Software processing methods, apparatuses, electronic devices, and media

Abstract

This application provides a method, apparatus, electronic device, and medium for processing software packages. The method specifically includes: receiving a private key and storing it in first secure hardware; unpacking the software package; performing security checks on each file unit contained in the software package; if the security checks on all file units are successful, generating a digital signature corresponding to the software package using the private key, adding the digital signature to the software package, and performing a software package insertion operation; determining a first hash value and storing it in the first secure hardware; receiving a download request from a client for a target software package; sending the target software package to the client; and sending the first hash value to second secure hardware so that the client can match the first hash value with a newly determined second hash value. This application can prevent software packages in a software repository from being attacked by the software supply chain before insertion and during transmission.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and medium for processing software packages. Background Technology

[0002] The practical application of an operating system relies heavily on the installation and upgrade of various software packages. Existing Linux operating systems primarily manage software or software packages through software repositories. A software repository is a special directory on the server where users can select the necessary software packages and download, install, or upgrade them.

[0003] Current software package processing methods typically utilize package signatures to enhance package authenticity. Specifically, these methods include: the software repository signing the package; the operating system downloading the package from the repository and then using a public key to verify the signature; if the signature verification passes, the package is installed.

[0004] However, in practical applications, the public key used for signature verification may be at risk of being leaked. If the public key is leaked, even if the software package is attacked by the software supply chain, the signature verification can still pass; therefore, current software package processing methods still suffer from the problem of software supply chain attacks. Summary of the Invention

[0005] This application provides a method for processing software packages, which can prevent software packages in a software repository from being attacked by the software supply chain before being stored and during transmission.

[0006] Accordingly, embodiments of this application also provide a software package processing apparatus, an electronic device, and a machine-readable medium to ensure the implementation and application of the above methods.

[0007] To address the aforementioned problems, this application discloses a method for processing software packages, applied to a software repository server. The software repository server is equipped with first security hardware. The method includes:

[0008] Receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware;

[0009] The software package is unpacked to obtain the file units contained in the software package;

[0010] Security checks are performed on each file unit contained in the software package to obtain the security check result for each file unit;

[0011] If all file units are found to be secure, the private key is used to generate a digital signature for the software package, the digital signature is added to the software package, and the software package is then added to the database.

[0012] Determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware;

[0013] Receives a download request from a client for a target software package; the client is equipped with a second security hardware.

[0014] The target software package is sent to the client using an encrypted channel;

[0015] Using the channel between the first security hardware and the second security hardware, the target software package and the first hash value of the file units contained in the target software package are sent to the second security hardware, so that the client can match the first hash value with the redefined second hash value.

[0016] To address the aforementioned problems, this application discloses a software package processing method applied to a client, wherein the client is equipped with second security hardware, and the method includes:

[0017] Send a download request for the target software package to the software repository server;

[0018] Receive the target software package sent by the software repository server using an encrypted channel;

[0019] Using the channel between the first security hardware and the second security hardware, the first hash value of the target software package and the file unit contained in the target software package is received, and the first hash value is saved to the second security hardware;

[0020] Utilizing the channel between the second security hardware and the third security hardware of the security management server, a public key is received and stored in the second security hardware;

[0021] Determine the second hash value of the target software package and the file units contained in the target software package;

[0022] The first hash value and the second hash value are matched to obtain the corresponding matching result;

[0023] If the matching result is successful, the corresponding digital signature is obtained from the target software package, and the digital signature is verified using the public key.

[0024] If the signature verification passes, the target software package will be installed.

[0025] To address the aforementioned issues, this application also discloses a software package processing device applied to a software repository server. The software repository server is equipped with first security hardware. The device includes:

[0026] The key processing module is used to receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware;

[0027] A software package unpacking module is used to unpack software packages to obtain the file units contained in the software packages;

[0028] The security detection module is used to perform security detection on each file unit contained in the software package to obtain the security detection result corresponding to each file unit;

[0029] The digital signature module is used to generate a digital signature corresponding to the software package using the private key, and add the digital signature to the software package, provided that the security detection results of all file units are secure.

[0030] The data entry module is used to perform the data entry operation of the software package after the digital signature is added to the software package;

[0031] A hash value processing module is used to determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware;

[0032] A download request receiving module is used to receive download requests sent by a client for a target software package; the client is equipped with a second security hardware.

[0033] A software package sending module is used to send the target software package to the client using an encrypted channel;

[0034] The hash value sending module is used to send the target software package and the first hash value of the file units contained in the target software package to the second security hardware via the channel between the first security hardware and the second security hardware.

[0035] Optionally, the security detection module is specifically used to detect vulnerabilities and malicious code in each file unit contained in the software package.

[0036] Optionally, the digital signature module includes:

[0037] The record generation module is used to generate a detection record for each file unit contained in the software package, provided that the detection results for each file unit are safe.

[0038] The record sending module is used to send the detection record to the security management server so that the security management server can approve the detection record;

[0039] The signature generation module is used to generate a digital signature corresponding to the software package using the private key after receiving the approval message sent by the security management server.

[0040] Optionally, the private key is a key generated by the security management server using a national commercial cryptographic algorithm.

[0041] This application also discloses a software package processing apparatus, which is applied to a client, the client being equipped with second security hardware, and the apparatus comprising:

[0042] The download request sending module is used to send download requests for the target software package to the software repository server;

[0043] The software package receiving module is used to receive the target software package sent by the software repository server using an encrypted channel;

[0044] The hash value receiving and saving module is used to receive the first hash value of the target software package and the file unit contained in the target software package using the channel between the first security hardware and the second security hardware, and save the first hash value to the second security hardware;

[0045] The public key processing module is used to receive the public key through the channel between the second security hardware and the third security hardware of the security management server, and save the public key to the second security hardware.

[0046] A hash value determination module is used to determine the second hash value of the target software package and the file units contained in the target software package;

[0047] A matching module is used to match the first hash value with the second hash value to obtain the corresponding matching result;

[0048] The signature verification module is used to obtain the corresponding digital signature from the target software package when the matching result is a successful match, and to perform signature verification on the digital signature using the public key;

[0049] The installation processing module is used to install the target software package if the signature verification passes.

[0050] Optionally, the installation processing module includes:

[0051] The dependency determination module is used to determine the dependencies of the target software package and obtain the corresponding determination result;

[0052] The dependency download module is used to download the target software unit when the determination result indicates that the target software unit needs to be downloaded.

[0053] The installation module is used to install the target software package when the determination result indicates that the target software unit does not need to be downloaded.

[0054] This application also discloses an electronic device, including: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform the method described in this application.

[0055] This application also discloses a machine-readable medium storing executable code thereon, which, when executed, causes a processor to perform the method described in this application.

[0056] The embodiments of this application have the following advantages:

[0057] In the technical solution of this application embodiment, the software repository server unpacks the software package and performs security checks on each file unit contained in the software package. These file units may include binary files, scripts, configuration files, and other critical files. The aforementioned security checks may involve vulnerability and malicious code detection for each file unit to determine whether each file unit is secure.

[0058] Secondly, in this embodiment of the software repository, if the security check results of all file units of the software package are secure, the server uses the private key to generate a digital signature corresponding to the software package, adds the digital signature to the software package, and performs the package insertion operation. The insertion operation can be used to save the software package to the software repository. Because this embodiment of the application inserts secure and signed software packages into the repository, it can prevent insecure software packages from being saved to the software repository. In other words, this embodiment of the application can prevent software packages in the software repository from being attacked by the software supply chain before being inserted into the repository.

[0059] Furthermore, the software repository server in this embodiment of the application also determines the first hash value of the software package and the file units contained in the software package, and saves the first hash value to the first secure hardware; and, after receiving a download request sent by the client for the target software package, it can use an encrypted channel to send the target software package to the client, and use the channel between the first secure hardware and the second secure hardware to send the target software package and the first hash value of the file units contained in the target software package to the second secure hardware, so that the client can match the first hash value with the re-determined second hash value. Since changes in the file package or the file units of the file package will cause changes in the hash value, the client in this embodiment of the application can prevent the software package from being attacked by the software supply chain during transmission by matching the first hash value with the re-determined second hash value.

[0060] In summary, the collaborative processing of the software repository server and client in this embodiment helps mitigate software supply chain attacks corresponding to software packages. Furthermore, it effectively protects the data associated with the software packages and improves the intelligence, efficiency, and security of software repository management. Attached Figure Description

[0061] Figure 1 This is a schematic diagram of the structure of a software package processing system according to an embodiment of this application;

[0062] Figure 2 This is a flowchart illustrating the steps of a software package processing method according to an embodiment of this application;

[0063] Figure 3 This is a schematic diagram of the interaction process between the security management server and the software repository server according to one embodiment of this application;

[0064] Figure 4 This is a flowchart illustrating a method for processing a software package according to an embodiment of this application;

[0065] Figure 5 This is a flowchart illustrating the processing procedure of a scanning tool for a software repository server according to an embodiment of this application.

[0066] Figure 6 This is a flowchart illustrating the steps of a software package processing method according to an embodiment of this application;

[0067] Figure 7 This is a flowchart illustrating the steps of a software package installation method according to an embodiment of this application;

[0068] Figure 8 This is a flowchart illustrating the steps of a software package processing method according to an embodiment of this application;

[0069] Figure 9This is a schematic diagram of the structure of a software package processing apparatus according to an embodiment of this application;

[0070] Figure 10 This is a schematic diagram of the structure of a software package processing apparatus according to an embodiment of this application;

[0071] Figure 11 This is a schematic diagram of the structure of an apparatus provided in one embodiment of this application. Detailed Implementation

[0072] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0073] The embodiments of this application can be used to process software packages of operating systems such as Linux, so as to alleviate the problem of software packages being attacked by the supply chain to a certain extent.

[0074] Supply chain attacks are an emerging threat targeting software developers and vendors. Their goal is to gain access to source code, build processes, or update mechanisms by distributing malware through infected applications. Because Linux software is typically open-source, and open-source software is upstream in the software supply chain, an attack on one open-source project directly impacts the entire downstream user base, creating a very large attack surface.

[0075] Software repositories typically reside on a server and manage numerous software packages, including software and operating systems. They aggregate these packages into a single repository and provide a unified URL (Uniform Resource Locator) for client use. For simplicity, the software repository located on the server is referred to as the software repository server.

[0076] Current software package processing methods typically utilize package signatures to enhance package authenticity. Specifically, these methods include: the software repository signing the package; the operating system downloading the package from the repository and then using a public key to verify the signature; if the signature verification passes, the package is installed.

[0077] However, in practical applications, the public key used for signature verification may be at risk of being leaked. If the public key is leaked, even if the software package is attacked by the software supply chain, the signature verification can still pass; therefore, current software package processing methods still suffer from the problem of software supply chain attacks.

[0078] To address the technical problem of software packages being vulnerable to attacks from the software supply chain in related technologies, this application provides a method for processing software packages. This method is applied to a software repository server, which is equipped with first security hardware. The method specifically includes: receiving a private key sent by a security management server through third security hardware and storing the private key in the first security hardware; unpacking the software package to obtain the file units contained within it; performing security checks on each file unit to obtain a security check result for each file unit; and, if the security check results for all file units are secure, using the private key to generate the software package... The system retrieves and adds a digital signature corresponding to the software package to the software package and performs a software package insertion operation; determines a first hash value for the software package and the file units contained in the software package, and saves the first hash value to the first secure hardware; receives a download request from a client for the target software package; the client is equipped with second secure hardware; sends the target software package to the client using an encrypted channel; and sends the target software package and the first hash value of the file units contained in the target software package to the second secure hardware using a channel between the first and second secure hardware, so that the client matches the first hash value with the re-determined second hash value.

[0079] First, this embodiment of the application unpacks the software package and performs security checks on each file unit contained within the package. These file units may include binary files, scripts, configuration files, and other critical files. The security checks may involve detecting vulnerabilities and malicious code in each file unit to determine whether each file unit is secure.

[0080] Secondly, in this embodiment, if the security detection results of all file units of the software package are secure, a digital signature corresponding to the software package is generated using the private key, the digital signature is added to the software package, and the software package is added to the repository. The repository addition operation can be used to save the software package to a software repository. Because this embodiment adds a secure and signed software package to the repository, it can prevent insecure software packages from being saved to the software repository. In other words, this embodiment can prevent software packages in the software repository from being attacked by the software supply chain before they are added to the repository.

[0081] Furthermore, this embodiment of the application also determines a first hash value for the software package and the file units contained within the software package, and saves the first hash value to the first secure hardware. After receiving a download request from a client for the target software package, the client can use an encrypted channel to send the target software package to the client, and use the channel between the first and second secure hardware to send the target software package and the first hash value of the file units contained within the target software package to the second secure hardware, so that the client can match the first hash value with the redefined second hash value. Since changes in the file package or file units of the file package will cause changes in the hash value, the client's matching of the first hash value with the redefined second hash value in this embodiment of the application can prevent the software package from being attacked by the software supply chain during transmission.

[0082] In summary, the collaborative processing of the software repository server and client in this embodiment helps mitigate software supply chain attacks corresponding to software packages. Furthermore, it effectively protects the data associated with the software packages and improves the intelligence, efficiency, and security of software repository management.

[0083] Reference Figure 1 The diagram shows a schematic of the structure of a software package processing system according to an embodiment of this application. The system specifically includes: a security management server 101, a software repository server 102, and a client 103.

[0084] The software repository server 102 is equipped with first security hardware, the client 103 is equipped with second security hardware, and the security management server 101 is equipped with third security hardware.

[0085] The security management server 101 can generate a public key and a private key, and send the private key to the software repository server 102. Specifically, the security management server 101 can use the channel between the first security hardware and the third security hardware to send the private key to the first security hardware of the software repository server 102.

[0086] The security management server 101 can also use the channel between the second security hardware and the third security hardware to send the public key to the client 103.

[0087] The software repository server 102 can perform a first preset processing on the software package. The first preset processing may include: unpacking the software package to obtain the file units contained in the software package; performing security checks on each file unit contained in the software package to obtain the security check result corresponding to each file unit; if the security check results of all file units are secure, using the private key to generate a digital signature corresponding to the software package, adding the digital signature to the software package, and performing the software package storage operation; determining the first hash value of the software package and the file units contained in the software package, and saving the first hash value to the first secure hardware.

[0088] The first preset processing result of the software repository server 102 for the software package may include: saving the software package with all file units having security detection results of being secure and having been signed to the software repository; and saving the first hash value to the first security hardware.

[0089] Client 103 can perform a second preset processing on the software package to enable the download and installation of the software package. The second preset processing specifically includes: sending a download request for the target software package to the software repository server; receiving the target software package sent by the software repository server via an encrypted channel; receiving the target software package and the first hash value of the file units contained in the target software package via the channel between the first and second security hardware, and saving the first hash value to the second security hardware; receiving a public key via the channel between the second security hardware and the third security hardware of the security management server, and saving the public key to the second security hardware; determining the second hash value of the target software package and the file units contained in the target software package; matching the first hash value with the second hash value to obtain a corresponding matching result; obtaining the corresponding digital signature from the target software package; if the matching result is successful, performing signature verification on the digital signature using the public key; and if the signature verification passes, performing the installation process on the target software package.

[0090] First, second, and third security hardware can be types of security hardware. Security hardware is a type of hardware capable of protecting information security. It plays a role in security protection within electronic devices and can employ advanced technologies and algorithms to effectively protect sensitive data, private information, and critical software.

[0091] Examples of secure hardware may include: TCM (Trusted Cryptography Module), TPM (Trusted Platform Module), etc. It is understood that this application does not limit the specific secure hardware used in its embodiments.

[0092] Method Example 1

[0093] refer to Figure 2 This diagram illustrates a step-by-step flowchart of a software package processing method according to an embodiment of this application. The method is applied to a software repository server, which is equipped with first security hardware, and may specifically include the following steps:

[0094] Step 201: Receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware;

[0095] Step 202: Unpack the software package to obtain the file units contained in the software package;

[0096] Step 203: Perform security checks on each file unit contained in the software package to obtain the security check results for each file unit;

[0097] Step 204: If the security test results of all file units are secure, use the private key to generate a digital signature corresponding to the software package, add the digital signature to the software package, and perform the software package insertion operation.

[0098] Step 205: Determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first secure hardware;

[0099] Step 206: Receive a download request from the client for the target software package; the client has a second security hardware configured.

[0100] Step 207: Send the target software package to the client using an encrypted channel;

[0101] Step 208: Using the channel between the first security hardware and the second security hardware, send the target software package and the first hash value of the file units contained in the target software package to the second security hardware, so that the client can match the first hash value with the redefined second hash value.

[0102] In step 201, the security management server can generate a public key and a private key, and send the private key to the software repository server. If the public key and private key are updated, the security management server can send the updated private key to the software repository server.

[0103] In practical applications, the public and private keys are keys generated by the security management server using national commercial cryptographic algorithms. National commercial cryptographic algorithms can be domestically developed cryptographic algorithms recognized by the State Cryptography Administration. The types of national commercial cryptographic algorithms can include: symmetric encryption algorithms, asymmetric cryptographic algorithms, or cryptographic hash algorithms, etc. It is understood that this application does not limit the specific national commercial cryptographic algorithms used.

[0104] The software repository server stores the private key in this first security hardware. Because the first security hardware prevents unauthorized access or tampering of the private key, it ensures the confidentiality and security of the private key. In a specific implementation, the software repository server can utilize the channel between the first and third security hardware to receive the private key sent by the security management server through the third security hardware.

[0105] Reference Figure 3 The diagram illustrates the interaction flow between a security management server and a software repository server according to an embodiment of this application. In this embodiment, the security management server generates a public key, a private key, and a public key certificate, sends the public key certificate to the first security module of the software repository server, and sends the private key to the first security hardware of the software repository server.

[0106] The public key certificate can include: the signature of the security management server and the signing public key. The software repository server can use the signing public key to verify the signature of the security management server. If the verification is successful, the security management server can be considered trustworthy.

[0107] In steps 202 to 205, the software package can be an existing package already included in the software repository server, or it can be a new package issued by the security management server. The software repository server may be equipped with a scanning tool, and each package on the software repository server needs to undergo a first preset processing by the scanning tool. The function of the scanning tool is to perform a comprehensive check on the software package to ensure that it does not contain any potential malicious code, vulnerabilities, or malicious behavior. This first preset processing can be performed under the supervision of the security management server to improve the security of the software package.

[0108] The first preset processing procedure of the scanning tool specifically includes: unpacking the software package to obtain multiple file units contained in the software package; performing security detection on each file unit contained in the software package to obtain the security detection result corresponding to each file unit; and determining the first hash value of the software package and the file units contained in the software package, and saving the first hash value to the first security hardware.

[0109] The file unit may include binary files, scripts, configuration files, and other critical files. It is understood that this application embodiment does not limit the specific file units contained in the software package.

[0110] Security testing can be performed on file units to detect vulnerabilities and malicious code. It can identify pre-defined vulnerabilities, pre-defined viruses, pre-defined malware signatures, and pre-defined security vulnerabilities.

[0111] Once the scanning tool confirms the software package is secure, it can use the private key to generate a digital signature for the package, add this digital signature to the package, and then perform the package insertion operation. The generation of the digital signature can be performed by the software repository server or the security management server. The private key used for the digital signature can be a pair of private keys that are paired with the public key.

[0112] Digital signatures can be added to software packages. Embodiments of this application can perform an ingestion operation on digitally signed software packages. The ingestion operation can be used to save the digitally signed software packages to a software repository, where the packages can be downloaded and installed by clients.

[0113] In one alternative implementation of this application, the software repository server may also generate a detection record for each file unit contained in the software package and send the detection record to the security management server.

[0114] Specifically, assuming each file unit's detection result is secure, a detection record for each file unit contained in the software package is generated and sent to the security management server for approval. Upon receiving an approval message from the security management server, a digital signature corresponding to the software package is generated using the private key. The approval message serves as a signature indication, instructing the software repository server to generate the digital signature corresponding to the software package. The approval of the aforementioned detection records ensures the transparency and consistency of the first preset processing of the software package.

[0115] The scanning tool can determine the first hash value of the software package and the file units contained within it, and save the first hash value to the first secure hardware. The first hash value may include a first hash value A and a first hash value B. First hash value A may correspond to the complete software package, and first hash value B may correspond to each file unit contained within the software package. Since changes in the file package or its file units will cause changes in the hash value, the first hash value can be used as a criterion for determining whether the file package or its file units have changed. Saving the first hash value to the first secure hardware can improve its security. In practical applications, a cryptographic hash function can be used to calculate the first hash value of the software package and its file units. It is understood that the embodiments of this application do not limit the specific calculation method of the first hash value.

[0116] Reference Figure 4 The diagram illustrates a flowchart of a software package processing method according to an embodiment of this application, which may specifically include the following steps:

[0117] Step 401: The software repository server generates a detection record for each file unit contained in the software package and sends the detection record to the security management server;

[0118] Step 402: Receive the approval message sent by the security management server;

[0119] Step 403: Using the private key, generate a digital signature corresponding to the software package;

[0120] Step 404: For software packages with digital signatures, perform an insert operation;

[0121] Step 405: Determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware.

[0122] Reference Figure 5 The diagram illustrates a flowchart of the processing procedure of a scanning tool for a software repository server according to an embodiment of this application. The scanning tool can perform security checks on each file unit contained in the software package to obtain a security check result corresponding to each file unit. The security check result may include: secure or insecure.

[0123] If the security check result is unsafe, the processing of the software package can be terminated.

[0124] If the detection results for each file unit are all secure, a detection record for each file unit contained in the software package is generated and sent to the security management server for approval. Upon receiving an approval message from the security management server, a digital signature corresponding to the software package is generated using the private key. Furthermore, a first hash value for the software package and its contained file units can be determined and saved to the first secure hardware.

[0125] Steps 202 to 205 ensure that each software package in the software repository undergoes security checks, digital signature processing, and hash value processing. Therefore, these security checks, digital signature processing, and hash value processing prove the trustworthiness, authenticity, and integrity of the software packages. Based on this, the embodiments of this application can reduce the risk of supply chain attacks and malware distribution, providing a higher level of software repository security, enabling users to trust and securely use these software packages.

[0126] This application embodiment does not restrict the execution order between steps 204 and 205. For example, step 204 can be executed first, followed by step 205. Alternatively, step 205 can be executed first, followed by step 204. Or, steps 204 and 205 can be executed in parallel. It is understood that step 205 may have a corresponding triggering condition, specifically: the security detection results of all file units are secure. In other words, if the security detection results of all file units are secure, the first hash value of the software package and the file units contained in the software package can be determined, and the first hash value can be saved to the first secure hardware.

[0127] Steps 206 to 208 correspond to the download and installation process of the target software package. The target software package can be a type of software package used to represent the software package requested by the client.

[0128] Upon receiving a download request from a client for a target software package, the system can use an encrypted channel to send the target software package to the client, and use the channel between the first and second security hardware to send the target software package and the first hash value of the file units contained in the target software package to the second security hardware, so that the client can match the first hash value with the redefined second hash value.

[0129] Encrypted channels can encrypt target software packages and transmit the encrypted package ciphertext to the client, thereby improving the security of target software package transmission.

[0130] In specific implementations, the encrypted channel can conform to the HTTPS (Hypertext Transfer Protocol Secure) protocol. Of course, this application embodiment does not limit the communication protocol corresponding to the encrypted channel.

[0131] The channel between the first and second security hardware can conform to communication protocols such as TCP / IP (Transmission Control Protocol / Internet Protocol). Since the first hash value is transmitted between the two security hardware devices, and these devices provide information security protection, the transmission security of the first hash value is improved.

[0132] In summary, the software package processing method of this application embodiment involves the software repository server unpacking the software package and performing security checks on each file unit contained within it. These file units may include binary files, scripts, configuration files, and other critical files. The aforementioned security checks may involve vulnerability and malicious code detection for each file unit to determine whether each file unit is secure.

[0133] Secondly, in this embodiment of the software repository, if the security check results of all file units of the software package are secure, the server uses the private key to generate a digital signature corresponding to the software package, adds the digital signature to the software package, and performs the package insertion operation. The insertion operation can be used to save the software package to the software repository. Because this embodiment of the application inserts secure and signed software packages into the repository, it can prevent insecure software packages from being saved to the software repository. In other words, this embodiment of the application can prevent software packages in the software repository from being attacked by the software supply chain before being inserted into the repository.

[0134] Furthermore, the software repository server in this embodiment of the application also determines the first hash value of the software package and the file units contained in the software package, and saves the first hash value to the first secure hardware; and, after receiving a download request sent by the client for the target software package, it can use an encrypted channel to send the target software package to the client, and use the channel between the first secure hardware and the second secure hardware to send the target software package and the first hash value of the file units contained in the target software package to the second secure hardware, so that the client can match the first hash value with the re-determined second hash value. Since changes in the file package or the file units of the file package will cause changes in the hash value, the client in this embodiment of the application can prevent the software package from being attacked by the software supply chain during transmission by matching the first hash value with the re-determined second hash value.

[0135] In summary, the collaborative processing of the software repository server and client in this embodiment helps mitigate software supply chain attacks corresponding to software packages. Furthermore, it effectively protects the data associated with the software packages and improves the intelligence, efficiency, and security of software repository management.

[0136] Method Example 2

[0137] refer to Figure 6 This diagram illustrates a step-by-step flowchart of a software package processing method according to an embodiment of this application. The method can be applied to a client, which may be equipped with second security hardware. Specifically, the method may include the following steps:

[0138] Step 601: Send a download request for the target software package to the software repository server;

[0139] Step 602: Receive the target software package sent by the software repository server using the encrypted channel;

[0140] Step 603: Using the channel between the first security hardware and the second security hardware, receive the target software package and the first hash value of the file unit contained in the target software package, and save the first hash value to the second security hardware;

[0141] Step 604: Utilize the channel between the second security hardware and the third security hardware of the security management server to receive the public key and save it to the second security hardware; wherein, the security management server can generate a public key and a private key, and send the public key to the client. If the public key and private key are updated, the security management server can send the updated public key to the client.

[0142] Step 605: Determine the second hash value of the target software package and the file units contained in the target software package;

[0143] Step 606: Match the first hash value with the second hash value to obtain the corresponding matching result;

[0144] Step 607: If the matching result is successful, obtain the corresponding digital signature from the target software package. If the matching result is successful, use the public key to verify the digital signature.

[0145] Step 608: If the signature verification passes, proceed with the installation of the target software package.

[0146] In step 601, the user can request to install the target software package through the user interface or command-line interface provided by the software repository, and the client can send a download request for the target software package to the software repository server.

[0147] In step 602, the client can receive the target software package sent by the software repository server using an encrypted channel compliant with HTTPS. Since the encrypted channel can encrypt the target software package and transmit the encrypted package ciphertext, the security of the target software package transmission is improved.

[0148] In step 603, since the first hash value is transmitted between the two security hardware devices corresponding to the first and second security hardware, and the security hardware can play a role in information security protection, the transmission security of the first hash value can be improved.

[0149] In step 604, since the public key is transmitted between the two security hardware devices corresponding to the second and third security hardware, and the security hardware can play a role in information security protection, the transmission security of the public key can be improved.

[0150] In step 605, the client can re-determine the second hash value of the target software package and the file units contained within the target software package. For example, the client can use a cryptographic hash function to calculate the second hash value of the target software package and the file units contained within the target software package.

[0151] In step 606, the client matches the first hash value with the second hash value to obtain the corresponding matching result. If the matching result is a failure, it indicates that the target software package or the file units contained in the target software package have changed, and the process can end. If the matching result is a success, it indicates that the target software package and the file units contained in the target software package have not changed, and step 607 is executed.

[0152] In step 607, if the matching result is successful, the client obtains the corresponding digital signature from the target software package and uses the public key to verify the digital signature.

[0153] The signature verification process may include: using the public key to decrypt the digital signature, and comparing the decryption result with the original message corresponding to the digital signature. If the comparison result is consistent, the signature verification passes, indicating that the target software package is trustworthy; if the comparison result is inconsistent, the signature verification fails.

[0154] In this embodiment, a second security module can be set on the client side. The second security module can perform hash value matching and signature verification on the target software package before it is installed on the operating system, thereby preventing the tampered target software package from being installed on the operating system.

[0155] Step 608, the process of installing the target software package, specifically includes: determining the dependencies of the target software package to obtain a corresponding determination result; if the determination result indicates that a target software unit needs to be downloaded, downloading the target software unit; and if the determination result indicates that a target software unit does not need to be downloaded, installing the target software package.

[0156] Before installing the target software package, the first security module determines its dependencies. This determination is used to decide whether it is necessary to download target software units. Target software units may include: function libraries, software modules, or components required for the installation of the target software package. If the determination indicates that target software units need to be downloaded, the download of those target software units can proceed until no further target software units need to be downloaded.

[0157] Once the target software package and its dependencies are verified, the target software package will be installed on the user's operating system. The corresponding installation process may include, but is not limited to, copying the relevant files of the target software package to the relevant directory, generating configuration files, and adding startup items. It is understood that this application embodiment does not limit the specific installation process of the target software package.

[0158] In practical applications, software repository servers can periodically update software packages to achieve functions such as security fixes and performance improvements. Updated packages are generated, which users can then choose to install on their respective operating systems. It's understandable that if a user no longer needs an installed software package, they can uninstall it through the software repository.

[0159] Reference Figure 7 The diagram illustrates a flowchart of a software package installation method according to an embodiment of this application, wherein the client may include an operating system, a download module, and a second security module.

[0160] The operating system can request to download the target software package; in other words, it can send a corresponding download request to the software repository server.

[0161] The download module can use an encrypted channel to receive the target software package sent by the software repository server; use the channel between the first security hardware and the second security hardware to receive the target software package and the first hash value of the file units contained in the target software package, and save the first hash value to the second security hardware; and use the channel between the second security hardware and the third security hardware of the security management server to receive the public key, and save the public key to the second security hardware.

[0162] The second security module can perform hash value matching and signature verification on the target software package before it is installed on the operating system.

[0163] Before installing the target software package, the first security module determines its dependencies. This determination is used to decide whether the target software unit needs to be downloaded. If the determination indicates that the target software unit needs to be downloaded, it can be downloaded until no further target software units need to be downloaded. If the determination indicates that the target software unit does not need to be downloaded, the target software package is installed onto the operating system.

[0164] Method Example 3

[0165] refer to Figure 8 The diagram illustrates a step-by-step flowchart of a software package processing method according to an embodiment of this application. The method may specifically include the following steps:

[0166] Step 801: The software repository server receives the private key sent by the security management server through the third security hardware and saves the private key to the first security hardware.

[0167] Step 802: The software repository server unpacks the software package to obtain the file units contained in the software package;

[0168] Step 803: The software repository server performs security checks on each file unit contained in the software package to obtain the security check result for each file unit.

[0169] Step 804: If the security check results of all file units are secure, the software repository server uses the private key to generate a digital signature corresponding to the software package, adds the digital signature to the software package, and performs the software package insertion operation.

[0170] Step 805: The software repository server determines the first hash value of the software package and the file units contained in the software package, and saves the first hash value to the first secure hardware;

[0171] Step 806: The software repository server receives a download request from the client for the target software package; the client is equipped with secondary security hardware.

[0172] Step 807: The software repository server sends the target software package to the client using an encrypted channel;

[0173] Step 808: The software repository server uses the channel between the first security hardware and the second security hardware to send the target software package and the first hash value of the file units contained in the target software package to the second security hardware, so that the client can match the first hash value with the redefined second hash value;

[0174] Step 809: The client determines the second hash value of the target software package and the file units contained in the target software package;

[0175] Step 810: The client matches the first hash value with the second hash value to obtain the corresponding matching result;

[0176] Step 811: If the matching result is successful, the client obtains the corresponding digital signature from the target software package. If the matching result is successful, the client uses the public key sent by the security management server to verify the digital signature.

[0177] Step 812: If the signature verification passes, the client will install the target software package.

[0178] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0179] Based on the above embodiments, this application also provides a software package processing apparatus, which can be applied to a software repository server. The software repository server is equipped with first security hardware, as described above. Figure 9 The device specifically includes: a key processing module 901, a software package unpacking module 902, a security detection module 903, a digital signature module 904, a database entry module 905, a hash value processing module 906, a download request receiving module 907, a software package sending module 908, and a hash value sending module 909.

[0180] The key processing module 901 is used to receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware.

[0181] The software package unpacking module 902 is used to unpack the software package to obtain the file units contained in the software package;

[0182] The security detection module 903 is used to perform security detection on each file unit contained in the software package to obtain the security detection result corresponding to each file unit;

[0183] The digital signature module 904 is used to generate a digital signature corresponding to the software package using the private key when the security detection results of all file units are secure, and to add the digital signature to the software package.

[0184] The data entry module 905 is used to perform a data entry operation on the software package after the digital signature is added to the software package;

[0185] The hash value processing module 906 is used to determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware;

[0186] The download request receiving module 907 is used to receive download requests sent by the client for the target software package; the client is equipped with second security hardware.

[0187] The software package sending module 908 is used to send the target software package to the client using an encrypted channel;

[0188] The hash value sending module 909 is used to send the target software package and the first hash value of the file unit contained in the target software package to the second security hardware using the channel between the first security hardware and the second security hardware.

[0189] Optionally, the security detection module is specifically used to detect vulnerabilities and malicious code in each file unit contained in the software package.

[0190] Optionally, the digital signature module includes:

[0191] The record generation module is used to generate a detection record for each file unit contained in the software package, provided that the detection results for each file unit are safe.

[0192] The record sending module is used to send the detection record to the security management server so that the security management server can approve the detection record;

[0193] The signature generation module is used to generate a digital signature corresponding to the software package using the private key after receiving the approval message sent by the security management server.

[0194] Optionally, the private key is a key generated by the security management server using a national commercial cryptographic algorithm.

[0195] This application also provides a software package processing apparatus, which can be applied to a client equipped with second security hardware, as described above. Figure 10 The device specifically includes: a download request sending module 1001, a software package receiving module 1002, a hash value receiving and storing module 1003, a public key processing module 1004, a hash value determining module 1005, a matching module 1006, a signature verification module 1007, and an installation processing module 1008.

[0196] The download request sending module 1001 is used to send a download request for the target software package to the software repository server.

[0197] The software package receiving module 1002 is used to receive the target software package sent by the software repository server using an encrypted channel;

[0198] The hash value receiving and saving module 1003 is used to receive the first hash value of the target software package and the file unit contained in the target software package using the channel between the first security hardware and the second security hardware, and save the first hash value to the second security hardware;

[0199] The public key processing module 1004 is used to receive a public key and save the public key to the second security hardware by utilizing the channel between the second security hardware and the third security hardware of the security management server.

[0200] The hash value determination module 1005 is used to determine the second hash value of the target software package and the file units contained in the target software package;

[0201] The matching module 1006 is used to match the first hash value with the second hash value to obtain the corresponding matching result;

[0202] The signature verification module 1007 is used to obtain the corresponding digital signature from the target software package when the matching result is a successful match, and to perform signature verification on the digital signature using the public key;

[0203] Installation processing module 1008 is used to perform installation processing on the target software package if the signature verification passes.

[0204] Optionally, the installation processing module 1008 specifically includes:

[0205] The dependency determination module is used to determine the dependencies of the target software package and obtain the corresponding determination result;

[0206] The dependency download module is used to download the target software unit when the determination result indicates that the target software unit needs to be downloaded.

[0207] The installation module is used to install the target software package when the determination result indicates that the target software unit does not need to be downloaded.

[0208] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0209] This application provides one or more machine-readable media storing instructions that, when executed by one or more processors, cause an electronic device to perform one or more of the methods described in the above embodiments. In this application, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0210] The embodiments of this disclosure can be implemented as an apparatus configured as desired using any suitable hardware, firmware, software, or any combination thereof, including electronic devices such as terminal devices and servers (clusters). Figure 8 An exemplary apparatus 1100 is schematically shown that can be used to implement the various embodiments described in this application.

[0211] In one embodiment, Figure 8 An exemplary device 1100 is shown, which includes one or more processors 1102, a control module (chipset) 1104 coupled to at least one of the processors 1102, a memory 1106 coupled to the control module 1104, a non-volatile memory (NVM) / storage device 1108 coupled to the control module 1104, one or more input / output devices 1110 coupled to the control module 1104, and a network interface 1112 coupled to the control module 1104.

[0212] Processor 1102 may include one or more single-core or multi-core processors, and processor 1102 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 1100 can serve as a terminal device, server (cluster), or other device as described in the embodiments of this application.

[0213] In some embodiments, apparatus 1100 may include one or more computer-readable media (e.g., memory 1106 or NVM / storage device 1108) having instructions 1114 and one or more processors 1102 that are combined with the one or more computer-readable media and configured to execute instructions 1114 to implement a module thereby performing the actions described in this disclosure.

[0214] In one embodiment, the control module 1104 may include any suitable interface controller to provide any suitable interface to at least one of the processors 1102 and / or any suitable device or component communicating with the control module 1104.

[0215] The control module 1104 may include a memory controller module to provide an interface to the memory 1106. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0216] Memory 1106 may be used, for example, to load and store data and / or instructions 1114 for device 1100. In one embodiment, memory 1106 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 1106 may include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

[0217] In one embodiment, the control module 1104 may include one or more input / output controllers to provide interfaces to the NVM / storage device 1108 and (one or more) input / output devices 1110.

[0218] For example, NVM / storage device 1108 may be used to store data and / or instructions 1114. NVM / storage device 1108 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0219] NVM / storage device 1108 may include storage resources that are physically part of a device on which device 1100 is mounted, or that can be accessed by the device without needing to be part of the device. For example, NVM / storage device 1108 may be accessed via a network via one or more input / output devices 1110.

[0220] One or more input / output devices 1110 may provide an interface for device 1100 to communicate with any other suitable device. Input / output devices 1110 may include communication components, audio components, sensor components, etc. Network interface 1112 may provide an interface for device 1100 to communicate via one or more networks. Device 1100 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, etc., or combinations thereof.

[0221] In one embodiment, at least one of the processors 1102 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 1104. In one embodiment, at least one of the processors 1102 may be logically packaged with one or more controllers of the control module 1104 to form a system-in-package (SiP). In one embodiment, at least one of the processors 1102 may be integrated with the logic of one or more controllers of the control module 1104 on the same die. In one embodiment, at least one of the processors 1102 may be integrated with the logic of one or more controllers of the control module 1104 on the same die to form a system-on-a-chip (SoC).

[0222] In various embodiments, device 1100 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, device 1100 may have more or fewer components and / or different architectures. For example, in some embodiments, device 1100 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0223] The detection device can use a main control chip as a processor or control module, and sensor data, position information, etc. can be stored in a memory or NVM / storage device. The sensor group can be used as an input / output device, and the communication interface can include a network interface.

[0224] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0225] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0226] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0227] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more blocks of a block diagram.

[0228] These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable terminal equipment, provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of a block diagram.

[0229] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0230] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0231] The foregoing has provided a detailed description of a software processing method and apparatus, an electronic device, and a machine-readable medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method of processing a software package, characterized by, Applied to a software repository server, wherein the software repository server is equipped with first security hardware, the method includes: Receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware; The software package is unpacked to obtain the file units contained in the software package; Security checks are performed on each file unit contained in the software package to obtain the security check result for each file unit; If all file units are found to be secure, the private key is used to generate a digital signature for the software package, the digital signature is added to the software package, and the software package is then added to the database. Determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware; Receives a download request from a client for a target software package; the client is equipped with a second security hardware. The target software package is sent to the client using an encrypted channel; Using the channel between the first security hardware and the second security hardware, the target software package and the first hash value of the file units contained in the target software package are sent to the second security hardware, so that the client can match the first hash value with the redefined second hash value.

2. The method according to claim 1, characterized in that, The security detection of each file unit contained in the software package includes: Vulnerability and malicious code detection is performed on each file unit contained in the software package.

3. The method according to claim 1, characterized in that, If all file units pass security checks, the private key is used to generate a digital signature for the software package, including: If the detection result of each file unit is safe, a detection record for each file unit contained in the software package is generated; The detection record is sent to the security management server so that the security management server can approve the detection record; After receiving the approval message from the security management server, the private key is used to generate a digital signature corresponding to the software package.

4. The method according to any one of claims 1 to 3, characterized in that, The private key is a key generated by the security management server using a national commercial cryptographic algorithm.

5. A method for processing software packages, characterized in that, Applied to a client equipped with second security hardware, the method includes: Send a download request for the target software package to the software repository server; Receive the target software package sent by the software repository server using an encrypted channel; Using the channel between the first security hardware and the second security hardware, the first hash value of the target software package and the file unit contained in the target software package is received, and the first hash value is saved to the second security hardware; Utilizing the channel between the second security hardware and the third security hardware of the security management server, a public key is received and stored in the second security hardware; Determine the second hash value of the target software package and the file units contained in the target software package; The first hash value and the second hash value are matched to obtain the corresponding matching result; If the matching result is successful, the corresponding digital signature is obtained from the target software package, and the digital signature is verified using the public key. If the signature verification passes, the target software package will be installed.

6. The method according to claim 5, characterized in that, The installation process for the target software package, after successful signature verification, includes: The dependencies of the target software package are determined to obtain the corresponding determination results; If the determination result indicates that the target software unit needs to be downloaded, then the target software unit is downloaded. If the determination result indicates that the target software unit does not need to be downloaded, the target software package is installed.

7. A software package processing apparatus, characterized in that, Applied to a software repository server, the software repository server is equipped with a first security hardware, the device comprising: The key processing module is used to receive the private key sent by the security management server through the third security hardware, and save the private key to the first security hardware; A software package unpacking module is used to unpack software packages to obtain the file units contained in the software packages; The security detection module is used to perform security detection on each file unit contained in the software package to obtain the security detection result corresponding to each file unit; The digital signature module is used to generate a digital signature corresponding to the software package using the private key, and add the digital signature to the software package, provided that the security detection results of all file units are secure. The data entry module is used to perform the data entry operation of the software package after the digital signature is added to the software package; A hash value processing module is used to determine the first hash value of the software package and the file units contained in the software package, and save the first hash value to the first security hardware; A download request receiving module is used to receive download requests sent by a client for a target software package; the client is equipped with a second security hardware. A software package sending module is used to send the target software package to the client using an encrypted channel; The hash value sending module is used to send the target software package and the first hash value of the file unit contained in the target software package to the second security hardware via the channel between the first security hardware and the second security hardware.

8. A software package processing apparatus, characterized in that, Applied to a client, the client being equipped with second security hardware, the device comprising: The download request sending module is used to send download requests for the target software package to the software repository server; The software package receiving module is used to receive the target software package sent by the software repository server using an encrypted channel; The hash value receiving and saving module is used to receive the first hash value of the target software package and the file unit contained in the target software package through the channel between the first security hardware and the second security hardware, and save the first hash value to the second security hardware; The public key processing module is used to receive the public key through the channel between the second security hardware and the third security hardware of the security management server, and save the public key to the second security hardware. A hash value determination module is used to determine the second hash value of the target software package and the file units contained in the target software package; A matching module is used to match the first hash value with the second hash value to obtain the corresponding matching result; The signature verification module is used to obtain the corresponding digital signature from the target software package when the matching result is a successful match, and to perform signature verification on the digital signature using the public key; The installation processing module is used to install the target software package if the signature verification passes.

9. An electronic device, characterized in that, include: processor; and A memory having executable code stored thereon, which, when executed, causes the processor to perform the method as described in any one of claims 1-6.

10. A machine-readable medium having executable code stored thereon, which, when executed, causes a processor to perform the method as claimed in any one of claims 1-6.

Images