A menu dynamic loading method and related device

Abstract

This invention proposes a method and related apparatus for dynamically loading menus, relating to the field of computer technology. When a user attempts to open a menu, the client verifies whether there are any security vulnerabilities by comparing the real-time file hash value of the menu file containing the target menu module with the preset file hash value corresponding to the initial menu file. If they are the same, the client system is secure, and the client constructs the target menu corresponding to the interactive operation, allowing the user to access the menu securely. If they are different, the menu file has been maliciously modified, posing a security risk, and the client directly returns a "target menu generation failed" message to the user. By verifying the hash value of the menu file, the security of the client system can be significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a menu dynamic loading method and related devices. Background Art

[0002] With the development of Internet technology, more and more clients are appearing in users' daily life and work. Among them, menu is an important means for users to interact with client software systems. In order to improve the response speed of the client and user experience, the client often supports dynamic loading of menus.

[0003] In the prior art, commonly used methods for dynamically loading menus include configuration file drive, database drive, plug-in system, remote application programming interface (Application Programming Interface, referred to as: API) and reflection mechanism. Each commonly used method for dynamically loading menus has its applicable scenarios, but at the same time, they also have potential security risks. Summary of the invention

[0004] The object of the present invention is to provide a menu dynamic loading method and related device, which are used to improve the security of client dynamic loading menu.

[0005] In order to achieve the above purpose, the technical solution adopted by the embodiment of the present invention is as follows:

[0006] In a first aspect, the present invention provides a menu dynamic loading method, the method comprising:

[0007] When responding to the user's interactive operation of opening a menu, the client calculates the real-time file hash value corresponding to the menu file;

[0008] The client verifies the real-time file hash value and the preset file hash value; the preset file hash value corresponds to the initial menu file; the menu file includes a target menu module corresponding to the interactive operation;

[0009] If the verification is successful, the client searches the menu information table for a target export function set corresponding to the target menu module; the client constructs a target menu corresponding to the interactive operation by executing the export function in the target export function set;

[0010] If the verification fails, the client returns a prompt indicating that the target menu generation failed.

[0011] Optionally, after the verification is successful, the method further includes:

[0012] The client calls the background thread to obtain the blacklist and whitelist information corresponding to the target menu module;

[0013] The client verifies the target menu module and the black and white list information through the background thread;

[0014] If the target menu module matches the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the blacklist and confirms that the target menu module is abnormal;

[0015] If the target menu module does not match the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the blacklist and confirms that the target menu module is safe;

[0016] If the target menu module matches the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the whitelist and confirms that the target menu module is safe;

[0017] If the target menu module does not match the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the whitelist and confirms that the target menu module is abnormal.

[0018] Optionally, the blacklist information includes blacklist type information and a preset module hash value, and the step of the client verifying the target menu module and the blacklist and whitelist information through the background thread includes:

[0019] The client confirms, through the background thread, that the name information of the target menu module matches the blacklist type information;

[0020] The client calculates the real-time module hash value corresponding to the target menu module through the background thread;

[0021] The client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same; the preset module hash value corresponds to the initial menu module one by one;

[0022] If different, the client determines through the background thread that the target menu module does not belong to the blacklist;

[0023] If they are the same, the client determines through the background thread that the target menu module belongs to the blacklist.

[0024] Optionally, the blacklist information further includes at least one perception information; the perception information includes a perception domain type and a preset perception domain value; after the client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same, the method further includes:

[0025] If they are the same, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread;

[0026] The client compares, through the background thread, whether the current perception domain value corresponding to the perception domain type is the same as the preset perception domain value;

[0027] If all are the same, the client determines through the background thread that the target menu module belongs to the blacklist;

[0028] If they are partially the same or completely different, the client determines through the background thread that the target menu module does not belong to the blacklist.

[0029] Optionally, the whitelist information includes whitelist type information and a preset module hash value, and the step of the client verifying the target menu module and the blacklist and whitelist information through the background thread includes:

[0030] The client confirms, through the background thread, that the name information of the target menu module matches the whitelist type information;

[0031] The client calculates the real-time module hash value corresponding to the target menu module through the background thread;

[0032] The client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same; the preset module hash value corresponds to the initial menu module one by one;

[0033] If they are the same, the client determines through the background thread that the target menu module belongs to the whitelist;

[0034] If different, the client determines through the background thread that the target menu module does not belong to the whitelist.

[0035] Optionally, the whitelist information further includes at least one perception information; the perception information includes a perception domain type and a preset perception domain value; after the client compares, through the background thread, whether the real-time module hash value is the same as the preset module hash value corresponding to the target menu module, the method further includes:

[0036] If they are different, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread;

[0037] The client compares, through the background thread, whether the current perception domain value corresponding to the perception domain type is the same as the preset perception domain value;

[0038] If all are the same, the client determines through the background thread that the target menu module belongs to the whitelist;

[0039] If they are partially the same or completely different, the client determines through the background thread that the target menu module does not belong to the whitelist.

[0040] Optionally, before the step of the client calculating the real-time file hash value corresponding to the menu file in response to the user's interactive operation of opening the menu, the method further includes:

[0041] The client obtains the initial menu file and the preset file hash value corresponding to the initial menu file from the server; the menu file includes: a menu information table, a role permission table, a black and white list configuration table and a perception information table; the menu information table includes menus, menu modules and export function sets; the role permission table includes roles and menus granted access rights; the black and white list configuration table includes blacklist type information, whitelist type information, menu modules and preset module hash values; the perception information table includes perception domain types and preset perception domain values.

[0042] In a second aspect, an embodiment of the present invention provides a client, including a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the method described in any one of the aforementioned implementations.

[0043] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method as described in any one of the aforementioned embodiments.

[0044] In a fourth aspect, an embodiment of the present invention provides a program product, which, when executed by a processor, implements a method as described in any one of the aforementioned implementation modes.

[0045] Compared with the prior art, the menu dynamic loading method and related devices provided by the embodiments of the present invention, when the user executes to open the menu, the client determines the target menu module based on the interactive operation, and calculates the real-time file hash value corresponding to the menu file containing the target menu module, and verifies whether there are security risks in the client system by comparing the real-time file hash value with the preset file hash value corresponding to the initial menu file.

[0046] When the real-time file hash value and the preset file hash value are the same, it indicates that the client system is safe. The target menu corresponding to the interactive operation is constructed to allow users to access the menu under the condition of system safety. When the real-time file hash value and the preset file hash value are different, it indicates that the menu file has been maliciously tampered with and there is a security risk. To avoid data leakage, service interruption and other risk behaviors, the client directly returns a prompt to the user that the target menu generation failed. By checking the hash value of the menu file, the security of the client system can be significantly improved.

[0047] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A flowchart of a menu dynamic loading method provided by an embodiment of the present invention.

[0050] Figure 2 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention.

[0051] Figure 3 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention.

[0052] Figure 4 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention.

[0053] Figure 5 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention.

[0054] Figure 6 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention.

[0055] Figure 7 A schematic diagram of a menu dynamic loading device provided by an embodiment of the present invention.

[0056] Figure 8 A schematic diagram of the structure of a client provided by an embodiment of the present invention.

[0057] Icons: 40 - menu dynamic loading device; 400 - processing module; 401 - verification module; 402 - execution module; 50 - client; 500 - processor; 501 - memory. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0059] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0061] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0062] Dynamically loading menus is a common requirement in financial investment management systems. Dynamically loading menus is a technology that generates menu items based on specific conditions after the client is started. This method can improve the client's flexibility, responsiveness and user experience.

[0063] In the prior art, desktop clients usually use configuration file drive, database drive, plug-in system, remote API, reflection mechanism and other methods to dynamically load menus. Configuration file drive is to store the structure and properties of menu items in a configuration file, such as JavaScript Object Notation (JSON), Extensible Markup Language (XML) or Initialization (INI) file. When the client application starts, the configuration file is read and the menu is dynamically constructed according to the information in the configuration file.

[0064] Database-driven means using a database to store information about menu items, including the menu's structure, display name, permissions, etc. When the client application starts, it queries the menu data from the database and dynamically generates a menu based on the query results.

[0065] The plugin system allows developers to write custom plugins to extend the functionality and menus of client applications. The client application loads the plugin when it starts and dynamically builds the menu based on the information provided by the plugin.

[0066] The remote API stores menu items on a remote server. When the client application starts, it sends a request to the remote server to obtain menu data. After the remote server returns the menu data, the client application dynamically builds the menu based on the returned menu data. This method is suitable for scenarios where the menu content needs to be dynamically updated.

[0067] The reflection mechanism uses the reflection mechanism of the programming language to dynamically load menu items. According to the convention or tag, the client application scans the relevant classes, methods or attributes and builds the menu according to the scanning results.

[0068] The inventor has found that although dynamic menu loading based on common methods such as configuration file drive, database drive, plug-in system, remote API, reflection mechanism, etc. can provide flexibility and scalability, there are also potential security risks, such as tampering with configuration files, injecting malicious code, etc. At present, when the client dynamically loads the menu, no effective security measures are taken to protect the client.

[0069] In order to solve the above problems, the core idea of ​​the present invention is that when the user opens the menu, the client verifies whether there is a security risk in the client system by comparing the real-time file hash value of the menu file containing the target menu module and the preset file hash value corresponding to the initial menu file. If they are the same, it means that the client system is safe, and the client constructs a target menu corresponding to the interactive operation, allowing the user to access the menu under the condition of system safety. If they are different, it means that the menu file has been maliciously tampered with and there is a security risk. The client directly returns a prompt to the user that the target menu generation failed. By performing hash value verification on the menu file, the security of the client system can be significantly improved.

[0070] The following provides possible implementations of the menu dynamic loading method of the present invention. Specifically, Figure 1 A flowchart of a menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 1 , the method comprising:

[0071] Step 100: In response to the user's interactive operation of opening a menu, the client calculates a real-time file hash value corresponding to the menu file.

[0072] In the embodiment of the present invention, it is assumed that the user performs an operation of opening a menu through the display interface of the client, and the client responds to the user's interactive operation of opening the menu. In the process of building the target menu, it is necessary to access the target menu module in the menu file, and build the target menu based on the target menu module to realize the client dynamically loading the menu. In order to prevent the menu file from being maliciously tampered with or injected, it is necessary to verify the menu file before accessing the menu file.

[0073] Optionally, the menu file can be verified by using a hash value. A hash value is also called a hash value, which can be calculated using a commonly used hash function algorithm such as Message Digest Algorithm-5 (MD5), Secure Hash Algorithm-1 (SHA1), SHA256, or SHA512.

[0074] Step 102: The client verifies the real-time file hash value and the preset file hash value.

[0075] Among them, the preset file hash value corresponds to the initial menu file. Specifically, since the menu file has not been modified when the client obtains the menu file from the server, it can be understood as the initial menu file. Therefore, by using the preset file hash value corresponding to the initial menu file and verifying with the real-time file hash value, it is possible to confirm whether the menu file has been tampered with or has an abnormality at the current moment. Further, the menu file includes a target menu module corresponding to the interactive operation. If the verification is successful, step 104 is executed, and if the verification fails, step 106 is executed.

[0076] It should be noted that the menu file may be a directory storing the original published files, or may be a compressed package of the original published files, which is not limited in the present invention.

[0077] Step 104: The client searches the menu information table for a target export function set corresponding to the target menu module; the client constructs a target menu corresponding to the interactive operation by executing the export functions in the target export function set.

[0078] In an embodiment of the present invention, the client obtains a target menu module from a menu file and loads the menu module. The client searches for a target export function set and a target parameter set corresponding to the target menu module in a menu information table, and obtains export functions in the target export function set from the loaded target menu module. Parameters corresponding to each export function are obtained from the target parameter set, and the parameters of each export function are instantiated through a runtime reflection function to obtain corresponding parameter information. The corresponding export function in the target export function set is executed based on the parameter information to construct a target menu corresponding to the interactive operation.

[0079] Step 106: The client returns a prompt indicating that target menu generation has failed.

[0080] To summarize, in the menu dynamic loading method provided by the embodiment of the present invention, when the user executes to open the menu, the client determines the target menu module based on the interactive operation, and calculates the real-time file hash value corresponding to the menu file containing the target menu module, and verifies whether there are security risks in the client system by comparing the real-time file hash value with the preset file hash value corresponding to the initial menu file.

[0081] When the real-time file hash value and the preset file hash value are the same, it indicates that the client system is safe. The target menu corresponding to the interactive operation is constructed to allow users to access the menu under the condition of system safety. When the real-time file hash value and the preset file hash value are different, it indicates that the menu file has been maliciously tampered with and there is a security risk. To avoid data leakage, service interruption and other risk behaviors, the client directly returns a prompt to the user that the target menu generation failed. By checking the hash value of the menu file, the security of the client system can be significantly improved.

[0082] In addition, after executing step 104 or step 106, the client can record the operation log corresponding to the interactive operation according to the verification result. The operation log is used to record all the user's operations based on the menu, which is convenient for the administrator to monitor and audit and ensure the compliance of the client system operation. Security reports can be generated regularly based on the operation log so that the administrator can monitor and analyze potential security threats and intrusion behaviors and update the blacklist and whitelist information.

[0083] Optionally, in order to further improve the security of the client, background scanning can be used to regularly monitor the security risks of the client. A possible implementation method is provided below. Specifically, Figure 2 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 2 , the method further comprises:

[0084] Step 100: The client calls the background thread to obtain the blacklist and whitelist information corresponding to the target menu module.

[0085] In the embodiment of the present invention, when the client starts, a background thread is created so as to use the background thread to periodically scan the menu module list, which is used to record the menu modules loaded on the client. For example, if the user triggers futures trading, the client will add the menu module corresponding to futures trading to the menu module list after constructing the menu of futures trading.

[0086] It is worth mentioning that each menu module will pre-set a corresponding blacklist and whitelist information, that is, the menu module corresponds to the blacklist and whitelist information one by one. When the background thread scans the target menu module, it obtains the blacklist and whitelist information corresponding to the target menu module, so as to use the blacklist and whitelist information to verify the security of the target menu module.

[0087] Step 102: The client verifies the target menu module and the blacklist and whitelist information through a background thread.

[0088] In an embodiment of the present invention, when the background thread periodically scans the target menu module, the client needs to obtain the current information corresponding to the target menu module, and use the current information corresponding to the target menu module and the black and white list information for verification to determine whether there is a security risk in the target menu module.

[0089] Step 104: If the target menu module matches the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the blacklist and confirms that the target menu module is abnormal.

[0090] Step 106: If the target menu module does not match the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the blacklist and confirms that the target menu module is safe.

[0091] Step 108: If the target menu module matches the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the whitelist and confirms that the target menu module is safe.

[0092] Step 110: If the target menu module does not match the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the whitelist and confirms that the target menu module is abnormal.

[0093] In the embodiment of the present invention, when the target menu module has blacklist information, it means that the target menu module is controlled by the blacklist, the target menu module belonging to the blacklist is abnormal, and the target menu module not belonging to the blacklist is safe. When the target menu module has whitelist information, it means that the target menu module is controlled by the whitelist, the target menu module belonging to the whitelist is safe, and the target menu module not belonging to the whitelist is abnormal.

[0094] It should be noted that when the target menu module is found to be abnormal, it indicates that there is a security risk in the client, and a security log may be recorded or the system operation of the client may be terminated. The security log is used to analyze the security vulnerability of the abnormal target menu module.

[0095] It can be seen that the embodiment of the present invention provides an active defense strategy, which uses the background thread to regularly monitor and verify the blacklist and whitelist information of the menu module to achieve continuous prevention and detection of potential security threats, thereby further improving the security protection of the client. In addition, since the regular security monitoring is implemented by the background thread, it has no effect on user operations and use, and ensures the security of the client system without affecting the customer experience.

[0096] Optionally, for the above step 102, when the blacklist information includes blacklist type information and preset module hash value, a possible implementation method is provided below for how the client determines whether the target menu module belongs to the blacklist through the blacklist type information and the preset module hash value. Figure 2 On the basis of Figure 3 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 3 , step 102 comprises:

[0097] Step 102-1: The client confirms through a background thread that the name information of the target menu module matches the blacklist type information.

[0098] In an embodiment of the present invention, the blacklist type includes a blacklist type and a whitelist type, wherein the blacklist type information is also a blacklist type. The menu module corresponds to the blacklist type and the preset module hash value one by one. In other words, the menu module may be set to a blacklist type or a whitelist type. When the name information of the target menu module matches the blacklist type information, it indicates that the target module menu is set to a blacklist type.

[0099] Step 102-2: The client calculates the real-time module hash value corresponding to the target menu module through a background thread.

[0100] In the embodiment of the present invention, the background thread calculates the real-time module hash value corresponding to the target menu module using a preset hash function algorithm.

[0101] Step 102-3: The client compares the hash value of the real-time module with the hash value of the preset module corresponding to the target menu module through a background thread to see whether they are the same.

[0102] Wherein, the preset module hash value corresponds to the initial menu module one by one. Specifically, since the menu modules are not modified at this time when the client obtains the menu module from the server, they can be understood as the initial menu module. Therefore, the preset module hash value of the corresponding initial menu module is obtained according to the target menu module, and then the preset module hash value is used to compare with the real-time module hash value, so as to confirm whether the target menu file at the current moment is tampered with or has an abnormality. If the real-time module hash value is different from the preset module hash value, step 102-4 is executed, and if the real-time module hash value is the same as the preset module hash value, step 102-5 is executed.

[0103] Step 102-4: If they are different, the client determines through a background thread that the target menu module does not belong to the blacklist.

[0104] Step 102-5: If they are the same, the client determines through a background thread that the target menu module belongs to the blacklist.

[0105] In the embodiment of the present invention, if the real-time module hash value and the preset module hash value corresponding to the target menu module are the same, it means that the target menu module matches the blacklist information and the target menu module belongs to the blacklist. If the real-time module hash value and the preset module hash value corresponding to the target menu module are different, it means that the target menu module does not match the blacklist information and the target menu module does not belong to the blacklist.

[0106] It should be noted that each menu module can set the perception information in the blacklist information according to the actual application. When the menu module does not need to consider the context perception information, there is no need to set the perception information in the blacklist information. If the menu module needs to consider the context perception information, the perception information is set in the blacklist information. For example, a menu module is safe in the company's internal network, but is restricted from use in external networks outside the company. In this case, the menu module needs to set the perception information that distinguishes between internal and external networks in the blacklist information.

[0107] Optionally, for the above step 102, when the blacklist information also includes perception information (the perception information includes the perception domain type and the preset perception domain value), another possible implementation method is provided below for how the client determines whether the target menu module belongs to the blacklist by combining the preset module hash value and the perception information. Figure 3 On the basis of Figure 4 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 4 , after step 102-3, step 102 further includes:

[0108] Step 102-6: If they are the same, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread.

[0109] In the embodiment of the present invention, when the real-time module hash value corresponding to the target menu module is the same as the preset module hash value, further judgment is required based on the perception information. The perception domain type corresponding to the target menu module is obtained, and the corresponding current perception domain value is obtained based on the perception domain type.

[0110] Specifically, the perception domain type includes access time period, access location, user information, service authority, role, and IP address. The perception domain type and preset perception domain value can be set according to the actual application scenario, which is not limited by the present invention.

[0111] Step 102-7: The client compares the current perception domain value corresponding to the perception domain type and the preset perception domain value through a background thread to see whether they are the same.

[0112] Step 102-8: If all are the same, the client determines through a background thread that the target menu module belongs to the blacklist.

[0113] Step 102-9: If they are partially the same or completely different, the client determines through a background thread that the target menu module does not belong to the blacklist.

[0114] As a possible implementation, assume that the target menu module sets a perception information, the perception domain type is an IP address, and the preset perception domain value is 1.1.1.1. When the current IP address (current perception domain value) obtained by the client is 1.1.1.1, the client determines through the background thread that the target menu module belongs to the blacklist. If the current IP address obtained by the client is 1.1.1.2, the client determines through the background thread that the target menu module does not belong to the blacklist.

[0115] It is worth mentioning that a menu module can set multiple perception information, and the perception domain types in each perception information are different. It is judged whether the current perception domain value and the preset perception domain value corresponding to each perception domain type are the same. If all are the same, the target menu module belongs to the blacklist, otherwise the target menu module does not belong to the blacklist.

[0116] Optionally, when the whitelist information includes whitelist type information and preset module hash value, a possible implementation method is provided below for how the client determines whether the target menu module belongs to the whitelist based on the whitelist type and preset module hash value. Figure 2 On the basis of Figure 5 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 5 , step 102 comprises:

[0117] Step 102-10: The client confirms through a background thread that the name information of the target menu module matches the whitelist type information.

[0118] In the embodiment of the present invention, the whitelist type information is the whitelist type mentioned above. When the name information of the target menu module matches the whitelist type information, it indicates that the target module menu is set to the whitelist type.

[0119] Step 102-11: The client calculates the real-time module hash value corresponding to the target menu module through a background thread.

[0120] Step 102-12: The client compares the hash value of the real-time module with the hash value of the preset module corresponding to the target menu module through a background thread to see whether they are the same.

[0121] Among them, the preset module hash value corresponds to the initial menu module one by one.

[0122] Step 102-13: If they are the same, the client determines through a background thread whether the target menu module belongs to the whitelist.

[0123] Step 102-14: If they are different, the client determines through a background thread that the target menu module does not belong to the whitelist.

[0124] In the embodiment of the present invention, if the real-time module hash value and the preset module hash value corresponding to the target menu module are the same, it means that the target menu module matches the whitelist information and the target menu module belongs to the whitelist. If the real-time module hash value and the preset module hash value corresponding to the target menu module are different, it means that the target menu module does not match the whitelist information and the target menu module does not belong to the whitelist.

[0125] It should be noted that each menu module can set the perception information in the whitelist information according to the actual application. When the menu module does not need to consider the context perception information, there is no need to set the perception information in the whitelist information. If the menu module needs to consider the context perception information, the perception information is set in the whitelist information. For example, if a menu module is safe to be accessed between 8 am and 12 pm, and is restricted from use during other time periods, then the menu module needs to set the perception information with the perception domain type as time in the whitelist information.

[0126] Optionally, for the above step 102, when the whitelist information also includes perception information (the perception information includes the perception domain type and the preset perception domain value), another possible implementation is provided below for how the client determines whether the target menu module belongs to the whitelist by combining the preset module hash value and the perception information. Figure 5 On the basis of Figure 6 A flowchart of another menu dynamic loading method provided by an embodiment of the present invention is shown in FIG. Figure 6 , after step 102-12, step 102 further includes:

[0127] Step 102-15: If they are different, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread.

[0128] In the embodiment of the present invention, when the real-time module hash value corresponding to the target menu module is different from the preset module hash value, further judgment needs to be made based on the perception information.

[0129] Step 102-16: The client compares the current perception domain value corresponding to the perception domain type and the preset perception domain value through a background thread to see whether they are the same.

[0130] Step 102-17: If all are the same, the client determines through a background thread that the target menu module belongs to the whitelist.

[0131] Step 102-18: If they are partially the same or completely different, the client determines through a background thread that the target menu module does not belong to the whitelist.

[0132] In the embodiment of the present invention, the role of the whitelist is to perform strict control. When the target menu module completely matches the perceived information in the whitelist information, it is confirmed that the target menu module belongs to the whitelist and the target menu module is safe. When the target menu module completely does not match or partially matches the perceived information in the whitelist information, it is confirmed that the target menu module does not belong to the whitelist and the target menu module is abnormal.

[0133] Optionally, in order to load the menu safely, the client needs to synchronize the menu file from the server to the local computer. Here is a possible implementation method. Figure 1 Before step 100, the method further includes:

[0134] The client obtains the initial menu file and the preset file hash value corresponding to the initial menu file from the server.

[0135] Among them, the menu file may include but is not limited to: a menu information table, a role permission table, a black and white list configuration table and a perception information table; the menu information table includes menus, menu modules and export function sets; the role permission table includes roles and menus with granted access rights; the black and white list configuration table includes blacklist type information, whitelist type information, menu modules and preset module hash values; the perception information table includes perception domain types and preset perception domain values.

[0136] In the embodiment of the present invention, when the client is started for the first time or the menu file is changed, the client needs to obtain the initial menu file and the preset file hash value corresponding to the initial menu file from the server. The preset file hash value is obtained by the server using a preset hash function algorithm to calculate the hash value of the initial menu file on the server.

[0137] In order to more clearly illustrate the menu dynamic loading method provided by the embodiment of the present invention, the menu dynamic loading process and the background thread verification process are exemplarily illustrated in combination with the menu information table, role permission table, black and white list configuration table and perception information table.

[0138] As a possible implementation, it is assumed that the menu information table includes the menu number, menu name, name information of the menu module, derivative function set and parameter set, as shown in Table 1. It is assumed that the role permission table includes the role identifier and the authorized menu number, as shown in Table 2. The black and white list configuration table includes the black and white list serial number, the name information of the menu module, the preset module hash value and the black and white list type, as shown in Table 3. The perception information table includes the black and white list serial number, the perception domain type and the preset perception domain value, as shown in Table 4.

[0139] The export function set includes export functions, and the parameter set includes parameters corresponding to each export function. The menu number is globally uniformly addressed and used to identify the menu. The menu permission information of the client login role can be set through the role permission table. The role ID is globally uniformly addressed and used to identify the role.

[0140] Table 1

[0141]

[0142] Table 2

[0143]

[0144] Table 3

[0145]

[0146] Table 4

[0147]

[0148] When the user logs in to the client, the client responds to the user's login operation, and the client obtains the role authority (i.e., role ID) corresponding to the user. Assuming the role authority is 1, according to role authority 1, the client determines the accessible menu number matching the role authority in the role authority table, and the accessible menu numbers are 10001, 10002, and 10004. Then, based on the menu number, the accessible menu module is determined in the menu information table, and the accessible menu modules are a.dll, b.dll, and d.dll.

[0149] When the target menu module operated by the user is an accessible menu module, the client can verify based on the real-time file hash value corresponding to the menu file containing the target menu module and the preset file hash value corresponding to the initial menu file, and construct the corresponding target menu after successful verification. When the target menu module operated by the user does not belong to the accessible menu module, the client returns a prompt that the target menu generation failed.

[0150] It is worth mentioning that when a user logs in to the client, the client can load all menu modules and intercept the user's access to the menu module using the role authority. In addition, the client can also only load the accessible menu module according to the role authority, allowing the user to access the menu corresponding to the accessible menu module through the client operation. The present invention is not limited to this.

[0151] When the user opens the A menu, the client verifies the real-time file hash value corresponding to the menu file and the preset file hash value corresponding to the initial menu file. If the verification succeeds, the client searches the menu information table for the target menu module, target export function set, and target parameter set corresponding to the menu name A menu. Among them, the target menu module is a.ll, the export function in the target function set is export_a, and the target parameter set is {"param1a":"value1a", "param2a":"value2a"}. The client executes the export function export_a based on the parameters in the target parameter set to construct the corresponding target menu.

[0152] When the client scans the target menu module a.dll through the background thread, the background thread searches the blacklist type and preset module hash value (1e323122f359a8310aaaf81bc9b88a0a) corresponding to the target menu module a.dl in the blacklist and whitelist configuration table, and compares the real-time module hash value and preset module hash value of the target menu module a.dll. If the two values ​​are different, it is considered that the target menu module does not belong to the blacklist.

[0153] If the two values ​​are the same, the client searches for the corresponding perception information in the perception information table based on the blacklist and whitelist sequence number 1, and obtains two matching perception information. The two perception domain types are time and IP address, and the preset perception domain values ​​are 10:00-12:00 am and 1.1.1.1, respectively. Finally, the current perception domain value corresponding to the time and the current perception domain value corresponding to the IP address are obtained.

[0154] Assuming that the current perception domain value corresponding to the time is 11:00 and the current perception domain value corresponding to the IP address is 1.1.1.1, the target menu module a.dll belongs to the blacklist, confirming that the target menu module is abnormal. Assuming that the current perception domain value corresponding to the time is 13:00 or the current perception domain value corresponding to the IP address is 1.1.1.2, the target menu module a.dll does not belong to the blacklist, confirming that the target menu module is safe.

[0155] It is worth mentioning that since the menu module b.ll does not set the perception information, when the client scans the target menu module b.ll, the client only needs to compare the real-time module hash value corresponding to the target menu module with the preset module hash value. If they are the same, the target menu module b.ll belongs to the whitelist, confirming that the target menu module is safe. If they are different, the target menu module b.ll does not belong to the whitelist, confirming that the target menu module is abnormal.

[0156] It can be seen that the embodiment of the present invention configures the name information, derivative function set and parameter set of the menu module based on the configurable menu information table, which can not only realize that one menu module corresponds to multiple menus, but also dynamically personalize the display of menu functions by configuring differentiated parameter sets, and the configuration effect is more flexible and diverse. At the same time, by configuring the black and white list configuration table and the perception information table, flexible judgment of security risks can be achieved, so that the client system can protect the security of more business scenarios.

[0157] The embodiment of the present invention also provides a menu dynamic loading device, which is used to execute the above-mentioned steps to achieve the corresponding technical effects. The following is a possible implementation method, specifically, Figure 7 A schematic diagram of a menu dynamic loading device provided by an embodiment of the present invention, see Figure 7 The menu dynamic loading device 40 includes: a processing module 400, a verification module 401 and an execution module 402.

[0158] The processing module 400 is used for the client to calculate the real-time file hash value corresponding to the menu file in response to the user's interactive operation of opening the menu;

[0159] Verification module 401 is used for the client to verify the real-time file hash value and the preset file hash value; the preset file hash value corresponds to the initial menu file; the menu file includes a target menu module corresponding to the interactive operation.

[0160] Execution module 402 is used to, if verification is successful, the client searches the menu information table for a target export function set corresponding to the target menu module; the client constructs a target menu corresponding to the interactive operation by executing the export functions in the target export function set; if verification fails, the client returns a prompt indicating that the target menu generation failed.

[0161] To summarize, in the menu dynamic loading device provided by the embodiment of the present invention, when the user executes to open the menu, the client determines the target menu module based on the interactive operation, and calculates the real-time file hash value corresponding to the menu file containing the target menu module, and verifies whether there are security risks in the client system by comparing the real-time file hash value with the preset file hash value corresponding to the initial menu file.

[0162] When the real-time file hash value and the preset file hash value are the same, it indicates that the client system is safe. The target menu corresponding to the interactive operation is constructed to allow users to access the menu under the condition of system safety. When the real-time file hash value and the preset file hash value are different, it indicates that the menu file has been maliciously tampered with and there is a security risk. To avoid data leakage, service interruption and other risk behaviors, the client directly returns a prompt to the user that the target menu generation failed. By checking the hash value of the menu file, the security of the client system can be significantly improved.

[0163] The embodiment of the present invention further provides a client, which can execute all the steps of the above examples of the embodiment of the present invention to achieve the corresponding technical effects. Specifically, Figure 8 A schematic diagram of the structure of a client provided by an embodiment of the present invention, see Figure 8 , the client 50 , comprises: a memory 501 , a processor 500 ;

[0164] Memory 501, used to store one or more programs;

[0165] Processor 500;

[0166] When one or more programs are executed by the processor, when the client 50 is used to execute the steps shown in the above-mentioned method examples, it can achieve each step and the corresponding technical effects.

[0167] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by the processor 500, the menu dynamic loading method disclosed in the above embodiments is implemented.

[0168] The embodiment of the present invention further provides a program product, which, when executed by the processor 500, implements the menu dynamic loading method disclosed in the above embodiments.

[0169] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a module, a program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0170] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0171] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a computer-readable storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0172] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A menu dynamic loading method, It is characterized in that The method comprises: When responding to the user's interactive operation of opening a menu, the client calculates the real-time file hash value corresponding to the menu file; The client verifies the real-time file hash value and the preset file hash value; the preset file hash value corresponds to the initial menu file; the menu file includes a target menu module corresponding to the interactive operation; If the verification is successful, the client obtains the target menu module from the menu file and loads the target menu module; the client searches the menu information table for a target export function set and a target parameter set corresponding to the target menu module, obtains export functions in the target export function set from the loaded target menu module, obtains parameters corresponding to each export function from the target parameter set, instantiates parameters of each export function to obtain corresponding parameter information, executes the export function in the target export function set based on the parameter information, and constructs a target menu corresponding to the interactive operation; If the verification fails, the client returns a prompt indicating that the target menu generation failed.

2. The method according to claim 1, It is characterized in that After the verification is successful, it also includes: The client calls the background thread to obtain the blacklist and whitelist information corresponding to the target menu module; The client verifies the target menu module and the black and white list information through the background thread; If the target menu module matches the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the blacklist and confirms that the target menu module is abnormal; If the target menu module does not match the blacklist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the blacklist and confirms that the target menu module is safe; If the target menu module matches the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module belongs to the whitelist and confirms that the target menu module is safe; If the target menu module does not match the whitelist information in the blacklist and whitelist information, the client confirms that the target menu module does not belong to the whitelist and confirms that the target menu module is abnormal.

3. The method according to claim 2, It is characterized in that The blacklist information includes blacklist type information and a preset module hash value, and the step of the client verifying the target menu module and the blacklist and whitelist information through the background thread includes: The client confirms, through the background thread, that the name information of the target menu module matches the blacklist type information; The client calculates the real-time module hash value corresponding to the target menu module through the background thread; The client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same; the preset module hash value corresponds to the initial menu module one-to-one; if they are different, the client determines through the background thread that the target menu module does not belong to the blacklist; If they are the same, the client determines through the background thread that the target menu module belongs to the blacklist.

4. The method according to claim 3, It is characterized in that The blacklist information also includes at least one perception information; the perception information includes a perception domain type and a preset perception domain value; after the client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same, it also includes: If they are the same, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread; The client compares, through the background thread, whether the current perception domain value corresponding to the perception domain type is the same as the preset perception domain value; If all are the same, the client determines through the background thread that the target menu module belongs to the blacklist; If they are partially the same or completely different, the client determines through the background thread that the target menu module does not belong to the blacklist.

5. The method according to claim 2, It is characterized in that The whitelist information includes whitelist type information and a preset module hash value, and the step of the client verifying the target menu module and the blacklist and whitelist information through the background thread includes: The client confirms, through the background thread, that the name information of the target menu module matches the whitelist type information; The client calculates the real-time module hash value corresponding to the target menu module through the background thread; The client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same; the preset module hash value corresponds to the initial menu module one by one; If they are the same, the client determines through the background thread that the target menu module belongs to the whitelist; If different, the client determines through the background thread that the target menu module does not belong to the whitelist.

6. The method according to claim 5, It is characterized in that The whitelist information also includes at least one perception information; the perception information includes a perception domain type and a preset perception domain value; after the client compares the real-time module hash value with the preset module hash value corresponding to the target menu module through the background thread to see whether they are the same, it also includes: If they are different, the client obtains the corresponding current perception domain value according to the perception domain type through the background thread; The client compares, through the background thread, whether the current perception domain value corresponding to the perception domain type is the same as the preset perception domain value; If all are the same, the client determines through the background thread that the target menu module belongs to the whitelist; If they are partially the same or completely different, the client determines through the background thread that the target menu module does not belong to the whitelist.

7. The method according to claim 1, It is characterized in that Before the step of calculating the real-time file hash value corresponding to the menu file by the client in response to the user's interactive operation of opening the menu, the method further includes: The client obtains the initial menu file and the preset file hash value corresponding to the initial menu file from the server; the menu file includes: a menu information table, a role permission table, a black and white list configuration table and a perception information table; the menu information table includes menus, menu modules and export function sets; the role permission table includes roles and menus granted access rights; the black and white list configuration table includes blacklist type information, whitelist type information, menu modules and preset module hash values; the perception information table includes perception domain types and preset perception domain values.

8. A client, It is characterized in that The method comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A program product, It is characterized in that When the program product is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images