Article traceability method and related apparatus, device, and storage medium

Abstract

The application discloses a product traceability method and related devices, equipment and storage media, wherein the product traceability method comprises: obtaining first fingerprint information generated based on a construction domain detail of an existing product; in response to a target process being detected in a production environment by calling a probe program, obtaining a target folder of the existing product to which the target process belongs, and generating second fingerprint information of the existing product based on the target folder of the existing product; comparing the first fingerprint information and the second fingerprint information of the existing product to obtain a traceability result; wherein any fingerprint information contains data fingerprints of paths at all levels, and the data fingerprints of any path at a level other than the last level are generated based on the data fingerprints of the next level, and the traceability result at least includes whether the existing product in the production environment is suspected of being tampered with. The above scheme can timely and accurately determine whether the product is suspected of being tampered with after the product is released online.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of product management, and in particular to a product tracing method and related device, equipment and storage medium. BACKGROUND

[0002] In the research and development work of Internet-related enterprises, a large number of products such as program packages and middleware are often formed. Some products will be deployed to the production environment in the future, and if there is a problem, it will cause significant losses, so it is necessary to prevent and timely find the problems existing in the products.

[0003] At present, the existing technology often controls based on the devops and cicd systems, and these methods can only ensure the relative accuracy of the product release export. However, if the product is modified by the operation and development personnel after being released online, or the product is attacked by hackers, the existing technology will not be able to identify the problem. Therefore, how to timely and accurately find out whether the product is suspected to be tampered with after being released online has become a problem to be solved. SUMMARY

[0004] The technical problem solved by the present application is to provide a product tracing method and related device, equipment, system and storage medium, which can timely and accurately find out whether the product is suspected to be tampered with after being released online.

[0005] In order to solve the above technical problem, the first aspect of the present application provides a product tracing method, comprising: obtaining first fingerprint information generated based on a construction domain detail of an existing product; in response to a target process being detected in a production environment by calling a probe program, obtaining a target folder of the existing product to which the target process belongs in the production environment, and generating second fingerprint information of the existing product based on the target folder of the existing product; comparing the first fingerprint information and the second fingerprint information of the existing product to obtain a tracing result; wherein any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected to be tampered with.

[0006] To solve the above technical problems, the second aspect of the present application provides a product traceability device, comprising: a first acquisition module, a second acquisition module, and a comparison and traceability module. The first acquisition module is configured to acquire first fingerprint information generated based on a construction domain specification of an existing product. The second acquisition module is configured to, in response to a probe program detecting a target process in a production environment, acquire a target folder of the existing product to which the target process belongs in the production environment, and generate second fingerprint information of the existing product based on the target folder of the existing product. The comparison and traceability module is configured to compare the first fingerprint information and the second fingerprint information of the existing product to obtain a traceability result. Any fingerprint information includes data fingerprints of paths at different levels, and the data fingerprints of paths at any level except the last level are generated based on the data fingerprints of paths at the next level. The traceability result at least includes whether the existing product in the production environment is suspected of being tampered with.

[0007] To solve the above technical problems, the third aspect of the present application provides an electronic device, which at least comprises a memory and a processor coupled with each other. The memory at least stores program instructions. The processor is configured to execute the program instructions to implement the product traceability method in the first aspect.

[0008] To solve the above technical problems, the fourth aspect of the present application provides a computer-readable storage medium, which stores program instructions capable of being executed by a processor. The program instructions are configured to implement the product traceability method in the first aspect.

[0009] The above scheme acquires first fingerprint information generated based on a construction domain specification of an existing product, in response to a probe program detecting a target process in a production environment, acquires a target folder of the existing product to which the target process belongs in the production environment, and generates second fingerprint information of the existing product based on the target folder of the existing product. Then, the first fingerprint information and the second fingerprint information of the existing product are compared to obtain a traceability result. Any fingerprint information includes data fingerprints of paths at different levels, and the data fingerprints of paths at any level except the last level are generated based on the data fingerprints of paths at the next level. The traceability result at least includes whether the existing product in the production environment is suspected of being tampered with. Therefore, before the existing product is released online, the first fingerprint information is generated based on the construction domain specification of the existing product. After the existing product is released online, a process is detected by the probe program to lock a target folder of the existing product to which a specific process belongs, and the second fingerprint information is generated accordingly. Then, the first fingerprint information and the second fingerprint information are compared to trace the existing product in the production environment. Even if the existing product is modified by personnel in operation and maintenance, research and development, or the like, or the existing product is attacked by hackers, etc., the existing product can be timely and accurately determined whether it is suspected of being tampered with. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1is a flowchart of an embodiment of the product traceability method of the present application;

[0011] Figure 2a is a process diagram of an embodiment of the product traceability method of the present application;

[0012] Figure 2b is a schematic diagram of an embodiment of the product folder;

[0013] Figure 3 is a frame diagram of an embodiment of the product traceability device of the present application;

[0014] Figure 4 is a frame diagram of an embodiment of the electronic device of the present application;

[0015] Figure 5 is a frame diagram of an embodiment of the computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0016] The scheme of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0017] In the following description, specific details such as specific system structures, interfaces, techniques, etc. are presented in order to provide a thorough understanding of the present application for the sake of explanation, but not for the sake of limitation.

[0018] The terms "system" and "network" are often used interchangeably herein. The term "and / or" herein is merely an associative relationship between the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases: A alone, A and B together, and B alone. In addition, the segment " / " herein generally means that the front and rear associated objects are an "or" relationship. In addition, "multiple" herein means two or more than two.

[0019] Please refer to Figure 1 , Figure 1 is a flowchart of an embodiment of the product traceability method of the present application. Specifically, it can include the following steps:

[0020] Step S11: Obtain the first fingerprint information generated based on the construction domain details of the existing product.

[0021] In the embodiments of the present disclosure, the existing product can include but is not limited to: program package, middleware, etc., and the specific types of the existing product are not limited herein.

[0022] In one implementation scenario, for ease of understanding, please refer to Figure 2a , Figure 2a is a process diagram of an embodiment of the product traceability method of the present application. As Figure 2aAs shown, in the development stage, the developer can submit the code to the code repository (such as git, etc.); in the build stage, the pipeline build (such as iBuild) can be realized by pulling the code from the code repository, and the product can be obtained, that is, as an existing product, the existing product can be stored in the enterprise product warehouse, or the business private product warehouse can be built; in the release stage, whether it is an enterprise product warehouse or a business private product warehouse, the existing product can be selected and released to the release platform (such as iDeploy) or to the manual, the difference is that the existing product released to the release platform can be automatically released to the server, and the existing product released to the manual needs to be manually released to the server. Through the above process, the existing product can be deployed to the production environment.

[0023] In one implementation scenario, please continue to refer to Figure 2a In the build stage, the product package name, application name, product folder and other build domain details can be obtained. It should be noted that the product folder can contain files of all levels of the existing product. Please refer to Figure 2b , Figure 2b is a schematic diagram of an embodiment of a product folder. As Figure 2b shown, the service-thirdparty-interaction root directory contains three subfolders (namely bin, config, and lib) and three files (namely application.yml, redis-setting.xml, and zxlogback.xml), and in addition, the three subfolders contain multiple files. On this basis, based on the product folder in the build domain details, the first fingerprint information of the existing product (such as Figure 2a the product fingerprint in the build stage) can be generated. The specific generation process of the first fingerprint information can be referred to the related description below, which is not described here.

[0024] In one implementation scenario, the first fingerprint information can be received and stored by the operation and maintenance system. Illustratively, the operation and maintenance system can receive the first fingerprint information through a long link, and the specific way in which the operation and maintenance system receives the first fingerprint information is not limited here. In addition, the operation and maintenance system can be iOPS, etc., and the specific selection of the operation and maintenance system is not limited here.

[0025] Step S12: In response to the call probe program detecting the target process in the production environment, obtaining the target folder of the existing product to which the target process belongs in the production environment, and generating the second fingerprint information of the existing product based on the target folder of the existing product.

[0026] In one implementation scenario, the specific number of probe programs can be determined according to the number of processes in the production environment. For example, when the number of processes in the production environment is large, the specific number of probe programs can also be large accordingly; or when the number of processes in the production environment is small, the specific number of probe programs can also be small accordingly, and the specific number of probe programs is not limited herein.

[0027] In one implementation scenario, the operation and maintenance system can collect and obtain the second fingerprint information through the probe program. Please refer to Figure 2a the running view of the publishing stage in the

[0028] In one implementation scenario, the probe program can be configured in the operation and maintenance system for process detection. For example, the black and white lists of the probe program can be configured in the operation and maintenance system. If a process (such as a product-related process) is in the black list of the probe program, the probe program can detect the process, that is, the process is regarded as a target process at this time; otherwise, if a process (such as a system process of the production environment, which can specifically include but is not limited to root, etc.) is in the white list of the probe program, the probe program can not detect the process, that is, the process is not regarded as a target process at this time. In addition, the non-functional resource limit configuration capability of the probe program can also be configured in the operation and maintenance system. Of course, the above examples are only a few possible examples of related configuration of the probe program in the operation and maintenance system, and the specific configuration of the probe program is not limited herein.

[0029] In one implementation scenario, taking the Linux environment as an example, after the probe program detects the target process in the production environment, the target folder of the existing product to which the target process belongs can be obtained based on the CWD (Change Working Directory) command. Of course, the above example is only one possible example of obtaining the target folder when the production environment is the Linux environment, and other cases are not exemplified herein.

[0030] In the embodiments of the present disclosure, any of the first fingerprint information and the second fingerprint information includes data fingerprints (such as MD5, etc.) of each level path, and the data fingerprint of any level path except the last level path is generated by referring to the data fingerprint of the next level path. Specifically, a path node tree can be constructed based on the product folder, and a node in the path node tree represents a file path of a file or a subfolder in the product folder, and the level of the node in the path node tree is consistent with the level of the file path represented by the node in the product folder. On this basis, the data fingerprints of the nodes in the path node tree can be generated from bottom to top until the root node, to obtain the fingerprint information. It should be noted that when the product folder is obtained from the construction domain details, the fingerprint information is the first fingerprint information, and when the product folder is the target folder, the fingerprint information is the second fingerprint information. In the above manner, the accuracy of the fingerprint information can be improved by constructing the path node tree first and then generating the data fingerprints.

[0031] In one implementation scenario, the file path represented by the root node of the path node tree can be the root directory of the target folder, and the file directory represented by the leaf node of the path node tree can be the file directory of each file in the target folder. Please continue to refer to Figure 2b , the file directory of application.yml can be represented as “. / application.yml”, the file directory of startup.bat can be represented as “. / bin / startup.bat”, and other files or subfolders can be represented in the same manner, which will not be listed one by one here. Then Figure 2bThe target folder shown can form leaf nodes including: application.yml, service-thirdparty-interaction.pid, shutdown.sh, startup.bat, startup.sh, applicationContext_dubboProvider.xml, applicationContext_service.xml, activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, ZX-log-dubbo-filter-1.0.1022.jar, redis-setting.xml, zxlogback.xml, and the file directories of these files. The nodes corresponding to the sub-folders bin of service-thirdparty-interaction.pid, shutdown.sh, startup.bat, and startup.sh are the parent nodes of the nodes corresponding to these four files. The nodes corresponding to the sub-folder config of applicationContext_dubboProvider.xml and applicationContext_service.xml are the parent nodes of the nodes corresponding to these two files. The nodes corresponding to the sub-folder lib of activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, and ZX-log-dubbo-filter-1.0.1022.jar are the parent nodes of the nodes corresponding to these six files. On this basis, the nodes corresponding to the sub-folders bin, config, and lib and the nodes corresponding to application.yml, redis-setting.xml, and zxlogback.xml have the root node as their parent node. Of course, the above examples are only Figure 2b The target folder shown can form leaf nodes including: application.yml, service-thirdparty-interaction.pid, shutdown.sh, startup.bat, startup.sh, applicationContext_dubboProvider.xml, applicationContext_service.xml, activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, ZX-log-dubbo-filter-1.0.1022.jar, redis-setting.xml, zxlogback.xml, and the file directories of these files. The nodes corresponding to the sub-folders bin of service-thirdparty-interaction.pid, shutdown.sh, startup.bat, and startup.sh are the parent nodes of the nodes corresponding to these four files. The nodes corresponding to the sub-folder config of applicationContext_dubboProvider.xml and applicationContext_service.xml are the parent nodes of the nodes corresponding to these two files. The nodes corresponding to the sub-folder lib of activation-1.1.jar, aliyun-java-core-3.0.0.jar, aliyun-java-sdk-wm-3.0.0-rcl-jar, ZX-auth-service-api-1.0.1002.jar, ZX-logback-monitor-1.0.1018.jar, and ZX-log-dubbo-filter-1.0.1022.jar are the parent nodes of the nodes corresponding to these six files. On this basis, the nodes corresponding to the sub-folders bin, config, and lib and the nodes corresponding to application.yml, redis-setting.xml, and zxlogback.xml have the root node as their parent node. Of course, the above examples are only

[0032] In an implementation scenario, for ease of understanding, Figure 2b Taking the target folder shown as an example, the data fingerprint corresponding to application.yml can be recorded as A, the data fingerprint corresponding to service-thirdparty-interaction.pid can be recorded as B, the data fingerprint corresponding to shutdown.sh can be recorded as C, the data fingerprint corresponding to startup.bat can be recorded as D, the data fingerprint corresponding to startup.sh can be recorded as E, the data fingerprint corresponding to applicationContext_dubboProvider.xml can be recorded as F, the data fingerprint corresponding to applicationContext_service.xml can be recorded as G, and the data fingerprint corresponding to activation-1.1.jar can be recorded as The data fingerprint corresponding to aliyun-java-core-3.0.0.jar can be recorded as I, the data fingerprint corresponding to aliyun-java-sdk-wm-3.0.0-rcl-jar can be recorded as J, the data fingerprint corresponding to ZX-auth-service-api-1.0.1002.jar can be recorded as K, the data fingerprint corresponding to ZX-logback-monitor-1.0.1018.jar can be recorded as L, the data fingerprint corresponding to ZX-log-dubbo-filter-1.0.1022.jar can be recorded as M, the data fingerprint corresponding to redis-setting.xml can be recorded as N, and the data fingerprint corresponding to zxlogback.xml can be recorded as O. On this basis, we can continue to generate data fingerprints from bottom to top: the data fingerprint of the subfolder bin can be calculated by hash (BCDE), which can be recorded as BCDE; the data fingerprint of the subfolder config can be calculated by hash (FG), which can be recorded as FG; the data fingerprint of the subfolder lib can be calculated by hash (HIJKLM), which can be recorded as HIJKLM. On this basis, we can continue to generate the data fingerprint of the root node from bottom to top, that is, by calculating hash (ANO + BCDE + FG + HIJKLM). Of course, the above example is only Figure 2b The target folder shown is a possible example of calculating fingerprint information. When the target folder is in other situations, the calculation process of fingerprint information can be deduced by analogy, and no further examples are given here.

[0033] Step S13: Compare the first fingerprint information of the existing product with the second fingerprint information to obtain a tracing result.

[0034] In the embodiments of the present disclosure, the traceability result at least includes whether the existing product in the production environment is suspected to be tampered with. As a possible example, in the case that the traceability result includes that the existing product in the production environment is suspected to be tampered with, the result can further include a tampering degree of the existing product suspected to be tampered with. It should be noted that the higher the tampering degree, the more the existing product is tampered with, and vice versa, the lower the tampering degree, the less the existing product is tampered with. In addition, in the embodiments of the present disclosure, "tampering" can not only include that the authorized personnel such as R&D personnel and operation and maintenance personnel modify the existing product, for example, the authorized personnel directly modify the existing product and redeploy it on the server without going through the Figure 2a product delivery flow shown in the figure; it can also include that the unauthorized personnel such as hackers modify the existing product through network attacks, and the possible personnel who implement tampering is not limited here.

[0035] In one implementation scenario, after obtaining the first fingerprint information and the second fingerprint information, a first comparison result between the data fingerprint of the top-level path in the first fingerprint information and the data fingerprint of the top-level path in the second fingerprint information can be obtained, and then based on the first comparison result, it is determined whether the existing product in the production environment is suspected to be tampered with. The above-mentioned manner directly compares the data fingerprint of the top-level path to determine whether the existing product in the production environment is suspected to be tampered with, which can improve the efficiency of determining whether it is suspected to be tampered with and reduce the complexity of determining whether it is suspected to be tampered with.

[0036] In a specific implementation scenario, still taking the target folder shown in Figure 2b As a possible example, it is assumed that the config sub-folder in Figure 2b is modified and added after the existing product is deployed to the production environment. Then the data fingerprint of the top-level path in the first fingerprint information obtained in the construction stage can be recorded as hash(ANO+BCDE+HIJKLM), and the data fingerprint of the top-level path in the second fingerprint information can be recorded as hash(ANO+BCDE+FG+HIJKLM). Obviously, the first comparison result of the two includes that the comparison is inconsistent. As another possible example, unlike the foregoing possible situation, it is assumed that the config sub-folder and the files contained therein in Figure 2b are already present in the construction stage itself. Then the data fingerprint of the top-level path in the first fingerprint information and the second fingerprint information can both be recorded as hash(ANO+BCDE+FG+HIJKLM). Obviously, the first comparison result of the two includes that the comparison is consistent. Of course, the above-mentioned examples are only one possible example in the actual application process, and when the target folder is in other possible situations, it can be analogized accordingly, and here will not be exemplified one by one.

[0037] In a specific implementation scenario, after obtaining the first comparison result, in response to the first comparison result including comparison consistency, it can be determined that the existing product in the production environment is not tampered with, as the second case described above, it can be determined that the existing product in the production environment is not tampered with; on the contrary, in response to the first comparison result including comparison inconsistency, it can be determined that the existing product in the production environment is suspected of tampering, as the first case described above, it can be determined that the existing product in the production environment is suspected of tampering. The above-mentioned method can determine whether the existing product in the production environment is suspected of tampering by comparing whether the fingerprint data of the top-level path is consistent, which can improve the efficiency of determining whether it is suspected of tampering and reduce the complexity of determining whether it is suspected of tampering.

[0038] In one implementation scenario, as described above, in the case that the existing product is suspected of tampering, the trace result further includes the tampering degree of the existing product suspected of tampering, then each secondary path of the top-level path can be selected as the current path, and it is detected whether the current path is the end-level path, and the second comparison result between the data fingerprint of the current path in the first fingerprint information and the data fingerprint of the current path in the second fingerprint information is obtained. On this basis, in response to the current path being the end-level path, it can be determined whether to increase the current value of the tampering degree based on the second comparison result, and in response to the current path being the end-level path, it can be determined whether to continue to select the secondary path of the current path as the new current path based on the second comparison result. The step of detecting whether the current path is the end-level path is returned. The above-mentioned method performs fingerprint comparison on the top-level path and then on the secondary path, and updates the tampering degree according to the comparison result when the end-level path is reached, and determines whether to expand the next level path according to the comparison result when the end-level path is not reached. On the one hand, it can improve the efficiency of fingerprint comparison, and on the other hand, it can improve the accuracy of the tampering degree.

[0039] In a specific implementation scenario, still taking Figure 2b the product folder shown in the figure as an example, the top-level path is the root directory, and each secondary path under the top-level path can include: “. / application.yml”, “. / bin”, “. / config”, “. / lib”, “. / redis-setting.xml”, “. / zxlogback.xml”. Of course, the above-mentioned examples are only one possible example in the actual application process, and in other cases, it can be analogized, which will not be repeated here.

[0040] In a specific implementation scenario, still taking Figure 2bAs shown in the product file folder, when the secondary path “. / application.yml” is selected as the current path, it is detected that the current path “. / application.yml” is the final path, and the second comparison result between the data fingerprint A of the current path “. / application.yml” in the first fingerprint information and the data fingerprint A of the current path in the second fingerprint information includes a consistent comparison; or, as mentioned earlier, when “. / config” is newly added by the relevant personnel after construction, when “. / config” is selected as the current path, it is detected that the current path “. / config” is not the final path, and the second comparison result between the data fingerprint (since there is no current path “. / config” during construction, the data fingerprint can be represented as empty) of the current path “. / config” in the first fingerprint information and the data fingerprint FG of the current path in the second fingerprint information includes an inconsistent comparison. Of course, the above examples are only two possible examples in the actual application process, and do not limit other situations that may occur in the actual application process, and will not be exemplified one by one here.

[0041] In one specific implementation scenario, in the case where the current path is the final path, after obtaining the second comparison result, in response to the second comparison result including a consistent comparison, it can be determined to maintain the current value of the tampering degree, and in response to the second comparison result including an inconsistent comparison, it can be determined to increase the current value of the tampering degree. Exemplarily, the initial value of the tampering degree can be set to 0, 10, 20, etc., and the specific size of the initial value is not limited here. In addition, each time the current value of the tampering degree is increased, it can be increased by 1, 5, 10, etc., and the value of each increase is not limited here. The above-mentioned manner, when the second comparison result is a consistent comparison or an inconsistent comparison, respectively maintains the current value or increases the current value, that is, in the comparison process, each time the data fingerprint inconsistency of the final path is found, the tampering degree is added, which helps to improve the accuracy of the tampering degree.

[0042] In one specific implementation scenario, in the case where the current path is not the final path, after obtaining the second comparison result, in response to the second comparison result including a consistent comparison, it can be determined not to continue to select the secondary path of the current path as the new current path, that is, subsequent fingerprint comparison of the secondary path of the current path will not be continued, and in response to the second comparison result including an inconsistent comparison, it can be determined to continue to select the secondary path of the current path as the new current path, that is, subsequent fingerprint comparison of the secondary path of the current path needs to be continued. The above-mentioned manner, in the case where the current path is not the final path, determines whether to continue to perform fingerprint comparison on the secondary path of the current path according to whether the fingerprint comparison is consistent, which can perform fingerprint comparison on the secondary path step by step, helps to improve the fingerprint comparison efficiency, and further improves the efficiency of obtaining the tampering degree.

[0043] In one specific implementation scenario, still with Figure 2bThe illustrated product folder and ". / config " is added by the relevant personnel after the construction as an example, when the data fingerprint comparison of the root directory is inconsistent, the secondary path of the root directory can be selected: ". / application.yml ", ". / bin ", ". / config ", ". / lib ", ". / redis-setting.xml ", ". / zxlogback.xml ", respectively, as the current path. When ". / application.yml " is selected as the current path, since it is itself a terminal path and the fingerprint comparison is consistent, the current value of the tampering degree can be maintained (at this time it is still the initial value 0); When ". / bin " is selected as the current path, since it is itself not a terminal path and the fingerprint comparison is consistent, the secondary path of the current path ". / bin " can no longer be selected as the new current path; When ". / lib " is selected as the current path, since it is itself not a terminal path and the fingerprint comparison is consistent, the secondary path of the current path ". / lib " can no longer be selected as the new current path; When ". / redis-setting.xml " is selected as the current path, since it is itself a terminal path and the fingerprint comparison is consistent, the current value of the tampering degree can be maintained (at this time it is still the initial value 0); When ". / zxlogback.xml " is selected as the current path, since it is itself a terminal path and the fingerprint comparison is consistent, the current value of the tampering degree can be maintained (at this time it is still the initial value 0); When ". / config " is selected as the current path, since it is itself not a terminal path and the fingerprint comparison is inconsistent, its secondary path ". / config / applicationContext_dubboProvider.xml ", ". / config / applicationContext_service.xml " can be selected as the new current path, and the step of detecting whether the current path is a terminal path is returned. When ". / config / applicationContext_dubboProvider.xml " is selected as the new current path, since the new current path is a terminal path at this time, and the fingerprint comparison is inconsistent, the current value of the tampering degree can be increased (such as increasing 1, 5, 10, etc.), and when ". / config / applicationContext_service.xml " is selected as the new current path, since the new current path is a terminal path at this time, and the fingerprint comparison is inconsistent, the current value of the tampering degree can be increased again (such as increasing 1, 5, 10, etc.), that is, the fingerprint comparison process is ended, and the tampering degree is determined. Of course, the above example is only to Figure 2bThe product folder shown is an example of a possible example of fingerprint comparison. In other cases, the product folder can be analogized accordingly, and examples are not repeated here.

[0044] In one implementation scenario, as described previously, in the case where the existing product is suspected of tampering, the tracing result further includes the tampering degree of the existing product suspected of tampering, and the specific process can refer to the foregoing related description, which is not repeated here. In this case, after obtaining the tracing result, the similarity degree between the existing product in the construction stage and the running stage can be obtained based on the tampering degree of the existing product suspected of tampering, and whether to report the tracing result can be determined based on whether the similarity degree meets the preset condition. As a possible example, as described previously, the first fingerprint information can be received and stored by the operation and maintenance system, the second fingerprint information can be collected and obtained by the probe program, and the result can be reported to the operation and maintenance system. It should be noted that the tracing result can further include the product package name, the server of the release, etc., and the specific content of the tracing result is not limited here. The above-mentioned manner determines the similarity degree between the existing product in the construction stage and the running stage through the tampering degree, and determines whether to report the tracing result based on whether the similarity degree meets the preset condition, which can timely report the tracing result according to the similarity degree between the construction stage and the running stage.

[0045] In one specific implementation scenario, the tampering degree and the similarity degree can be in a negative correlation, that is, the higher the tampering degree, the lower the similarity degree, and vice versa, the lower the tampering degree, the higher the similarity degree. The specific functional relationship between the tampering degree and the similarity degree is not limited here. Exemplarily, the tampering degree and the similarity degree can specifically adopt a linear function, and examples are not repeated here.

[0046] In one specific implementation scenario, the preset condition can be set to be that the similarity degree is lower than a preset threshold (such as 95%, 90%, etc.). In this case, in the case where the similarity degree meets the preset condition, it can be determined to report the tracing result; otherwise, in the case where the similarity degree does not meet the preset condition, it can be determined not to report the tracing result. Of course, the preset threshold can also be set to 100%, that is, as long as the similarity degree is lower than 100%, the tracing result is reported.

[0047] In one specific implementation scenario, if multiple target processes are detected in the server and belong to the same existing product, and the similarity degree between the construction stage and the running stage is not lower than the preset threshold, it can be determined that the existing products to which the target processes belong are different versions of the same existing product. In this case, the tracing results corresponding to the target processes can also be reported to the operation and maintenance system for processing by the management personnel of the operation and maintenance system, such as stopping running the old version, which is not limited here.

[0048] The above scheme, the first fingerprint information generated based on the construction domain details of the existing product is acquired, the target folder of the existing product to which the target process belongs in the production environment is acquired in response to the detection of the target process in the production environment by calling the probe program, the second fingerprint information of the existing product is generated based on the target folder of the existing product, the first fingerprint information and the second fingerprint information of the existing product are compared based on the first fingerprint information and the second fingerprint information, and the tracing result is obtained. Any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path, and the tracing result at least includes whether the existing product in the production environment is suspected to be tampered with. Therefore, the first fingerprint information is generated through the construction domain details of the existing product before the existing product is released online, and the process detection is performed through the probe program after the existing product is released online, so as to lock the target folder of the existing product to which the specific process belongs, and the second fingerprint information is generated accordingly. Therefore, the first fingerprint information and the second fingerprint information are compared, so as to realize the tracing of the existing product in the production environment, and then even if the product is modified by operation and maintenance personnel, research and development personnel, or the product has problems caused by hacker attacks on the network, the product can be timely and accurately found out whether it is suspected to be tampered with.

[0049] Please refer to Figure 3 , Figure 3 is a frame diagram of an embodiment of the product tracing device. The product tracing device 30 comprises a first acquisition module 31, a second acquisition module 32 and a comparison and tracing module 33. The first acquisition module 31 is configured to acquire first fingerprint information generated based on construction domain details of an existing product. The second acquisition module 32 is configured to acquire a target folder of the existing product to which a target process belongs in a production environment in response to detection of the target process in the production environment by calling a probe program, and generate second fingerprint information of the existing product based on the target folder of the existing product. The comparison and tracing module 33 is configured to compare the first fingerprint information and the second fingerprint information of the existing product, and obtain a tracing result. Any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path. The tracing result at least includes whether the existing product in the production environment is suspected to be tampered with.

[0050] The above scheme, the product traceability device 30 obtains the first fingerprint information generated based on the build domain details of the existing product, detects the target process in the production environment in response to the call probe program, obtains the target folder of the existing product to which the target process belongs in the production environment, generates the second fingerprint information of the existing product based on the target folder of the existing product, and compares the first fingerprint information and the second fingerprint information of the existing product based on the first fingerprint information and the second fingerprint information of the existing product to obtain the traceability result. Any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path. The traceability result at least includes whether the existing product in the production environment is suspected of tampering. Therefore, the first fingerprint information is generated through the build domain details of the existing product before the existing product is released online, and the process detection is performed through the probe program after the existing product is released online to lock the target folder of the existing product to which the specific process belongs, and the second fingerprint information is generated accordingly. Therefore, the first fingerprint information and the second fingerprint information are compared to realize the traceability of the existing product in the production environment, so that even if the existing product is modified by operation and maintenance personnel, research and development personnel, or hacker attacks on the network, etc., the existing product can be timely and accurately found out whether it is suspected of tampering.

[0051] In some disclosed embodiments, the comparison and traceability module 33 includes a first comparison sub-module for obtaining a first comparison result between the data fingerprint of the top-level path in the first fingerprint information and the data fingerprint of the top-level path in the second fingerprint information; the comparison and traceability module 33 includes a tampering determination sub-module for determining whether the existing product in the production environment is suspected of tampering based on the first comparison result.

[0052] In some disclosed embodiments, the tampering determination sub-module includes a first determination unit for determining that the existing product in the production environment has not been tampered with in response to the first comparison result including consistent comparison; the tampering determination sub-module includes a second determination unit for determining that the existing product in the production environment is suspected of tampering in response to the first comparison result including inconsistent comparison.

[0053] In some disclosed embodiments, in the case that the existing product is suspected to be tampered, the traceability result further comprises a tampering degree of the existing product suspected to be tampered, the comparison and traceability module 33 comprises a path selection submodule for selecting each secondary path of the top-level path as a current path respectively; the comparison and traceability module 33 comprises a second comparison submodule for detecting whether the current path is a terminal-level path and obtaining a second comparison result between the data fingerprint of the current path in the first fingerprint information and the data fingerprint of the current path in the second fingerprint information; the comparison and traceability module 33 comprises a first execution submodule for determining whether to increase the current value of the tampering degree based on the second comparison result in response to the current path being a terminal-level path; the comparison and traceability module 33 comprises a second execution submodule for determining whether to continue to select the secondary path of the current path as a new current path in response to the current path being a non-terminal-level path, so as to return to the step of detecting whether the current path is a terminal-level path.

[0054] In some disclosed embodiments, the first execution submodule comprises a value maintaining unit for determining to maintain the current value of the tampering degree in response to the second comparison result comprising a consistent comparison; the first execution submodule comprises a value increasing unit for determining to increase the current value of the tampering degree in response to the second comparison result comprising an inconsistent comparison.

[0055] In some disclosed embodiments, the second execution submodule comprises a stopping selection unit for determining not to continue to select the secondary path of the current path as a new current path in response to the second comparison result comprising a consistent comparison; the second execution submodule comprises a continuing selection unit for determining to continue to select the secondary path of the current path as a new current path in response to the second comparison result comprising an inconsistent comparison.

[0056] In some disclosed embodiments, the product traceability device 30 comprises a node tree construction module for constructing a path node tree based on the product folder; wherein a node in the path node tree represents a file path of a file or a subfolder in the product folder, and the level of the node in the path node tree is consistent with the level of the file path represented by the node in the product folder; the product traceability device 30 comprises a fingerprint generation module for generating data fingerprints of the nodes in the path node tree from bottom to top successively until the root node, so as to obtain fingerprint information; wherein the fingerprint information is first fingerprint information when the product folder is obtained from the construction domain details, and the fingerprint information is second fingerprint information when the product folder is the target folder.

[0057] In some disclosed embodiments, in the case that the existing product is suspected to be tampered, the traceability result further comprises a tampering degree of the existing product suspected to be tampered, the product traceability device 30 comprises a similarity measurement module configured to obtain a similarity degree of the existing product between the construction stage and the operation stage based on the tampering degree of the existing product suspected to be tampered, and the product traceability device 30 comprises a traceability reporting module configured to determine whether to report the traceability result based on whether the similarity degree meets a preset condition.

[0058] In some disclosed embodiments, the operation and maintenance system receives and stores the first fingerprint information, the operation and maintenance system acquires the second fingerprint information through the probe program, and the traceability result is reported to the operation and maintenance system.

[0059] Please refer to Figure 4 , Figure 4 is a schematic diagram of a framework of an embodiment of the electronic device. The electronic device 40 at least includes a memory 41 and a processor 42 coupled with each other, the memory 41 at least stores program instructions, and the processor 42 is configured to execute the program instructions to implement the steps in any of the product traceability method embodiments described above. For details, please refer to the foregoing disclosed embodiments, which will not be repeated here. As a possible example, the electronic device 40 can include but is not limited to a server and the like, and the specific type of the electronic device 40 is not limited here.

[0060] Specifically, the processor 42 is configured to control itself and the memory 41 to implement the steps in any of the product traceability method embodiments described above. The processor 42 can also be referred to as a CPU (Central Processing Unit). The processor 42 can be an integrated circuit chip with processing capability. The processor 42 can also be a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general purpose processor can be a microprocessor or the processor can also be any conventional processor. In addition, the processor 42 can be implemented by an integrated circuit chip.

[0061] The above scheme, the electronic device 40 obtains the first fingerprint information generated based on the build domain details of the existing product, detects the target process in the production environment in response to the call probe program, obtains the target folder of the existing product to which the target process belongs in the production environment, and generates the second fingerprint information of the existing product based on the target folder of the existing product. The first fingerprint information and the second fingerprint information of the existing product are compared based on the first fingerprint information and the second fingerprint information of the existing product, and the tracing result is obtained. Any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path. The tracing result at least includes whether the existing product in the production environment is suspected of tampering. Therefore, before the existing product is released online, the first fingerprint information is generated through the build domain details of the existing product, and after the existing product is released online, the process detection is performed through the probe program to lock the target folder of the existing product to which the specific process belongs, and the second fingerprint information is generated accordingly. The first fingerprint information and the second fingerprint information are compared to realize the tracing of the existing product in the production environment, so that even if the product is modified by operation and maintenance, research and development personnel or hacker attacks on the network, etc. After the product is released online, the product can be timely and accurately found out whether it is suspected of tampering.

[0062] Please refer to Figure 5 , Figure 5 is a framework schematic diagram of an embodiment of the computer readable storage medium 50 of the present application. The computer readable storage medium 50 stores program instructions 51 capable of being executed by the processor, and the program instructions 51 are used to implement the steps in any product tracing method embodiment.

[0063] The above scheme, the computer readable storage medium 50 acquires the first fingerprint information generated based on the build domain details of the existing product, acquires the target folder of the existing product to which the target process belongs in the production environment in response to the call probe program detecting the target process in the production environment, and generates the second fingerprint information of the existing product based on the target folder of the existing product. The first fingerprint information and the second fingerprint information of the existing product are compared based on the first fingerprint information and the second fingerprint information of the existing product, and the tracing result is obtained. Any fingerprint information contains the data fingerprint of each level path, and the data fingerprint of any level path outside the last level path is generated based on the data fingerprint of the next level path. The tracing result at least includes whether the existing product in the production environment is suspected to be tampered with. Therefore, before the existing product is released online, the first fingerprint information is generated based on the build domain details of the existing product, and after the existing product is released online, the process is detected by the probe program to lock the target folder of the existing product to which the specific process belongs, and the second fingerprint information is generated accordingly. Therefore, the first fingerprint information and the second fingerprint information are compared to realize the tracing of the existing product in the production environment, so that even if the product is modified by operation and maintenance, research and development personnel, or the product is attacked by hackers, etc., the product can be timely and accurately found out whether it is suspected to be tampered with.

[0064] In some embodiments, the device provided by the embodiments of the present disclosure has functions or includes modules that can be used to perform the methods described in the above method embodiments, and the specific implementation can refer to the description of the above method embodiments. For brevity, it will not be repeated here.

[0065] The above description of various embodiments tends to emphasize the differences between various embodiments, and the same or similar parts can be mutually referred to. For brevity, it will not be repeated here.

[0066] In several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division, and actual implementation can have another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed mutual elements can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other form.

[0067] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment scheme.

[0068] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0069] If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application, essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to execute all or part of the steps of the methods in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program codes that can be stored in the medium.

[0070] If the technical solutions of the present application involve personal information, the product applying the technical solutions of the present application has been explicitly informed of the personal information processing rules before processing the personal information, and has obtained the personal independent consent. If the technical solutions of the present application involve sensitive personal information, the product applying the technical solutions of the present application has obtained the personal independent consent before processing the sensitive personal information, and at the same time meets the requirement of "explicit consent". For example, at the personal information collection device such as a camera, a clear and prominent sign is set to inform that the personal information collection range has been entered, and the personal information will be collected. If the individual voluntarily enters the collection range, it is considered to agree to collect the personal information. Or, on the device for processing personal information, through the pop-up information or by uploading the personal information by the individual, the personal authorization is obtained under the condition that the obvious sign / information informs the individual of the personal information processing rules. The personal information processing rules can include the personal information processor, the processing purpose, the processing method, and the type of processed personal information, etc.

Claims

1. An article traceability method, characterized by, The method comprises: obtaining first fingerprint information generated based on a construction domain specification of an existing product; in response to detecting a target process in a production environment by invoking a probe program, obtaining a target folder of the existing product to which the target process belongs in the production environment, and generating second fingerprint information of the existing product based on the target folder of the existing product; comparing the first fingerprint information and the second fingerprint information of the existing product to obtain a trace result; wherein any fingerprint information contains data fingerprints of paths at different levels, and the data fingerprints of any path at a level are generated based on the data fingerprints of a path at a next level, and the trace result at least includes whether the existing product in the production environment is suspected of being tampered with, and in the case that the existing product is suspected of being tampered with, the trace result further includes a tampering degree of the existing product suspected of being tampered with, and the comparison of the first fingerprint information and the second fingerprint information of the existing product to obtain the trace result further includes: selecting each sub-path of the top-level path as a current path respectively; detecting whether the current path is the last-level path, and obtaining a second comparison result between the data fingerprints of the current path in the first fingerprint information and the data fingerprints of the current path in the second fingerprint information; in response to the current path being the last-level path, determining whether to increase a current value of the tampering degree based on the second comparison result; in response to the current path not being the last-level path, determining whether to continue selecting a sub-path of the current path as a new current path based on the second comparison result, so as to return to the step of detecting whether the current path is the last-level path.

2. The method of claim 1, wherein, The comparison of the first fingerprint information and the second fingerprint information of the existing product to obtain the trace result comprises: obtaining a first comparison result between the data fingerprints of the top-level path in the first fingerprint information and the data fingerprints of the top-level path in the second fingerprint information; determining whether the existing product in the production environment is suspected of being tampered with based on the first comparison result.

3. The method of claim 2, wherein, The determination of whether the existing product in the production environment is suspected of being tampered with based on the first comparison result comprises at least one of: in response to the first comparison result including a consistent comparison, determining that the existing product in the production environment has not been tampered with; in response to the first comparison result including an inconsistent comparison, determining that the existing product in the production environment is suspected of being tampered with.

4. The method of claim 1, wherein, The determination of whether to increase the current value of the tampering degree based on the second comparison result comprises at least one of: in response to the second comparison result including a consistent comparison, determining to maintain the current value of the tampering degree; in response to the second comparison result including an inconsistent comparison, determining to increase the current value of the tampering degree.

5. The method of claim 1, wherein, The determination of whether to continue selecting a sub-path of the current path as a new current path based on the second comparison result comprises at least one of: in response to the second comparison result including a consistent comparison, determining not to continue selecting a sub-path of the current path as the new current path; in response to the second comparison result including an inconsistent comparison, determining to continue selecting a sub-path of the current path as the new current path. In response to the second comparison result including a comparison inconsistency, a sub-path of the current path is determined to continue to be selected as the new current path.

6. The method of claim 1, wherein, The generating of the fingerprint information comprises: constructing a path node tree based on the product folder; wherein a node in the path node tree represents a file path of a file or a sub-folder in the product folder, and the level of the node in the path node tree is consistent with the level of the file path represented by the node in the product folder; generating data fingerprints of the nodes in the path node tree from bottom to top until the root node, to obtain the fingerprint information; wherein when the product folder is obtained from the construction domain details, the fingerprint information is the first fingerprint information, and when the product folder is the target folder, the fingerprint information is the second fingerprint information.

7. The method of claim 1, wherein, In the case that the existing product is suspected to be tampered, the tampering degree of the existing product suspected to be tampered is included in the tracing result, and after the first fingerprint information and the second fingerprint information of the existing product are compared to obtain the tracing result, the following steps are included: based on the tampering degree of the existing product suspected to be tampered, obtaining the similarity degree between the existing product in the construction stage and the running stage; based on whether the similarity degree meets a preset condition, determining whether to report the tracing result.

8. The method according to any one of claims 1 to 7, characterized in that, The operation and maintenance system receives and stores the first fingerprint information, the operation and maintenance system collects and obtains the second fingerprint information through the probe program, and the tracing result is reported to the operation and maintenance system.

9. An article traceability device, characterized by, comprises: a first obtaining module configured to obtain first fingerprint information generated based on construction domain details of an existing product; a second obtaining module configured to, in response to a probe program detecting a target process in a production environment, obtain a target folder of an existing product to which the target process belongs in the production environment, and generate second fingerprint information of the existing product based on the target folder of the existing product; a comparison and tracing module configured to compare the first fingerprint information and the second fingerprint information of the existing product to obtain a tracing result; wherein any fingerprint information contains data fingerprints of paths at all levels, and the data fingerprints of paths at any level except the last level are generated by referring to the data fingerprints of paths at the next level, and the tracing result at least includes whether the existing product in the production environment is suspected to be tampered, and in the case that the existing product is suspected to be tampered, the tracing result further includes a tampering degree of the existing product suspected to be tampered, and the comparison and tracing module is further configured to: select each sub-path of the top-level path as a current path; detect whether the current path is the last-level path, and obtain a second comparison result between the data fingerprints of the current path in the first fingerprint information and the data fingerprints of the current path in the second fingerprint information; in response to the current path being the last-level path, determine whether to increase a current value of the tampering degree based on the second comparison result; In response to the current path not being the final stage path, based on the second comparison result, determining whether to continue to select a sub-path of the current path as a new current path to return to the step of detecting whether the current path is the final stage path.

10. An electronic device, comprising: An article tracing method is provided, comprising: obtaining a first comparison result of a first path of a product and a second comparison result of a second path of the product; determining whether the first path is a final stage path based on the first comparison result; and determining whether to continue to select a sub-path of the current path as a new current path to return to the step of detecting whether the current path is the final stage path based on the second comparison result in response to the current path not being the final stage path.

11. A computer readable storage medium characterized by, An article tracing method is provided, comprising: obtaining a first comparison result of a first path of a product and a second comparison result of a second path of the product; determining whether the first path is a final stage path based on the first comparison result; and determining whether to continue to select a sub-path of the current path as a new current path to return to the step of detecting whether the current path is the final stage path based on the second comparison result in response to the current path not being the final stage path. An article tracing method is provided, comprising: obtaining a first comparison result of a first path of a product and a second comparison result of a second path of the product; determining whether the first path is a final stage path based on the first comparison result; and determining whether to continue to

Images