Web application protection system, method and device based on security parallel section

Abstract

The present invention proposes a Web application protection system, method and device based on secure parallel aspects, which belongs to the field of information security technology. The method includes: starting the attach module, obtaining the business application process running on the virtual machine by loading the human-computer interaction engine, selecting the business application process to perform the control operation of the hook aspect and loading the boot module; in the boot module, by executing the agentmain method, initializing and starting the engine module; loading the engine module, initializing the bytecode converter, performing the hook loading check, initializing the Instrumentation register class and rewriting the transform through the aspect manager, and injecting the hook aspect into the target class to provide security protection function and permission management function for the target object.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a Web application protection system, method and device based on security parallel slices. Background Art

[0002] As Web attack methods become more complex, the attack surface is also getting wider. Traditional security protection methods, such as WAF, IDS, etc., are mostly rule-based and difficult to apply to complex network architecture environments. They can no longer meet the basic security needs of enterprises. The concept of "application self-protection" technology emphasizes that the security protection of application services should not only rely on external systems. Application services should have the ability to protect themselves, that is, to build native security technologies with built-in security, active defense, and overall defense as the main features.

[0003] In program development, improving development efficiency, promoting maintainability, enhancing portability and compatibility are the core goals of software engineering, and are also one of the important measures for enterprises to reduce costs and improve efficiency. Therefore, when designing a program, security protection and application services can be integrated but decoupled from each other, that is, security can be deeply integrated into the business logic and is no longer an external security; security protection is plug-and-play, and is deployed independently from application business services, and security protection upgrades and deployments do not affect application business services; at the same time, security capabilities are programmable and scalable, and evolve independently from the business. Native security requires an orthogonal parallel space to provide security protection in a way that is both integrated and decoupled, which very well meets the needs of enterprises to establish "native security" capabilities.

[0004] Currently, the methods for implementing web applications based on security aspects basically adopt the following two methods: one is to load the proxy at startup, that is, specify the proxy program when the web application is started. In this way, the security aspect can only take effect on the current web application, and cannot achieve batch proxy or implement proxy for web applications that are running, which has great limitations; the other method adopts runtime loading, but most of them are to dynamically bind the running application process through the startup parameters when the security aspect is started. Once started, it is impossible to continue to bind new web applications. There is no friendly human-computer interaction method, and it is impossible to flexibly bind or uninstall the specified application process. Summary of the invention

[0005] In view of the problems existing in the prior art, the purpose of the present invention is to provide a Web application protection system, method and device based on secure parallel slices, which can effectively solve the problems of no human-computer interaction when proxy plugging of web applications, and no real-time dynamic batch binding or uninstallation.

[0006] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0007] A Web application protection system based on security parallel sections, including: an attach module, a boot module and an engine module;

[0008] The attach module is used to obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, select the business application process to perform the control operation of the hook aspect and load the boot module;

[0009] The boot module is used to execute the agentmain method, initialize and start the engine module;

[0010] The engine module is used to initialize the aspect manager, which performs hook loading checks, initializes the Instrumentation registrant class, and rewrites transforms. It also injects the hook aspect into the target class to provide security protection and permission management functions for the target object.

[0011] Correspondingly, the present invention also discloses a Web application protection method based on security parallel sections, comprising:

[0012] Start the attach module, load the Groovy script-based human-computer interaction engine to obtain the business application process running on the virtual machine, select the business application process to perform the control operation of the hook aspect and load the boot module;

[0013] In the boot module, initialize and start the engine module by executing the agentmain method;

[0014] Load the engine module and initialize the aspect manager. Use the aspect manager to check the loading of hooks, initialize the Instrumentation registrant class, and rewrite transforms. In addition, inject the hook aspect into the target class to provide security protection and permission management functions for the target object.

[0015] Furthermore, the attach module is started to obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, including:

[0016] Start the attach module, load the human-computer interaction engine based on Groovy scripts, enter the main method of the groovy startup process through GroovyScriptEngine, interact with the virtual machine through the com.sun.tools.attach.VirtualMachine interface, and obtain all business application processes running on the current virtual machine.

[0017] Further, the selecting of the business application process to perform the control operation of the hook section and load the boot module includes:

[0018] Execute Groovy scripts through GroovyScriptEngine to provide a user interaction interface;

[0019] Obtain the user's selection information through the user interaction interface to determine the selected business application process, and determine the uninstallation or installation operation of the hook aspect for the business application process;

[0020] Load the boot module through the loadAgent method of VirtualMachine.

[0021] Furthermore, in the boot module, the engine module is initialized and started by executing the agentmain method, including:

[0022] Configure the MANIFEST.MF file in the pom file of the boot module to specify the proxy class;

[0023] When the virtual machine is loaded, it automatically finds and calls the agentmain method of the specified agent class according to the MANIFEST.MF file;

[0024] Load the engine module by running the agentmain method and start the engine module.

[0025] Furthermore, the hook loading check, instrumentation registration class initialization and transform rewriting are performed through the aspect manager, and the hook aspect is injected into the target class, including:

[0026] Use Spring dynamic injection technology to mark hook points through custom annotations;

[0027] Use the abstract factory pattern to define an abstract class of hook;

[0028] Initialize the custom Instrumentation registrar, automatically discover and register all hook subclasses that inherit from the hook abstract class through the class scanner, and collect these subclasses into the Set collection;

[0029] Rewrite the transform method to match the hook subclass in the Set collection with the target class. If the match is successful, use the bytecode modification technology to modify the bytecode of the target class and insert the hook logic.

[0030] Furthermore, the abstract class of the hook includes an insertion logic based on bytecode technology, and after any hook point inherits the abstract class, the insertion logic can be rewritten.

[0031] Correspondingly, the present invention also discloses a Web application protection device based on secure parallel sections, comprising:

[0032] Memory for storing computer programs;

[0033] A processor is used to implement the steps of the Web application protection method based on secure parallel sections as described in any of the above items when executing the computer program.

[0034] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides a Web application protection system, method and device based on secure parallel aspects, which uniformly manages hook aspects through a custom annotation, class scanning and factory mode, and modularly constructs the hook program startup loading process, displays the web application process and operation in the server in a human-computer interactive manner, and can flexibly batch inject or unload hooks to web applications at any time. After startup, the present invention loads the interaction engine, dynamically binds the application process and initializes the aspect manager. The aspect manager is mainly responsible for the centralized control of hooks, type matching, initialization of Instrumentation and rewriting of transforms, and injects different hook points into the target class method based on bytecode modification technology.

[0035] The present invention realizes the dynamic batch binding or uninstallation of hooks for a single or multiple application processes on a server through human-computer interaction through modular architecture design and the combination of springboot, groovy, java agent plugging technology, etc., and defines a section manager based on custom annotations, class scanning, factory mode and other technologies, thereby realizing unified management of business hooks and batch injection and uninstallation of hooks. The present invention can effectively solve the problems of no human-computer interaction and no real-time dynamic batch binding or uninstallation when performing proxy plugging on web applications.

[0036] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 It is a method flow chart of a specific implementation mode of the present invention.

[0039] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0040] In the figure, 1. attach module; 2. boot module; 3. engine module. DETAILED DESCRIPTION

[0041] The specific implementation of the present invention is described below with reference to the accompanying drawings.

[0042] like Figure 1 As shown, the present invention discloses a Web application protection system based on secure parallel aspects. The system is based on the combination of springboot framework, groovy script engine and java agent bytecode plug-in technology. The architecture is designed and developed using maven modules, including: attach module 1, boot module 2 and engine module 3.

[0043] The attach module 1 is used to obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, select the business application process to perform the control operation of the hook aspect and load the boot module.

[0044] In a specific implementation, attach module 1 is responsible for loading a human-computer interaction engine based on a Groovy script, entering the main method of the groovy startup process through GroovyScriptEngine, interacting with the virtual machine through the com.sun.tools.attach.VirtualMachine interface, and obtaining all business application processes running on the current virtual machine.

[0045] The boot module 2 is used to execute the agentmain method, initialize and start the engine module 3.

[0046] In a specific implementation, the boot module 2, as the core part of the Java Agent, is loaded into the target JVM by the attach module 1. It is responsible for initializing and starting the engine module 3, and is a bridge connecting the attach module 1 and the engine module 3.

[0047] The boot module 2 is used to configure MANIFEST.MF in the pom file, specify the agent class in the MANIFEST.MF file, and automatically find the agentmain method of the agent class after the jvm loads the program. This method mainly initializes the engine module 3 engine and starts the engine module 3.

[0048] The engine module 3 is used to initialize the aspect manager, which performs hook loading check, Instrumentation registration class initialization and transform rewrite, and injects the hook aspect into the target class to provide security protection and permission management functions for the target object.

[0049] In a specific implementation, the engine module 3 is specifically used to: use Spring dynamic injection technology to mark hook points through custom annotations; use the abstract factory pattern to define an abstract class of hook; initialize a custom Instrumentation registrar, automatically discover and register all hook subclasses that inherit from the abstract class of hook through a class scanner, and collect these subclasses into a Set collection; rewrite the transform method to match the hook subclasses in the Set collection with the target class. If the match is successful, the bytecode of the target class is modified using bytecode modification technology, and the hook logic is inserted.

[0050] Correspondingly, such as Figure 2 As shown, the present invention also discloses a Web application protection method based on secure parallel sections. The method adopts the above-mentioned Web application protection system based on secure parallel sections, and specifically includes the following steps:

[0051] S1: Start the attach module, obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, select the business application process to perform the control operation of the hook aspect and load the boot module.

[0052] In a specific implementation, first start the attach module, load the human-computer interaction engine based on the Groovy script, enter the groovy startup process main method through the GroovyScriptEngine, interact with the virtual machine through the com.sun.tools.attach.VirtualMachine interface, and obtain all running business application processes on the current virtual machine.

[0053] Then, the Groovy script is executed through the GroovyScriptEngine to provide a user interaction interface. At this time, the user's selection information is obtained through the user interaction interface to determine the selected business application process and determine the uninstallation or installation operation of the hook aspect for the business application process.

[0054] Finally, load the boot module through the loadAgent method of VirtualMachine.

[0055] As an example, first start the attach module and load the human-computer interaction engine. This engine is based on the groovy script. Enter the main method of the groovy startup process through GroovyScriptEngine. In this method, load "com.sun.tools.attach.VirtualMachine" to obtain the JVM virtual machine. Use the list method of VirtualMachine to list the business application processes running on the JVM virtual machine, and choose to install or uninstall the parallel aspect for the specified process according to the prompt of the groovy script, and call the loadAgent method of VirtualMachine according to the reflection of the class to load the agent boot module.

[0056] S2: In the boot module, initialize and start the engine module by executing the agentmain method.

[0057] In a specific implementation, a MANIFEST.MF file is configured in the pom file of the boot module to specify the agent class; when the virtual machine is loaded, the agentmain method of the specified agent class is automatically found and called according to the MANIFEST.MF file; finally, the engine module is loaded by running the agentmain method and the engine module is started.

[0058] As an example, configure MANIFEST.MF in pom, specify the agent class in the MANIFEST.MF file, and after the jvm loads the program, it automatically finds the agentmain method of the agent class. This method mainly initializes the engine module engine and starts the engine.

[0059] S3: Load the engine module and initialize the aspect manager. Use the aspect manager to check the loading of hooks, initialize the Instrumentation registrant class, and rewrite transforms. Then, inject the hook aspect into the target class to provide security protection and permission management functions for the target object.

[0060] In a specific implementation, the engine module is first loaded and the aspect manager is initialized. The Spring dynamic injection technology is used to mark the hook points through custom annotations; an abstract class of hook is defined using the abstract factory pattern. The abstract class of hook includes insertion logic based on bytecode technology. After any hook point inherits the abstract class, the insertion logic can be rewritten.

[0061] At this point, initialize the custom Instrumentation registrar, automatically discover and register all hook subclasses that inherit from the hook abstract class through the class scanner, and collect these subclasses into the Set collection. Finally, rewrite the transform method to match the hook subclasses in the Set collection with the target class. If the match is successful, use the bytecode modification technology to modify the bytecode of the target class and insert the hook logic.

[0062] As an example, this step includes: starting the engine module, initializing the aspect manager, which is mainly responsible for checking the loading of hooks, initializing Instrumentation, rewriting transforms, etc., and injecting hooks into the target class. The specific steps are divided into:

[0063] 1. Use spring dynamic injection technology to configure custom annotations and introduce them when creating different hook points.

[0064] 2. Create an abstract class of hook through the abstract factory pattern. The abstract class defines different insertion methods based on bytecode technology. Different hook points inherit the abstract class and can rewrite the insertion method and target class type matching method.

[0065] 3. Initialize the custom Instrumentation registrar class. During the initialization process, obtain all hooks in the class directory through the class scanner. If the hook belongs to the abstract class type defined in step 2, add it to the Set collection.

[0066] 4. Rewrite the transform method and match the hook in the Set collection with the target class. If the match is successful, modify the bytecode of the target class.

[0067] Correspondingly, the present invention also discloses a Web application protection device based on secure parallel sections, comprising:

[0068] Memory for storing computer programs;

[0069] A processor is used to implement the Web application protection steps based on security parallel aspects as described in any of the above items when executing the computer program.

[0070] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a storage medium such as a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, etc., which can store program codes, including several instructions to enable a computer terminal (which can be a personal computer, a server, or a second terminal, a network terminal, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The same and similar parts between the various embodiments in this specification can be referred to each other. In particular, for the terminal embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0071] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0072] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0073] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0074] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0075] In conjunction with the accompanying drawings and specific embodiments, the present invention will be further described. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art may make various changes or modifications to the present invention, and these equivalent forms also fall within the scope limited by the application.

Claims

1. A Web application protection system based on security parallel aspects, characterized in that: include: attach module, boot module and engine module; The attach module is used to obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, select the business application process to perform the control operation of the hook aspect and load the boot module; The boot module is used to execute the agentmain method, initialize and start the engine module; The engine module is used to initialize the aspect manager, which performs hook loading checks, initializes the Instrumentation registrant class, and rewrites transforms. It also injects the hook aspect into the target class to provide security protection and permission management functions for the target object.

2. A Web application protection method based on security parallel sections, characterized in that: The method adopts the Web application protection system based on security parallel sections as described in claim 1; The method comprises: Start the attach module, load the Groovy script-based human-computer interaction engine to obtain the business application process running on the virtual machine, select the business application process to perform the control operation of the hook aspect and load the boot module; In the boot module, initialize and start the engine module by executing the agentmain method; Load the engine module and initialize the aspect manager. Use the aspect manager to check the loading of hooks, initialize the Instrumentation registrant class, and rewrite transforms. In addition, inject the hook aspect into the target class to provide security protection and permission management functions for the target object.

3. According to claim 2, the Web application protection method based on security parallel sections is characterized in that: The attach module is started to obtain the business application process running on the virtual machine by loading the human-computer interaction engine based on the Groovy script, including: Start the attach module, load the human-computer interaction engine based on Groovy scripts, enter the main method of the groovy startup process through GroovyScriptEngine, interact with the virtual machine through the com.sun.tools.attach.VirtualMachine interface, and obtain all business application processes running on the current virtual machine.

4. According to claim 3, the Web application protection method based on security parallel sections is characterized in that: The process of selecting a business application process to perform a control operation on the hook section and loading a boot module includes: Execute Groovy scripts through GroovyScriptEngine to provide a user interaction interface; Obtain the user's selection information through the user interaction interface to determine the selected business application process, and determine the uninstallation or installation operation of the hook aspect for the business application process; Load the boot module through the loadAgent method of VirtualMachine.

5. According to claim 4, the Web application protection method based on security parallel sections is characterized in that: In the boot module, the engine module is initialized and started by executing the agentmain method, including: Configure the MANIFEST.MF file in the pom file of the boot module to specify the proxy class; When the virtual machine is loaded, it automatically finds and calls the agentmain method of the specified agent class according to the MANIFEST.MF file; Load the engine module by running the agentmain method and start the engine module.

6. According to claim 5, the Web application protection method based on security parallel sections is characterized in that: The hook loading check, instrumentation registration class initialization and transform rewrite are performed through the aspect manager, and the hook aspect is injected into the target class, including: Use Spring dynamic injection technology to mark hook points through custom annotations; Use the abstract factory pattern to define an abstract class of hook; Initialize the custom Instrumentation registrar, automatically discover and register all hook subclasses that inherit from the hook abstract class through the class scanner, and collect these subclasses into the Set collection; Rewrite the transform method to match the hook subclass in the Set collection with the target class. If the match is successful, use the bytecode modification technology to modify the bytecode of the target class and insert the hook logic.

7. The Web application protection method based on security parallel sections according to claim 6 is characterized in that: The abstract class of the hook includes the insertion logic based on the bytecode technology. After any hook point inherits the abstract class, the insertion logic can be rewritten.

8. A Web application protection device based on security parallel sections, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the Web application protection method based on secure parallel sections as described in any one of claims 2 to 7 when executing the computer program.

Images