Security acceptance method, device, apparatus and storage medium

Abstract

The application belongs to the technical field of computers, and particularly relates to a safety acceptance method, device, equipment and storage medium, which are used to improve the efficiency of safety acceptance. The safety acceptance method comprises the following steps: in response to a safety acceptance instruction, obtaining a safety standard item to be accepted of a target project; based on a smart contract, performing acceptance on the safety standard item to be accepted; and outputting an acceptance result of the target project. The application can greatly improve the efficiency of safety acceptance and guarantee the accuracy and authority of the safety acceptance result.

Description

Technical Field

[0001] This application belongs to the field of computer technology, specifically relating to a security acceptance method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of information technology, security issues have gradually become a significant factor affecting and restricting the development of network applications. By examining the security status of application systems, we can assess the security of application systems and integrated environments from an information security perspective. This allows us to properly address any issues discovered and prevent security vulnerabilities from remaining after system deployment and becoming hidden threats.

[0003] Currently, the security acceptance of application systems is usually deployed in office automation (OA) systems, and the operation is carried out through the fixed processes of the OA system. Each node requires the corresponding personnel to log in to the OA system to operate, which leads to low efficiency. Summary of the Invention

[0004] In order to solve the above-mentioned problems in the prior art, namely to improve the efficiency of security acceptance, this application provides a security acceptance method, apparatus, equipment and storage medium.

[0005] Firstly, this application provides a security acceptance method, including:

[0006] In response to a safety acceptance command, obtain the safety standard items to be accepted for the target project;

[0007] Based on smart contracts, the security standard items to be accepted are accepted. The smart contract is used to generate corresponding verification codes based on the acceptance information of the target project. The acceptance information of the target project includes at least the input parameters and security acceptance codes of the security standard items to be accepted.

[0008] Output the acceptance results of the target project.

[0009] In one possible implementation, based on a smart contract, the security standard item to be accepted is inspected, including: obtaining the verification code corresponding to the input parameter of the security standard item to be accepted; if it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtaining the verification code corresponding to the security acceptance code of the security standard item to be accepted; if it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then inspecting the security standard item to be accepted according to the security acceptance code; and writing the inspection result of the security standard item to be accepted into the smart contract.

[0010] In one possible implementation, the security acceptance method further includes: if it is determined that the verification code corresponding to the input parameter is inconsistent with the verification code of the corresponding input parameter in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unacceptable; or, if it is determined that the verification code corresponding to the security acceptance code is inconsistent with the verification code of the corresponding security acceptance code in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unacceptable.

[0011] In one possible implementation, outputting the acceptance result of the target project includes: if at least one security standard item to be accepted is determined to have failed acceptance, then the acceptance result of the target project is determined to have failed acceptance; or, if all security standard items to be accepted are determined to have passed acceptance, then the acceptance result of the target project is determined to have passed acceptance; outputting an acceptance report corresponding to the acceptance result; if the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is determined to be consistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target project is determined to have passed acceptance; or, if the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is determined to be inconsistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target project is determined to have failed acceptance.

[0012] In one possible implementation, the security acceptance method further includes: if the security standard item to be accepted does not have a corresponding security acceptance code, then receiving the security proof information corresponding to the security standard item to be accepted; receiving the acceptance result of the security standard item to be accepted; and writing the acceptance result of the security standard item to be accepted into the smart contract.

[0013] In one possible implementation, before obtaining the security standard items to be accepted for the target project in response to the security acceptance instruction, the method further includes: receiving project-related information of the target project; generating corresponding initial security standard items to be accepted based on the project-related information; determining the security standard items to be accepted based on the initial security standard items to be accepted; and generating corresponding evidence descriptions based on the security standard items to be accepted.

[0014] In one possible implementation, after generating the corresponding evidence description based on the security standard item to be accepted, the method further includes: writing the security standard item to be accepted, the evidence description corresponding to the security standard item to be accepted, the input parameters of the security standard item to be accepted, and the security acceptance code into a smart contract, so that the smart contract generates the verification code corresponding to the input parameters of the security standard item to be accepted and the verification code corresponding to the security acceptance code of the security standard item to be accepted.

[0015] Secondly, this application provides a safety acceptance device, comprising:

[0016] The acquisition module is used to acquire the safety standard items to be accepted for the target project in response to the safety acceptance command;

[0017] The acceptance module is used to perform acceptance testing on the security standard items to be accepted based on smart contracts. The smart contracts are used to generate corresponding verification codes based on the acceptance information of the target project. The acceptance information of the target project includes at least the input parameters and security acceptance codes of the security standard items to be accepted.

[0018] The output module is used to output the acceptance results of the target project.

[0019] In one possible implementation, the acceptance module is specifically used to: obtain the verification code corresponding to the input parameter of the security standard item to be accepted; if it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtain the verification code corresponding to the security acceptance code of the security standard item to be accepted; if it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then accept the security standard item to be accepted according to the security acceptance code; and write the acceptance result of the security standard item to be accepted into the smart contract.

[0020] In one possible implementation, the acceptance module is further configured to: if the verification code corresponding to the input parameter is inconsistent with the verification code of the corresponding input parameter in the smart contract, then determine that the acceptance result of the security standard item to be accepted is unacceptable; or, if the verification code corresponding to the security acceptance code is inconsistent with the verification code of the corresponding security acceptance code in the smart contract, then determine that the acceptance result of the security standard item to be accepted is unacceptable.

[0021] In one possible implementation, the output module is specifically used to: determine the target project's acceptance result as failed if at least one security standard item to be accepted is found to have failed acceptance; or, determine the target project's acceptance result as passed if all security standard items to be accepted are found to have passed acceptance; output the acceptance report corresponding to the acceptance result; if the verification code corresponding to the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result in the smart contract, output the target project's acceptance result as passed acceptance; or, if the verification code corresponding to the security standard item to be accepted in the acceptance report is inconsistent with the verification code of the corresponding acceptance result in the smart contract, output the target project's acceptance result as failed acceptance.

[0022] In one possible implementation, the acceptance module is further configured to: receive the security certification information corresponding to the security standard item to be accepted if there is no corresponding security acceptance code; receive the acceptance result of the security standard item to be accepted; and write the acceptance result of the security standard item to be accepted into the smart contract.

[0023] In one possible implementation, the security acceptance device further includes a generation module, which is used to receive project-related information of the target project before obtaining the security standard items to be accepted for the target project in response to the security acceptance instruction; generate corresponding initial security standard items to be accepted based on the project-related information; determine the security standard items to be accepted based on the initial security standard items to be accepted; and generate corresponding evidence descriptions based on the security standard items to be accepted.

[0024] In one possible implementation, the security acceptance device further includes a writing module, which, after generating corresponding evidence descriptions based on the security standard items to be accepted, writes the security standard items to be accepted, the evidence descriptions corresponding to the security standard items to be accepted, the input parameters of the security standard items to be accepted, and the security acceptance code into a smart contract, so that the smart contract generates the verification code corresponding to the input parameters of the security standard items to be accepted and the verification code corresponding to the security acceptance code of the security standard items to be accepted.

[0025] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0026] The memory stores the instructions that the computer executes;

[0027] The processor executes computer execution instructions stored in memory to implement the security acceptance method as described in the first aspect of this application.

[0028] Fourthly, this application provides a computer-readable storage medium storing computer program instructions, which, when executed, implement the security acceptance method as described in the first aspect of this application.

[0029] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the security acceptance method as described in the first aspect of this application.

[0030] Those skilled in the art will understand that in this application, by responding to a security acceptance command, the security standard items to be accepted for the target project are obtained; based on a smart contract, the security standard items to be accepted are accepted; and the acceptance result of the target project is output. Because this application is based on a smart contract and automatically accepts the security standard items to be accepted, it can greatly improve the efficiency of security acceptance and ensure the accuracy and authority of the security acceptance results. Attached Figure Description

[0031] Preferred embodiments of the security acceptance method, apparatus, equipment, and storage medium of this application will now be described with reference to the accompanying drawings. The drawings are as follows:

[0032] Figure 1 This is a schematic diagram illustrating an application scenario provided in one embodiment of this application;

[0033] Figure 2 A flowchart of a security acceptance method provided in an embodiment of this application;

[0034] Figure 3 A flowchart of a security acceptance method provided in another embodiment of this application;

[0035] Figure 4 This is a schematic diagram of the structure of a safety inspection device provided in an embodiment of this application;

[0036] Figure 5 A schematic diagram illustrating the interaction between an electronic device and a smart contract according to an embodiment of this application;

[0037] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0038] First, those skilled in the art should understand that these embodiments are merely for explaining the technical principles of this application and are not intended to limit the scope of protection of this application. Those skilled in the art can make adjustments as needed to adapt to specific application scenarios.

[0039] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms "a" and "the" as used in the embodiments of this application are also intended to include the plural forms unless the context clearly indicates otherwise.

[0040] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can be represented as: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0041] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0042] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0043] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0044] First, the technical terms used in this application will be explained:

[0045] Blockchain is a distributed shared ledger and database. It is a new application model of computer technologies such as distributed storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. It has the characteristics of decentralization, immutability, full traceability, collective maintenance, and openness and transparency.

[0046] A smart contract is a computer protocol designed to disseminate, verify, or execute contracts in an informational manner. Once established and deployed, this protocol can self-execute and self-verify without human intervention. Technically, a smart contract can be viewed as a computer program that autonomously executes all or part of the operations related to the smart contract and generates verifiable evidence demonstrating the validity of the contract's execution. Before deployment, the logical flow of all terms related to the smart contract is already defined. Smart contracts typically have a user interface for users to interact with the contract, and these interactions strictly adhere to the pre-defined logical flow. Thanks to cryptographic techniques, these interactions can be rigorously verified to ensure the smart contract executes smoothly according to the pre-established rules, thus preventing breaches of contract.

[0047] During application system security acceptance testing in enterprises, human factors (such as disagreements on acceptance results) can lead to inconsistent security acceptance standards and discrepancies in the compliance of security documentation submitted by developers with the required security standards. This significantly reduces the authority of the security acceptance process. Currently, application system security acceptance is typically deployed within an OA (Office Automation) system, using its fixed workflow. Each step requires specific personnel to log in to the OA system, resulting in excessive workflow steps, long processing times, and cumbersome procedures. Furthermore, developers often lack understanding of security acceptance procedures and frequently have the following questions: What are the security acceptance standards? Does the provided documentation meet the security acceptance standards? What if a certain aspect of the security acceptance standards is inapplicable to the developed application system?

[0048] To address the aforementioned issues, this application provides a security acceptance method, apparatus, device, and storage medium. Based on smart contracts, it can automatically accept the security standard items of a target project, thereby significantly improving the efficiency of security acceptance and ensuring the accuracy and authority of the security acceptance results.

[0049] The following section provides examples illustrating the application scenarios of the solution provided in this application.

[0050] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 1 As shown, in this application scenario, server 102 in the blockchain deploys the application system to be accepted. Server 101 in the blockchain receives a security acceptance request for the application system to be accepted, performs acceptance testing on the application system based on the blockchain's smart contract, and outputs the corresponding acceptance result. The specific implementation process of server 101 performing acceptance testing on the application system based on the blockchain's smart contract and outputting the corresponding acceptance result can be found in the solutions of the following embodiments.

[0051] It should be noted that, Figure 1 This is merely a schematic diagram illustrating one application scenario provided by an embodiment of this application. This embodiment does not necessarily represent... Figure 1 The included equipment is not limited, nor is it restricted. Figure 1 The positional relationships between the devices are defined.

[0052] Next, the safety acceptance method will be introduced through specific examples.

[0053] Figure 2 This is a flowchart illustrating a security acceptance method provided in one embodiment of this application. The method of this embodiment can be applied to an electronic device, which may be a server or a server cluster, etc. Figure 2As shown, the method in this application embodiment includes:

[0054] S201. In response to the safety acceptance instruction, obtain the safety standard items to be accepted for the target project.

[0055] In this embodiment, the security acceptance command can be input by a user to the electronic device executing this embodiment (e.g., by the user operating the interface button corresponding to the security acceptance command), or it can be sent by another device to the electronic device executing this embodiment. The target project is, for example, an application system to be accepted. The security standards for the target project are pre-defined; for example, the target project may have 100 security standards to be accepted. How to define the security standards for the target project can be referred to subsequent embodiments, and will not be repeated here. Therefore, in response to the security acceptance command, the security standards for the target project can be obtained.

[0056] S202. Based on smart contracts, conduct acceptance testing on the security standard items to be accepted.

[0057] The smart contract is used to generate a corresponding verification code based on the acceptance information of the target project. The acceptance information of the target project includes at least the input parameters of the security standard items to be accepted and the security acceptance code.

[0058] For example, the verification code corresponding to the acceptance information of the target project generated by the smart contract can ensure the authority of the acceptance results of the security standard items to be accepted. The security acceptance code, such as a script or program, can automatically determine whether the security standard items to be accepted have passed acceptance, thus enabling automated acceptance. For example, to determine whether the operating system has the Transmission Control Protocol (TCP) port 22 open, the security acceptance code will have corresponding acceptance script code that can automatically log into the operating system, automatically list the open ports within the operating system, and then automatically determine whether TCP port 22 is open. When accepting the security standard items to be accepted based on the smart contract, it is determined whether the security standard items to be accepted have passed acceptance. For security standard items that have passed acceptance, the corresponding acceptance results are recorded; for example, security standard items that have passed acceptance are marked as "completed," and security standard items that have failed acceptance are marked as "incomplete." For how to accept security standard items based on the smart contract, please refer to the following embodiments, which will not be repeated here.

[0059] S203, Output the acceptance results of the target project.

[0060] In this step, based on the smart contract, after the security standard items to be accepted have been accepted, the acceptance result of the target project can be output. For example, if the acceptance results of all the security standard items to be accepted are marked as "completed", then the acceptance result of the target project is "accepted"; if the acceptance result of at least one security standard item to be accepted is "not completed", then the acceptance result of the target project is "failed".

[0061] The security acceptance method provided in this application, in response to a security acceptance command, obtains the security standard items to be accepted for the target project, performs acceptance on the security standard items based on a smart contract, and outputs the acceptance result of the target project. Because this application embodiment automatically performs acceptance on the security standard items based on a smart contract, it can greatly improve the efficiency of security acceptance and ensure the accuracy and authority of the security acceptance results.

[0062] Based on the above embodiments, the safety standard items to be accepted for the target project are pre-defined. Therefore, in one specific embodiment, before obtaining the safety standard items to be accepted for the target project in response to the safety acceptance instruction, the method may further include: receiving project-related information of the target project; generating corresponding initial safety standard items to be accepted based on the project-related information; determining the safety standard items to be accepted based on the initial safety standard items to be accepted; and generating corresponding evidence descriptions based on the safety standard items to be accepted.

[0063] For example, the project-related information of the target project includes information relevant to the target project's ability to run, such as the target project's operating system being Linux and the database being MySQL. Before the development of the application system corresponding to the target project, project team members submit project-related information. Accordingly, the electronic device executing this method embodiment receives the project-related information of the target project and generates corresponding initial security standard items to be accepted based on the project-related information. For example, if the target project uses a Linux operating system in the project-related information submitted by the project team members, then the corresponding initial security standard items to be accepted will include security acceptance requirements related to the Linux operating system. Based on the initial security standard items to be accepted, the security standard items to be accepted are confirmed manually (e.g., by personnel from the enterprise's security department). Specifically, for the initial security standard items to be accepted, applicable security standard items are marked as "incomplete," and inapplicable security standard items are marked as "not applicable." The determined "incomplete" security standard items are the security standard items to be accepted, and corresponding evidence descriptions are automatically generated based on the security standard items to be accepted. Specifically, the evidence descriptions include, for example, screenshots of the corresponding functions of the target project, function code, related documents, and system verification interfaces. For example, if the security standard item to be accepted is "User login requires access to the X authentication system," then corresponding evidence will be automatically generated to prompt relevant personnel to submit key code for accessing the X authentication system, as well as security proof materials such as screenshots. For example, if the security standard item to be accepted is "Server port 22 needs to be closed," then the corresponding evidence could be described as "Linux server needs to close TCP port 22." For example, the evidence for the security standard item to be accepted can be jointly confirmed by the enterprise's security department personnel and project team members. If there are any objections, the security department personnel need to re-mark the security standard item to determine the security standard item to be accepted for the target project.

[0064] Further, optionally, after generating the corresponding evidence description based on the security standard item to be accepted, it may also include: writing the security standard item to be accepted, the evidence description corresponding to the security standard item to be accepted, the input parameters of the security standard item to be accepted, and the security acceptance code into the smart contract, so that the smart contract generates the verification code corresponding to the input parameters of the security standard item to be accepted and the verification code corresponding to the security acceptance code of the security standard item to be accepted.

[0065] For example, after generating corresponding evidence descriptions based on the security standards to be accepted, the security standards to be accepted, the corresponding evidence descriptions, the input parameters of the security standards to be accepted, and the security acceptance code can be written into a smart contract. This means deploying the security standards to be accepted, the corresponding evidence descriptions, the input parameters of the security standards to be accepted, and the security acceptance code into the smart contract. Specifically, the input parameters of the security standards to be accepted written into the smart contract can include the application system's domain name, the application system's Internet Protocol (IP) address, port, system administrator, development administrator, database information used, middleware information, operating system information, the types of personal information contained in the system, whether it contains sensitive personal information, whether the system has passed the graded protection system, whether the system has been registered with an Internet Content Provider (ICP), and whether the system is connected to a unified identity authentication system, etc. Accordingly, the smart contract will generate a verification code corresponding to the input parameters of the security standard item to be accepted, and a verification code corresponding to the security acceptance code of the security standard item to be accepted, based on the security standard item to be accepted, the evidence description corresponding to the security standard item to be accepted, the input parameters of the security standard item to be accepted, and the security acceptance code.

[0066] Figure 3 A flowchart of a security acceptance method provided in another embodiment of this application is shown. Based on the above embodiments, this application further describes the security acceptance method. Figure 3 As shown, the method in this application embodiment may include:

[0067] S301. In response to a safety acceptance instruction, obtain the safety standard items to be accepted for the target project.

[0068] For a detailed description of this step, please refer to [link / reference]. Figure 2 The relevant description of S201 in the illustrated embodiment will not be repeated here.

[0069] In the embodiments of this application, Figure 2 Step S202 may further include steps S302 to S305 as follows:

[0070] S302. Obtain the verification code corresponding to the input parameters of the safety standard items to be accepted.

[0071] In this step, for example, the verification code corresponding to the input parameter of the security standard item to be accepted can be obtained through a preset password-related algorithm, such as a hash algorithm. Specifically, if the input parameter of the security standard item to be accepted is, for example, the domain name of the application system, then the corresponding verification code is obtained for that domain name using a hash algorithm.

[0072] S303. If it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtain the verification code corresponding to the security acceptance code of the security standard item to be accepted.

[0073] In this step, the verification code corresponding to the input parameter in the smart contract is calculated by the smart contract according to a preset cryptographic algorithm when the input parameter is written into the smart contract before this step. For details on how the input parameter is written into the smart contract, please refer to subsequent embodiments; it will not be repeated here. It is understood that the preset cryptographic algorithm used by the smart contract is the same as the preset cryptographic algorithm used by the electronic device executing this method embodiment. For example, the preset cryptographic algorithm may be a hash algorithm, and the input parameter may be the domain name of the application system. In this case, both the electronic device executing this method embodiment and the smart contract obtain the verification code corresponding to the domain name of the application system using the same hash algorithm. Therefore, after obtaining the verification code corresponding to the input parameter of the security standard item to be accepted, the verification code corresponding to the input parameter can be compared with the verification code of the corresponding input parameter in the smart contract to determine whether the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract. If it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then the verification code corresponding to the security acceptance code of the security standard item to be accepted is obtained. For example, the verification code corresponding to the security acceptance code of the security standard item to be accepted can be obtained through a hash algorithm.

[0074] Optionally, if it is determined that the verification code corresponding to the input parameter is inconsistent with the verification code of the corresponding input parameter in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful.

[0075] For example, the checksum corresponding to the input parameter is compared with the checksum of the corresponding input parameter in the smart contract. If it is determined that the checksum corresponding to the input parameter is inconsistent with the checksum of the corresponding input parameter in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful.

[0076] S304. If it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then the security standard item to be accepted shall be accepted according to the security acceptance code.

[0077] It is understandable that the checksum corresponding to the security acceptance code and the checksum of the corresponding security acceptance code in the smart contract can be calculated using the same pre-defined cryptographic algorithm. Therefore, after obtaining the checksum corresponding to the security acceptance code of the security standard item to be accepted, the checksum can be compared with the checksum of the corresponding security acceptance code in the smart contract to determine whether they match. If they match, the security standard item to be accepted is then accepted according to the security acceptance code. By confirming that the checksum of the security acceptance code matches the checksum of the corresponding security acceptance code in the smart contract, it can be guaranteed that the acceptance result after executing the security acceptance code is authoritatively recognized.

[0078] It's understandable that security acceptance code can automatically determine whether a security standard item to be accepted has passed acceptance. For example, to determine whether the operating system has TCP port 22 open, the security acceptance code will have corresponding acceptance script code that can automatically log into the operating system, automatically list the open ports within the operating system, and then automatically determine whether TCP port 22 is open. When accepting a security standard item to be accepted based on the security acceptance code, for example, for a method requiring remote acceptance, if the security standard item to be accepted is "close TCP port 22", executing the corresponding security acceptance code will log into the server where the target project is located based on the corresponding input parameters, automatically list the open ports on the server, and automatically determine whether TCP port 22 is open. If TCP port 22 is not open, the acceptance result for the security standard item to be accepted is passed; if TCP port 22 is open, the acceptance result for the security standard item to be accepted is failed. This method can be understood as a remote acceptance process. Optionally, if the security standard item to be accepted is one that needs to be accepted locally on the server where the target project is located, i.e., it is an acceptance method that needs to be accepted locally, such as "password file permission is only readable by the administrator", the security standard item to be accepted cannot obtain the corresponding acceptance result through remote scanning. Since the server where the target project is located is also in the blockchain, and all information (such as security acceptance code, domain name, IP, middleware, etc.) is synchronized through the blockchain, the server where the target project is located can execute the security acceptance code through a smart contract to obtain the acceptance result of the security standard item "password file permission is only readable by the administrator" to be accepted, and synchronize the acceptance result to all blockchain nodes through the blockchain network, including the electronic devices executing this method embodiment.

[0079] Optionally, if it is determined that the verification code corresponding to the security acceptance code is inconsistent with the verification code of the corresponding security acceptance code in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful.

[0080] For example, the checksum corresponding to the security acceptance code is compared with the checksum of the corresponding security acceptance code in the smart contract. If it is determined that the checksum corresponding to the security acceptance code is inconsistent with the checksum of the corresponding security acceptance code in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful.

[0081] S305. Write the acceptance results of the security standard items to be accepted into the smart contract.

[0082] After the security standard items to be accepted have been accepted according to the security acceptance code, the acceptance results of the security standard items to be accepted can be written into the smart contract so that the smart contract can generate the verification code corresponding to the acceptance results.

[0083] In the embodiments of this application, Figure 2 Step S203 may further include steps S306 to S310 as follows:

[0084] S306. If it is determined that the acceptance result of at least one safety standard item to be accepted is not passed, then the acceptance result of the target item is determined to be not passed.

[0085] For example, suppose the target project has 100 safety standard items to be accepted. After obtaining the acceptance results of the 100 safety standard items to be accepted, if it is determined that the acceptance result of one of the safety standard items to be accepted is not accepted, then the acceptance result of the target project is determined to be not accepted.

[0086] S307. If the acceptance results of all safety standard items to be accepted are passed, then the acceptance result of the target item is determined to be passed.

[0087] For example, suppose the target project has 100 safety standard items to be accepted. After obtaining the acceptance results of the 100 safety standard items to be accepted, if the acceptance results of all 100 safety standard items to be accepted are passed, then the acceptance result of the target project is determined to be passed.

[0088] S308. Output the acceptance report corresponding to the acceptance results.

[0089] After obtaining the acceptance results of the target project, the verification codes corresponding to the acceptance results of each of the safety standard items to be accepted are retrieved, and the corresponding acceptance report is output. It can be understood that the acceptance report contains the acceptance results of each of the safety standard items to be accepted in the target project, as well as the corresponding verification codes for each of the safety standard items to be accepted.

[0090] S309. If the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target project is output as "accepted".

[0091] For example, suppose a target project has 100 security standard items to be accepted. Correspondingly, the acceptance report includes the acceptance results for each of the 100 security standard items and a verification code for each acceptance result. The verification codes for the acceptance results of these 100 security standard items are compared with the verification codes for the corresponding acceptance results in the smart contract. If the verification codes for the acceptance results of these 100 security standard items match the verification codes for the corresponding acceptance results in the smart contract, then the acceptance result for the target project is output as "accepted." This method ensures the authority of the acceptance results.

[0092] S310. If the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is inconsistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target item is output as "acceptance failed".

[0093] In this step, the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is compared with the corresponding verification code of the acceptance result in the smart contract. If it is determined that the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is inconsistent with the corresponding verification code of the acceptance result in the smart contract, the acceptance result of the target project is output as "acceptance failed".

[0094] The security acceptance method provided in this application embodiment, in response to a security acceptance command, obtains the security standard items to be accepted for the target project; obtains the verification code corresponding to the input parameters of the security standard items to be accepted; if it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtains the verification code corresponding to the security acceptance code of the security standard item to be accepted; if it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then performs acceptance on the security standard item to be accepted according to the security acceptance code; writes the acceptance result of the security standard item to be accepted into the smart contract; if it is determined that at least one security standard item to be accepted... If the acceptance result for all standard items is "failed," then the acceptance result for the target project is determined to be "failed." If the acceptance results for all security standard items to be accepted are "passed," then the acceptance result for the target project is determined to be "passed." An acceptance report corresponding to the acceptance result is output. If the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report matches the verification code of the corresponding acceptance result in the smart contract, then the acceptance result for the target project is output as "passed." If the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report does not match the verification code of the corresponding acceptance result in the smart contract, then the acceptance result for the target project is output as "failed." Since this embodiment is based on a smart contract, based on the determination that the verification code corresponding to the input parameter matches the verification code of the corresponding input parameter in the smart contract, and the determination that the verification code corresponding to the security acceptance code matches the verification code of the corresponding security acceptance code in the smart contract, the security standard items to be accepted are accepted according to the security acceptance code, and the acceptance result is verified through the smart contract. Therefore, the efficiency of security acceptance can be greatly improved, and the accuracy and authority of the security acceptance results can be guaranteed.

[0095] Based on the above embodiments, considering that the security standard items to be accepted in the target project include security standard items that require manual acceptance, for example, if the security standard item to be accepted requires a screenshot of the corresponding function, and the content of the screenshot cannot be automatically recognized by the security acceptance code, then manual acceptance of the security standard item is required. Therefore, optionally, the security acceptance method may further include: if the security standard item to be accepted does not have a corresponding security acceptance code, then receiving the security proof information corresponding to the security standard item to be accepted; receiving the acceptance result of the security standard item to be accepted; and writing the acceptance result of the security standard item to be accepted into the smart contract.

[0096] If a security standard item to be accepted does not have a corresponding security acceptance code, then manual acceptance of the security standard item is required. For example, for security standard items requiring manual acceptance, firstly, project team members can submit security certification information (i.e., security certification materials) based on the security standard item to be accepted and the corresponding evidence. Correspondingly, the electronic device executing this method embodiment receives the security certification information corresponding to the security standard item to be accepted. Specifically, the security standard items to be accepted for the target project are displayed in a list. When submitting security certification information manually based on the security standard item to be accepted and the corresponding evidence, the security certification information may be, for example, images or documents related to the target project's functions. This information can be uploaded by clicking the upload button corresponding to the security standard item to be accepted. Then, manual acceptance is performed based on the security certification information corresponding to the security standard item to be accepted. Correspondingly, the electronic device executing this method embodiment receives the acceptance result of the security standard item to be accepted and writes the acceptance result of the security standard item to be accepted into a smart contract. Through the above method, all security standard items of the target project requiring manual acceptance can be completed.

[0097] In summary, the technical solution provided in this application has at least the following advantages:

[0098] (1) Efficient Operation Process: Since the execution of smart contracts does not require the participation of human third-party authorities or centralized proxy services, it can respond to the application system security acceptance request at any time, greatly improving the efficiency of application system security acceptance. Developers do not need to wait for the task flow on the OA system to be transferred to the corresponding node and approvers to carry out relevant security acceptance operations. As long as there is a network, acceptance can be carried out conveniently and quickly.

[0099] (2) Accurate Execution: All security standards and corresponding evidence for smart contracts are pre-defined and executed under absolute computer control. Therefore, all execution results are accurate and error-free, avoiding unpredictable outcomes, which is also expected in traditional security acceptance processes. The accurate execution of smart contracts benefits from the development of cryptography and the invention of blockchain technology.

[0100] (3) Lower risk of human intervention: After the relevant content of security acceptance is deployed to the smart contract, all content of security acceptance will be unmodifiable. No party in the smart contract can interfere with the execution of the smart contract. In other words, no party can change the security acceptance standard for their own benefit. Even if a breach of contract occurs, the person responsible for the event will have a corresponding record and will formulate corresponding penalties through the company's internal security management methods. These penalties are determined at the beginning of the smart contract and cannot be changed after the smart contract takes effect.

[0101] (4) Decentralized Authority: Smart contracts do not require a centralized authority to judge whether the security standards of the application system to be accepted are executed as required. The supervision and arbitration of smart contracts are all done by the server. Smart contracts on the blockchain have this characteristic even more. In a blockchain network, there is generally no absolute authority to supervise the execution of smart contracts. Instead, the majority of users in the network judge whether the smart contracts are executed as required.

[0102] (5) Lower security acceptance cost: Because smart contracts have the characteristic of eliminating human intervention, they can greatly reduce the human cost of application system security acceptance evaluation. However, it requires the smart contract creator to determine all the details of application system security acceptance at the beginning of contract creation.

[0103] The apparatus of this application embodiment can be used to execute the security acceptance method in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0104] Figure 4 This is a schematic diagram of the structure of a security acceptance device provided in an embodiment of this application, as shown below. Figure 4 As shown, the security acceptance device 400 of this application embodiment includes: an acquisition module 401, an acceptance module 402, and an output module 403. Wherein:

[0105] The acquisition module 401 is used to acquire the safety standard items to be accepted for the target project in response to the safety acceptance command.

[0106] The acceptance module 402 is used to perform acceptance testing on the security standard items to be accepted based on a smart contract. The smart contract is used to generate a corresponding verification code based on the acceptance information of the target item. The acceptance information of the target item includes at least the input parameters and security acceptance code of the security standard items to be accepted.

[0107] Output module 403 is used to output the acceptance results of the target project.

[0108] In some embodiments, the acceptance module 402 may be specifically used to: obtain the verification code corresponding to the input parameter of the security standard item to be accepted; if it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtain the verification code corresponding to the security acceptance code of the security standard item to be accepted; if it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then perform acceptance on the security standard item to be accepted according to the security acceptance code; and write the acceptance result of the security standard item to be accepted into the smart contract.

[0109] Optionally, the acceptance module 402 can also be used to: determine that the acceptance result of the security standard item to be accepted is failed if it is determined that the verification code corresponding to the input parameter is inconsistent with the verification code of the corresponding input parameter in the smart contract; or, determine that the acceptance result of the security standard item to be accepted is failed if it is determined that the verification code corresponding to the security acceptance code is inconsistent with the verification code of the corresponding security acceptance code in the smart contract.

[0110] In some embodiments, the output module 403 may be specifically used to: determine the acceptance result of the target project as failing acceptance if at least one security standard item to be accepted is determined to have failed acceptance; or, determine the acceptance result of the target project as passing acceptance if all security standard items to be accepted are determined to have passed acceptance; output the acceptance report corresponding to the acceptance result; output the acceptance result of the target project as passing acceptance if the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result in the smart contract; or, output the acceptance result of the target project as failing acceptance if the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is inconsistent with the verification code of the corresponding acceptance result in the smart contract.

[0111] Optionally, the acceptance module 402 can also be used to: receive the security certification information corresponding to the security standard item to be accepted if there is no corresponding security acceptance code; receive the acceptance result of the security standard item to be accepted; and write the acceptance result of the security standard item to be accepted into the smart contract.

[0112] In some embodiments, the security acceptance device further includes a generation module 404, configured to receive project-related information of the target project before obtaining the security standard items to be accepted for the target project in response to the security acceptance instruction; generate corresponding initial security standard items to be accepted based on the project-related information; determine the security standard items to be accepted based on the initial security standard items to be accepted; and generate corresponding evidence descriptions based on the security standard items to be accepted.

[0113] In some embodiments, the security acceptance device further includes a writing module 405, which, after generating corresponding evidence descriptions based on the security standard items to be accepted, writes the security standard items to be accepted, the evidence descriptions corresponding to the security standard items to be accepted, the input parameters of the security standard items to be accepted, and the security acceptance code into a smart contract, so that the smart contract generates a verification code corresponding to the input parameters of the security standard items to be accepted and a verification code corresponding to the security acceptance code of the security standard items to be accepted.

[0114] The apparatus of this application embodiment can be used to execute the security acceptance method in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0115] Figure 5 This is a schematic diagram illustrating the interaction between an electronic device and a smart contract, provided as an embodiment of this application. Figure 5 As shown, the electronic device is the one executing the embodiments of this application, and the smart contract is deployed in a blockchain network. The smart contract provides a user interface for the electronic device to call. Before conducting security acceptance on the target project, the electronic device writes the relevant information of the security standard items to be accepted into the smart contract through the user interface. For example, it writes the relevant information such as the application system domain name, IP address, database type, middleware type, and security acceptance code corresponding to the target project into the smart contract. The smart contract calculates the corresponding verification value according to a certain formula and a cryptographic algorithm, that is, it confirms the acceptance standard through the smart contract. When conducting security acceptance on the target project, it judges the conformity of the relevant verification information of the security standard items to be accepted based on the smart contract. For example, the electronic device reads the verification value of the security acceptance code from the smart contract through the user interface and compares it with the verification value of its own local security acceptance code. If the two are consistent, it means that the security acceptance code is the same, and the acceptance result after executing the security acceptance code is accepted.

[0116] Figure 6 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Exemplarily, the electronic device may be provided as a server or a computer. (Refer to...) Figure 6 The electronic device 600 includes a processing component 601, which further includes one or more processors, and memory resources represented by memory 602 for storing instructions, such as application programs, that can be executed by the processing component 601. The application programs stored in memory 602 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 601 is configured to execute instructions to perform any of the method embodiments described above.

[0117] Electronic device 600 may also include a power supply component 603 configured to perform power management of electronic device 600, a wired or wireless network interface 604 configured to connect electronic device 600 to a network, and an input / output (I / O) interface 605. Electronic device 600 may operate on an operating system stored in memory 602, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0118] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implements the above-described security acceptance method.

[0119] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described security acceptance method.

[0120] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0121] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in a security acceptance device.

[0122] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0123] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. Without departing from the principles of this application, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of this application.

Claims

1. A safety acceptance method, characterized in that, include: In response to a safety acceptance command, obtain the safety standard items to be accepted for the target project; The target project is the application system that is to be accepted. Based on a smart contract, a verification code corresponding to the input parameters of the security standard items to be accepted for the target project is generated, as well as a verification code corresponding to the security acceptance code of the security standard items to be accepted. The security acceptance code is a script or program used to automatically determine whether the security standard items to be accepted have passed the acceptance test. The electronic device and the smart contract executing the security acceptance method both use the same preset cryptographic algorithm to obtain the verification code corresponding to the input parameters. If it is determined that the verification code corresponding to the input parameter is consistent with the verification code of the corresponding input parameter in the smart contract, then obtain the verification code corresponding to the security acceptance code of the security standard item to be accepted. If it is determined that the verification code corresponding to the security acceptance code is consistent with the verification code of the corresponding security acceptance code in the smart contract, then the security standard item to be accepted is accepted according to the security acceptance code; wherein, the verification code corresponding to the security acceptance code and the verification code of the corresponding security acceptance code in the smart contract are calculated using the same preset cryptographic-related algorithm; Write the acceptance results of the security standard items to be accepted into the smart contract; If it is determined that the acceptance result of at least one of the safety standard items to be accepted is "failed", then the acceptance result of the target project is determined to be "failed". If all the safety standard items to be inspected pass the inspection, then the inspection result of the target project is determined to be passed. Output the acceptance report corresponding to the acceptance results; the acceptance report includes: the acceptance result of each safety standard item to be accepted for the target project and the verification code corresponding to the acceptance result of each safety standard item to be accepted; The system determines whether the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result pre-stored in the smart contract, and outputs the acceptance result of the target project based on the determination result.

2. The safety acceptance method according to claim 1, characterized in that, Also includes: If it is determined that the checksum corresponding to the input parameter does not match the checksum of the corresponding input parameter in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful; or, If it is determined that the verification code corresponding to the security acceptance code is inconsistent with the verification code of the corresponding security acceptance code in the smart contract, then the acceptance result of the security standard item to be accepted is determined to be unsuccessful.

3. The safety acceptance method according to claim 1 or 2, characterized in that, The step of determining whether the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result pre-stored in the smart contract, and outputting the acceptance result of the target project based on the determination result, includes: If it is determined that the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target project is output as "accepted"; or, If it is determined that the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is inconsistent with the verification code of the corresponding acceptance result in the smart contract, then the acceptance result of the target project is output as "acceptance failed".

4. The safety acceptance method according to claim 1 or 2, characterized in that, Also includes: If the security standard item to be accepted does not have a corresponding security acceptance code, then the security certification information corresponding to the security standard item to be accepted is received. Receive the acceptance results of the safety standard items to be accepted; The acceptance results of the security standard items to be accepted are written into the smart contract.

5. The safety acceptance method according to claim 1 or 2, characterized in that, Before obtaining the safety standard items to be accepted for the target project in response to the safety acceptance command, the method further includes: Receive project-related information for the target project; Based on the project-related information, generate the corresponding initial safety standard items to be accepted; Based on the initial safety standard items to be accepted, the safety standard items to be accepted are determined; Based on the safety standards to be accepted, generate corresponding supporting documentation.

6. The safety acceptance method according to claim 5, characterized in that, After generating corresponding evidence based on the safety standards to be accepted, the process also includes: The security standard item to be accepted, the evidence description corresponding to the security standard item to be accepted, the input parameters of the security standard item to be accepted, and the security acceptance code are written into the smart contract, so that the smart contract generates the verification code corresponding to the input parameters of the security standard item to be accepted and the verification code corresponding to the security acceptance code of the security standard item to be accepted.

7. A safety inspection device, characterized in that, include: The acquisition module is used to acquire the safety standard items to be accepted for the target project in response to the safety acceptance command; The target project is the application system that is to be accepted. The acceptance module is used to generate, based on a smart contract, verification codes corresponding to the input parameters of the security standard items to be accepted for the target project, and verification codes corresponding to the security acceptance codes of the security standard items to be accepted. The security acceptance code is a script or program used to automatically determine whether the security standard items to be accepted pass the acceptance test. Both the electronic device performing the security acceptance and the smart contract use the same, preset cryptographic algorithm to obtain the verification codes corresponding to the input parameters. If it is determined that the verification code corresponding to the input parameter matches the verification code of the corresponding input parameter in the smart contract, then the verification code corresponding to the security acceptance code of the security standard item to be accepted is obtained. If it is determined that the verification code corresponding to the security acceptance code matches the verification code of the corresponding security acceptance code in the smart contract, then according to the... The security acceptance code is used to accept the security standard items to be accepted; wherein, the verification code corresponding to the security acceptance code and the verification code of the corresponding security acceptance code in the smart contract are calculated using the same preset cryptographic algorithm; the acceptance results of the security standard items to be accepted are written into the smart contract; if it is determined that the acceptance result of at least one of the security standard items to be accepted is failed, then the acceptance result of the target project is determined to be failed; if the acceptance results of all the security standard items to be accepted are passed, then the acceptance result of the target project is determined to be passed; an acceptance report corresponding to the acceptance results is output; the acceptance report includes: the acceptance result of each security standard item to be accepted in the target project and the verification code corresponding to the acceptance result of each security standard item to be accepted; The output module is used to determine whether the verification code corresponding to the acceptance result of the security standard item to be accepted in the acceptance report is consistent with the verification code of the corresponding acceptance result pre-stored in the smart contract, so as to output the acceptance result of the target project according to the judgment result.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the security acceptance method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed, implement the security acceptance method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the security acceptance method as described in any one of claims 1 to 6.

Images