Product tracing method, related device, equipment and storage medium

Abstract

The invention discloses a product tracing method, a related device, equipment and a storage medium, and the method comprises the steps: obtaining first fingerprint information generated based on the construction domain details of an existing product; in response to a target process detected in the production environment by calling the probe program, obtaining a target folder of an existing product to which the target process belongs in the production environment, and generating second fingerprint information of the existing product based on the target folder of the existing product; comparing the first fingerprint information of the existing product with the second fingerprint information to obtain a tracing result; wherein any one piece of fingerprint information comprises the data fingerprint of each level of path, the data fingerprint of any level of path except the last level of path is generated by referring to the data fingerprint of the next level of path, and the tracing result at least comprises whether the existing product in the production environment is suspected to be tampered or not. According to the scheme, whether the product is suspected to be tampered or not can be timely and accurately found after the product is released online.

Description

Technical Field

[0001] The present application relates to the technical field of product management, and in particular to a product tracing method and related devices, equipment and storage media. Background Art

[0002] Companies in the Internet and other related fields often produce a large number of products, such as program packages, middleware, etc., during their R&D work. Some products will be deployed to the production environment later, and if there are problems, it will cause significant losses, so it is necessary to prevent and promptly discover problems with products.

[0003] At present, existing technologies are often based on devops and cicd systems for control, which can only ensure the relative accuracy of product release exports. However, after the product is released, if there are modifications made by operation and maintenance, R&D personnel, or if hackers launch network attacks on the product, causing problems with the product, the existing technology will not be able to identify it. In view of this, how to promptly and accurately detect whether the product is suspected of tampering after it is released has become an urgent problem to be solved. Summary of the invention

[0004] The main technical problem solved by the present application is to provide a product traceability method and related devices, equipment, systems and storage media, which can promptly and accurately detect whether a product is suspected of being tampered with after the product is released online.

[0005] In order to solve the above technical problems, the first aspect of the present application provides a product tracing method, including: obtaining first fingerprint information generated based on the construction domain details of an existing product; in response to calling a probe program to detect a target process in a production environment, obtaining a target folder of an existing product to which the target process belongs in the production environment, and generating second fingerprint information of the existing product based on the target folder of the existing product; comparing the first fingerprint information of the existing product with the second fingerprint information to obtain a tracing result; wherein any fingerprint information contains data fingerprints of paths at all levels, and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected of being tampered with.

[0006] In order to solve the above technical problems, the second aspect of the present application provides a product tracing device, including: a first acquisition module, a second acquisition module and a comparison and tracing module, the first acquisition module is used to acquire first fingerprint information generated based on the construction domain details of an existing product; the second acquisition module is used to detect a target process in a production environment in response to calling a probe program, acquire a target folder of an existing product belonging to the target process in the production environment, and generate second fingerprint information of the existing product based on the target folder of the existing product; the comparison and tracing module is used to compare the first fingerprint information of the existing product with the second fingerprint information to obtain a tracing result; wherein any fingerprint information contains data fingerprints of paths at all levels, and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected of being tampered with.

[0007] In order to solve the above technical problems, the third aspect of the present application provides an electronic device, which at least includes a memory and a processor coupled to each other, the memory at least stores program instructions, and the processor is used to execute the program instructions to implement the product traceability method in the above first aspect.

[0008] In order to solve the above technical problems, the fourth aspect of the present application provides a computer-readable storage medium storing program instructions that can be executed by a processor, and the program instructions are used to implement the product traceability method of the first aspect.

[0009] The above scheme obtains the first fingerprint information generated based on the construction domain details of the existing artifacts, responds to calling the probe program to detect the target process in the production environment, obtains the target folder of the existing artifacts to which the target process belongs in the production environment, and generates the second fingerprint information of the existing artifacts based on the target folder of the existing artifacts, and then compares the first fingerprint information of the existing artifacts with the second fingerprint information to obtain the tracing result, and any fingerprint information contains the data fingerprints of the paths at all levels, and the data fingerprint of any level path other than the final level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing artifacts in the production environment are suspected of being tampered with, so before the existing artifacts are released and launched, the first fingerprint information is first generated through the construction domain details, and after the release and launch, the process detection is performed through the probe program to lock the target folder of the existing artifacts to which the specific process belongs, and the second fingerprint information is generated accordingly, so as to compare the first fingerprint information with the second fingerprint information to realize the tracing of the existing artifacts in the production environment, and then after the product is released and launched, even if there are operations and maintenance, R&D and other personnel who modify it, or hackers attack the network and other situations that cause problems with the product, it is possible to timely and accurately find out whether the product is suspected of being tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1This is a flow chart of an embodiment of the product tracing method of the present application; Figure 2a This is a process diagram of an embodiment of the product tracing method of the present application; Figure 2b It is a schematic diagram of an embodiment of a product folder; Figure 3 It is a schematic diagram of the framework of an embodiment of the product tracing device of the present application; Figure 4 It is a schematic diagram of the framework of an embodiment of the electronic device of the present application; Figure 5 It is a schematic diagram of a framework of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0011] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0012] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0013] The terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the fragment " / " in this article generally indicates that the associated objects before and after are in an "or" relationship. In addition, "many" in this article means two or more than two.

[0014] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of the product tracing method of the present application. Specifically, it may include the following steps: Step S11: Obtain first fingerprint information generated based on the construction domain details of the existing product.

[0015] In the embodiments of the present disclosure, the existing products may include but are not limited to: program packages, middleware, etc., and the specific types of the existing products are not limited here.

[0016] In an implementation scenario, for easier understanding, please refer to Figure 2a , Figure 2a This is a schematic diagram of the process of an embodiment of the product tracing method of the present application. Figure 2aAs shown, in the development phase, R&D personnel can submit code to the code repository (such as git, etc.); in the construction phase, by pulling code from the code repository to implement pipeline construction (such as iBuild), products can be obtained, that is, as existing products, existing products can be stored in the enterprise product warehouse, or a business private product warehouse can be built; in the release phase, whether it is an enterprise product warehouse or a business private product warehouse, existing products can be released to the release platform (such as iDeploy) or to the manual. The difference is that existing products released to the release platform can be automatically released to the server, while existing products released to the manual need to be manually released to the server. Through the above process, the existing products can be deployed to the production environment.

[0017] In an implementation scenario, please continue to refer to Figure 2a In the build phase, you can get the build domain details such as the product package name, application name, and product folder. It should be noted that the product folder can contain files of all levels of existing products. Please refer to Figure 2b , Figure 2b Schematic diagram of an embodiment of a product folder. Figure 2b As shown in the figure, the service-thirdparty-interaction root directory contains three subfolders (bin, config, lib) and three files (application.yml, redis-setting.xml, zxlogback.xml). In addition, the three subfolders contain multiple files. Based on this, the first fingerprint information of the existing artifacts can be generated based on the artifact folders in the build domain details (such as Figure 2a The specific generation process of the first fingerprint information can refer to the following related description, which will not be repeated here.

[0018] In one implementation scenario, the first fingerprint information may be received and stored by the operation and maintenance system. Exemplarily, the operation and maintenance system may receive the first fingerprint information via a long link, and the specific manner in which the operation and maintenance system receives the first fingerprint information is not limited. In addition, the operation and maintenance system may specifically be iOPS, etc., and the specific selection of the operation and maintenance system is not limited.

[0019] Step S12: in response to calling the probe program to detect the target process in the production environment, obtaining a target folder of an existing artifact to which the target process belongs in the production environment, and generating second fingerprint information of the existing artifact based on the target folder of the existing artifact.

[0020] In an implementation scenario, the specific number of probe programs can be determined according to the number of processes in the production environment. For example, when the number of processes in the production environment is large, the specific number of probe programs can be correspondingly large; or, when the number of processes in the production environment is small, the specific number of probe programs can be correspondingly small. The specific number of probe programs is not limited here.

[0021] In an implementation scenario, the operation and maintenance system can collect and obtain the second fingerprint information through the probe program. Figure 2a In the running view of the release stage, you can obtain the product fingerprint, that is, the second fingerprint information.

[0022] In one implementation scenario, the probe program can be configured for process detection in the operation and maintenance system. Exemplarily, the blacklist and whitelist of the probe program can be configured in the operation and maintenance system. If a process (such as a product-related process) is in the blacklist of the probe program, the probe program can detect the process, that is, the process is then considered as the target process. Conversely, if a process (such as a system process in a production environment, which may specifically include but is not limited to root, etc.) is in the whitelist of the probe program, the probe program may not detect the process, that is, the process is not considered as the target process. In addition, the non-functional resource restriction configuration capability of the probe program can also be configured in the operation and maintenance system. Of course, the above examples are only a few possible examples of related configuration of the probe program in the operation and maintenance system, and the specific configuration of the probe program is not limited here.

[0023] In an implementation scenario, taking the production environment as a Linux environment as an example, after the probe program detects the target process in the production environment, it can query the target folder of the existing artifacts to which the target process belongs based on commands such as CWD (Change Working Directory). Of course, the above example is only a possible example of obtaining the target folder when the production environment is a Linux environment, and other situations will not be given one by one here.

[0024] In the disclosed embodiment, any of the above-mentioned first fingerprint information and second fingerprint information contains data fingerprints of paths at all levels (such as MD5, etc.), and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path. Specifically, a path node tree can be constructed based on the product folder, and the nodes in the path node tree represent the file paths of files or subfolders in the product folder, and the levels of the nodes in the path node tree and the levels of the file paths represented by the nodes in the product folder are consistent. On this basis, the data fingerprints of the nodes in the path node tree can be generated sequentially from bottom to top until the root node to obtain fingerprint information. It should be noted that when the product folder is obtained from the construction domain details, the fingerprint information is the first fingerprint information, and when the product folder is the target folder, the fingerprint information is the second fingerprint information. The above method can improve the accuracy of the fingerprint information by first constructing the path node tree and then generating the data fingerprint.

[0025] In an implementation scenario, the file path represented by the root node of the path node tree may be the root directory of the target folder, and the file directories represented by the leaf nodes of the path node tree may be the file directories of each file in the target folder. Figure 2b , the file directory of application.yml can be expressed as ". / application.yml", the file directory of startup.bat can be expressed as ". / bin / startup.bat", and other files or subfolders can be expressed in the same way, which will not be given examples here. Figure 2bThe target folder shown in the figure can form leaf nodes including: application.yml, service-thirdparty-interaction.pid, shutdown.sh, startup.bat, startup.sh, applicationContext_dubboProvider.xml, applicationContext_service.xml, activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, ZX-log-dubbo-filter-1.0.1022.jar, redis-setting.xml, zxlogback.xml, and service-thirdparty-interaction.pid. The node corresponding to the subfolder bin where the four files dparty-interaction.pid, shutdown.sh, startup.bat, and startup.sh are located is the parent node of the nodes corresponding to these four files. The node corresponding to the subfolder config where the two files applicationContext_dubboProvider.xml and applicationContext_service.xml are located is the parent node of the nodes corresponding to these two files. The node corresponding to the subfolder lib where the six files activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, and ZX-log-dubbo-filter-1.0.1022.jar are located is the parent node of the files corresponding to these six files. On this basis, the parent node of the nodes corresponding to the subfolders bin, config and lib, and the nodes corresponding to the three files application.yml, redis-setting.xml and zxlogback.xml is the root node. Figure 2b The target folder shown is a possible example of the path node tree constructed. When the target folder is in other situations, the path node tree can be deduced in the same way, and examples are not given one by one here.

[0026] In an implementation scenario, for ease of understanding, Figure 2b Taking the target folder shown in the figure as an example, the data fingerprint corresponding to application.yml can be recorded as A, the data fingerprint corresponding to service-thirdparty-interaction.pid can be recorded as B, the data fingerprint corresponding to shutdown.sh can be recorded as C, the data fingerprint corresponding to startup.bat can be recorded as D, the data fingerprint corresponding to startup.sh can be recorded as E, the data fingerprint corresponding to applicationContext_dubboProvider.xml can be recorded as F, the data fingerprint corresponding to applicationContext_service.xml can be recorded as G, and the data fingerprint corresponding to activation-1.1.jar can be recorded as The data fingerprint corresponding to aliyun-java-core-3.0.0.jar can be recorded as I, the data fingerprint corresponding to aliyun-java-sdk-wm-3.0.0-rcl-jar can be recorded as J, the data fingerprint corresponding to ZX-auth-service-api-1.0.1002.jar can be recorded as K, the data fingerprint corresponding to ZX-logback-monitor-1.0.1018.jar can be recorded as L, the data fingerprint corresponding to ZX-log-dubbo-filter-1.0.1022.jar can be recorded as M, the data fingerprint corresponding to redis-setting.xml can be recorded as N, and the data fingerprint corresponding to zxlogback.xml can be recorded as O. On this basis, the data fingerprint can be generated from bottom to top: the data fingerprint of the subfolder bin can be calculated by hash(BCDE), which can be recorded as BCDE; the data fingerprint of the subfolder config can be calculated by hash(FG), which can be recorded as FG; the data fingerprint of the subfolder lib can be calculated by hash(HIJKLM), which can be recorded as HIJKLM. On this basis, the data fingerprint of the root node can be generated from bottom to top, that is, calculated by hash(ANO+BCDE+FG+HIJKLM). Of course, the above example is only Figure 2b The target folder shown is a possible example of calculating fingerprint information. When the target folder is in other situations, the calculation process of fingerprint information can be deduced by analogy, and no examples are given here one by one.

[0027] Step S13: Compare the first fingerprint information of the existing product with the second fingerprint information to obtain a traceability result.

[0028] In the embodiment of the present disclosure, the traceability result at least includes whether an existing product in the production environment is suspected of being tampered with. As a possible example, in the case where the traceability result includes suspected tampering of an existing product in the production environment, the redundant result may also include the degree of tampering of the existing product. It should be noted that the higher the degree of tampering, the more the existing product has been tampered with, and conversely, the lower the degree of tampering, the less the existing product has been tampered with. In addition, in the embodiment of the present disclosure, "tampering" can not only include modifications to existing products by authorized personnel such as R&D personnel and operation and maintenance personnel, such as relevant personnel directly modifying existing products and redeploying them on the server without going through Figure 2a The product delivery flow shown may also include hackers and other unauthorized persons modifying existing products through network attacks, and there is no limitation on the possible persons who may carry out tampering.

[0029] In one implementation scenario, after obtaining the first fingerprint information and the second fingerprint information, a first comparison result between the data fingerprint of the top-level path in the first fingerprint information and the data fingerprint of the top-level path in the second fingerprint information can be obtained, and then based on the first comparison result, it is determined whether an existing product in the production environment is suspected of being tampered with. The above method directly compares the data fingerprint of the top-level path to determine whether an existing product in the production environment is suspected of being tampered with, which can improve the efficiency of determining whether tampering is suspected and reduce the complexity of determining whether tampering is suspected.

[0030] In a specific implementation scenario, Figure 2b As a possible example, suppose Figure 2b The config subfolder is modified and added after the existing product is deployed to the production environment. The data fingerprint of the top-level path in the first fingerprint information obtained during the construction phase can be recorded as hash(ANO+BCDE+HIJKLM), and the data fingerprint of the top-level path in the second fingerprint information can be recorded as hash(ANO+BCDE+FG+HIJKLM). Obviously, the first comparison results of the two are inconsistent. As another possible example, different from the above possible scenario, suppose Figure 2b The config subfolder and the files it contains are already present in the construction phase, so the data fingerprints of the top-level paths in the first fingerprint information and the second fingerprint information can be recorded as hash(ANO+BCDE+FG+HIJKLM), and it is obvious that the first comparison results of the two include the consistency. Of course, the above example is only a possible example in the actual application process. When the target folder is other possible situations, it can be deduced by analogy, and no more examples are given here.

[0031] In a specific implementation scenario, after obtaining the first comparison result, in response to the first comparison result including a comparison consistency, it can be determined that the existing products in the production environment have not been tampered with, such as in the second situation described above, it can be determined that the existing products in the production environment have not been tampered with; conversely, in response to the first comparison result including a comparison inconsistency, it can be determined that the existing products in the production environment are suspected of being tampered with, such as in the first situation described above, it can be determined that the existing products in the production environment are suspected of being tampered with. In the above manner, by comparing whether the fingerprint data of the top-level path is consistent, it can be determined whether the existing products in the production environment are suspected of being tampered with, which can improve the efficiency of determining whether tampering is suspected and reduce the complexity of determining whether tampering is suspected.

[0032] In one implementation scenario, as mentioned above, in the case where an existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product suspected of being tampered with, then each secondary path of the top-level path can be selected as the current path respectively, and it is detected whether the current path is the final path, and the second comparison result between the data fingerprint of the current path in the first fingerprint information and the data fingerprint of the current path in the second fingerprint information is obtained. On this basis, in response to the current path being the final path, it can be determined based on the second comparison result whether to increase the current value of the degree of tampering, and in response to the current path not being the final path, it can be determined based on the second comparison result whether to continue to select the secondary path of the current path as the new current path, so as to return to the step of detecting whether the current path is the final path. In the above method, fingerprint comparison is performed path by path starting from the top-level path, and the degree of tampering is updated according to the comparison result when the final path is compared, and whether to expand the next level path is determined according to the comparison result when the final path is not compared. On the one hand, the efficiency of fingerprint comparison can be improved, and on the other hand, the accuracy of the degree of tampering can be improved.

[0033] In a specific implementation scenario, Figure 2b Taking the product folder as an example, the top-level path is the root directory, and the sub-paths under the top-level path may include: ". / application.yml", ". / bin", ". / config", ". / lib", ". / redis-setting.xml", ". / zxlogback.xml". Of course, the above example is only a possible example in the actual application process. In other cases, it can be deduced by analogy, and no examples are given here one by one.

[0034] In a specific implementation scenario, Figure 2bTaking the product folder shown as an example, when the secondary path ". / application.yml" is selected as the current path, it is detected that the current path ". / application.yml" is the final path, and the second comparison result between the data fingerprint A of the current path ". / application.yml" in the first fingerprint information and the data fingerprint A of the current path in the second fingerprint information includes a comparison consistency; or, as mentioned above, when ". / config" is added by the relevant personnel after the construction, when ". / config" is selected as the current path, it is detected that the current path ". / config" is not the final path, and the data fingerprint of the current path ". / config" in the first fingerprint information (since there is no current path ". / config" during the construction, the data fingerprint can be expressed as empty) and the data fingerprint FG of the current path in the second fingerprint information The second comparison result includes a comparison inconsistency. Of course, the above examples are only two possible examples in the actual application process, and do not limit other situations that may occur in the actual application process. Examples are not given one by one here.

[0035] In a specific implementation scenario, when the current path is the final path, after obtaining the second comparison result, in response to the second comparison result including a comparison consistency, it can be determined to maintain the current numerical value of the tampering degree, and in response to the second comparison result including a comparison inconsistency, it can be determined to increase the current numerical value of the tampering degree. Exemplarily, the initial numerical value of the tampering degree can be set to 0, 10, 20, etc., and the specific size of the initial numerical value is not limited here. In addition, each time the current numerical value of the tampering degree is increased, it can be increased by 1, 5, 10, etc., and each increase in the numerical value is not limited here. In the above method, when the second comparison result is a comparison consistency or a comparison inconsistency, the current numerical value is maintained or increased, respectively, that is, in the comparison process, each time the data fingerprint inconsistency is found in the final path, the tampering degree is numerically accumulated, which helps to improve the accuracy of the tampering degree.

[0036] In a specific implementation scenario, when the current path is not the final path, after obtaining the second comparison result, in response to the second comparison result including a consistent comparison, it can be determined not to continue to select the secondary path of the current path as the new current path, that is, the fingerprint comparison of the secondary path of the current path will not be continued subsequently, and in response to the second comparison result including a inconsistent comparison, it can be determined to continue to select the secondary path of the current path as the new current path, that is, the fingerprint comparison of the secondary path of the current path needs to be continued subsequently. In the above method, when the current path is not the final path, whether to continue to perform fingerprint comparison on the secondary path of the current path is determined based on whether the fingerprint comparison is consistent, and fingerprint comparison can be performed path by path, which helps to improve the efficiency of fingerprint comparison, and thus improve the efficiency of obtaining the degree of tampering.

[0037] In a specific implementation scenario, Figure 2bTaking the product folder shown in the figure and ". / config" being added by relevant personnel after the build as an example, when the data fingerprint comparison of the root directory is inconsistent, you can select the secondary path of the root directory: ". / application.yml", ". / bin", ". / config", ". / lib", ". / redis-setting.xml", ". / zxlogback.xml" as the current path respectively. When ". / application.yml" is selected as the current path, since it is the final path and the fingerprint comparison is consistent, the current value of the tampering degree can be maintained (it is still the initial value 0 at this time); when ". / bin" is selected as the current path, since it is not the final path and the fingerprint comparison is consistent, the secondary path of the current path ". / bin" can no longer be selected as the new current path; when ". / lib" is selected as the current path, since it is not the final path and the fingerprint comparison is consistent, the secondary path of the current path ". / lib" can no longer be selected as the new current path; when ". / redis-setting.xml" is selected as the current path, since it is the final path and the fingerprint comparison is consistent, the secondary path of the current path ". / redis-setting.xml" can be selected as the current path, since it is the final path and the fingerprint comparison is consistent. To maintain the current value of the tampering degree (still the initial value 0 at this time); when ". / zxlogback.xml" is selected as the current path, since it is the final path and the fingerprint comparison is consistent, the current value of the tampering degree can be maintained (still the initial value 0 at this time); when ". / config" is selected as the current path, since it is not the final path and the fingerprint comparison is inconsistent, its secondary paths ". / config / applicationContext_dubboProvider.xml" and ". / config / applicationContext_service.xml" can be selected as the new current paths respectively, and return to the aforementioned step of detecting whether the current path is the final path. When ". / config / applicationContext_dubboProvider.xml" is selected as the new current path, since the new current path is the final path and the fingerprint comparison is inconsistent, the current value of the tampering degree can be increased (for example, by 1, 5, 10, etc.), and when ". / config / applicationContext_service.xml" is selected as the new current path, since the new current path is the final path and the fingerprint comparison is inconsistent, the current value of the tampering degree can be increased again (for example, by 1, 5, 10, etc.), and the fingerprint comparison process can be ended to determine the tampering degree. Of course, the above example is only based on Figure 2bThe product folder shown is a possible example of fingerprint matching. When the product folder is in other situations, the same can be applied and no further examples are given here.

[0038] In an implementation scenario, as mentioned above, in the case where an existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product suspected of being tampered with. The specific process can refer to the above-mentioned related description, which will not be repeated here. In this case, after obtaining the traceability result, the similarity between the existing product in the construction stage and the operation stage can be obtained based on the degree of tampering of the existing product suspected of being tampered with, and then whether to report the traceability result is determined based on whether the similarity meets the preset conditions. As a possible example, as mentioned above, the operation and maintenance system can receive and store the first fingerprint information, the operation and maintenance system can collect and obtain the second fingerprint information through the probe program, and the repeated result can be reported to the operation and maintenance system. It should be noted that in addition to the above-mentioned tampering degree, the traceability result can also further include the product package name, the server where it is released, etc., and the specific content of the traceability result is not limited here. In the above method, the similarity between the existing product in the construction stage and the operation stage is determined by the degree of tampering, and whether to report the traceability result is determined based on whether the similarity meets the preset conditions, and the traceability result can be reported in time according to the similarity between the construction stage and the operation stage.

[0039] In a specific implementation scenario, the degree of tampering and the degree of similarity may be in a negative correlation, that is, the higher the degree of tampering, the lower the degree of similarity, and vice versa, the lower the degree of tampering, the higher the degree of similarity. The specific functional relationship between the degree of tampering and the degree of similarity is not limited here. Exemplarily, the degree of tampering and the degree of similarity may be specifically a linear function, etc., which will not be given one by one here.

[0040] In a specific implementation scenario, the preset condition can be set to a similarity level lower than a preset threshold (e.g., 95%, 90%, etc.). In this case, if the similarity level meets the preset condition, it can be determined to report the tracing result; conversely, if the similarity level does not meet the preset condition, it can be determined not to report the tracing result. Of course, the preset threshold can also be set to 100%, that is, as long as the similarity level is lower than 100%, the tracing result will be reported.

[0041] In a specific implementation scenario, if multiple target processes are detected in the server and the similarity between the build phase and the run phase is not less than a preset threshold, it can be determined that the existing products to which these target processes belong are different versions of the same existing product. In this case, the tracing results corresponding to these target processes can also be reported to the operation and maintenance system, so that the administrator of the operation and maintenance system can handle it, such as stopping the running of the old version, etc., which is not limited here.

[0042] The above scheme obtains the first fingerprint information generated based on the construction domain details of the existing artifacts, responds to calling the probe program to detect the target process in the production environment, obtains the target folder of the existing artifacts to which the target process belongs in the production environment, and generates the second fingerprint information of the existing artifacts based on the target folder of the existing artifacts, and then compares the first fingerprint information of the existing artifacts with the second fingerprint information to obtain the tracing result, and any fingerprint information contains the data fingerprints of the paths at all levels, and the data fingerprint of any level path other than the final level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing artifacts in the production environment are suspected of being tampered with, so before the existing artifacts are released and launched, the first fingerprint information is first generated through the construction domain details, and after the release and launch, the process detection is performed through the probe program to lock the target folder of the existing artifacts to which the specific process belongs, and the second fingerprint information is generated accordingly, so as to compare the first fingerprint information with the second fingerprint information to realize the tracing of the existing artifacts in the production environment, and then after the product is released and launched, even if there are operations and maintenance, R&D and other personnel who modify it, or hackers attack the network and other situations that cause problems with the product, it is possible to timely and accurately find out whether the product is suspected of being tampered with.

[0043] See also Figure 3 , Figure 3 It is a schematic diagram of the framework of an embodiment of the product tracing device of the present application. The product tracing device 30 includes: a first acquisition module 31, a second acquisition module 32 and a comparison and tracing module 33, the first acquisition module 31 is used to obtain the first fingerprint information generated based on the construction domain details of the existing product; the second acquisition module 32 is used to detect the target process in the production environment in response to calling the probe program, obtain the target folder of the existing product belonging to the target process in the production environment, and generate the second fingerprint information of the existing product based on the target folder of the existing product; the comparison and tracing module 33 is used to compare the first fingerprint information of the existing product with the second fingerprint information to obtain the tracing result; wherein any fingerprint information contains the data fingerprint of each level of path, and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected of tampering.

[0044] In the above scheme, the product tracing device 30 obtains the first fingerprint information generated based on the construction domain details of the existing product, responds to calling the probe program to detect the target process in the production environment, obtains the target folder of the existing product belonging to the target process in the production environment, and generates the second fingerprint information of the existing product based on the target folder of the existing product, and then compares the first fingerprint information of the existing product with the second fingerprint information to obtain the tracing result, and any fingerprint information contains the data fingerprints of the paths at all levels, and the data fingerprint of any level path other than the final level path is generated by referring to the data fingerprint of the next level path. The tracing result at least includes whether the existing product in the production environment is suspected of being tampered with, so before the existing product is released and launched, the first fingerprint information is first generated through its construction domain details, and after the release and launch, the process detection is performed through the probe program to lock the target folder of the existing product belonging to the specific process, and the second fingerprint information is generated accordingly, so as to compare the first fingerprint information and the second fingerprint information in combination to realize the tracing of the existing products in the production environment, and then after the product is released and launched, even if there are operations and maintenance, R&D personnel and other personnel modify it, or hackers attack the network and other situations cause problems with the product, it can be timely and accurately discovered whether the product is suspected of being tampered with.

[0045] In some disclosed embodiments, the comparison and tracing module 33 includes a first comparison submodule, which is used to obtain a first comparison result between the data fingerprint of the top-level path in the first fingerprint information and the data fingerprint of the top-level path in the second fingerprint information; the comparison and tracing module 33 includes a tampering determination submodule, which is used to determine whether an existing product in the production environment is suspected of being tampered with based on the first comparison result.

[0046] In some disclosed embodiments, the tampering determination submodule includes a first determination unit for determining that an existing product in the production environment has not been tampered with in response to the first comparison result including a consistent comparison; the tampering determination submodule includes a second determination unit for determining that an existing product in the production environment is suspected of being tampered with in response to the first comparison result including an inconsistent comparison.

[0047] In some disclosed embodiments, in the case where an existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product suspected of being tampered with, and the comparison and tracing module 33 includes a path selection submodule, which is used to select each secondary path of the top-level path as the current path respectively; the comparison and tracing module 33 includes a second comparison submodule, which is used to detect whether the current path is a final path, and obtain a second comparison result between the data fingerprint of the current path in the first fingerprint information and the data fingerprint of the current path in the second fingerprint information; the comparison and tracing module 33 includes a first execution submodule, which is used to determine whether to increase the current value of the degree of tampering based on the second comparison result in response to the current path being the final path; the comparison and tracing module 33 includes a second execution submodule, which is used to determine whether to continue to select the secondary path of the current path as the new current path based on the second comparison result in response to the current path not being the final path, so as to return to the step of detecting whether the current path is the final path.

[0048] In some disclosed embodiments, the first execution submodule includes a numerical value maintaining unit for determining to maintain a current numerical value of the degree of tampering in response to the second comparison result including a consistent comparison; the first execution submodule includes a numerical value increasing unit for determining to increase the current numerical value of the degree of tampering in response to the second comparison result including a inconsistent comparison.

[0049] In some disclosed embodiments, the second execution submodule includes a stop selection unit for determining, in response to the second comparison result including a comparison consistency, to no longer continue to select the secondary path of the current path as the new current path; the second execution submodule includes a continue selection unit for determining, in response to the second comparison result including a comparison inconsistency, to continue to select the secondary path of the current path as the new current path.

[0050] In some disclosed embodiments, the product traceability device 30 includes a node tree construction module, which is used to construct a path node tree based on a product folder; wherein the nodes in the path node tree represent the file paths of files or subfolders in the product folder, and the levels of the nodes in the path node tree and the levels of the file paths represented by the nodes in the product folder are consistent; the product traceability device 30 includes a fingerprint generation module, which is used to generate data fingerprints of the nodes in the path node tree from bottom to top until the root node, to obtain fingerprint information; wherein, when the product folder is obtained from the construction domain details, the fingerprint information is the first fingerprint information, and when the product folder is the target folder, the fingerprint information is the second fingerprint information.

[0051] In some disclosed embodiments, in the case where an existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product. The product traceability device 30 includes a similarity measurement module for obtaining the degree of similarity between the existing product in the construction stage and the operation stage based on the degree of tampering of the existing product. The product traceability device 30 includes a traceability reporting module for determining whether to report the traceability result based on whether the degree of similarity meets a preset condition.

[0052] In some disclosed embodiments, the operation and maintenance system receives and stores the first fingerprint information, the operation and maintenance system collects and obtains the second fingerprint information through a probe program, and reports the tracing result to the operation and maintenance system.

[0053] See also Figure 4 , Figure 4 It is a schematic diagram of the framework of an embodiment of an electronic device of the present application. The electronic device 40 includes at least a memory 41 and a processor 42 coupled to each other, the memory 41 stores at least program instructions, and the processor 42 is used to execute the program instructions to implement the steps in any of the above-mentioned product tracing method embodiments. For details, please refer to the aforementioned disclosed embodiments, which will not be repeated here. As a possible example, the electronic device 40 may include but is not limited to a server, etc., and the specific type of the electronic device 40 is not limited here.

[0054] Specifically, the processor 42 is used to control itself and the memory 41 to implement the steps in any of the above-mentioned product traceability method embodiments. The processor 42 can also be called a CPU (Central Processing Unit). The processor 42 may be an integrated circuit chip with signal processing capabilities. The processor 42 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 42 can be implemented by an integrated circuit chip.

[0055] In the above scheme, the electronic device 40 obtains the first fingerprint information generated based on the construction domain details of the existing product, and in response to calling the probe program to detect the target process in the production environment, obtains the target folder of the existing product to which the target process belongs in the production environment, and generates the second fingerprint information of the existing product based on the target folder of the existing product, and then compares the first fingerprint information of the existing product with the second fingerprint information to obtain the tracing result, and any fingerprint information contains the data fingerprints of the paths at all levels, and the data fingerprint of any level path other than the final level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected of being tampered with, so before the existing product is released and launched, the first fingerprint information is first generated through its construction domain details, and after the release and launch, the process detection is performed through the probe program to lock the target folder of the existing product to which the specific process belongs, and the second fingerprint information is generated accordingly, so as to compare the first fingerprint information with the second fingerprint information to realize the tracing of the existing products in the production environment, and then after the product is released and launched, even if there are operations and maintenance, R&D and other personnel who modify it, or hackers attack the network and other situations that cause problems with the product, it can be timely and accurately discovered whether the product is suspected of being tampered with.

[0056] See also Figure 5 , Figure 5 1 is a schematic diagram of a framework of an embodiment of a computer-readable storage medium 50 of the present application. The computer-readable storage medium 50 stores program instructions 51 that can be executed by a processor, and the program instructions 51 are used to implement the steps in any of the above product traceability method embodiments.

[0057] In the above scheme, the computer-readable storage medium 50 obtains the first fingerprint information generated based on the construction domain details of the existing artifact, and in response to calling the probe program to detect the target process in the production environment, obtains the target folder of the existing artifact to which the target process belongs in the production environment, and generates the second fingerprint information of the existing artifact based on the target folder of the existing artifact, and then compares the first fingerprint information of the existing artifact with the second fingerprint information to obtain the tracing result, and any fingerprint information contains the data fingerprints of the paths at all levels, and the data fingerprint of any level path other than the final level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing artifact in the production environment is suspected of being tampered with, so before the existing artifact is released and launched, the first fingerprint information is first generated through its construction domain details, and after the release and launch, the process detection is performed through the probe program to lock the target folder of the existing artifact to which the specific process belongs, and the second fingerprint information is generated accordingly, so as to combine the first fingerprint information and the second fingerprint information for comparison to achieve the tracing of the existing artifact in the production environment, and then after the product is released and launched, even if there are modifications made by operation and maintenance, R&D personnel, or hackers attack the network, etc., causing problems with the product, it is possible to timely and accurately find out whether the product is suspected of being tampered with.

[0058] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0059] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0060] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0061] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0062] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0063] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0064] If the technical solution of this application involves personal information, the product using the technical solution of this application has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using the technical solution of this application has obtained the individual's separate consent before processing the sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, clear and prominent signs are set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that he or she agrees to the collection of his or her personal information; or on the device that processes personal information, the personal information processing rules are notified by obvious signs / information, and the individual's authorization is obtained through pop-up information or by asking the individual to upload his or her personal information; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

Claims

1. A product tracing method, characterized in that: include: Obtaining first fingerprint information generated based on the construction domain details of the existing product; In response to calling the probe program to detect a target process in a production environment, obtaining a target folder of the existing artifact to which the target process belongs in the production environment, and generating second fingerprint information of the existing artifact based on the target folder of the existing artifact; The first fingerprint information and the second fingerprint information of the existing product are compared to obtain a traceability result; wherein any fingerprint information contains data fingerprints of paths at each level, and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path, and the traceability result at least includes whether the existing product in the production environment is suspected of being tampered with.

2. The method according to claim 1, characterized in that The comparing the first fingerprint information based on the existing product with the second fingerprint information to obtain the tracing result includes: Obtaining a first comparison result between the data fingerprint of the top-level path in the first fingerprint information and the data fingerprint of the top-level path in the second fingerprint information; Based on the first comparison result, determine whether the existing product in the production environment is suspected of being tampered with.

3. The method according to claim 2, characterized in that The determining, based on the first comparison result, whether the existing product in the production environment is suspected of being tampered with comprises at least one of the following: In response to the first comparison result including a comparison consistency, determining that the existing product in the production environment has not been tampered with; In response to the first comparison result including a comparison inconsistency, it is determined that the existing product in the production environment is suspected of being tampered with.

4. The method according to claim 1, characterized in that: In the case where the existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product. The traceability result obtained by comparing the first fingerprint information and the second fingerprint information of the existing product also includes: Select each sub-path of the top-level path as the current path; Detecting whether the current path is the final path, and obtaining a second comparison result between the data fingerprint of the current path in the first fingerprint information and the data fingerprint of the current path in the second fingerprint information; In response to the current path being the final path, determining whether to increase the current value of the tampering degree based on the second comparison result; In response to the current path not being the final path, based on the second comparison result, determining whether to continue selecting a secondary path of the current path as a new current path, so as to return to the step of detecting whether the current path is the final path.

5. The method according to claim 4, characterized in that The determining whether to increase the current value of the tampering degree based on the second comparison result includes at least one of the following: In response to the second comparison result including a comparison agreement, determining to maintain the current value of the tampering degree; In response to the second comparison result including a comparison inconsistency, it is determined to increase the current value of the tampering degree.

6. The method according to claim 4, characterized in that The determining, based on the second comparison result, whether to continue selecting the secondary path of the current path as the new current path includes at least one of the following: In response to the second comparison result including a consistent comparison, determining not to continue selecting the secondary path of the current path as the new current path; In response to the second comparison result including a comparison inconsistency, it is determined to continue selecting a secondary path of the current path as the new current path.

7. The method according to claim 1, characterized in that The step of generating the fingerprint information comprises: Based on the artifact folder, a path node tree is constructed; wherein the nodes in the path node tree represent the file paths of the files or subfolders in the artifact folder, and the levels of the nodes in the path node tree and the file paths represented by the nodes are consistent with the levels in the artifact folder; Generate data fingerprints of the nodes in the path node tree from bottom to top until the root node, and obtain the fingerprint information; wherein, when the product folder is obtained from the construction domain details, the fingerprint information is the first fingerprint information, and when the product folder is the target folder, the fingerprint information is the second fingerprint information.

8. The method according to claim 1, characterized in that In the case where the existing product is suspected of being tampered with, the traceability result also includes the degree of tampering of the existing product. After the first fingerprint information based on the existing product is compared with the second fingerprint information to obtain the traceability result, it includes: Based on the degree of tampering of the existing artifact suspected of tampering, obtain the degree of similarity between the existing artifact in the construction phase and the operation phase; Whether to report the tracing result is determined based on whether the similarity level meets a preset condition.

9. The method according to any one of claims 1 to 8, characterized in that: The operation and maintenance system receives and stores the first fingerprint information, the operation and maintenance system collects and obtains the second fingerprint information through the probe program, and the tracing result is reported to the operation and maintenance system.

10. A product tracing device, characterized in that: include: A first acquisition module, used to acquire first fingerprint information generated based on the construction domain details of an existing product; A second acquisition module is configured to, in response to calling the probe program to detect a target process in a production environment, acquire a target folder of an existing artifact to which the target process belongs in the production environment, and generate second fingerprint information of the existing artifact based on the target folder of the existing artifact; A comparison and tracing module is used to compare the first fingerprint information and the second fingerprint information of the existing product to obtain a tracing result; wherein any fingerprint information contains data fingerprints of paths at all levels, and the data fingerprint of any level path other than the last level path is generated by referring to the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected of being tampered with.

11. An electronic device, characterized in that: The system comprises at least a memory and a processor coupled to each other, wherein the memory at least stores program instructions, and the processor is used to execute the program instructions to implement the product traceability method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: Program instructions that can be executed by a processor are stored, and the program instructions are used to implement the product traceability method according to any one of claims 1 to 9.

Images