A data processing method, device, apparatus, and storage medium

Abstract

The application discloses a data processing method and device, equipment and a storage medium, at least comprising: for each of the M business systems related to the security system, obtaining the components involved in each of the business systems to obtain a target component list including N components; for each of the N components included in the target component list, determining the identification of the security version of the component in the component library; based on the component identification of each of the N components included in the target component list and the security version identification of the component, creating a security bill of materials; publishing the security bill of materials. In this way, the security system uniformly manages and maintains the security bill of materials, which not only saves manpower and resources and improves research and development efficiency, but also improves the security of the business system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, including but not limited to data processing methods, apparatus, devices, and storage media. Background Technology

[0002] With the rapid development of computer technology, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher demands are also being placed on technology.

[0003] For the management and maintenance of open-source component versions, the relevant technology typically involves maintaining a separate list of open-source component versions for each project. Since each project maintains its own list of open-source components and versions, when introducing a new open-source component, the developers themselves evaluate the required open-source component and its corresponding version.

[0004] Maintaining separate versions of imported open-source components for each project has the following drawbacks: First, during program development, when introducing external open-source components, security vulnerabilities are easily overlooked due to developers' insufficient security awareness, potentially leading to the introduction of components with security vulnerabilities and reducing security. Second, because developers are unfamiliar with security vulnerabilities, assessing and understanding the security vulnerabilities of open-source components requires considerable time and effort, reducing development efficiency. Summary of the Invention

[0005] This application provides a data processing method, apparatus, device, and storage medium that uses a security system to uniformly manage and maintain a security bill of materials, thereby achieving unified management and maintenance of components and versions of M business systems. On the one hand, this saves manpower and resources and improves R&D efficiency; on the other hand, since the versions of the components in the full bill of materials are security versions, it also improves the security of the business systems.

[0006] The technical solution of this application is implemented as follows:

[0007] In a first aspect, this application provides a data processing method applied to a security system. The method includes: for each of M business systems related to the security system, obtaining the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1; for each of the N components included in the target component list, determining the security version identifier of the component in a component library; the security version identifier is used to point to the security version of the component in the component library; creating a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component; and publishing the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0008] Secondly, this application provides another data processing method, which is applied to a first business system. The method includes: configuring component identifiers of K components involved in the first business system; wherein K is greater than or equal to 1; configuring version identifiers of the K components based on a security bill of materials; wherein the security bill of materials includes component identifiers of N components involved in M ​​business systems, and a security version identifier for each of the N components; wherein the M business systems include the first business system; wherein the N components include the K components; and wherein M and N are integers greater than 1.

[0009] Thirdly, this application provides a first data processing apparatus, the apparatus comprising:

[0010] The acquisition unit is configured to acquire, for each of the M business systems related to the security system, the components involved in each business system, and obtain a target component list including N components; where M and N are integers greater than 1.

[0011] The determining unit is configured to, for each of the N components included in the target component list, determine the identifier of the security version of the component in the component library; the identifier of the security version is used to point to the security version of the component in the component library;

[0012] A creation unit is used to create a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component;

[0013] The publishing unit is used to publish the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0014] Fourthly, this application provides a second data processing apparatus, the apparatus comprising:

[0015] The first configuration unit is used to configure the component identifiers of the K components involved in the first business system; wherein K is greater than or equal to 1;

[0016] The second configuration unit is used to configure the version identifiers of the K components based on the security bill of materials; the security bill of materials includes the component identifiers of N components involved in M ​​business systems, and the security version identifier of each of the N components; the M business systems include the first business system; the N components include the K components; and M and N are integers greater than 1.

[0017] Fifthly, this application also provides an electronic device, including: a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the program to implement the data processing method provided in the first or second aspect above.

[0018] Sixthly, this application also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the data processing method provided in the first or second aspect above.

[0019] The data processing method, apparatus, device, and storage medium provided in this application include at least: for each of the M business systems related to the security system, obtaining the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1; for each of the N components included in the target component list, determining the security version identifier of the component in a component library; the security version identifier is used to point to the security version of the component in the component library; creating a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component; and publishing the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0020] The proposed solution creates a secure bill of materials (BOM) through a secure system to manage and maintain components across M business systems. This achieves two advantages: firstly, the entire BOM is managed and maintained uniformly, meaning all components across the M business systems are managed and maintained in a unified manner, saving manpower and resources and improving R&D efficiency compared to individual management and maintenance; secondly, because the component versions in the entire BOM are secure versions, the security of the business systems is also enhanced. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of an optional structure of the data processing system provided in an embodiment of this application;

[0022] Figure 2 An optional flowchart illustrating the data processing method provided in the embodiments of this application.

[0023] Figure 3 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0024] Figure 4 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0025] Figure 5 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0026] Figure 6 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0027] Figure 7 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0028] Figure 8 A schematic flowchart of an optional data processing method provided in an embodiment of this application;

[0029] Figure 9 A schematic diagram of an optional structure of the first data processing apparatus provided in the embodiments of this application;

[0030] Figure 10 This is a schematic diagram of an optional structure of the second data processing apparatus provided in an embodiment of this application;

[0031] Figure 11 This is a schematic diagram of an optional structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the specific technical solutions of the application will be further described in detail below with reference to the accompanying drawings of the embodiments of this application. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0033] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0034] In the following description, the terms "first," "second," and "third" are used only to distinguish different objects and do not represent a specific order of objects, nor are they constituting a chronological order. It is understood that "first," "second," and "third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0036] This application provides data processing methods, apparatus, devices, and storage media. In practical applications, the data processing method can be implemented by a data processing apparatus, and the functional entities in the data processing apparatus can be collaboratively implemented by the hardware resources of electronic devices, such as computing resources like processors and communication resources (such as those used to support various communication methods like optical fiber and cellular networks).

[0037] The data processing method provided in this application is applied to a data processing system, which includes a security system and a business system.

[0038] The security system is used to perform the following: For each of the M business systems related to the security system, obtain the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1; for each of the N components included in the target component list, determine the security version identifier of the component in the component library; the security version identifier is used to point to the security version of the component in the component library; based on the component identifier of each of the N components included in the target component list and the security version identifier of the component, create a security bill of materials; publish the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0039] The business system is used to perform the following: configuring component identifiers for K components involved in the first business system; where K is greater than or equal to 1; configuring version identifiers for the K components based on a security bill of materials; where the security bill of materials includes component identifiers for N components involved in M ​​business systems, and a security version identifier for each of the N components; where the M business systems include the first business system; where the N components include the K components; and where M and N are integers greater than 1.

[0040] It should be noted that the number of business systems in this application embodiment is not limited and can be determined according to the actual situation.

[0041] As an example, the structure of a data processing system can be as follows: Figure 1 As shown, it includes a security processing terminal 10 and a service processing terminal 20. Data can be transmitted between the security processing terminal 10 and the service processing terminal 20.

[0042] Here, the security processing terminal 10 is used to execute the functions of the business system, specifically including: for each of the M business systems related to the security system, obtaining the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1; for each of the N components included in the target component list, determining the security version identifier of the component in the component library; the security version identifier is used to point to the security version of the component in the component library; based on the component identifier of each of the N components included in the target component list and the security version identifier of the component, creating a security bill of materials; and publishing the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0043] Among them, the security processing terminal 10 can be an electronic device with relevant data processing capabilities, such as a server or computer.

[0044] The business processing terminal 20 is used to execute the functions of the business system, specifically including: configuring the component identifiers of K components involved in the first business system; wherein K is greater than or equal to 1; configuring the version identifiers of the K components based on the security bill of materials; wherein the security bill of materials includes the component identifiers of N components involved in M ​​business systems, and the security version identifier of each of the N components; wherein the M business systems include the first business system; wherein the N components include the K components; wherein M and N are integers greater than 1.

[0045] Among them, the business processing terminal 20 can be an electronic device with relevant data processing capabilities, such as a server or computer.

[0046] It should be noted that the security processing terminal 10 and the business processing terminal 20 can be the same electronic device or different electronic devices.

[0047] Below, in conjunction with Figure 1 The schematic diagram of the data processing system shown illustrates various embodiments of the data processing methods, apparatus, devices, and storage media provided in this application.

[0048] In a first aspect, embodiments of this application provide a data processing method, which is applied to a first data processing device; wherein the first data processing device can be deployed in... Figure 1The security processing terminal 10 is used to execute the functions of the security system. The process of the first data processing method provided in this application embodiment will be described below, with the security processing terminal as the executing entity.

[0049] Figure 2 This diagram illustrates a possible data processing method. (See reference) Figure 2 The data processing method shown may include, but is not limited to, the following: Figure 2 S201 to S204 are shown.

[0050] S201. For each of the M business systems related to the security system, the security processing end obtains the components involved in each business system and obtains a target component list including N components.

[0051] A component is a simple encapsulation of data or methods. This application does not specifically limit the type of component; it can be determined based on the actual situation. For example, a component can be an open-source component or a closed-source component.

[0052] The target component list refers to all components in the M business systems related to the security system.

[0053] A security system is used to manage and maintain a security component inventory, which includes the identifier of each of the N components in the target component inventory and the security version identifier of each component.

[0054] A business system is used to execute specific business functions. Components are required to execute these business functions.

[0055] The number M of business systems in this application embodiment is not specifically limited and can be determined according to the actual situation. M is an integer greater than 1.

[0056] This application does not limit the number of components involved in a business system, and can determine the number based on the actual situation. The number can be an integer greater than or equal to 0.

[0057] In this application embodiment, the total number N of components involved in the M business systems is not limited, and can be determined according to actual conditions, where N is an integer greater than 1.

[0058] S201 can be implemented as follows: For each of the M business systems related to the security system, the security processing end performs the following: obtain the components involved in each business system, thereby obtaining all the components involved in the M business systems, and determine the target component list based on all the components involved in the M business systems.

[0059] When determining the target component list, components can be identified or represented by their identifiers. Each component identifier uniquely identifies a single component. Thus, the target component list includes the identifiers of N components.

[0060] This application does not limit the specific form of the component identifier, which can be determined according to the actual situation. For example, the component identifier can be a component name, component code, etc.

[0061] S202. For each of the N components included in the target component list, the security processing end determines the identifier of the security version of the component in the component library.

[0062] The security version identifier is used to point to the security version of the component in the component library. The specific form of the security version identifier in this application embodiment is not limited and can be determined according to actual circumstances. An exemplary security version identifier can be V1.0-S.

[0063] The component library stores various versions of N components (such as secure versions, vulnerability versions, etc.).

[0064] When the component type is an open-source component, the component library can be the component library corresponding to each public website.

[0065] When the component type is a non-open source component, the component library is a private component library.

[0066] S202 can be implemented as follows: For each of the N components included in the target component list, the security processing end performs the following: search for all versions corresponding to the component in the component library, filter out the insecure versions to obtain the secure version of the component, then check the secure version identifier of the secure version of the component, traverse the N components, and thus obtain the secure version identifier of each of the N components.

[0067] S203. The security processing end creates a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component.

[0068] Since the target component list includes component identifiers for N components, and security version identifiers for N components are also obtained in S202, S203 can be implemented as follows: the security processing end performs the following for each of the N components included in the target component list: associate the component identifier of the component with the security version identifier of the component, traverse the N components, and then create a security bill of materials.

[0069] The specific method by which the component identifier of the component is associated with the security version identifier of the component in this application embodiment is not limited, and can be determined according to the actual situation.

[0070] In one possible implementation, the component identifier and the component's security version identifier can be associated in a table format. For example, one row corresponds to one component, the first column corresponds to the component identifier, and the second column corresponds to the component's security version. In this way, the component identifier and version identifier are associated in a single row.

[0071] In another possible implementation, the component identifier and the security version identifier of the component can be associated through a common feature. For example, for component A, the component identifier is A002, and the version identifier is AV1.0. That is, the component identifier and the version identifier are associated through A.

[0072] S204. The security processing terminal publishes the security material list so that the security material list can be reused for component references in the M business systems.

[0073] S204 can be implemented as follows: The security processing end publishes the security bill of materials to the component repository so that the security bill of materials can be reused in the component referencing process of the M business systems. That is, when the M business systems reference a component, they can directly call the security version of the component in the component repository through the security bill of materials.

[0074] Here, there is no limit to the number of components that can be reused in business systems; this can be determined based on the actual situation. In other words, it depends on which business system needs to reference it, i.e., which system calls the secure version of the component from the component repository through the secure bill of materials.

[0075] The first data processing method provided in this application includes: for each of the M business systems related to the security system, obtaining the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1; for each of the N components included in the target component list, determining the security version identifier of the component in a component library; the security version identifier is used to point to the security version of the component in the component library; creating a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component; and publishing the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0076] The proposed solution creates a secure bill of materials (BOM) through a secure system to manage and maintain components across M business systems. This achieves two advantages: firstly, the entire BOM is managed and maintained uniformly, meaning all components across the M business systems are managed and maintained in a unified manner, saving manpower and resources and improving R&D efficiency compared to individual management and maintenance; secondly, because the component versions in the entire BOM are secure versions, the security of the business systems is also enhanced.

[0077] The process of obtaining the components involved in each of the business systems described in S201 at the security processing end will be explained below. This process may include, but is not limited to, method 1 or method 2 described below.

[0078] Method 1: Scan the code of the business system using the first method, identify the declarations in the code, and obtain the components involved in the business system.

[0079] The first method includes: software component analysis or code scanning.

[0080] It should be noted that the process of identifying declarations in the code differs for business systems programmed in different languages. Based on the specific format required by the programming language for referencing components, the component identifiers of components with that format are identified in the code declarations, thereby revealing the components involved in the business system.

[0081] Method 2: Scan the files introduced by the business system using the second method to obtain the components involved in the business system.

[0082] The second method includes: software component analysis or detection based on a host-based intrusion detection system.

[0083] It should be noted that the specific methods for importing files may differ for business systems programmed in different languages. Here, it is necessary to identify the components involved in the business system based on the method of importing files required by the programming language of the business system.

[0084] like Figure 3 As shown, the first data processing method provided in this application embodiment may also include, but is not limited to, the following S205 to S207.

[0085] S205. The security processing end collects vulnerability information for each of the N components included in the component list.

[0086] A vulnerability is a flaw in the specific implementation of software or protocols, or in the security policies of a system. Vulnerability information is used to characterize the specific description of a vulnerability.

[0087] S205 can be implemented as follows: The security processing end collects vulnerability information for each of the N components included in the component list, thereby achieving monitoring of the vulnerability information of each component.

[0088] This application does not limit the specific source of the vulnerability information to be collected, and it can be determined according to the actual situation.

[0089] In one possible implementation, the security processing end can collect vulnerability information of components based on external Common Vulnerabilities and Exposures (CVEs).

[0090] In another possible implementation, the security processing end can collect vulnerability information of components based on component update logs.

[0091] S206. If the security processing terminal collects vulnerability information of the first component among the N components, it determines the patch version corresponding to the vulnerability information based on the vulnerability information of the first component.

[0092] The first component refers to any component that has collected vulnerability information. It should be noted that if multiple components have collected vulnerability information, then each component with vulnerability information will be processed similarly to the first component.

[0093] The patch version corresponding to this vulnerability information fixed the vulnerability in the first component, so the patch version corresponding to this vulnerability information can be considered the secure version corresponding to the first component.

[0094] Here, due to continuous technological updates, vulnerabilities may be constantly discovered, so the security versions of the components will be constantly updated.

[0095] S207. The security processing terminal updates the security version identifier corresponding to the first component in the security bill of materials based on the identifier of the repaired version.

[0096] S207 can be implemented as follows: the security processing end first obtains the version identifier of the patch version, then locates the first component in the security bill of materials based on the component identifier of the first component, and then updates the security version identifier of the first component to the version identifier of the patch version.

[0097] Secondly, embodiments of this application provide another data processing method, which is applied to a second data processing device; wherein the second data processing device can be deployed in... Figure 1 The business processing terminal 20 is used to execute the functions of the business system. The following describes the process of the second data processing method provided in this application embodiment, with the business processing terminal as the executing entity.

[0098] Figure 4 This diagram illustrates a possible data processing method. (See reference) Figure 4 The data processing method described herein, when applied to the first business system, may include, but is not limited to, the following: Figure 4 S401 and S402 are shown.

[0099] The first business system is any one of the M systems related to the security management system.

[0100] It should be noted that for the processing of other business systems, please refer to the specific description of the first business system, which will not be repeated here.

[0101] S401. The business processing terminal configures the component identifiers of the K components involved in the first business system.

[0102] The K is greater than or equal to 1. This application embodiment does not limit the specific number of K components involved in the first business system; it can be determined according to the actual situation.

[0103] S401 can be implemented as follows: The business processing end executes the following for each of the K components in the first business system: at the relevant location where the component needs to be introduced, configure the component to be introduced through the component identifier; traverse the K components and complete the configuration of the component identifiers of the K components.

[0104] S402. The business processing end configures the version identifiers of the K components based on the security bill of materials.

[0105] The security bill of materials includes component identifiers for N components involved in M ​​business systems, and a security version identifier for each of the N components; the M business systems include the first business system; the N components include the K components.

[0106] M and N are integers greater than 1.

[0107] It should be noted that the way version identifiers for the K components are configured differs between the first business system programmed in an interpreted language and the first business system programmed in a non-interpreted language.

[0108] Non-interpreted languages ​​correspond to programming languages ​​that require compilation; for example, a non-interpreted language could be Java. Interpreted languages ​​correspond to programming languages ​​that do not require compilation; for example, an interpreted language could be Python.

[0109] The data processing scheme provided in this application embodiment includes at least: configuring component identifiers of K components involved in the first business system; wherein K is greater than or equal to 1; configuring version identifiers of the K components based on a security bill of materials; wherein the security bill of materials includes component identifiers of N components involved in M ​​business systems, and a security version identifier of each of the N components; wherein the M business systems include the first business system; and wherein the N components include the K components.

[0110] In the solution of this application, when the first business system references a component, it can locate all versions of the component based on the component identifier, and further locate the security version of the component based on the component's security version identifier, thereby improving the security of the first business system.

[0111] The following describes the process by which the business processing end in S402 configures the version identifiers of the K components based on the security bill of materials.

[0112] Specifically, this may include, but is not limited to, the following method A or method B.

[0113] Method A: If the first business system is programmed using a non-interpreted language, configure the version identifiers of the K components based on the security bill of materials;

[0114] Method B: If the first business system is programmed using an interpreted language, the version identifiers of the K components are configured based on the safety bill of materials.

[0115] The following describes the process of configuring the version identifiers of the K components based on the safety bill of materials if the first business system is programmed using a non-interpreted language in method A.

[0116] In Method A, the business processing end imports the security bill of materials in the configuration file of the first business system in a declarative manner, so as to determine the version identifiers of the K components based on the version identifiers of the components in the security bill of materials.

[0117] The specific declaration format can be determined based on the specific language type.

[0118] In Method B, the version identifiers of the K components are configured in the configuration environment based on the security version identifier of each of the N components in the security bill of materials.

[0119] In Method B, the business processing end first determines the security version identifier of K components from N components in the security bill of materials, and then adds the version identifier of each of the K components to the configuration environment.

[0120] Since the version information of components is called based on the version in the configuration environment when interpreted languages, it is necessary to add the version identifiers of K components to the configuration environment based on the security version identifiers of K components.

[0121] As can be seen, the data processing method provided in this application embodiment can be applied to both interpreted and non-interpreted languages, has wide applicability, and can vary the processing method for different languages, thus offering great flexibility.

[0122] The following section explains how to handle the newly added vulnerability in the first component of the first business system. For example... Figure 5 As shown, the process may include, but is not limited to, S501 to S504 below.

[0123] S501. The business processing terminal performs a first regression test on a first number of items in the first business system and obtains a first test result.

[0124] Regression testing refers to retesting old code after modifications to confirm that the modifications have not introduced new errors or caused errors in other code.

[0125] The first test result is used to characterize whether any errors or anomalies occurred during the first test. If even one error or anomaly exists, the first test result is considered abnormal.

[0126] The embodiments of this application do not limit the first quantity, which can be determined according to the actual situation. For example, the first quantity can be 10% of the total number of projects in the first business system.

[0127] This application example does not limit the method of selecting the first number of items in the first business system, and can be determined according to the actual situation.

[0128] In one possible implementation, the first number of items can be randomly selected.

[0129] In another possible implementation, the first number of projects may be determined based on the degree of automation of the projects and / or the completeness of the regression tests of the projects.

[0130] By testing a small number of items first to ensure they function correctly, testing efficiency can be improved.

[0131] S502. If the first test result is abnormal, the business processing terminal adjusts the version identifier of the first component or adjusts the interface parameters of the first component; the adjusted first business system is used as the new first business system, and a new first regression test is performed on the first number of items in the new first business system; if the first test result is normal, the business processing terminal performs a second regression test on the second number of items in the first business system to obtain a second test result.

[0132] The interface parameters of the component may change for different versions, so if the first test result is abnormal, it may be necessary to adjust the interface parameters of the first component.

[0133] The abnormal test result may be due to an incorrect version of the first component (version incompatibility) or incorrect interface parameters of the first component.

[0134] The second test result is used to characterize whether any errors or anomalies occurred during the second test. If even one error or anomaly exists, the second test result is considered abnormal.

[0135] The embodiments of this application do not limit the second quantity, which can be determined according to the actual situation. For example, the second quantity can be 30% of the total number of projects in the first business system.

[0136] S503. If the second test result is abnormal, the business processing terminal adjusts the version identifier of the first component or adjusts the interface parameters of the first component; the adjusted first business system is used as the new first business system, and a new second regression test is performed on the second number of items in the new first business system; if the second test result is normal, the business processing terminal performs a third regression test on the third number of items in the first business system to obtain the third test result.

[0137] The third test result is used to characterize whether any errors or anomalies occurred during the third test. If even one error or anomaly exists, the third test result is considered abnormal.

[0138] This application does not limit the third quantity, which can be determined according to the actual situation. For example, the third quantity can be 60% of the total number of projects in the first business system.

[0139] S504. If the third test result is abnormal, the business processing terminal adjusts the version of the first component or adjusts the interface parameters of the first component; the adjusted first business system is used as the new first business system, and a new third regression test is performed on the third number of items in the new first business system; if the third test result is normal, the business processing terminal determines that the first business system has passed the test.

[0140] In the regression testing process, the processing procedures may not be exactly the same for the first business system programmed in different languages.

[0141] For non-interpreted languages ​​(such as Java), open-source components need to be introduced during the compilation process, so recompiling is required when upgrading (regression testing).

[0142] In one possible implementation, if the first business system is programmed using a non-interpreted language, the method further includes: before the first regression test, the business processing terminal needs to build a first number of items in the first business system; before the second regression test, the business processing terminal needs to build a second number of items in the first business system; and before the third regression test, the business processing terminal needs to build a third number of items in the first business system.

[0143] For interpreted languages ​​(such as Python), since there is no compilation or no need to import components during the compilation process, but corresponding components need to be imported into the environment, the component versions in the environment need to be updated when updating (regression testing).

[0144] In another possible implementation, if the first business system is programmed using an interpreted language, the method further includes: before the first regression test, the business processing end needs to update the version identifier of the first component in the test environment for a first number of items in the first business system; before the second regression test, the business processing end needs to update the version identifier of the first component in the test environment for a second number of items in the first business system; and before the third regression test, the business processing end needs to update the version identifier of the first component in the test environment for a third number of items in the first business system.

[0145] The following example, using a non-interpreted language, illustrates the data processing method provided in this application.

[0146] To facilitate understanding, some technical terms are explained.

[0147] Bill of Materials (BOM): In application development, it usually refers to a list of components that the application depends on.

[0148] Maven: An open-source software project management and automated build tool provided by the Apache Software Foundation.

[0149] Gradle: A popular open-source tool for automating project builds.

[0150] Maven repository: Used to store builds and various dependencies generated during the build process.

[0151] GAV: an acronym for groupId, artifactId, and version, also known as Maven repository coordinates, used to uniquely identify a JAR file.

[0152] Common Vulnerabilities and Exposures (CVE) is a database that lists known defects and exposure instances in software systems.

[0153] Continuous Integration (CI): Continuous integration is a software development practice where team members frequently integrate their work, typically at least once a day, meaning multiple integrations may occur daily. Each integration is validated through automated builds (including compilation, deployment, and automated testing) to detect integration errors as early as possible.

[0154] Continuous Deployment (CD): refers to the continuous deployment process.

[0155] Software Composition Analysis (SCA) is a technique for identifying, analyzing, and tracing the components of binary software. It is specifically designed to analyze the various source code, modules, frameworks, and libraries used by developers to identify and inventory the components, structure, and dependencies of open-source software.

[0156] Host-based Intrusion Detection System (HIDS): HIDS monitors and analyzes system, events, and security logs.

[0157] Software Development Kit (SDK): A software development kit is generally a collection of development tools used by software engineers to build application software for specific software packages, software frameworks, hardware platforms, operating systems, etc.

[0158] For the management and maintenance of open source component versions, the relevant technology is generally to maintain the version of the open source component introduced in each project separately.

[0159] Because each project maintains its own list of open-source components and versions, when introducing new open-source components, developers are responsible for evaluating the necessary components and their corresponding versions. When a referenced component is found to have a vulnerability, each project is responsible for upgrading and fixing it. Specifically, if the vulnerable open-source component was introduced by the project itself, the developers upgrade it themselves, either by modifying the component version number in the project configuration file or by directly replacing the component in the project with a higher version. If the vulnerable open-source component was introduced through another component, the parent component must first be upgraded before the version of the introduced parent component is modified.

[0160] Maintaining separate versions of imported open-source components for each project has the following drawbacks:

[0161] First, during program development, when introducing external open-source components, security vulnerabilities are easily overlooked due to insufficient security awareness among developers. As a result, the project may introduce components with security vulnerabilities, thereby reducing security.

[0162] Secondly, because developers are unfamiliar with security vulnerabilities, assessing and understanding the security vulnerabilities of open-source components requires a certain amount of time and effort, reducing development efficiency.

[0163] Third, when new vulnerabilities emerge, security personnel need to communicate with the developers of each affected project to push them to implement upgrades; this communication process consumes a lot of manpower.

[0164] Fourth, each project's own modifications and upgrades will consume a lot of manpower on repetitive work, reducing R&D efficiency.

[0165] Fifth, component upgrades may cause compatibility issues and affect program stability.

[0166] For example, after an open-source component is introduced, it is typically called through interfaces / methods in the project code. When a component is upgraded, in addition to fixing known security vulnerabilities, functional upgrades are often also included. However, if there are functional upgrades, the interfaces provided by the component may change, such as changes in input parameters. For example, after open-source component A is upgraded from version 1.5 to version 1.7, one of its interface parameters changes, from requiring two parameters to requiring three. Correspondingly, our code needs to be modified to add the newly added parameter when calling the interface; otherwise, call exceptions may occur, that is, functional exceptions, ultimately affecting system stability.

[0167] Sixth, if each project upgrades itself, the same problem may be encountered multiple times, reducing R&D efficiency.

[0168] Suppose multiple projects within the company are using version 1.5 of open-source component A, and all need to upgrade to version 1.7. Since these projects are often managed by multiple developers, each needs to research the changes brought about by the component A version upgrade. Some projects might even upgrade directly, encountering compatibility issues before resolving them. This is essentially the same problem, but each project solving it independently, repeatedly encountering the same pitfalls, significantly reduces development efficiency.

[0169] An analysis of the management and maintenance methods for open-source components in related technologies reveals that the main reasons for the aforementioned shortcomings include:

[0170] In related technologies, each project maintains its own list of referenced open-source components and versions; the specific versions referenced need to be evaluated by the developers themselves; when vulnerabilities occur, each project can only upgrade on its own, and unified and automated operations cannot be achieved.

[0171] The main improvements made in this embodiment of the application are as follows:

[0172] First, the security team maintains a unified BOM, which defines specific open-source components and their security versions for various business systems or SDKs to reference.

[0173] Secondly, by referencing the Bill of Materials (BOM) provided by the security team, business systems only need to declare the component name when introducing open-source components; the component version is based on the one declared in the BOM file. Developers do not need to worry about specific security vulnerabilities, and this also avoids introducing security components with vulnerabilities.

[0174] Furthermore, when new external security vulnerabilities are discovered, the security department updates the versions of the relevant components in the Bill of Materials (BOM) immediately. Individual business systems do not require separate modifications; they can simply be rebuilt and deployed through CI / CD processes, improving development efficiency.

[0175] Then, when new security vulnerabilities are added externally, the component versions in the BOM are automatically modified and released. Combined with automated CI and CD processes, the open-source components are automatically tested and upgraded through relevant automated processes, ensuring that the upgrade process is efficient and reliable.

[0176] Specifically, this embodiment of the application may include, but is not limited to, the following three parts:

[0177] Part 1: The security system collects vulnerability information of external open-source components and automatically maintains the component versions in the BOM;

[0178] Part Two: The business system ensures that the introduced open-source components are secure and free of vulnerabilities by introducing a Bill of Materials (BOM).

[0179] Part Three: Business Systems. When new vulnerabilities are added externally, components are automatically upgraded and verified through an automated pipeline.

[0180] The following describes the process of collecting vulnerability information of external open-source components and automatically maintaining the component versions in the BOM. This may include, but is not limited to, steps A1 to A4 below.

[0181] Step A1: The security department initially obtains a complete list of open-source components currently used within the organization through methods such as SCA, code scanning, and HIDS.

[0182] Step A2: Select the security versions of each open-source component and create a BOM.

[0183] Suppose that in step A1, a list of internally used open-source components can be obtained through various means, including: A, B, C, D, E…

[0184] For these open-source components, there are usually corresponding minimum versions without security vulnerabilities, which can also be called secure versions.

[0185] Then create a BOM file and make declarations, mainly declaring the component's groupId, artifactId (equivalent to the component's identifier), and version. The version is the security version that is declared directly.

[0186] If you are using the Maven tool for building, the minimum declaration should look like this:

[0187] <dependency>Represented as a declaration

[0188] <groupid> com.google.code.gson< / groupid> Indicates the component's groupId;

[0189] <artifactid> gson< / artifactid> This represents the component's artifactId;

[0190] <version> 2.9.0< / version> Indicates the security version of the component.

[0191] < / dependency> This indicates the end of the statement.

[0192] Step A3: By writing a program, collect vulnerability information of these open-source components automatically every day. This information can be found on the relevant public websites of CVE.

[0193] Additionally, when the official component releases a new version, you can determine whether there is a security update by checking the update content or version type (feature update, security update). (A security update corresponds to a security version.)

[0194] Step A4: Based on the information collected in step A3, when a new external security vulnerability is added, the component version defined in the BOM can be automatically modified to achieve automatic upgrade of the components in the BOM.

[0195] The version number of a component is declared in the Bill of Materials (BOM). When a new vulnerability is discovered, the corresponding version number can be modified. The automated modification method is similar to editing a text file: matching and locating the specific line, and then replacing the version number.

[0196] For example, if open-source component A has a new security vulnerability, and the corresponding patch version is 1.9, then we need to change its version number. If we are using Maven for building, the component and version declaration are as follows:

[0197] <dependency>

[0198] <groupid> com.test.A< / groupid>

[0199] <artifactid> A< / artifactid>

[0200] <version> 1.8< / version>

[0201] < / dependency>

[0202] The only thing needed for automated program upgrades is to match component names and keywords. <version> 1.8< / version> In this line, change the version number in the label to the safe version number and save.

[0203] Flowchart as follows Figure 6 As shown, this process can be achieved through... Figure 6 It is represented by S601 to S612 in the code.

[0204] S601, Begin;

[0205] S602, SCA / Code Scanning / HIDS;

[0206] S603, a list of open-source components used within the organization;

[0207] S604, Define the security version;

[0208] S605, BOM;

[0209] S606, external CVE vulnerability data;

[0210] S607, Component Update Log;

[0211] S608, Automated data collection;

[0212] S609. Have any new security vulnerabilities been added?

[0213] If yes, proceed with S610 below; if no, proceed with S612 below.

[0214] S610 and BOM component automated upgrade;

[0215] S611, BOM;

[0216] S612, Released.

[0217] The following section explains the second part: the process by which the business system ensures the security and vulnerability-free nature of the introduced open-source components by introducing a Bill of Materials (BOM).

[0218] Specifically, the business system declares the inclusion of the provided BOM in the project's configuration file.

[0219] Taking Java projects as an example, the industry mainly uses Maven and Gradle for component dependency management and building.

[0220] For Maven programs, configuration is mainly done through the pom.xml file. When declaring the versions of dependent components, simply place the BOM import declaration first.

[0221] For Gradle programs, configuration is mainly done through the build.gradle file. Similar to Maven, when declaring the versions of dependent components, the BOM import declaration is placed first.

[0222] After introducing the BOM provided by the unified security provider, developers only need to fill in the groupId (group name) and artifactId (component name) from the component's GAV when referencing open-source components. The component version does not need to be filled in; it will be based on the one defined in the BOM. If a custom version is required, simply declare the version number.

[0223] The following section describes the process of automatically upgrading and verifying components through an automated pipeline when external vulnerabilities are added. This process may include, but is not limited to, steps B1 to B7 below.

[0224] Step B1: Sort projects according to their level of automation and the completeness of regression test cases within the organization, and group them into groups of 10%, 30%, and 60%.

[0225] Step B2: When a new external security vulnerability is discovered and the components in the BOM are affected, the security department shall promptly update and republish the BOM.

[0226] Step B3: Begin the canary rollout and verification. Using the CI / CD automated workflow, in the test environment, first rebuild the first 10% of projects from Step B1 using CI. After a successful build, execute automated regression testing. If no anomalies are found during regression testing, the automated upgrade of this batch of projects is considered successful. Then, similarly, allocate and execute automated builds and tests for the remaining 30%, 60%, and so on.

[0227] Step B4: If problems are found during regression testing, the security department will work with the relevant business developers to investigate and adjust the relevant component versions or component interface calling methods.

[0228] Step B5: After the entire project is completed, summarize the results of the automated regression test cases to determine whether the upgrade has any impact on the business.

[0229] Step B6: Inform project team members that projects that pass verification can choose to redeploy directly to the production environment through process automation.

[0230] Step B7: Vulnerable component upgrade and repair completed.

[0231] The processing procedure in the third part can be described as follows: Figure 7 S701 to S712 are shown.

[0232] S701, New external security vulnerability;

[0233] S702, Is it affected?

[0234] If affected, proceed with S703 below; if not affected, then end.

[0235] S703, BOM automation upgrade;

[0236] S704, automated building and testing of the top 10% of projects;

[0237] S705. Did the regression test detect any abnormalities?

[0238] If yes, then execute S706 below; if no, then execute S707 below.

[0239] S706, troubleshoot component conflicts or interface changes;

[0240] S707, 30% of projects are automated for building and testing;

[0241] S708. Did the regression test detect any abnormalities?

[0242] If yes, then execute S706 below; if no, then execute S709 below.

[0243] S709, Automated build and testing of the remaining 60% of the project;

[0244] S710, Did the regression test detect any anomalies?

[0245] If yes, then execute S706 below; if no, then execute S711 below.

[0246] S711, Project redeployment;

[0247] S712, the automated upgrade process is complete.

[0248] This embodiment of the application has the following technical effects:

[0249] Establish a unified list of secure versions of components across the entire organization. When developers introduce components, they will use the secure version declared in the BOM by default, without having to consider the security vulnerabilities involved in specific versions, thereby improving development efficiency.

[0250] This helps prevent the introduction of vulnerable components due to developers' lack of security awareness.

[0251] When new security vulnerabilities are discovered, they can be automatically upgraded through BOM and CI / CD processes, effectively reducing the cost of security vulnerability remediation.

[0252] Improve vulnerability remediation efficiency, reduce vulnerability exposure time, and enhance system security.

[0253] The data processing method provided in this application embodiment can also be applied to services developed using interpreted languages.

[0254] For projects developed using languages ​​like Python, the dependencies are installed on the machine running the program and are not updated during the build phase. The dependency versions on the deployment server can be updated based on the Bill of Materials (BOM). More details can be provided. Figure 8 S801 to S812 are shown.

[0255] S801, New external security vulnerability;

[0256] S802, Is it affected?

[0257] If affected, execute S803 below; if not affected, then end.

[0258] S803, BOM automation upgrade;

[0259] S804, the test environment for the top 10% of projects has been updated with dependent versions;

[0260] S805. Did the regression test detect any anomalies?

[0261] If yes, then execute S806 below; if no, then execute S807 below.

[0262] Troubleshooting S806, component conflicts, or interface changes;

[0263] S807, 30% of project test environment updates dependency versions;

[0264] S808, Did the regression test find any abnormalities?

[0265] If yes, then execute S806 below; if no, then execute S809 below.

[0266] S809, 60% of project test environments have updated dependency versions;

[0267] S810, Did the regression test detect any anomalies?

[0268] If yes, then execute S806 below; if no, then execute S811 below.

[0269] S811, Production environment update dependency versions;

[0270] S812, the automated upgrade process is complete.

[0271] Thirdly, to implement the data processing method provided in the first aspect, this application provides a first data processing apparatus, which is described below in conjunction with... Figure 9 The structural diagram of the data processing device shown is used for illustration.

[0272] like Figure 9 As shown, the first data processing device 90 includes: an acquisition unit 901, a determination unit 902, a creation unit 903, and a publishing unit 904. Wherein:

[0273] The acquisition unit 901 is used to acquire the components involved in each of the M business systems related to the security system, and obtain a target component list including N components; where M and N are integers greater than 1.

[0274] The determining unit 902 is configured to determine, for each of the N components included in the target component list, an identifier of the security version of the component in the component library; the identifier of the security version is used to point to the security version of the component in the component library;

[0275] Creation unit 903 is used to create a security bill of materials based on the component identifier of each of the N components included in the target component list and the security version identifier of the component;

[0276] The publishing unit 904 is used to publish the security bill of materials so that the security bill of materials can be reused for component references in the M business systems.

[0277] In some embodiments, the obtaining unit 901 is further configured to:

[0278] By scanning the code of the business system using the first method, identifying the declarations in the code, and obtaining the components involved in the business system;

[0279] Alternatively, the components involved in the business system can be obtained by scanning the files introduced by the business system using a second method;

[0280] The first method includes software component analysis or code scanning; the second method includes software component analysis or host-based intrusion detection.

[0281] In some embodiments, the first data processing device 90 further includes a vulnerability processing unit, which is configured to: collect vulnerability information of each of the N components included in the component list;

[0282] If vulnerability information of the first component among the N components is collected, then a patch version corresponding to the vulnerability information is determined based on the vulnerability information of the first component.

[0283] Update the security version identifier of the first component in the security bill of materials based on the identifier of the repaired version.

[0284] Fourthly, to implement the data processing method provided in the second aspect above, a second data processing apparatus according to an embodiment of this application is described below in conjunction with... Figure 10 The structural diagram of the data processing device shown is used for illustration.

[0285] like Figure 10 As shown, the second data processing device 100 includes: a first configuration unit 1001 and a second configuration unit 1002.

[0286] The first configuration unit 1001 is used to configure the component identifiers of K components involved in the first business system; wherein K is greater than or equal to 1;

[0287] The second configuration unit 1002 is used to configure the version identifiers of the K components based on the security bill of materials; the security bill of materials includes the component identifiers of N components involved in the M business systems, and the security version identifier of each of the N components; the M business systems include the first business system; the N components include the K components.

[0288] In some embodiments, the second configuration unit 1002 is further configured to: if the first business system is programmed using a non-interpreted language, introduce the security bill of materials in the configuration file of the first business system in a declarative manner, so as to determine the version identifiers of the K components based on the version identifiers of the components in the security bill of materials;

[0289] If the first business system is programmed using an interpreted language, the version identifiers of the K components are configured in the configuration environment based on the security version identifier of each of the N components in the security bill of materials.

[0290] In some embodiments, the second processing device 100 may further include a testing unit.

[0291] The testing unit is used to: perform a first regression test on a first number of items in the first business system and obtain a first test result;

[0292] If the first test result is abnormal, the version identifier of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new first regression test is performed on the first number of items in the new first business system; if the first test result is normal, a second regression test is performed on the second number of items in the first business system to obtain the second test result.

[0293] If the second test result is abnormal, the version identifier of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new second regression test is performed on the second number of items in the new first business system; if the second test result is normal, a third regression test is performed on the third number of items in the first business system to obtain the third test result.

[0294] If the third test result is abnormal, the version of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new third regression test is performed on the third number of items in the new first business system; if the third test result is normal, the first business system is determined to have passed the test.

[0295] In some embodiments, if the first business system is programmed using a non-interpreted language, the testing unit is further configured to: build a first number of items in the first business system before the first regression test; build a second number of items in the first business system before the second regression test; and build a third number of items in the first business system before the third regression test.

[0296] In some embodiments, if the first business system is programmed using an interpreted language, the testing unit is further configured to: update the version identifier of the first component in the test environment for a first number of items in the first business system before the first regression test; update the version identifier of the first component in the test environment for a second number of items in the first business system before the second regression test; and update the version identifier of the first component in the test environment for a third number of items in the first business system before the third regression test.

[0297] It should be noted that the data processing device provided in this application embodiment includes all the units included, which can be implemented by a processor in an electronic device; of course, it can also be implemented by specific logic circuits; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field-programmable gate array (FPGA), etc.

[0298] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0299] It should be noted that, in the embodiments of this application, if the above-described data processing method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0300] Fifthly, in order to implement the data processing method provided in the first or second aspect above, this application provides an electronic device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements the steps in the data processing method provided in the first or second aspect above.

[0301] The following is combined with Figure 11 The electronic device 110 shown is illustrated with a structural diagram of the electronic device.

[0302] In one example, electronic device 110 can be either the aforementioned security processing terminal or service processing terminal. For example... Figure 11 As shown, the electronic device 110 includes: a processor 1101, at least one communication bus 1102, a user interface 1103, at least one external communication interface 1104, and a memory 1105. The communication bus 1102 is configured to enable communication between these components. The user interface 1103 may include a display screen, and the external communication interface 1104 may include standard wired and wireless interfaces.

[0303] The memory 1105 is configured to store instructions and applications executable by the processor 1101, and can also cache data to be processed or already processed by the processor 1101 and various modules in the electronic device (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0304] Sixthly, embodiments of this application provide a storage medium, namely a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the steps in the data processing method provided in the first or second aspect of the above embodiments.

[0305] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0306] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0307] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0308] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0309] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0310] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0311] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0312] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0313] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing method, characterized in that, The method is applied to a security system, and the method includes: For each of the M business systems related to the security system, obtain the components involved in each business system to obtain a target component list including N components; where M and N are integers greater than 1. For each of the N components included in the target component list, a security version identifier for the component is determined in the component library; the security version identifier is used to point to the security version of the component in the component library; when the component type is an open source component, the component library is the component library corresponding to each public website; when the component type is a non-open source component, the component library is a private component library. A security bill of materials is created based on the component identifier of each of the N components included in the target component list and the security version identifier of the component; Publish the security bill of materials so that the security bill of materials can be reused for component references in the M business systems; The method further includes: For each of the N components included in the component list, collect vulnerability information for that component; If vulnerability information of the first component among the N components is collected, then a patch version corresponding to the vulnerability information is determined based on the vulnerability information of the first component; wherein, the first component is any component whose vulnerability information is collected. Update the security version identifier of the first component in the security bill of materials based on the identifier of the repaired version.

2. The method according to claim 1, characterized in that, The acquisition of the components involved in each of the business systems includes: By scanning the code of the business system using the first method, identifying the declarations in the code, and obtaining the components involved in the business system; Alternatively, the components involved in the business system can be obtained by scanning the files introduced by the business system using a second method; The first method includes software component analysis or code scanning; the second method includes software component analysis or detection based on a host-based intrusion detection system.

3. A data processing method, characterized in that, The method is applied to a first business system, and the method includes: Configure the component identifiers of the K components involved in the first business system; wherein K is greater than or equal to 1; The version identifiers of the K components are configured based on the security bill of materials; the security bill of materials includes component identifiers of N components involved in M ​​business systems, and security version identifiers of each of the N components; the M business systems include the first business system; the N components include the K components; M and N are integers greater than 1; Wherein, the security version identifier is used to point to the security version of the component in the component library; when the component type is an open source component, the component library is the component library corresponding to each public website; when the component type is a non-open source component, the component library is a private component library; Among them, the M business systems are related to the security system, and the security system is used to perform the following steps: For each of the N components included in the target component list, collect vulnerability information for that component; If vulnerability information of the first component among the N components is collected, then a patch version corresponding to the vulnerability information is determined based on the vulnerability information of the first component; wherein, the first component is any component whose vulnerability information is collected. Update the security version identifier of the first component in the security bill of materials based on the identifier of the repaired version.

4. The method according to claim 3, characterized in that, If the first business system is programmed using a non-interpreted language, the configuration of the version identifiers of the K components based on the safety bill of materials includes: In the configuration file of the first business system, the security bill of materials is introduced in a declarative manner so that the version identifiers of the K components can be determined according to the version identifiers of the components in the security bill of materials. If the first business system is programmed using an interpreted language, the step of configuring the version identifiers of the K components based on the safety bill of materials includes: Based on the security version identifier of each of the N components in the security bill of materials, the version identifiers of the K components are configured in the configuration environment.

5. The method according to claim 3, characterized in that, In the event that a vulnerability is added to the first component, the method further includes: A first regression test is performed on a first number of items in the first business system to obtain a first test result; If the first test result is abnormal, the version identifier of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new first regression test is performed on the first number of items in the new first business system; if the first test result is normal, a second regression test is performed on the second number of items in the first business system to obtain the second test result. If the second test result is abnormal, the version identifier of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new second regression test is performed on the second number of items in the new first business system; if the second test result is normal, a third regression test is performed on the third number of items in the first business system to obtain the third test result. If the third test result is abnormal, the version of the first component is adjusted, or the interface parameters of the first component are adjusted; the adjusted first business system is used as the new first business system, and a new third regression test is performed on the third number of items in the new first business system; if the third test result is normal, the first business system is determined to have passed the test.

6. The method according to claim 5, characterized in that, If the first business system is programmed using a non-interpreted language, the method further includes: Before the first regression test, a first number of projects are constructed in the first business system; Before the second regression test, a second number of projects are constructed in the first business system; Prior to the third regression test, a third number of projects are constructed in the first business system.

7. The method according to claim 5, characterized in that, If the first business system is programmed using an interpreted language, the method further includes: Before the first regression test, the version identifier of the first component is updated in the test environment for a first number of projects in the first business system; Before the second regression test, the version identifier of the first component is updated in the test environment for a second number of items in the first business system; Prior to the third regression test, the version identifier of the first component is updated in the test environment for a third number of items in the first business system.

8. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, the processor executing the program to implement the data processing method according to any one of claims 1 to 7.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data processing method according to any one of claims 1 to 7.

Images