Security vulnerability detection method and device for alliance chain smart contract

Abstract

The present application provides a method and device for detecting security vulnerabilities of a consortium chain smart contract, the method comprising: converting the source code of the consortium chain smart contract into an SSA intermediate language, and obtaining the entry function of the consortium chain smart contract; starting from the entry function, constructing a function control flow graph and a function call graph of the consortium chain smart contract, and performing data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data; performing security vulnerability detection on the target data based on a target taint analysis method corresponding to the target data selected from a plurality of static taint analysis methods, and implementing a security vulnerability detection process corresponding to at least one taint analysis method based on a function call graph. The present application has good specificity, can greatly reduce the time of taint analysis, can improve the efficiency of static taint analysis, and can improve the accuracy of security vulnerability detection, so that the security vulnerability detection process of the consortium chain smart contract covers more types of vulnerabilities and has better detection effect.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a method and device for detecting security vulnerabilities in alliance chain smart contracts. Background Art

[0002] The representative of the consortium chain platform is Hyperledger Fabric, which supports writing smart contracts in high-level languages, mainly in Go. However, since smart contracts are still in their early stages, users and developers lack the knowledge to use and implement smart contracts. Therefore, some errors and omissions are inevitable when writing smart contract codes corresponding to the business, which may cause security vulnerabilities in smart contracts and cause losses due to malicious attacks. Types of security vulnerabilities in Hyperledger Fabric consortium chain smart contracts include: Figure 1 shown.

[0003] Most of the existing smart contract security vulnerability detection solutions have evolved from traditional software security vulnerability detection solutions. There is less research on the security vulnerability detection technology of smart contracts on the alliance chain platform. The main method is the abstract syntax tree analysis solution in static analysis technology, which performs simple pattern matching with the abstract syntax tree through a given rule base. However, this method lacks specific data flow and control flow analysis. Therefore, the types of vulnerabilities detected are not comprehensive enough, resulting in a high rate of missed reports, and there may also be a large number of false positives. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a security vulnerability detection method and device for alliance chain smart contracts to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present application provides a security vulnerability detection method for a consortium chain smart contract, comprising:

[0006] Convert the source code of the alliance chain smart contract into SSA intermediate language and obtain the entry function of the alliance chain smart contract;

[0007] Starting from the entry function, construct the function control flow graph and function call graph corresponding to the consortium chain smart contract, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain the target data to be tested for security vulnerabilities;

[0008] A target taint analysis method corresponding to the target data is selected from a plurality of static taint analysis methods, and security vulnerability detection is performed on the target data based on the target taint analysis method, wherein a security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph.

[0009] In some embodiments of the present application, the target data includes: at least one of a function return instruction statement, a source point, a sink point, and an unanalyzed function call parameter in a function call execution statement;

[0010] Correspondingly, the static taint analysis method corresponding to the Source point in the function call execution statement is the first taint propagation analysis method;

[0011] The static taint analysis methods corresponding to the unanalyzed function call parameters in the function call execution statement and the function return instruction statement are both the second taint propagation analysis method, and the security vulnerability detection process corresponding to the second taint propagation analysis method is implemented based on the function call graph;

[0012] The static taint analysis method corresponding to the Sink point in the function call execution statement is the taint detection analysis method.

[0013] In some embodiments of the present application, before converting the source code of the alliance chain smart contract into the SSA intermediate language, it also includes:

[0014] Get the configuration file for static taint analysis, where the configuration file is used to define the sink point, source point and corresponding taint label;

[0015] Correspondingly, performing data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data to be tested for security vulnerabilities includes:

[0016] The function control flow graph is traversed based on the configuration file and the SSA intermediate language to obtain target data to be tested for security vulnerabilities.

[0017] In some embodiments of the present application, converting the source code of the alliance chain smart contract into the SSA intermediate language and obtaining the entry function of the alliance chain smart contract includes:

[0018] Read the consortium chain smart contract source file;

[0019] The SSA conversion tool based on the go language converts the source code in the alliance chain smart contract source file into the SSA intermediate language and obtains the entry function of the alliance chain smart contract.

[0020] In some embodiments of the present application, selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes:

[0021] If the target data includes the Source point, selecting a first taint propagation analysis method corresponding to the Source point to perform taint propagation analysis on the Source point to determine the contaminated parameters;

[0022] If the target data includes the unanalyzed function call parameter, the second taint propagation analysis method is selected to perform taint propagation analysis on the unanalyzed function call parameter, an entry of the unanalyzed function call parameter is found from the function call graph, and the taint condition of the unanalyzed function call parameter is propagated to the function signature;

[0023] If the target data includes the function return instruction statement, the second taint propagation analysis method is selected to perform taint propagation analysis on the return value of the function return instruction statement, the corresponding function caller is taken out from the function call graph, and the taint status of the return value is passed to the caller's variable.

[0024] In some embodiments of the present application, selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes:

[0025] If the target data includes the Sink point, determine whether there is an intersection between the contaminated parameters and the parameters of the Sink point. If so, determine whether there is a taint path from the Source point to the Sink point and obtain the corresponding taint and taint label.

[0026] In some embodiments of the present application, after the target data is subjected to security vulnerability detection based on the target taint analysis method, the method further includes:

[0027] If the taint situation in the current function is updated, the function control flow graph and function call graph corresponding to the consortium chain smart contract are rebuilt based on the corresponding updated data, and the target data is tested for security vulnerabilities after the target data is reacquired;

[0028] If the taint situation in the current function is not updated, then generate a security vulnerability detection result corresponding to the taint label according to the preset security vulnerability detection rule;

[0029] The security vulnerability detection result is output.

[0030] Another aspect of the present application provides a security vulnerability detection device for a consortium chain smart contract, comprising:

[0031] SSA intermediate language conversion module, used to convert the source code of the alliance chain smart contract into SSA intermediate language and obtain the entry function of the alliance chain smart contract;

[0032] A data flow analysis module is used to construct a function control flow graph and a function call graph corresponding to the consortium chain smart contract starting from the entry function, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data to be tested for security vulnerabilities;

[0033] A static taint analysis module is used to select a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and perform security vulnerability detection on the target data based on the target taint analysis method, wherein the security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph.

[0034] Another aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security vulnerability detection method for the consortium chain smart contract when executing the computer program.

[0035] Another aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the security vulnerability detection method for the consortium chain smart contract.

[0036] The security vulnerability detection method for the alliance chain smart contract provided by the present application converts the source code of the alliance chain smart contract into SSA intermediate language, and obtains the entry function of the alliance chain smart contract; starting from the entry function, constructs the function control flow graph and function call graph corresponding to the alliance chain smart contract, and performs data flow analysis on the function control flow graph according to the SSA intermediate language to obtain the target data to be detected for security vulnerabilities; selects the target taint analysis method corresponding to the target data from a variety of static taint analysis methods, and performs security vulnerability detection on the target data based on the target taint analysis method, wherein the security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph, so that the security vulnerability detection method for the alliance chain smart contract has good specificity, which is for Hyperledger Fabric consortium chain smart contracts are specially constructed; the source code of the consortium chain smart contract is converted into SSA representation. Since each SSA variable will save its related instruction statements, it is only necessary to propagate the new variables obtained by the instruction statements related to the Source point variable in the target data to be detected for security vulnerabilities. Especially when there are many harmless instruction statements in the function, the time of taint propagation analysis can be greatly reduced, and the analysis efficiency can be improved; by collecting multiple elements such as control flow information and function call information for static taint analysis, combined with the design of separate detection rules for each security vulnerability detection, the accuracy of security vulnerability detection is improved, so that the consortium chain smart contract security vulnerability detection process covers more types of vulnerabilities and the detection effect is better.

[0037] Additional advantages, purposes, and features of the present application will be partially described in the following description, and will become partially apparent to those skilled in the art after studying the following, or may be learned from the practice of the present application. The purposes and other advantages of the present application can be achieved and obtained by the structures specifically pointed out in the specification and the drawings.

[0038] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present application. In the drawings:

[0040] Figure 1 This is an example diagram of common vulnerabilities and detection rules in Hyperledger Fabric smart contracts.

[0041] Figure 2 A flowchart of a security vulnerability detection method for a consortium chain smart contract in one embodiment of the present application.

[0042] Figure 3 Another flowchart of a method for detecting security vulnerabilities in a consortium chain smart contract in one embodiment of the present application.

[0043] Figure 4 This is a schematic diagram of the structure of a security vulnerability detection device for a consortium chain smart contract in another embodiment of the present application.

[0044] Figure 5 The logical architecture diagram of the system modules provided for the application example of this application.

[0045] Figure 6 A flowchart of a Hyperledger Fabric consortium chain smart contract security vulnerability detection method based on static taint analysis provided for the application example of this application.

[0046] Figure 7 Figure 2 is a diagram of the traditional stain analysis process. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the implementation modes and the accompanying drawings. Here, the illustrative implementation modes and descriptions of the present application are used to explain the present application, but are not intended to limit the present application.

[0048] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, only the structures and / or processing steps closely related to the scheme according to the present application are shown in the accompanying drawings, while other details that are not very relevant to the present application are omitted.

[0049] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0050] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection with an intermediate.

[0051] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0052] Smart contract applications based on blockchain technology are being widely embedded in various industry applications, such as finance, supply chain management, healthcare, energy, the Internet of Things, and government services. However, the transaction processing efficiency of decentralized public chain platforms is not high, so they cannot support large-scale applications. Although the alliance chain platform sacrifices a certain degree of decentralization, it can guarantee better transaction processing efficiency. Therefore, many companies' smart contract applications are built on the alliance chain platform.

[0053] The representative of the alliance chain platform is Hyperledger Fabric. Since most of the existing smart contract security vulnerability detection solutions have evolved from traditional software security vulnerability detection solutions. There are many methods for detecting security vulnerabilities in public chain platform smart contracts, including methods that use artificial intelligence to analyze, as well as ordinary static and dynamic analysis methods. However, there is less research on security vulnerability detection technology for smart contracts on alliance chain platforms, mainly focusing on the abstract syntax tree analysis solution in static analysis technology. Abstract syntax tree analysis technology is a method that converts each statement in the source code file into a tree structure, and analyzes the type and content of each node of the tree structure.

[0054] As a result, existing smart contract security vulnerability detection solutions have the following disadvantages:

[0055] 1) Most smart contract security vulnerability detection solutions are implemented for Ethereum public chain smart contracts, and are not suitable for security vulnerability detection of alliance chain smart contracts. There are two major differences between the two, namely, smart contract development language and blockchain platform transaction process. First, the smart contract development of Ethereum public chain is mainly developed in Solidity language, while Hyperledger Fabric alliance chain is mainly developed in Go language. Secondly, the transaction execution process of Ethereum public chain is "order-execute architecture", that is, transactions need to be uniformly sorted in different nodes, and the transaction order is determined before the transaction is executed. Hyperledger Fabric alliance chain adopts the new "execute-order-validate architecture", that is, execution first, then sorting, and finally verifying the results. The inconsistency of the two transaction execution processes leads to inconsistent security vulnerabilities, and the two detection tools cannot be used interchangeably.

[0056] 2) The existing consortium chain smart contract security vulnerability detection scheme uses abstract syntax tree analysis, and performs simple pattern matching with the abstract syntax tree through a given rule base. This method lacks specific data flow and control flow analysis. Therefore, the types of vulnerabilities detected are not comprehensive enough, resulting in a high rate of missed reports, and there may also be a large number of false positives.

[0057] In view of the above problems, this application provides a Hyperledger Fabric consortium chain smart contract security vulnerability detection solution based on static taint analysis, which can build key function APIs and basic variable analysis involved in taint analysis Source points for existing vulnerabilities; after the subsequent Hyperledger Fabric platform is updated, if new security vulnerabilities are found, Source points can be added to the configuration file according to the rules of the security vulnerabilities, reflecting good scalability.

[0058] At the same time, traditional static analysis methods need to be based on abstract syntax trees and intermediate languages, and various information is collected to improve the accuracy of detection and reduce the false alarm rate. Due to the lack of technical methods for converting go language into intermediate language, most of the tools for static analysis of go language are based on abstract syntax tree matching. Therefore, the tools for security detection of Hyperledger Fabric smart contracts currently use the same method. Collecting more information for security detection through go language is a major difficulty. This application uses the SSA intermediate language representation library of go language to convert the smart contract source file into SSA intermediate language representation analysis. Compared with abstract syntax tree analysis, it can better cover the control flow information, function call information, etc. of the source file, thereby realizing context-sensitive static taint analysis and reducing false alarm rate and missed alarm rate.

[0059] In one or more embodiments of the present application, a Source point refers to a data point that may cause security issues, and a Sink point refers to a stain convergence point.

[0060] In one or more embodiments of the present application, SSA is an intermediate language used by a compiler as the basis for compilation optimization (also the basis for DFG JIT), and it is used together with ControlDependence Graph to represent the data flow and control flow of a program.

[0061] Based on this, the present application embodiment provides a method for detecting security vulnerabilities in a consortium chain smart contract. Figure 2 The security vulnerability detection method of the alliance chain smart contract specifically includes the following contents:

[0062] Step 100: Convert the source code of the alliance chain smart contract into SSA intermediate language, and obtain the entry function of the alliance chain smart contract.

[0063] It can be understood that step 100 can be executed by the SSA intermediate language conversion module in the security vulnerability detection device of the alliance chain smart contract. The module can use the input smart contract source code file and the SSA conversion tool of the go language to convert it into an intermediate language, and convert the smart contract source code into an SSA intermediate language for representation. During the conversion process, the instruction statements (Referrers) involved in each variable can be saved, and the function entry of the smart contract can be obtained, providing basic support for subsequent analysis.

[0064] Step 200: Starting from the entry function, construct the function control flow graph and function call graph corresponding to the alliance chain smart contract, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain the target data for security vulnerability detection.

[0065] It is understandable that step 200 can be performed by a data flow analysis module in the security vulnerability detection device of the alliance chain smart contract, and the main functions of this module are:

[0066] 1) Construct the function's data flow graph ICFG, control flow graph CFG (Control Flow Graph) and function call graph (CallGraph) for subsequent analysis.

[0067] 2) Using the intermediate language obtained by the SSA intermediate language conversion module, each intermediate language statement in the CFG is traversed, and the analysis logic for the function call instruction statement and the return instruction statement is defined.

[0068] For the function call execution statement, it will determine whether there are source points, sink points, and unanalyzed function calls. If there are source points and unanalyzed function call instructions, the following taint propagation analysis module will be called for taint propagation analysis; if there are sink points, the following taint detection module will be called for taint detection analysis.

[0069] For the function return instruction statement, the following taint propagation analysis module will be called to perform taint propagation analysis.

[0070] Step 300: Select a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and perform security vulnerability detection on the target data based on the target taint analysis method, wherein a security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph.

[0071] It can be understood that step 300 can be executed by a static taint analysis module in the security vulnerability detection device of the alliance chain smart contract, which module is used to select a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and perform security vulnerability detection on the target data based on the target taint analysis method, wherein the security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph.

[0072] From the above description, it can be seen that the security vulnerability detection method for the alliance chain smart contract provided in the embodiment of the present application has good specificity and is specially constructed for the Hyperledger Fabric alliance chain smart contract; by converting the source code of the alliance chain smart contract into the SSA representation, since each SSA variable will save its related instruction statements, it is only necessary to carry out taint propagation on the new variable obtained by the instruction statement related to the Source point variable in the target data to be detected for security vulnerabilities, especially when there are many harmless instruction statements in the function, the time of taint propagation analysis can be greatly reduced, and the analysis efficiency can be improved; by collecting multiple elements such as control flow information and function call information for static taint analysis, combined with designing respective detection rules for each security vulnerability detection, the accuracy of security vulnerability detection is improved, so that the security vulnerability detection process of the alliance chain smart contract covers more types of vulnerabilities and the detection effect is better.

[0073] In order to further improve the accuracy of security vulnerability detection, in a security vulnerability detection method for a consortium chain smart contract provided in an embodiment of the present application, the target data includes: a function return instruction statement, a Source point in a function call execution statement, a Sink point, and at least one of unanalyzed function call parameters.

[0074] Correspondingly, the static taint analysis method corresponding to the Source point in the function call execution statement is the first taint propagation analysis method.

[0075] The static taint analysis methods corresponding to the unanalyzed function call parameters in the function call execution statement and the function return instruction statement are both the second taint propagation analysis method, and the security vulnerability detection process corresponding to the second taint propagation analysis method is implemented based on the function call graph.

[0076] The static taint analysis method corresponding to the Sink point in the function call execution statement is the taint detection analysis method.

[0077] From the above description, it can be seen that the security vulnerability detection method for the alliance chain smart contract provided in the embodiment of the present application can further improve the accuracy of security vulnerability detection by selecting corresponding static taint analysis methods for the source points, sink points and unanalyzed function call parameters in the function return instruction statement and function call execution statement, so that the security vulnerability detection process of the alliance chain smart contract covers more types of vulnerabilities and has better detection effect.

[0078] In order to make the security vulnerability detection method of the alliance chain smart contract have good scalability, in the security vulnerability detection method of the alliance chain smart contract provided in the embodiment of the present application, see Figure 3 , the security vulnerability detection method of the alliance chain smart contract also specifically includes the following contents before step 100:

[0079] Step 010: Obtain a configuration file for static taint analysis, where the configuration file is used to define Sink points, Source points and corresponding taint labels.

[0080] It can be understood that step 010 can be executed by the configuration module in the security vulnerability detection device of the alliance chain smart contract, which is mainly used to provide users with relevant parameters for configuring taint analysis, including data points (Source points) that may cause security problems and taint aggregation points (Sink points), etc.

[0081] Correspondingly, step 200 in the security vulnerability detection method of the alliance chain smart contract specifically includes the following contents:

[0082] Step 210: traverse the function control flow graph based on the configuration file and the SSA intermediate language to obtain target data for security vulnerability detection.

[0083] From the above description, it can be seen that the security vulnerability detection method of the alliance chain smart contract provided by the embodiment of the present application has good scalability by providing a taint analysis configuration file, and can be modified and extended by changing the taint analysis configuration file as the Hyperledger Fabric smart contract API changes. In addition, this framework can also configure other sensitive APIs through configuration files to perform privacy security detection such as sensitive data leakage.

[0084] In order to further significantly reduce the time of taint propagation analysis and improve analysis efficiency, in a security vulnerability detection method for a consortium chain smart contract provided in an embodiment of the present application, step 100 in the security vulnerability detection method for a consortium chain smart contract specifically includes the following contents:

[0085] Step 110: Read the consortium chain smart contract source file.

[0086] Step 120: Based on the SSA conversion tool of the go language, the source code in the consortium chain smart contract source file is converted into the SSA intermediate language, and the entry function of the consortium chain smart contract is obtained.

[0087] From the above description, it can be seen that after the traditional static taint analysis method finds the Source point, when performing taint propagation analysis on the variables related to the Source point, it is necessary to traverse all the instruction statements in the function again, and perform different taint propagation analysis logics by enumerating the instruction categories of each statement. However, the security vulnerability detection method for the alliance chain smart contract provided by the embodiment of the present application, when the go language is converted into the SSA representation, each SSA variable will save its related instruction statements, so it is only necessary to perform taint propagation on the new variables obtained by the instruction statements related to the Source point variables. This method can greatly reduce the time of taint propagation analysis and improve analysis efficiency when there are many harmless instruction statements in the function.

[0088] In order to further improve the accuracy of security vulnerability detection, in a security vulnerability detection method for a consortium chain smart contract provided in an embodiment of the present application, step 300 in the security vulnerability detection method for a consortium chain smart contract further specifically includes the following contents:

[0089] Step 310: If the target data includes the Source point, a first taint propagation analysis method corresponding to the Source point is selected to perform taint propagation analysis on the Source point to determine the contaminated parameters.

[0090] Step 320: If the target data includes the unanalyzed function call parameter, the second taint propagation analysis method is selected to perform taint propagation analysis on the unanalyzed function call parameter, the entry of the unanalyzed function call parameter is found from the function call graph, and the taint status of the unanalyzed function call parameter is propagated to the function signature.

[0091] Step 330: If the target data includes the function return instruction statement, the second taint propagation analysis method is selected to perform taint propagation analysis on the return value of the function return instruction statement, the corresponding function caller is taken out from the function call graph, and the taint status of the return value is passed to the caller's variable.

[0092] It is understandable that steps 310 to 330 can be performed by the taint propagation analysis module in the static taint analysis module in the security vulnerability detection device of the alliance chain smart contract, which mainly defines the representation of tainted data and the label of tainted data, and defines the propagation rules of tainted data. In addition, the module will perform taint propagation analysis on the taint propagation path of the Source point found in the analysis process of the data flow analysis module, as well as taint propagation analysis on the function parameters and function signatures of the unanalyzed function calls, caller variables and the return values ​​of the called functions.

[0093] From the above description, it can be seen that the security vulnerability detection method for the alliance chain smart contract provided in the embodiment of the present application can further improve the accuracy of security vulnerability detection by selecting corresponding taint propagation analysis methods for function return instruction statements, Source points in function call execution statements, and unanalyzed function call parameters, so that the security vulnerability detection process of the alliance chain smart contract covers more types of vulnerabilities and has better detection effect.

[0094] In order to further improve the accuracy of security vulnerability detection, in a security vulnerability detection method for a consortium chain smart contract provided in an embodiment of the present application, step 300 in the security vulnerability detection method for a consortium chain smart contract further specifically includes the following contents:

[0095] Step 340: If the target data includes the Sink point, determine whether there is an intersection between the contaminated parameters and the parameters of the Sink point. If so, determine whether there is a taint path from the Source point to the Sink point and obtain the corresponding taint and taint label.

[0096] It can be understood that steps 310 to 330 can be performed by a taint detection module in a static taint analysis module in a security vulnerability detection device for a consortium chain smart contract, which detects whether there is an intersection between the parameters contaminated during the taint propagation analysis and the parameters of the sink point during the data flow analysis, and determines whether there is a contaminated path. If there is a contaminated path, the module outputs the contaminated path and the taint label.

[0097] From the above description, it can be seen that the security vulnerability detection method for the alliance chain smart contract provided in the embodiment of the present application can further improve the accuracy of security vulnerability detection by selecting the corresponding taint detection and analysis methods for the Sink points in the function call execution statement, so that the security vulnerability detection process of the alliance chain smart contract covers more types of vulnerabilities and has better detection effect.

[0098] In order to ensure the comprehensiveness and effectiveness of the security vulnerability detection process of the alliance chain smart contract, and further improve the reliability and effectiveness of the output security vulnerability detection results, see Figure 3In a security vulnerability detection method for a consortium chain smart contract provided in an embodiment of the present application, step 300 in the security vulnerability detection method for a consortium chain smart contract further specifically includes the following contents:

[0099] Step 400: If the taint situation in the current function is updated, return to step 100 for the corresponding updated data, rebuild the function control flow graph and function call graph corresponding to the alliance chain smart contract, and perform security vulnerability detection on the target data after re-acquiring the target data.

[0100] Step 500: If the taint situation in the current function is not updated, then according to a preset security vulnerability detection rule, a security vulnerability detection result corresponding to the taint label is generated, and the security vulnerability detection result is output.

[0101] From the above description, it can be seen that the security vulnerability detection method for the alliance chain smart contract provided in the embodiment of the present application can effectively ensure the comprehensiveness and effectiveness of the security vulnerability detection process of the alliance chain smart contract by returning and reconstructing the function control flow graph and function call graph corresponding to the alliance chain smart contract according to the corresponding update data, and performing security vulnerability detection on the target data after re-acquiring the target data; by defining the common security vulnerabilities of Hyperledger Fabric smart contracts and the corresponding detection rules in the framework, combining the taint labels obtained by the taint detection module, and outputting the vulnerability detection results, the reliability and effectiveness of the output security vulnerability detection results can be further improved.

[0102] From the software level, the present application also provides a security vulnerability detection device for a consortium chain smart contract for executing all or part of the security vulnerability detection method for the consortium chain smart contract, see Figure 4 The security vulnerability detection device of the alliance chain smart contract specifically includes the following contents:

[0103] The SSA intermediate language conversion module 10 is used to convert the source code of the alliance chain smart contract into the SSA intermediate language and obtain the entry function of the alliance chain smart contract.

[0104] The data flow analysis module 20 is used to build a function control flow graph and a function call graph corresponding to the alliance chain smart contract starting from the entry function, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain the target data for security vulnerability detection.

[0105] The static taint analysis module 30 is used to select a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and perform security vulnerability detection on the target data based on the target taint analysis method, wherein the security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph.

[0106] The embodiment of the security vulnerability detection device for the consortium chain smart contract provided in the present application can be specifically used to execute the processing flow of the embodiment of the security vulnerability detection method for the consortium chain smart contract in the above-mentioned embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the embodiment of the security vulnerability detection method for the consortium chain smart contract mentioned above.

[0107] The security vulnerability detection device of the alliance chain smart contract can perform the security vulnerability detection of the alliance chain smart contract in the server, and in another practical application scenario, all operations can also be completed in the client device. The specific selection can be based on the processing capacity of the client device and the limitations of the user's usage scenario. This application is not limited to this. If all operations are completed in the client device, the client device may also include a processor for specific processing of the security vulnerability detection of the alliance chain smart contract.

[0108] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0109] The server and the client device may communicate with each other using any suitable network protocol, including network protocols that have not yet been developed on the date of filing this application. The network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Of course, the network protocols may also include, for example, RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer) protocols used on top of the above protocols.

[0110] From the above description, it can be seen that the security vulnerability detection device for the alliance chain smart contract provided in the embodiment of the present application has good specificity and is specially constructed for the Hyperledger Fabric alliance chain smart contract; by converting the source code of the alliance chain smart contract into the SSA representation, since each SSA variable will save its related instruction statements, it is only necessary to carry out taint propagation on the new variable obtained by the instruction statement related to the Source point variable in the target data to be detected for security vulnerabilities, especially when there are many harmless instruction statements in the function, the time of taint propagation analysis can be greatly reduced, and the analysis efficiency can be improved; by collecting multiple elements such as control flow information and function call information for static taint analysis, combined with designing respective detection rules for each security vulnerability detection, the accuracy of security vulnerability detection is improved, so that the security vulnerability detection process of the alliance chain smart contract covers more types of vulnerabilities and the detection effect is better.

[0111] To further illustrate this solution, this application also provides a specific application example of a Hyperledger Fabric consortium chain smart contract security vulnerability detection method based on static taint analysis. The following improvements are provided respectively:

[0112] 1) A dedicated detection method for Hyperledger Fabric consortium chain smart contracts;

[0113] 2) A method for converting smart contract source files into SSA intermediate language;

[0114] 3) Perform data flow analysis based on SSA intermediate language statements and construct control flow graphs and function call graphs;

[0115] 4) Build a taint analysis framework to implement taint propagation rules and taint detection rules;

[0116] 5) Through data flow analysis, taint propagation is performed on the relevant variables of the Source point;

[0117] 6) Check the parameters at the Sink point to determine whether there is an intersection with the related variables at the Source point to implement vulnerability detection.

[0118] Based on this, the specific description of the Hyperledger Fabric consortium chain smart contract security vulnerability detection method based on static taint analysis is as follows:

[0119] First, the logical architecture of the system module of the Hyperledger Fabric consortium chain smart contract security vulnerability detection method based on static taint analysis is as follows: Figure 5As shown, the whole is divided into a configuration module, a static single assignment SSA intermediate language conversion module, an inter-procedural data flow graph ICFG analysis module, a taint propagation analysis module, a taint detection module and a security vulnerability detection rule matching module.

[0120] (1) Configuration module 01: This module is mainly used to provide users with relevant parameters for configuring taint analysis, including data points (source points) that may cause security issues and taint sink points, etc.

[0121] (2) SSA intermediate language conversion module 10: This module uses the input smart contract source code file and the SSA conversion tool of the go language to perform intermediate language conversion on it, and converts the smart contract source code into an SSA intermediate language for representation. During the conversion process, the instruction statements (Referrers) involved in each variable can be saved, and the function entry of the smart contract can be obtained, providing basic support for subsequent analysis.

[0122] (3) Data flow analysis module 20 (also called: inter-process data flow graph ICFG analysis module): The main functions of this module are:

[0123] 1) Construct the function's data flow graph ICFG, control flow graph CFG (Control Flow Graph) and function call graph (CallGraph) for subsequent analysis.

[0124] 2) Using the intermediate language obtained by the SSA intermediate language conversion module, each intermediate language statement in the CFG is traversed, and the analysis logic for the function call instruction statement and the return instruction statement is defined.

[0125] For the function call execution statement, it will determine whether there are source points, sink points, and unanalyzed function calls. If there are source points and unanalyzed function call instructions, the following taint propagation analysis module will be called for taint propagation analysis; if there are sink points, the following taint detection module will be called for taint detection analysis.

[0126] For the function return instruction statement, the following taint propagation analysis module will be called to perform taint propagation analysis.

[0127] (4) Taint propagation analysis module 31: This module mainly defines the representation of tainted data and the label of tainted data, and defines the propagation rules of tainted data. In addition, this module will perform taint propagation analysis on the taint propagation path of the Source point found in the analysis process of the data flow analysis module, as well as the function parameters and function signatures of the unanalyzed function calls, caller variables and the return values ​​of the called functions.

[0128] (5) Taint detection module 32: This module detects whether there is an intersection between the parameters polluted during the taint propagation analysis and the parameters of the sink point during the data flow analysis, and determines whether there is a tainted path. If there is a tainted path, the module outputs the tainted path and the taint label.

[0129] (6) Security vulnerability detection rule matching module 4: This module mainly defines the common security vulnerabilities of Hyperledger Fabric smart contracts and the corresponding detection rules in the framework, combines the taint labels obtained by the taint detection module, and outputs the vulnerability detection results.

[0130] Secondly, based on the above system model, see Figure 6 The processing flow of the Hyperledger Fabric alliance chain smart contract security vulnerability detection method based on static taint analysis provided by the application example of this application is as follows:

[0131] (1) Configuration: Read the user configuration file and record the source point, sink point and corresponding taint label through the configuration module;

[0132] (2) SSA intermediate language conversion: read the smart contract source code file, construct the source code into SSA intermediate representation through the SSA intermediate language conversion module, and find the smart contract entry function;

[0133] (3) Data flow construction: Starting from the entry of the smart contract function, the function control flow graph CFG and function call graph (CallGraph) information are constructed through the data flow analysis module, and the data flow analysis within the function is performed;

[0134] (4) Data flow analysis: Based on the CFG information, traverse each intermediate language statement in the CFG to determine whether there are source points, sink points, and unanalyzed function calls in the function call execution statement.

[0135] (5) Taint propagation analysis:

[0136] If there is a Source point, the taint propagation analysis module is used to perform taint propagation analysis to determine the contaminated parameters;

[0137] If the function represented by the function call instruction statement is an unanalyzed function, the taint propagation analysis module will perform taint propagation analysis on the function call parameters, find the entry of the unanalyzed function from the CallGraph, and propagate the taint of the function call parameters to the function signature;

[0138] If it is a return instruction statement, the caller of this function will be taken out from CallGraph, and the taint status of the return value will be passed to the caller's variable.

[0139] (6)Stain detection analysis:

[0140] If there is a Sink point, the taint detection module is used to detect whether there is a taint path from the Source to the Sink point.

[0141] (7) After the taint propagation analysis of the call instruction statement and the return instruction statement is completed, if the taint situation in this function is updated, the data flow analysis process in this function is performed again.

[0142] (8) After execution is completed, output the result according to the result of the stain detection module.

[0143] See also Figure 7 From the traditional taint analysis process provided, it can be seen that this application builds the key function API and basic variable analysis involved in the taint analysis Source point for the existing vulnerabilities; after the subsequent Hyperledger Fabric platform is updated, if new security vulnerabilities are found, the Source point can be added to the configuration file according to the rules of the security vulnerabilities, reflecting good scalability.

[0144] At the same time, traditional static analysis methods need to be based on abstract syntax trees and intermediate languages, and various information is collected to improve the accuracy of detection and reduce the false alarm rate. Due to the lack of technical methods for converting go language into intermediate language, most of the tools for static analysis of go language are based on abstract syntax tree matching. Therefore, the tools for security detection of Hyperledger Fabric smart contracts currently use the same method. Collecting more information for security detection through go language is a major difficulty. This application uses the SSA intermediate language representation library of go language to convert the smart contract source file into SSA intermediate language representation analysis. Compared with abstract syntax tree analysis, it can better cover the control flow information, function call information, etc. of the source file, thereby realizing context-sensitive static taint analysis and reducing false alarm rate and missed alarm rate.

[0145] In summary, the static taint analysis framework for the alliance chain Hyperledger Fabric constructed by this application; the construction process of converting smart contract source files into SSA intermediate language; the method of performing data flow analysis on SSA intermediate language statements, building control flow graphs and function call graphs; the taint propagation rules defined by the above static taint analysis framework; the taint detection method for the Sink point in the above static taint analysis framework; and the vulnerability detection rules applicable to this framework formulated for each category of security vulnerabilities in the alliance chain Hyperledger Fabric. This application has the following beneficial effects:

[0146] 1. This technical solution has good specificity. This technical solution is specially built for Hyperledger Fabric alliance chain smart contracts, while other solutions are currently built for Ethereum public chain smart contracts. As mentioned above, due to the differences between the two in smart contract development language and blockchain platform transaction process, the two detection tools cannot be used interchangeably.

[0147] 2. This technical solution adopts a context-sensitive static taint analysis detection method. Compared with the existing technical solutions, this solution has the following advantages after converting the source file into an intermediate language: 1) Collecting multiple elements such as control flow information and function call information for static taint analysis, combining and designing separate detection rules for each security vulnerability detection, improving the accuracy of detection, so that this solution covers more types of vulnerabilities and has better detection effects; 2) After the traditional static taint analysis method finds the Source point, when performing taint propagation analysis on the variables related to the Source point, it is necessary to traverse all the instruction statements in the function again, and perform different taint propagation analysis logics by enumerating the instruction categories of each statement. In this solution, since each SSA variable will save its related instruction statements when converting the go language into SSA representation, it is only necessary to perform taint propagation on the new variables obtained by the instruction statements related to the Source point variables. This method can greatly reduce the time of taint propagation analysis and improve analysis efficiency when there are many harmless instruction statements in the function.

[0148] 3. This technical solution has good scalability and provides a taint analysis configuration file. It can be modified and extended by changing the taint analysis configuration file as the Hyperledger Fabric smart contract API changes. In addition, this framework can also configure other sensitive APIs through configuration files to perform privacy security detection such as sensitive data leakage.

[0149] 4. In order to avoid the path explosion problem caused by too many calls between functions in context-sensitive static taint analysis, this solution manually analyzes a large number of related APIs in the go language standard library, determines the taint changes before and after the calls, and incorporates them into the standard library call results, reducing the call analysis of the detection process, pruning the detection path, and improving the analysis performance.

[0150] The embodiment of the present application also provides a computer device (ie, an electronic device), which may include a processor, a memory, a receiver, and a transmitter, wherein the processor is used to execute the security vulnerability detection method for the alliance chain smart contract mentioned in the above embodiment, wherein the processor and the memory may be connected via a bus or other means, taking the bus connection as an example. The receiver may be connected to the processor and the memory via a wired or wireless manner. The computer device is communicatively connected to the security vulnerability detection device of the alliance chain smart contract or the security vulnerability detection device of the alliance chain smart contract to receive real-time motion data from the sensor in the wireless multimedia sensor network, and to receive the original video sequence from the video acquisition device.

[0151] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0152] As a non-transient computer-readable storage medium, the memory can be used to store non-transient software programs, non-transient computer executable programs and modules, such as the program instructions / modules corresponding to the security vulnerability detection method of the alliance chain smart contract in the embodiment of the present application. The processor executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory, that is, the security vulnerability detection method of the alliance chain smart contract in the above method embodiment is realized.

[0153] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0154] The one or more modules are stored in the memory, and when executed by the processor, the security vulnerability detection method of the alliance chain smart contract in the embodiment is executed.

[0155] In some embodiments of the present application, the user equipment may include a processor, a memory, and a transceiver unit, which may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0156] As an implementation method, the functions of the receiver and the transmitter in the present application can be considered to be implemented through a transceiver circuit or a dedicated chip for transceiver, and the processor can be considered to be implemented through a dedicated processing chip, a processing circuit or a general chip.

[0157] As another implementation method, it is possible to use a general-purpose computer to implement the server provided in the embodiment of the present application, that is, to store the program code for implementing the functions of the processor, receiver, and transmitter in a memory, and the general-purpose processor implements the functions of the processor, receiver, and transmitter by executing the code in the memory.

[0158] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the security vulnerability detection method of the aforementioned alliance chain smart contract are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0159] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0160] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0161] In the present application, features described and / or illustrated for one embodiment may be used in the same manner or in a similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0162] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the embodiments of the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A security vulnerability detection method for a consortium chain smart contract, characterized in that: include: Convert the source code of the alliance chain smart contract into SSA intermediate language and obtain the entry function of the alliance chain smart contract; Starting from the entry function, construct the function control flow graph and function call graph corresponding to the consortium chain smart contract, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain the target data to be tested for security vulnerabilities; Selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, wherein a security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph; The target data includes: function return instruction statements, source points, sink points and unanalyzed function call parameters in function call execution statements; Correspondingly, the static taint analysis method corresponding to the Source point in the function call execution statement is the first taint propagation analysis method; The static taint analysis methods corresponding to the unanalyzed function call parameters in the function call execution statement and the function return instruction statement are both the second taint propagation analysis method, and the security vulnerability detection process corresponding to the second taint propagation analysis method is implemented based on the function call graph; The static taint analysis method corresponding to the Sink point in the function call execution statement is the taint detection analysis method; The selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes: If the target data includes the Source point, selecting a first taint propagation analysis method corresponding to the Source point to perform taint propagation analysis on the Source point to determine the contaminated parameters; If the target data includes the unanalyzed function call parameter, the second taint propagation analysis method is selected to perform taint propagation analysis on the unanalyzed function call parameter, an entry of the unanalyzed function call parameter is found from the function call graph, and the taint condition of the unanalyzed function call parameter is propagated to the function signature; If the target data includes the function return instruction statement, the second taint propagation analysis method is selected to perform taint propagation analysis on the return value of the function return instruction statement, the corresponding function caller is taken out from the function call graph, and the taint status of the return value is passed to the variable of the caller; Before converting the source code of the alliance chain smart contract into the SSA intermediate language, it also includes: Get the configuration file for static taint analysis, where the configuration file is used to define the sink point, source point and corresponding taint label; Correspondingly, performing data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data to be tested for security vulnerabilities includes: Traversing the function control flow graph based on the configuration file and the SSA intermediate language to obtain target data to be tested for security vulnerabilities; The process of converting the source code of the alliance chain smart contract into the SSA intermediate language and obtaining the entry function of the alliance chain smart contract includes: Read the consortium chain smart contract source file; The SSA conversion tool based on the Go language converts the source code in the alliance chain smart contract source file into the SSA intermediate language and obtains the entry function of the alliance chain smart contract; The selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes: If the target data includes the Sink point, determine whether there is an intersection between the contaminated parameters and the parameters of the Sink point. If so, determine whether there is a taint path from the Source point to the Sink point and obtain the corresponding taint and taint label; After the target data is subjected to security vulnerability detection based on the target taint analysis method, the method further includes: If the taint situation in the current function is updated, the function control flow graph and function call graph corresponding to the consortium chain smart contract are rebuilt based on the corresponding updated data, and the target data is tested for security vulnerabilities after the target data is reacquired; If the taint situation in the current function is not updated, then generate a security vulnerability detection result corresponding to the taint label according to the preset security vulnerability detection rule; The security vulnerability detection result is output.

2. A security vulnerability detection device for a consortium chain smart contract, characterized in that: include: SSA intermediate language conversion module, used to convert the source code of the alliance chain smart contract into SSA intermediate language and obtain the entry function of the alliance chain smart contract; A data flow analysis module is used to construct a function control flow graph and a function call graph corresponding to the consortium chain smart contract starting from the entry function, and perform data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data to be tested for security vulnerabilities; a static taint analysis module, configured to select a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and perform security vulnerability detection on the target data based on the target taint analysis method, wherein a security vulnerability detection process corresponding to at least one of the taint analysis methods is implemented based on the function call graph; The target data includes: function return instruction statements, source points, sink points and unanalyzed function call parameters in function call execution statements; Correspondingly, the static taint analysis method corresponding to the Source point in the function call execution statement is the first taint propagation analysis method; The static taint analysis methods corresponding to the unanalyzed function call parameters in the function call execution statement and the function return instruction statement are both the second taint propagation analysis method, and the security vulnerability detection process corresponding to the second taint propagation analysis method is implemented based on the function call graph; The static taint analysis method corresponding to the Sink point in the function call execution statement is the taint detection analysis method; The selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes: If the target data includes the Source point, selecting a first taint propagation analysis method corresponding to the Source point to perform taint propagation analysis on the Source point to determine the contaminated parameters; If the target data includes the unanalyzed function call parameter, the second taint propagation analysis method is selected to perform taint propagation analysis on the unanalyzed function call parameter, an entry of the unanalyzed function call parameter is found from the function call graph, and the taint condition of the unanalyzed function call parameter is propagated to the function signature; If the target data includes the function return instruction statement, the second taint propagation analysis method is selected to perform taint propagation analysis on the return value of the function return instruction statement, the corresponding function caller is taken out from the function call graph, and the taint status of the return value is passed to the variable of the caller; Before converting the source code of the alliance chain smart contract into the SSA intermediate language, the device is also used to execute: obtaining a configuration file for static taint analysis, wherein the configuration file is used to define a sink point, a source point and a corresponding taint label; Correspondingly, performing data flow analysis on the function control flow graph according to the SSA intermediate language to obtain target data to be tested for security vulnerabilities includes: Traversing the function control flow graph based on the configuration file and the SSA intermediate language to obtain target data to be tested for security vulnerabilities; The process of converting the source code of the alliance chain smart contract into the SSA intermediate language and obtaining the entry function of the alliance chain smart contract includes: Read the consortium chain smart contract source file; The SSA conversion tool based on the Go language converts the source code in the alliance chain smart contract source file into the SSA intermediate language and obtains the entry function of the alliance chain smart contract; The selecting a target taint analysis method corresponding to the target data from a plurality of static taint analysis methods, and performing security vulnerability detection on the target data based on the target taint analysis method, includes: If the target data includes the Sink point, determine whether there is an intersection between the contaminated parameters and the parameters of the Sink point. If so, determine whether there is a taint path from the Source point to the Sink point and obtain the corresponding taint and taint label; After the target data is subjected to security vulnerability detection based on the target taint analysis method, the method further includes: If the taint situation in the current function is updated, the function control flow graph and function call graph corresponding to the consortium chain smart contract are rebuilt based on the corresponding updated data, and the target data is tested for security vulnerabilities after the target data is reacquired; If the taint situation in the current function is not updated, then generate a security vulnerability detection result corresponding to the taint label according to the preset security vulnerability detection rule; The security vulnerability detection result is output.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the security vulnerability detection method for the alliance chain smart contract as described in claim 1 is implemented.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the security vulnerability detection method for the alliance chain smart contract as described in claim 1.

Images