Security vulnerability patch distribution method, system, computer equipment and storage medium

Abstract

The present invention relates to the technical field of security vulnerabilities, and discloses a security vulnerability patch distribution method, system, computer equipment and storage medium. The system includes a service side and a client side: the service side generates file information and hash values ​​corresponding to a vulnerability patch package through a publishing platform, and generates a distributed hash table; determines whether there is information of a first node in the distributed hash table; when there is information of the first node in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform in a sharding manner based on the distributed hash table, and adds the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table; the client side responds to the update notification, obtains the updated distributed hash table; determines whether there is an available node on the service side; when there is an available node on the service side, the sharding obtains the vulnerability patch package from the available node. Less consumption of server performance, higher transmission efficiency, and improved client security.

Description

Technical Field

[0001] The present invention relates to the technical field of security vulnerability, and in particular to a security vulnerability patch distribution method, system, computer equipment and storage medium. Background Art

[0002] With the development of the computer field, computer security has shown a trend of wide-ranging, high timeliness, complex technology and high value. As the attackers and defenders of data, network and host security, each party will mine vulnerabilities in the current information equipment system to obtain the latest security vulnerabilities. These vulnerabilities are called "0day vulnerabilities, 1day vulnerabilities, and nday vulnerabilities". Among them, "nday vulnerabilities" refer to the situation where the patch for the vulnerability has been released for n days, but the victim has not yet applied the patch due to various reasons. The existence of nday vulnerabilities means that the attacker has mastered the means of attacking computer nodes in a certain area, but the target customer environment has not yet prepared countermeasures, thus giving the attacker a time window to take advantage of. For current computer software and hardware users, obtaining the latest information on vulnerability libraries and response patches as soon as possible and taking repair measures in a timely manner is an important means to protect the security of their own information systems. The current security vulnerability library generally exists in two forms: one is the national information security vulnerability library, which is an authoritative platform that collects the currently discovered computer system security vulnerability data and provides corresponding repair strategy recommendations. The other is the security vulnerability database established and maintained by security vendors themselves. Compared with the public security vulnerability database built by the government, security companies will maintain their own vulnerability discovery and repair teams to conduct vulnerability discovery and processing in specific areas. The output will go a step further and provide patches to repair vulnerabilities for the convenience of customers. The current measures for distributing vulnerability patches generally involve increasing the number of servers and dispatching multiple servers with general load balancing products such as nginx and LVS.

[0003] Among the related technologies, the versatility to cope with various scenarios is strong, but the load balancing implemented in hardware form (core switch, proxy server) will inevitably increase the cost; and the performance will inevitably be discounted in the form of software, and the total entrance network bandwidth will remain unchanged, which is not very timely for the large-scale distribution of millions of files. If a professional network transmission company is asked to design a set of file transmission strategies and deploy them, the cost will increase, and the target customers are in different network environments. Due to security requirements, they may not be able to access the public network and thus cannot obtain the latest security vulnerability patches in a timely manner. Summary of the invention

[0004] In view of this, the present invention provides a security vulnerability patch distribution method, system, computer device and storage medium to solve the existing problem of difficulty in timely obtaining the latest security vulnerability patches.

[0005] In a first aspect, the present invention provides a method for distributing security vulnerability patches, which is applied to a service side, wherein the service side includes a peer-to-peer network node group consisting of a publishing platform and a plurality of nodes, and the method includes:

[0006] Obtain vulnerabilities and their corresponding vulnerability patch packages;

[0007] Send the vulnerability patch package to the publishing platform, and generate file information and hash values ​​corresponding to the vulnerability patch package through the publishing platform;

[0008] Generate a distributed hash table based on file information and hash values;

[0009] Determine whether there is information of a first node in the distributed hash table, where the first node is a node in the peer-to-peer network node group that has a vulnerability patch package;

[0010] When the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table;

[0011] The publishing platform sends an update notification to the client, so that the client responds to the update notification and obtains the updated distributed hash table; based on the updated distributed hash table, it is determined whether there are available nodes on the service side, and the available nodes are nodes that have vulnerability patch packages and the transmission rate between the client and the client is greater than a preset threshold; when there are available nodes on the service side, the shard obtains the vulnerability patch package from the available node, and uses the vulnerability patch package to repair the patch or vulnerability update notification.

[0012] In the present invention, the vulnerability patch package is transmitted in segments to each node on the service side through a p2p network composed of several nodes and a publishing platform on the service side, so that the client can obtain the vulnerability patch package from the node segment on the service side. Compared with the existing vulnerability patch package transmission method, this transmission method consumes very little server performance, and when there are multiple nodes in the intranet environment of the service side, the transmission efficiency is higher. The time for distributing a vulnerability patch package to each node can be calculated in seconds. Combined with the automatic repair function of the client, the time window of the nday vulnerability can be greatly reduced, thereby improving the security of the client environment.

[0013] In an optional embodiment, when the information of the first node does not exist in the distributed hash table, the current node in the peer network node group is used to obtain the vulnerability patch package from the publishing platform through a direct link transmission method, and the current node is updated to the first node, and the node information of the current node itself is added to the distributed hash table, and the step of determining whether the information of the first node exists in the distributed hash table is returned.

[0014] In this method, when there is no node in the p2p node group for other nodes to download the vulnerability patch package, the current node is added to the p2p node group as the first node, and the vulnerability patch package is downloaded to the node through a direct link transmission method, so that other nodes can subsequently connect to the first node for fragmented downloading.

[0015] In an optional implementation, the remaining nodes obtain the vulnerability patch package in a sharded manner, including:

[0016] Divide the vulnerability patch package into several shards based on the preset shard data volume;

[0017] Generate an index hash corresponding to each shard, map the index hash to each first node and publishing platform, and obtain the file storage node IP address corresponding to each shard;

[0018] Generate the hash corresponding to each shard based on the index hash and the file storage node IP address;

[0019] The hashes corresponding to all shards are combined to obtain a hash ring, which is then reassembled to obtain a vulnerability patch package. The remaining nodes store the hash ring and vulnerability patch package in their own nodes.

[0020] In this way, by obtaining vulnerability patch packages in a sharded manner, nodes do not need to obtain vulnerability patch packages from the publishing platform, which reduces the pressure on the publishing platform and expands the bandwidth of the publishing platform. As a result, the latest vulnerability patch packages can be obtained more quickly after the vulnerability patch packages are updated. At the same time, the time spent by the client to obtain the vulnerability patch packages is greatly reduced, the transmission efficiency is higher, and the security of the client is further guaranteed.

[0021] In a second aspect, the present invention provides a method for distributing security vulnerability patches, which is applied to a client, and the method comprises:

[0022] In response to the update notification, an updated distributed hash table is obtained, and the updated distributed hash table is used by the service side to obtain the vulnerability and the vulnerability patch package corresponding to the vulnerability; the vulnerability patch package is sent to the publishing platform, and the file information and hash value corresponding to the vulnerability patch package are generated through the publishing platform; based on the file information and the hash value, a distributed hash table is generated; it is determined whether there is information of the first node in the distributed hash table, and the first node is a node with the vulnerability patch package in the peer-to-peer network node group; when the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform in a sharded manner based on the distributed hash table, and the node information of the remaining nodes is added to the distributed hash table;

[0023] Based on the updated distributed hash table, determine whether there are available nodes on the service side. Available nodes are nodes that have vulnerability patch packages and whose transmission rate with the client is greater than a preset threshold.

[0024] When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available node and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

[0025] In the present invention, the client obtains the vulnerability patch package in a sharded manner from each available node on the server that can obtain the vulnerability patch package, with fast transmission speed and higher transmission efficiency. Combined with the client's automatic repair, the vulnerability repair is achieved at the fastest speed, thereby improving the security of the client environment.

[0026] In an optional implementation, when there is no available node, the vulnerability patch package is obtained from the publishing platform.

[0027] In this method, when other nodes on the server side are not transmitting, since only the publishing platform has the vulnerability patch package at this moment, the vulnerability patch package can only be obtained through the publishing platform. In other cases, in order to ensure that the bandwidth of the publishing platform is not additionally occupied, the client obtains the vulnerability patch package from the available nodes on the server side.

[0028] In an optional embodiment, the method further includes:

[0029] Determine whether the current client agrees to join the client peer network node group;

[0030] When the current client agrees to join the client peer network node group, the current client is determined as one of the nodes of the client peer network node group, so that other clients in the client peer network node group download the vulnerability patch package of the current client.

[0031] In this method, when the current client agrees to join the client peer network node group, it means that the client can use its own node as one of the client P2P transmission nodes for other nodes in the client's intranet to download. Although it is beneficial for the overall file distribution on the client side, for the consideration of customer traffic protection and security strategy, it is only recommended to enable it when there are other vulnerabilities in the client's own LAN and the client needs to obtain it. At this time, multiple nodes in the client's intranet can use the client P2P to obtain file fragments nearby to improve transmission efficiency.

[0032] In a third aspect, the present invention provides a security vulnerability patch distribution system, the system comprising a service side and a client, the service side comprising a peer-to-peer network node group consisting of a publishing platform and a plurality of nodes:

[0033] The service side obtains the vulnerability and the vulnerability patch package corresponding to the vulnerability;

[0034] Send the vulnerability patch package to the publishing platform, and generate file information and hash values ​​corresponding to the vulnerability patch package through the publishing platform;

[0035] Generate a distributed hash table based on file information and hash values;

[0036] Determine whether there is information of a first node in the distributed hash table, where the first node is a node in the peer-to-peer network node group that has a vulnerability patch package;

[0037] When the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table;

[0038] The publishing platform sends update notifications to the client;

[0039] The client obtains the updated distributed hash table in response to the update notification;

[0040] Based on the updated distributed hash table, determine whether there are available nodes on the service side. Available nodes are nodes that have vulnerability patch packages and whose transmission rate with the client is greater than a preset threshold.

[0041] When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available node and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

[0042] In the present invention, a p2p network is formed by several nodes and a publishing platform on the service side, and the vulnerability patch package is transmitted to each node on the service side in pieces. The client obtains the vulnerability patch package in pieces from the available nodes on the service side, so that the client obtains the vulnerability patch package and uses the vulnerability patch package to repair the patch or notify the vulnerability update. Compared with the existing transmission method of the vulnerability patch package, the consumption of server performance is less, and when there are multiple nodes in the intranet environment of the service side, the transmission efficiency is higher. The time for a vulnerability patch package to be distributed to each node can be calculated in seconds. Combined with the automatic repair function of the client, the time window of the nday vulnerability can be greatly reduced, thereby improving the security of the client environment.

[0043] In a fourth aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to thereby execute the security vulnerability patch distribution method of the first aspect or any corresponding embodiment thereof, or to execute the security vulnerability patch distribution method of the second aspect or any corresponding embodiment thereof.

[0044] In a fifth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the security vulnerability patch distribution method of the first aspect or any corresponding embodiment thereof, or to execute the security vulnerability patch distribution method of the second aspect or any corresponding embodiment thereof.

[0045] In a sixth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the security vulnerability patch distribution method of the first aspect or any corresponding embodiment thereof, or to execute the security vulnerability patch distribution method of the second aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 4 is a schematic diagram of the structure of a security vulnerability patch distribution system according to an embodiment of the present invention.

[0048] Figure 2 Schematic diagram of the interaction of a security vulnerability patch distribution system according to an embodiment of the present invention.

[0049] Figure 3 It is a schematic diagram of a P2P vulnerability patch distribution network according to an embodiment of the present invention.

[0050] Figure 4 The figure is a schematic diagram of a process of distributing vulnerability patches according to an embodiment of the present invention.

[0051] Figure 5 The figure is a flowchart of a method for distributing security vulnerability patches according to an embodiment of the present invention.

[0052] Figure 6 4 is a flow chart of another security vulnerability patch distribution method according to an embodiment of the present invention.

[0053] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] Among the related technologies, the versatility to cope with various scenarios is strong, but the load balancing implemented in hardware form (core switch, proxy server) will inevitably increase the cost, and the performance will inevitably be discounted if it is implemented in software form, and the total entrance network bandwidth remains unchanged, which is not very timely for large-scale distribution of millions of files. If a professional network transmission company is asked to design a set of file transmission strategies and deploy them, the cost will increase, and the target customers are in different network environments. Due to security requirements, they may not be able to access the public network and thus cannot obtain the latest security vulnerability patches in a timely manner.

[0056] To solve the above problems, a security vulnerability patch distribution system is provided in an embodiment of the present invention, which is suitable for users with vulnerability security maintenance needs. The user environment generally has multiple security products and network protection measures. The network domain is also isolated from the public network, and the network gate releases and audits specific devices, protocols, ports, etc. in the form of a whitelist. The user with the above characteristics obtains the latest information of the vulnerability library and response patches and takes repair measures in time. The use scenario. The present invention provides a security vulnerability patch distribution system, which forms a p2p network by forming a p2p network with several nodes and a publishing platform on the service side, and transmits the vulnerability patch package to each node on the service side in slices. The client obtains the vulnerability patch package from the available nodes on the service side in slices, so that the client obtains the vulnerability patch package and uses the vulnerability patch package to repair the patch or vulnerability update notification. Compared with the existing transmission method of the vulnerability patch package, the consumption of server performance is less, and when there are multiple nodes in the intranet environment of the service side, the transmission efficiency is higher. The time for a vulnerability patch package to be distributed to each node can be calculated in seconds. Combined with the automatic repair function of the client, the time window of the nday vulnerability can be greatly reduced, thereby improving the security of the client environment.

[0057] In this embodiment, a security vulnerability patch distribution system is provided. Figure 1 FIG. 1 is a schematic diagram of a security vulnerability patch distribution system according to an embodiment of the present invention. Figure 1 As shown, the system includes a service side 100 and a client 200 , and the service side 100 includes a peer-to-peer network node group consisting of a publishing platform 110 and a plurality of nodes 120 .

[0058] Figure 2is an interactive schematic diagram of a security vulnerability patch distribution system according to an embodiment of the present invention. In this embodiment, a security vulnerability patch distribution method is provided, which can be used in the above security vulnerability patch distribution system, such as Figure 2 As shown, the service side 100 is used to execute steps S101 to S106, and the client is used to execute steps S201 to S203.

[0059] Step S101: The service side obtains a vulnerability and a vulnerability patch package corresponding to the vulnerability.

[0060] Step S102: Send the vulnerability patch package to the publishing platform, and generate file information and hash value corresponding to the vulnerability patch package through the publishing platform.

[0061] Step S103: Generate a distributed hash table based on the file information and the hash value.

[0062] Step S104, determining whether there is information of a first node in the distributed hash table, where the first node is a node in the peer network node group that has a vulnerability patch package.

[0063] Step S105, when the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table.

[0064] Step S106: The publishing platform sends an update notification to the client.

[0065] Step S201: The client obtains an updated distributed hash table in response to the update notification.

[0066] Step S202: Based on the updated distributed hash table, determine whether there is an available node on the service side, where the available node is a node that has a vulnerability patch package and whose transmission rate with the client is greater than a preset threshold;

[0067] Step S203: When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available node and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

[0068] In one implementation scenario, Figure 3 is a schematic diagram of a P2P vulnerability patch distribution network according to an embodiment of the present invention, such as Figure 3As shown in the figure, the network deployment on the service side is divided into the following functions: a. Vulnerability mining laboratory: professional vulnerability mining personnel and supporting facilities, which are the main collectors of 0day vulnerabilities, 1day vulnerabilities and other types of vulnerabilities. b. Vulnerability / patch policy library: composed of security practitioners and computer software developers, they formulate repair strategies based on existing vulnerabilities and edit them into repair programs, that is, patch packages corresponding to the vulnerabilities. Vulnerabilities and corresponding repair patch packages together constitute the vulnerability patch policy library, which is the main business object of security companies. c. Release platform: The platform has two main functions. One is to push updates to the vulnerability patch policy library in a timely manner to the release platform and push them to each warehouse node (internal push). The other is to release new vulnerability versions and notify clients, as well as the distributed hash table (DHT) of the distribution warehouse nodes.

[0069] Figure 4 is a schematic diagram of a vulnerability patch distribution process according to an embodiment of the present invention, such as Figure 4 As shown in the figure, the process of vulnerability patch distribution includes the following steps:

[0070] 1. After discovering 0day vulnerabilities and collecting 1day vulnerabilities, formulate a repair plan. The computer vulnerability repair cycle includes: 1) discovering vulnerabilities; 2) preparing patches; 3) distributing patches; 4) repairing vulnerabilities.

[0071] 2. Prepare vulnerability patch packages according to the formulated repair plan and conduct tests.

[0072] 3. After the test is correct, send the patch package to the release platform.

[0073] 4. After the release platform updates the vulnerability patch repository version, it generates the file information and hash value of the new patch package and generates a distributed hash table.

[0074] 5. The publishing platform first broadcasts the latest version to the warehouse node and notifies the warehouse node to update.

[0075] 6. The warehouse node obtains the current distributed hash table and determines whether there is a node available for download.

[0076] 7. If there is no node, the patch package is obtained directly from the publishing platform. The download method at this time is direct link transmission.

[0077] 8. If a node available for download is found, connect to the node and transfer the file to itself in pieces.

[0078] 9. After the transmission is completed, feedback is sent to the platform, and the platform adds its own node information to the distributed hash table. Among them, steps 6, 8, and 9 are the process of P2P shard downloading.

[0079] 10. When a certain proportion of nodes are synchronized, the advantages of P2P begin to emerge and vulnerability patches can be released to customers.

[0080] 11. The platform first sends an update notification to the client, and the client obtains the distributed hash table after receiving the notification.

[0081] 12. The process is the same as that of internal patch release. The client also determines whether there is an available node, but the node here is a connectivity test. If the transmission rate is slow, switch to the next node.

[0082] 13. If the transmission speed indicators are abnormal after traversing the nodes, it is considered that there are no available nodes, and the files will be obtained directly from the platform.

[0083] 14. For step 13, due to the network security policy configuration of the customer environment in general, the client can only connect to the tunnel of the publishing platform and cannot connect to other nodes. Although the file is directly obtained from the publishing platform, some reverse proxy and load balancing technologies are generally used to redirect the warehouse node to the client, which is implemented by existing technologies. This is not the focus of patent protection, so it is not shown in the figure.

[0084] 15. If an available node is found, the shard obtains the file to itself.

[0085] 16. After the download is complete, the patch will be automatically repaired or the customer will be notified based on the vulnerability repair strategy configured by the client user.

[0086] 17. The client will configure whether the current node is willing to join the P2P node group. If it agrees, it means that the client can use its own node as one of the P2P transmission nodes for other nodes to download. Although this is beneficial to the overall file distribution, for the sake of customer traffic protection and security strategy, it is only recommended to enable it when there are other vulnerabilities in the client's own LAN and the client needs to obtain it. At this time, multiple nodes in the private network can use P2P to obtain file fragments nearby to improve transmission efficiency.

[0087] 18. If the client agrees to join, it will send feedback to the publishing platform after downloading its own files, and the publishing platform will update and maintain the distributed hash table.

[0088] The security vulnerability patch distribution system provided in this embodiment forms a p2p network with several nodes and a publishing platform on the service side, and transmits the vulnerability patch package in pieces to each node on the service side. The client obtains the vulnerability patch package in pieces from the available nodes on the service side, so that the client obtains the vulnerability patch package and uses the vulnerability patch package to repair the patch or vulnerability update notification. Compared with the existing transmission method of vulnerability patch packages, it consumes less server performance, and when there are multiple nodes in the intranet environment of the service side, the transmission efficiency is higher. The time for a vulnerability patch package to be distributed to each node can be calculated in seconds. Combined with the automatic repair function of the client, the time window of the nday vulnerability can be greatly reduced, thereby improving the security of the client environment.

[0089] In this embodiment, a method for distributing a security vulnerability patch is provided, which can be used in the service side 100 of the above-mentioned security vulnerability patch distribution system. Figure 5 is a flow chart of a method for distributing security vulnerability patches according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0090] Step S501, obtain the vulnerability and the vulnerability patch package corresponding to the vulnerability. Figure 2 Step S101 of the illustrated embodiment will not be described in detail here.

[0091] Step S502: Send the vulnerability patch package to the publishing platform, and generate file information and hash value corresponding to the vulnerability patch package through the publishing platform.

[0092] Step S503: Generate a distributed hash table based on the file information and the hash value.

[0093] In one example, the principle of generating file information, hash value and distributed hash table corresponding to the vulnerability patch package through DHT application includes: 1. File index hashing: "File index" not only contains the file name of the vulnerability patch package, but also includes the number of a certain segment after the file is fragmented and the hash value of the content of the file fragment. The "file index" is then converted into a fixed-length hash value through a hash function, and this hash value is used as the identifier (key) of the current file index. 2. Node identifier generation: Since the vulnerability patch package file is stored in the node, the network information of the node (generally the file storage node IP address and network segment) is also generated through a hash function. Fixed-length identifier (NodeID). 3. Hash table segmentation: The entire hash space (the set of all hash values) is divided into multiple small blocks (the algorithms are different, and the classic algorithm is Chord ring, i.e. hash ring), and each small block is maintained by a node in the network. The entire hash table is distributed to all nodes in the network. 4. Node responsible area: Each node is responsible for maintaining a continuous hash value range according to the position of its identifier on the hash ring (Chord ring, etc.).

[0094] Specifically, the principles of steps 3-4 of the DHT application can include: 1. File storage: When a file is uploaded to the P2P network, the hash value of its index is calculated and mapped to a node in the network according to the hash value. The node stores the file index (Key) and the IP address (Value) of the file storage node as a pair (K, V) in the local hash table. 2. File query: When a file needs to be queried, the client first calculates the hash value of the file index, and then searches for the corresponding node in the DHT according to the hash value. This search process may involve routing of multiple nodes until the node responsible for the hash value is found. 3. Simple routing algorithm: In a simple DHT implementation, each node only maintains the information of its successor node. The query request is passed on the hash ring through the successor node until the target node is found. Among them, Chord's routing algorithm: In order to improve query efficiency, a finger table is maintained, which contains information of multiple nodes so that the query request can locate the target node faster.

[0095] Step S504: Determine whether there is information about the first node in the distributed hash table. Figure 2 Step S104 of the illustrated embodiment will not be described in detail here.

[0096] In the embodiment of the present invention, the first node is a node in the peer network node group that has a vulnerability patch package.

[0097] Step S505, when the information of the first node does not exist in the distributed hash table, use the current node in the peer network node group to obtain the vulnerability patch package from the publishing platform through a direct link transmission method, and update the current node to the first node, add the node information of the current node to the distributed hash table, and return to the step of determining whether the information of the first node exists in the distributed hash table.

[0098] In one example, the principle of direct link transmission is that the current node value publishing platform directly downloads the vulnerability patch package on the publishing platform. "Direct link transmission" and "multi-link transmission" are corresponding, and P2P belongs to multi-link transmission.

[0099] Step S506, when the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table.

[0100] Specifically, the above step S506 includes:

[0101] Step S5061: divide the vulnerability patch package into several fragments based on a preset fragment data volume.

[0102] Step S5062, generate an index hash corresponding to each shard, map the index hash to each first node and publishing platform, and obtain the file storage node IP address corresponding to each shard.

[0103] Step S5063, based on the index hash and the file storage node IP address, generate the hash corresponding to each shard.

[0104] Step S5064: combine the hashes corresponding to all the shards to obtain a hash ring, reassemble to obtain a vulnerability patch package, and the remaining nodes store the hash ring and the vulnerability patch package in their own nodes.

[0105] In one example, since the fragmented acquisition method divides a large file into multiple smaller data blocks, when multiple nodes in the network have the file, different fragments can be transmitted in parallel, or the priority of downloading can be adjusted according to the network speed, thereby improving the speed and efficiency of file transmission. Files are generally divided into multiple data blocks according to a specific size (such as 4096 or more). Each data block will be assigned a unique identifier (index hash) so that it can be identified and reassembled during the transmission process. Among them, during transmission and reassembly, the P2P component parses the hash ring to obtain the identifier (key) of the target file and the IP (Value) of the file storage node, and obtains the file fragments from the corresponding IP. The P2P node will transmit the file fragments back to itself. At this time, it is necessary to verify the returned content. As mentioned above, the hash of the file index contains both the file name, the file fragment number, and the hash value of the fragment. This hash value is the basis for verification. Only after the verification is correct can it be reassembled to obtain the complete file. When the first patch is downloaded to the node in the intranet environment, expanding the patch to a P2P node network within the company becomes another important measure for its rapid distribution. And because the network is short when distributing quickly within the enterprise, it is not subject to operational bandwidth restrictions. The network speed can be as fast as the basic hardware equipment (such as network cables and switches) supports, which is more efficient.

[0106] Step S507: The publishing platform sends an update notification to the client. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0107] The security vulnerability patch distribution method provided in this embodiment transmits the vulnerability patch package in pieces to each node on the service side through a p2p network composed of several nodes and a publishing platform on the service side, so that the client can obtain the vulnerability patch package from the node slices on the service side. Compared with the existing vulnerability patch package transmission method, this transmission method consumes little server performance, and when there are multiple nodes in the intranet environment of the service side, the transmission efficiency is higher. The time for a vulnerability patch package to be distributed to each node can be calculated in seconds. Combined with the automatic repair function of the client, the time window of the nday vulnerability can be greatly reduced, thereby improving the security of the client environment. When there is no node in the p2p node group for other nodes to download the vulnerability patch package, the current node is added to the p2p node group as the first node, and the vulnerability patch package is downloaded to the node through a direct link transmission method, so that other nodes can connect to the first node for subsequent fragment download. By obtaining vulnerability patch packages in a sharded manner, nodes do not need to obtain vulnerability patch packages from the publishing platform, which reduces the pressure on the publishing platform and expands the bandwidth of the publishing platform. As a result, the latest vulnerability patch packages can be obtained more quickly after the vulnerability patch packages are updated. At the same time, the time consumed by the client to obtain the vulnerability patch packages is greatly reduced, the transmission efficiency is higher, and the security of the client is further guaranteed.

[0108] In this embodiment, a method for distributing security vulnerability patches is provided, which can be used in the above-mentioned mobile terminals, such as mobile phones, tablet computers, etc. Figure 6 FIG. 1 is a flow chart of another method for distributing security vulnerability patches according to an embodiment of the present invention. Figure 6 As shown, the process includes the following steps:

[0109] Step S601, in response to the update notification, obtain the updated distributed hash table. Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0110] In an embodiment of the present invention, the updated distributed hash table obtains vulnerabilities and vulnerability patch packages corresponding to the vulnerabilities for the service side; the vulnerability patch package is sent to the publishing platform, and the file information and hash value corresponding to the vulnerability patch package are generated through the publishing platform; based on the file information and the hash value, a distributed hash table is generated; it is determined whether there is information about the first node in the distributed hash table, and the first node is a node with a vulnerability patch package in a peer-to-peer network node group; when the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform in a sharded manner based on the distributed hash table, and the node information of the remaining nodes is added to the distributed hash table to obtain the vulnerability patch package.

[0111] Step S602: Based on the updated distributed hash table, determine whether there is an available node on the service side.

[0112] In the embodiment of the present invention, the available node is a node that has a vulnerability patch package and a transmission rate between the node and the client is greater than a preset threshold.

[0113] In one example, the available node is determined by the connectivity test. If the transmission rate is slow, it switches to the next node. The connectivity test is the time statistics for downloading a certain file fragment. Since files in P2P are stored in multiple nodes, theoretically, file fragments can be obtained from any node. After a file fragment is transmitted, the transmission rate is calculated by time. When the rate is too low, it will try to traverse the hash ring and find the next node to obtain the fragment, thereby finding the most "convenient" available node to obtain the file. This process realizes the load balancing function in the network at a macro level.

[0114] Step S603: When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available node and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

[0115] Step S604: when there is no available node, obtain the vulnerability patch package from the publishing platform.

[0116] Step S605, determining whether the current client agrees to join the client peer network node group.

[0117] Step S606, when the current client agrees to join the client peer network node group, the current client is determined as one of the nodes of the client peer network node group, so that other clients in the client peer network node group download the vulnerability patch package of the current client.

[0118] The security vulnerability patch distribution method provided in this embodiment is that the client obtains the vulnerability patch package in a sharded manner from each available node on the server side that can obtain the vulnerability patch package. The transmission speed is fast and the transmission efficiency is higher. Combined with the automatic repair of the client, the vulnerability repair is achieved at the fastest speed, which improves the security of the client environment. When other nodes on the server side are not transmitting, since only the publishing platform has the vulnerability patch package at this moment, the vulnerability patch package can only be obtained through the publishing platform. In other cases, in order to ensure that the bandwidth of the publishing platform is not additionally occupied, the client obtains the vulnerability patch package from the available node on the service side. When the current client agrees to join the client peer-to-peer network node group, it means that the client can use its own node as one of the client P2P transmission nodes for other nodes in the client's intranet to download. Although it is beneficial to the overall file distribution on the client side, for the consideration of customer traffic protection and security strategy, it is only recommended to open it when there are other vulnerability clients in the client's own LAN that need to be obtained. At this time, multiple nodes on the client's intranet can use the client P2P to obtain file fragments nearby to improve transmission efficiency.

[0119] The embodiment of the present invention also provides a computer device. Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0120] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0121] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0122] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0124] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0125] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0126] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0127] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0128] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for distributing security vulnerability patches, characterized in that: Applied to a service side, the service side includes a peer-to-peer network node group consisting of a publishing platform and a plurality of nodes, the method includes: Obtain the vulnerability and the vulnerability patch package corresponding to the vulnerability; Sending the vulnerability patch package to the publishing platform, and generating file information and a hash value corresponding to the vulnerability patch package through the publishing platform; Based on the file information and the hash value, generate a distributed hash table; Determine whether there is information of a first node in the distributed hash table, where the first node is a node in the peer-to-peer network node group that has the vulnerability patch package; When the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table; The publishing platform sends an update notification to the client, so that the client responds to the update notification and obtains the updated distributed hash table; based on the updated distributed hash table, it is determined whether there is an available node on the service side, and the available node is a node that has the vulnerability patch package and the transmission rate between the client and the client is greater than a preset threshold; when there is an available node on the service side, the shard obtains the vulnerability patch package from the available node, and uses the vulnerability patch package to perform a repair patch or vulnerability update notification.

2. The method according to claim 1, characterized in that: When the information of the first node does not exist in the distributed hash table, the vulnerability patch package is obtained from the publishing platform through a direct link transmission method using the current node in the peer network node group, and the current node is updated to the first node, and the node information of the current node itself is added to the distributed hash table, and the step of determining whether the information of the first node exists in the distributed hash table is returned.

3. The method according to claim 1, characterized in that The remaining nodes obtain the vulnerability patch package in a sharded manner, including: Dividing the vulnerability patch package into a number of shards based on a preset shard data volume; Generate an index hash corresponding to each of the shards, map the index hash to each of the first nodes and the publishing platform, and obtain an IP address of a file storage node corresponding to each of the shards; Based on the index hash and the file storage node IP address, generate a hash corresponding to each of the shards; The hashes corresponding to all the shards are combined to obtain a hash ring, which is reassembled to obtain the vulnerability patch package, and the remaining nodes store the hash ring and the vulnerability patch package in each node itself.

4. A method for distributing security vulnerability patches, characterized in that: Applied to a client, the method comprises: In response to the update notification, an updated distributed hash table is obtained, wherein the updated distributed hash table is used by the service side to obtain the vulnerability and the vulnerability patch package corresponding to the vulnerability; the vulnerability patch package is sent to the publishing platform, and the file information and hash value corresponding to the vulnerability patch package are generated through the publishing platform; a distributed hash table is generated based on the file information and the hash value; it is determined whether there is information of a first node in the distributed hash table, wherein the first node is a node having the vulnerability patch package in a peer-to-peer network node group; when the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform in a sharded manner based on the distributed hash table, and the node information of the remaining nodes is added to the distributed hash table to obtain the patch package; Based on the updated distributed hash table, determine whether there is an available node on the service side, where the available node is a node that has the vulnerability patch package and whose transmission rate with the client is greater than a preset threshold; When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available nodes, and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

5. The method according to claim 4, characterized in that When there is no available node, the vulnerability patch package is obtained from the publishing platform.

6. The method according to claim 4, characterized in that The method further comprises: Determine whether the current client agrees to join the client peer network node group; When the current client agrees to join the client peer network node group, the current client is determined as one of the nodes of the client peer network node group, so that other clients in the client peer network node group download the vulnerability patch package of the current client.

7. A security vulnerability patch distribution system, characterized in that: The system includes a service side and a client, wherein the service side includes a peer-to-peer network node group consisting of a publishing platform and several nodes: The service side obtains a vulnerability and a vulnerability patch package corresponding to the vulnerability; Sending the vulnerability patch package to the publishing platform, and generating file information and a hash value corresponding to the vulnerability patch package through the publishing platform; Based on the file information and the hash value, generate a distributed hash table; Determine whether there is information of a first node in the distributed hash table, where the first node is a node in the peer-to-peer network node group that has the vulnerability patch package; When the information of the first node exists in the distributed hash table, the remaining nodes obtain the vulnerability patch package from the first node and the publishing platform based on the distributed hash table in a sharded manner, and add the node information of the remaining nodes to the distributed hash table to obtain an updated distributed hash table; The publishing platform sends an update notification to the client; The client obtains the updated distributed hash table in response to the update notification; Based on the updated distributed hash table, determining whether there is an available node on the service side, the available node being a node having the vulnerability patch package and a transmission rate between the node and the client being greater than a preset threshold; When there are available nodes on the service side, the shard obtains the vulnerability patch package from the available nodes, and uses the vulnerability patch package to perform repair patches or vulnerability update notifications.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the security vulnerability patch distribution method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the security vulnerability patch distribution method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the security vulnerability patch distribution method according to any one of claims 1 to 6.

Images