application software and improve the operation security of the application software and the host server.

[0079] The updating method of the RASP program of the application software provided by the embodiment of the present invention can automatically determine whether an update is needed after receiving the RASP program update instruction issued by the server control end through the above method steps 110 to 150. After determining that an update is needed and obtaining the latest version of the RASP program engine package, the application software can be restored to the state before the deployment of RASP by removing the currently running RASP program in the application software and releasing the resources associated with the currently running RASP program. Therefore, a second installation and update can be performed without restarting the application software. The latest version of the RASP program engine package is inserted into the method of the class of the application software to automatically realize the hot update of the RASP program in the application software, thereby avoiding the problem of application software business stopping due to the RASP program update.

[0080] Embodiment 2

[0081] Figure 6 This is a schematic block diagram of the server embodiment of the present invention, please refer to Figure 6 As shown, it includes a host, on which application software is installed, and a RASP program is embedded in the application software. The RASP program accompanies the application software during its operation and can be used to execute the updating method of the application software RASP program described in any one of the embodiments of the first embodiment to automatically upgrade and update.

[0082] The server of this embodiment can be used to execute Figure 1 The technical solution of the method embodiment shown, the server of this embodiment, its implementation principle and technical effect are similar to those of embodiment 1, and will not be described in detail here, and can be referenced by each other.

[0083] Embodiment 3

[0084] The present invention also provides an electronic device according to an embodiment, comprising one or more processors; a memory; the memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute any method described in embodiment one.

[0085] Figure 7 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 7As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program codes; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, which is used to execute the update method of the application software RASP program described in any of the above-mentioned embodiments one.

[0086] The specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the updating method of the application software RASP program of the present invention, which will not be repeated here.

[0087] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: This type of device is characterized by having mobile communication functions and its main goal is to provide voice and data communications. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end mobile phones. (2) Ultra-mobile personal computer devices: This type of device belongs to the category of personal computers, has computing and processing functions, and generally also has mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: This type of device can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0088] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the update method of the application software RASP program described in any of the above-mentioned embodiments.

[0089] In summary, according to the description of the above embodiments, the updating method of the application software RASP program disclosed in this embodiment can inject the RASP probe program into the application software without restarting the application software, thereby realizing the hot upgrade and update of the original RASP probe program, thereby avoiding the problem of application software business being stopped due to the RASP program update.

[0090] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0091] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0092] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0093] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can also be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0094] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for updating an application software RASP program, characterized in that: The method comprises the steps of: Receive a RASP program update instruction issued by the server control end; the update instruction carries the attribute information and acquisition address of the latest version of the RASP program engine maintained on the server control end; Determining whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information; If yes, then obtain the latest version of the RASP program engine package from the acquisition address; Removing the RASP program currently running in the application software and releasing resources associated with the RASP program currently running; Insert the latest version of the RASP program engine package into the class method of the application software; The engine attribute information includes: engine version number and engine package information summary value; The determining whether to update the currently running RASP program according to the latest version of the RASP program engine attribute information and the currently running RASP program engine attribute information includes: Compare the latest version RASP program engine version number with the currently running RASP program engine version number, and compare the latest version RASP program engine package information digest value with the currently running RASP program engine package information digest value; If the latest version of the RASP program engine version number is greater than the currently running RASP program engine version number, and the latest version of the RASP program engine package information digest value is consistent with the currently running RASP program engine package information digest value, then determine to update the currently running RASP program; After obtaining the latest version of the RASP program engine package from the acquisition address, the method further includes: determining whether the obtained latest version of the RASP program engine package is complete; If it is complete, update it according to the latest version of the RASP program engine package currently obtained; The engine attribute information includes: an engine package information digest value and a corresponding first information digest algorithm; the step of determining whether the latest version of the RASP program engine package is complete includes: Read the latest version of the RASP program engine package content, and calculate the corresponding information digest value according to the first information digest algorithm; determine whether the calculated information digest value is consistent with the engine package information digest value carried in the update instruction; if they are consistent, determine that the latest version of the RASP program engine package currently obtained is complete; The method of inserting the latest version of the RASP program engine package into the class of the application software includes: Obtaining attribute information of the latest version of the RASP program engine package; the attribute information includes: engine package name and startup class; According to the engine package name and startup class, obtain the top-level parent class loader and / or obtain the system class loader of the current application software; Identify the top-level parent class loader and / or the system class loader, and call the top-level parent class loader and / or the system class loader to load the engine class used to create the latest version of the RASP program; Create the latest version of RASP program through the engine class.

2. The updating method of the application software RASP program according to claim 1, characterized in that: The removing the RASP program currently running in the application software and releasing resources associated with the RASP program currently running includes: Removing a custom class converter previously registered for a currently running RASP program in a RASP program host operating environment; the RASP program host operating environment is a virtual execution environment of the application software; Traversing the previously loaded stub classes in the RASP program running environment for inserting the currently running RASP program into the method of the application software, and rolling back all the loaded stub classes to the original classes; Release the resources associated with the currently running RASP program; the associated resources include: an instrumentation point manager, a class loader, and memory space occupied by the application software.

3. The updating method of the application software RASP program according to claim 1, characterized in that: The method of inserting the latest version of the RASP program engine package into the class of the application software further includes: after creating the latest version of the RASP program through the engine class, starting the latest version of the RASP program; Obtain all loaded classes in the RASP program host running environment, and determine whether the loaded classes are classes to be plugged; If so, insert the latest version of the RASP program into the corresponding class.

4. The updating method of the application software RASP program according to claim 3, characterized in that: The latest version of the RASP program includes an attack detection algorithm, which is used to detect whether a user request entering the application software processing process is a network security attack.

5. A server, characterized in that: It comprises a host, on which application software is installed, in which a RASP program is embedded, and the RASP program accompanies the running of the application software and is used to execute the updating method of the RASP program of the application software as described in any one of claims 1 to 4 for automatic upgrading and updating.

6. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the method described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method of any one of claims 1 to 4.

Images