Information processing method and device, computer readable storage medium and electronic equipment

Abstract

The invention relates to the technical field of software security, and provides an information processing method, an information processing device, a computer readable storage medium and electronic equipment.The information processing method comprises the steps that software material information of each piece of software is obtained; each piece of software is composed of a plurality of components; key material information is determined from the software material information; the key material information comprises a material version identifier of the software material information and a component dependency relationship among the plurality of components; and carrying out encryption processing on the key material information, and storing the encrypted key material information to a block chain. According to the method disclosed by the invention, tampering resistance, transparency and traceability of software material information can be ensured.

Description

Background Art

[0002] With the increasing complexity and dependencies of software development, SBOM (Software Bill of Materials) has become an important tool for managing software components and dependencies. However, once the SBOM is tampered with, the component-related information it provides will lose credibility and cannot effectively support software security and compliance management. Therefore, it is very urgent to prevent tampering and securely distribute the SBOM.

[0003] In view of this, there is an urgent need in the art to develop a new information processing method and device.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure. Summary of the invention

[0005] The purpose of the present disclosure is to provide an information processing method, an information processing device, a computer-readable storage medium and an electronic device, thereby overcoming, at least to a certain extent, the technical problem that software material information may be tampered with due to the limitations of related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, there is provided an information processing method, comprising:

[0008] Acquire software material information of each software; each software is composed of multiple components;

[0009] Determining key material information from the software material information; the key material information includes a material version identifier of the software material information and a component dependency relationship between the multiple components;

[0010] The key material information is encrypted and the encrypted key material information is stored in the blockchain.

[0011] In an exemplary embodiment of the present disclosure, after obtaining the software material information of each software, the method further includes:

[0012] Determining secondary material information from the software material information, the secondary material information including component information of each component; the component information including original component identification, component version identification and component license information;

[0013] The secondary material information is encrypted and the encrypted secondary material information is stored in a local database.

[0014] In an exemplary embodiment of the present disclosure, the encrypting the secondary material information and storing the encrypted secondary material information in a local database includes:

[0015] Generate a derived component identifier according to the original component identifier and the component version identifier of each component;

[0016] Performing data flattening processing on the component information of each component to obtain each standard component information block corresponding to each component information; the standard component information block does not contain a nested relationship;

[0017] Each standard component information block corresponding to each component is encrypted to obtain an encrypted component information block, and the derived component identifier is associated with the encrypted component information block and stored in a local database.

[0018] In an exemplary embodiment of the present disclosure, generating a derived component identifier according to the original component identifier and the component version identifier includes:

[0019] Concatenate the original component identifier and the component version identifier to generate concatenation information;

[0020] The splicing information is encrypted to obtain the derived component identifier.

[0021] In an exemplary embodiment of the present disclosure, the method further includes:

[0022] identifying a risk component among the plurality of components;

[0023] Obtaining risk information corresponding to the risk component, and encrypting the risk information to obtain encrypted risk information;

[0024] The derivative component identifier corresponding to the risk component is associated with the encrypted risk information and stored in a local database.

[0025] In an exemplary embodiment of the present disclosure, the method further includes:

[0026] In response to monitoring a risk information change event of a target risk component, obtaining the changed risk information;

[0027] According to the derivative component identifier corresponding to the target risk component, searching the local database for the encrypted risk information associated with the target risk component;

[0028] The encrypted risk information is updated based on the changed risk information.

[0029] In an exemplary embodiment of the present disclosure, after updating the encrypted risk information based on the changed risk information, the method further includes:

[0030] Adding a version update record of the software material information of the target risk component to the blockchain;

[0031] The version update record includes an updated material version identifier and a location pointer pointing to the updated material version identifier.

[0032] In an exemplary embodiment of the present disclosure, the method further includes:

[0033] In response to the changed risk information satisfying a preset warning condition, generating warning information for the changed risk information; the preset warning condition and the hazard level of the changed risk information have a preset correlation relationship;

[0034] Triggering an early warning notification regarding the early warning information.

[0035] According to a second aspect of the present disclosure, there is provided an information processing device, including:

[0036] An information acquisition module, used to acquire software material information of each software; each software is composed of multiple components;

[0037] A key information determination module, used to determine key material information from the software material information; the key material information includes a material version identifier of the software material information and a component dependency relationship between the multiple components;

[0038] The storage module is used to encrypt the key material information and store the encrypted key material information in the blockchain.

[0039] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the information processing method described in the first aspect is implemented.

[0040] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the information processing method described in the first aspect above by executing the executable instructions.

[0041] It can be seen from the above technical solutions that the information processing method, information processing device, computer-readable storage medium and electronic device in the exemplary embodiments of the present disclosure have at least the following advantages and positive effects:

[0042] In the technical solutions provided by some embodiments of the present disclosure, by obtaining the software material information of each software (each software is composed of multiple components), determining the key material information from the software material information, the key material information includes the material version identification of the software material information and the component dependency relationship between multiple components, encrypting the key material information, and storing the encrypted key material information in the blockchain. On the one hand, given that one of the core characteristics of blockchain technology is the immutability of data, once the data is written into the blockchain, it is difficult to be modified or deleted, thereby ensuring the integrity and credibility of the key material information (such as the material version identification and the component dependency relationship); further, by encrypting the key material information, sensitive data can be protected from unauthorized access, and even if the data is intercepted during transmission, the attacker cannot easily interpret it, thereby significantly improving the security of the software material information; on the other hand, given that the data on the blockchain is open and transparent, all participants can view and verify the data, thereby increasing the transparency of the entire supply chain, allowing all parties to more easily track the source and history of software materials, and to easily trace the historical records of each software material through the blockchain, thereby improving the transparency and traceability of software material information.

[0043] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0045] Figure 1 A schematic diagram showing a flow chart of an information processing method in an embodiment of the present disclosure;

[0046] Figure 2 A flowchart showing how to determine secondary material information and store it in a local database in an embodiment of the present disclosure;

[0047] Figure 3 A schematic diagram showing a flow chart of how to encrypt secondary material information and store the encrypted secondary material information in a local database in an embodiment of the present disclosure;

[0048] Figure 4 A flowchart showing how to store risk information of SBOM and risk components in an embodiment of the present disclosure;

[0049] Figure 5 A flow chart showing how to update relevant information stored in a local database in real time according to a risk information change event in an embodiment of the present disclosure;

[0050] Figure 6 A schematic diagram showing a process of triggering risk warning information in an embodiment of the present disclosure;

[0051] Figure 7 A schematic diagram showing the overall flow of the information processing method in an embodiment of the present disclosure is shown;

[0052] Figure 8 A schematic diagram showing the structure of an information processing device in an exemplary embodiment of the present disclosure;

[0053] Fig. 9 A schematic structural diagram of an electronic device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0055] The terms "a", "an", "the" and "said" are used in this specification to indicate the presence of one or more elements / components / etc.; the terms "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.; the terms "first" and "second" etc. are used only as labels and are not intended to limit the quantity of their objects.

[0056] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0057] The present invention discloses a SBOM tamper-proof and vulnerability warning method based on blockchain technology, which uses blockchain technology itself to achieve SBOM tamper-proof and secure distribution. At the same time, a management method for SBOM and vulnerability library is proposed, aiming to achieve reliable storage, automatic update and vulnerability warning of SBOM and vulnerability library data. Considering that the blockchain has limited storage data, a data storage encryption and warning method combining on-chain and off-chain is proposed.

[0058] In the embodiments of the present disclosure, firstly, an information processing method is provided, which at least to some extent overcomes the defect in the related art that software material information may be tampered with.

[0059] Figure 1 A flow chart of the information processing method in the embodiment of the present disclosure is shown. The execution subject of the information processing method may be a server that processes software material information.

[0060] refer to Figure 1 According to an embodiment of the present disclosure, an information processing method includes the following steps:

[0061] Step S110, obtaining software material information of each software; each software is composed of multiple components;

[0062] Step S120, determining key material information from the software material information; the key material information includes the material version identifier of the software material information and the component dependency relationship between multiple components;

[0063] Step S130, encrypt the key material information and store the encrypted key material information in the blockchain.

[0064] exist Figure 1In the technical solution provided by the illustrated embodiment, by obtaining the software material information of each software (each software is composed of multiple components), the key material information is determined from the software material information, the key material information includes the material version identification of the software material information and the component dependency relationship between multiple components, the key material information is encrypted, and the encrypted key material information is stored in the blockchain. On the one hand, given that one of the core characteristics of blockchain technology is the immutability of data, once the data is written to the blockchain, it is difficult to be modified or deleted, thereby ensuring the integrity and credibility of the key material information (such as the material version identification and the component dependency relationship); further, by encrypting the key material information, sensitive data can be protected from unauthorized access, even if the data is intercepted during transmission, the attacker cannot easily interpret it, thereby significantly improving the security of the software material information; on the other hand, given that the data on the blockchain is open and transparent, all participants can view and verify the data, thereby increasing the transparency of the entire supply chain, allowing all parties to more easily track the source and history of software materials, and can also easily trace the historical records of each software material through the blockchain, thereby improving the transparency and traceability of software material information.

[0065] The following Figure 1 The specific implementation process of each step is described in detail:

[0066] In step S110, the software material information of each software is obtained.

[0067] In this step, the software material information of each software may be obtained. The software material information may be an SBOM file. The SBOM file may adopt the internationally used Cyclonedx standard json format.

[0068] Each software can contain multiple components, where software components refer to the reusable, independently deployable and replaceable parts that make up the software system. These components are usually modular, each of which is responsible for implementing specific functions or services and interacting with other components through well-defined interfaces. Component-based design methods help improve the maintainability, scalability and reusability of software.

[0069] The above software material information may include minor material information and key material information, wherein the minor material information may be component information of each component, and the key material information may include the material version identifier of the software material information (eg SBOM version number) and component dependencies between multiple components.

[0070] Exemplarily, the component information of each component includes an original component identifier (eg, component name, component ID, etc.), a component version identifier (eg, component version number), component licensing information (eg, component license), and the like.

[0071] Therefore, after the above step S110, the present disclosure can first determine the secondary material information from the software material information, and store the secondary material information in a local database without uploading it to the blockchain, thereby overcoming the problem of limited storage space in the blockchain.

[0072] refer to Figure 2 , Figure 2 A flow chart showing how to determine secondary material information and store it in a local database in an embodiment of the present disclosure includes steps S201-S202:

[0073] In step S201, secondary material information is determined from the software material information.

[0074] In this step, secondary material information may be determined from the software material information, where the secondary material information is component information of each component.

[0075] In step S202, the secondary material information is encrypted and the encrypted secondary material information is stored in a local database.

[0076] In this step, the secondary material information can be encrypted using an encryption algorithm, and the encrypted secondary material information can be stored in a local database. Exemplarily, the encryption algorithm can be a symmetric encryption algorithm, an asymmetric encryption algorithm, or a hybrid encryption algorithm, which can be set according to actual conditions, and the present disclosure does not specifically limit this.

[0077] refer to Figure 3 , Figure 3 A flow chart showing how to encrypt secondary material information and store the encrypted secondary material information in a local database in an embodiment of the present disclosure includes steps S301 to S303:

[0078] In step S301, a derived component identifier is generated according to the original component identifier and the component version identifier of each component.

[0079] In this step, in an optional implementation, the original component identifier and the component version identifier (for example, component name + version number) of each component mentioned above can be directly spliced ​​to obtain a derived component identifier; in another optional implementation, the original component identifier and the component version identifier (for example, component name + version number) can be first spliced ​​to generate splicing information, and then the splicing information can be encrypted using an encryption algorithm to obtain a derived component identifier corresponding to each component.

[0080] In step S302, data flattening is performed on the component information of each component to obtain each standard component information block corresponding to each component information.

[0081] In this step, the component information of each component can be flattened to obtain each standard component information block corresponding to each component information, wherein data flattening is a process of converting a complex data structure into a simpler, less hierarchical data structure. When processing component information, data flattening usually means converting a nested or multi-level data structure (such as nested objects and arrays in JSON objects) into a simple key-value pair set, which can be more easily stored, queried, and analyzed. After data flattening, a standard component json information block that does not contain a nested relationship can be obtained.

[0082] Exemplarily, the following is an example of a JSON object of a standard component information block in an embodiment of the present disclosure:

[0083] {"Component.Name":"ComponentA",#Component name

[0084] "Component.Version":"1.1.0",#Component version number

[0085] "Component.LicenseName":"MIT License",#License

[0086] "Component.Vulnerability":"CVE-2023-2976"}#Component vulnerability number

[0087] In step S303, each standard component information block corresponding to each component is encrypted, and the derived component identifier is associated with the encrypted component information block and stored in a local database.

[0088] In this step, each standard component information block corresponding to each component can be encrypted, and after the derived component identifier and the encrypted component information block are associated with each other, they are stored in a local database, so that the corresponding encrypted component information block can be quickly found according to the derived component identifier.

[0089] Among them, the local database can be an off-chain database that is different from the blockchain. Exemplarily, it can be SQLite, PostgreSQL, MySQL, H2 Database, etc. It can be set according to actual conditions, and this disclosure does not make any special limitations on this.

[0090] Afterwards, you can refer to Figure 1 , in step S120, key material information is determined from the software material information.

[0091] In this step, the key material information can be determined from the above software material information. Referring to the above related explanations, it can be known that the key material information includes the material version identification of the software material information and the component dependency relationship between multiple components.

[0092] The dependency between components refers to the relationship that one software component needs other components to exist and run correctly in order to work properly. This kind of dependency is a common phenomenon in software development, especially in large projects, where different functional modules or services are usually designed as independent components that interact with each other through interfaces.

[0093] In step S130, the key material information is encrypted and the encrypted key material information is stored in the blockchain.

[0094] In this step, the key material information can be encrypted and the encrypted key material information can be stored in the blockchain. Exemplarily, an encryption algorithm (e.g., symmetric encryption algorithm, asymmetric encryption algorithm, hybrid encryption algorithm, etc.) can be used to encrypt the key material information to obtain the encrypted key material information. Afterwards, the encrypted key material information can be stored in the blockchain, thereby utilizing the data immutability of the blockchain to ensure that the key material information cannot be tampered with, thereby ensuring software information security.

[0095] Exemplarily, the present disclosure can define a structure Component based on Solidity code to represent the various components of the software. Each component has a uniqueId field, which is an unsigned integer (uint256) used to uniquely identify the component (also known as a derived component identifier). The present disclosure can also define a structure ComponentReference to represent the dependency relationship between components. Each ComponentReference instance contains two fields: parentId represents the unique identifier of the parent component, and childId represents the unique identifier of the child component. Through these references, a tree or graph structure between components can be constructed. Each node in the tree structure represents a component, and the pointer or link of the node points to its child component.

[0096] The present disclosure also defines a mapping variable components to store all components. The key is of uint256 type and the value is of Component type. This mapping is used to store all components, and the corresponding component information can be quickly found through the unique identifier of the component. The public keyword makes this mapping open to external calls, so that component information can be directly queried.

[0097] The present disclosure also defines a dynamic array componentReferences, which is used to store all component dependencies. Each element in the array is a ComponentReference instance, representing a pair of parent-child components. Similarly, the public keyword makes this array open to external calls, so that the dependencies between components can be directly queried.

[0098] Exemplarily, the following is an example of a JSON object of the above structure and variables defined based on Solidity in an embodiment of the present disclosure:

[0099] contract ComponentTree{

[0100] / / Define the software component structure

[0101] struct Component{

[0102] uint256 uniqueId; / / component's derived component identifier}

[0103] / / Define component reference relationship structure

[0104] struct ComponentReference{

[0105] uint256 parentId; / / derived component identifier of the parent component

[0106] uint256 childId; / / derived component identifier of the child component}

[0107] / / Store the mapping of all components

[0108] mapping(uint256=>Component)public components;

[0109] / / Store the array of all component dependencies

[0110] ComponentReference[]public componentReferences;

[0111] In an optional implementation, the present disclosure can also determine risk components among multiple components, and crawl risk information corresponding to the risk components. Afterwards, the crawled risk information can be preprocessed (for example: its format can be uniformly converted into JSON format), and then, the processed risk information can be encrypted to obtain encrypted risk information. Afterwards, the derivative component identifier corresponding to the risk component can be associated with the encrypted risk information and stored in a local database.

[0112] Among them, the risk component can be a vulnerability component with potential security risks, and the risk information can be a possible vulnerability name or vulnerability number, etc., which can be set according to the actual situation, and the present disclosure does not make special restrictions on this. For example, the following shows an example of a JSON object of any risk component in the embodiments of the present disclosure:

[0113] {"CVEID":"CVE-2023-1234",

[0114] "Component_name":"Component_B",

[0115] 'version':1.2.3}

[0116] The above code describes a security vulnerability in a specific software component (Component_B) in its version 1.2.3, which has been assigned the CVE number CVE-2023-1234.

[0117] refer to Figure 4 , Figure 4 A flowchart showing how to store the risk information of the SBOM and risk components in the embodiment of the present disclosure includes steps S401 to S404:

[0118] In step S401, the risk information of the SBOM and risk components is obtained;

[0119] In step S402, data preprocessing may include obtaining key material information and secondary material information from the SBOM, and formatting the risk information;

[0120] In step S403, data is encrypted;

[0121] In step S404, the encrypted key material information is stored in the blockchain, and the encrypted secondary material information and encrypted risk information are stored in the off-chain database.

[0122] In an optional implementation, the present disclosure can also monitor the risk information change events of each component in real time, and update the relevant information stored in the local database in real time according to the risk information change events. Figure 5 , Figure 5 A flow chart showing how to update relevant information stored in a local database in real time according to a risk information change event in an embodiment of the present disclosure includes steps S501 to S503:

[0123] In step S501, in response to monitoring a risk information change event of a target risk component, the changed risk information is acquired.

[0124] In this step, you can write code based on Solidity to design an automated monitoring node to monitor the VulnerabilityAdded event (the addVulnerability function is used to add new component vulnerability information, which triggers the VulnerabilityAdded event). The VulnerabilityAdded event can contain the component name and component version number of the target risk component. Using the vulnerability number in the risk information as the index field can efficiently query these events.

[0125] When a risk information change event of a target risk component is monitored, the risk information change event can be parsed to find the risk information after the change occurs.

[0126] In step S502, according to the derived component identifier corresponding to the target risk component, the encrypted risk information associated with the target risk component is searched from the local database.

[0127] In this step, a derived component identifier may be generated according to the original component identifier and the component version identifier corresponding to the target risk component, and then the encrypted risk information associated with the target risk component may be found from the local database according to the derived component identifier.

[0128] In step S503, the encrypted risk information is updated based on the changed risk information.

[0129] In this step, the risk information after the change can be encrypted to obtain new encrypted information, and the new encrypted information can be used to update the encrypted risk information stored in the local database. Thus, it can be ensured that the local database stores the latest risk information to avoid risk problems caused by inconsistency between data and actual conditions.

[0130] In an optional implementation, after the encrypted component information block is updated based on the changed risk information, in view of the change in the SBOM, the present disclosure may also add a version update record of the software material information of the target risk component on the blockchain, and the version update record may include an updated material version identifier and a location pointer pointing to the updated material version identifier.

[0131] In an optional embodiment, if the changed risk information meets the preset warning conditions, the present disclosure can also generate warning information for the changed risk information; wherein the above-mentioned preset warning conditions have a preset correlation with the hazard level of the changed risk information, for example: when the hazard level of the changed risk information is higher than the preset hazard level, warning information can be generated and a warning notification about the warning information can be triggered.

[0132] refer to Figure 6 , Figure 6 A schematic diagram showing how to trigger risk warning information in an embodiment of the present disclosure includes steps S601 to S605:

[0133] In step S601, monitoring risk information change events;

[0134] In step S602, a target risk component for which a vulnerability update has occurred is determined;

[0135] In step S603, the SBOM of the target risk component is searched;

[0136] In step S604, the SBOM version is updated;

[0137] In step S605, when the preset warning condition is met, a warning notification is triggered.

[0138] refer to Figure 7 , Figure 7 The overall flow chart of the information processing method in the embodiment of the present disclosure is shown, including steps S701 to S708:

[0139] In step S701, obtain SBOM;

[0140] In step S702, risk information of the risk component is obtained;

[0141] In step S703, data encryption is performed;

[0142] In step S704, the data is distributedly stored on and off the chain;

[0143] In step S705, risk change events are monitored;

[0144] In step S706, the SBOM of the target risk component is searched;

[0145] In step S707, the SBOM version is updated;

[0146] In step S708, when the preset warning conditions are met, a warning notification is triggered.

[0147] Based on the above technical solutions, the present disclosure has at least the following technical effects:

[0148] First, the use of blockchain technology, with its immutability and high transparency, ensures the absolute integrity of SBOM data, effectively realizing tamper-proof and efficient data distribution;

[0149] Second, the disclosure can record the SBOM change history in detail, greatly facilitating data sharing and rapid verification among users in the software supply chain;

[0150] Third, in view of the limitation of blockchain storage space, this paper further proposes a distributed storage strategy combining on-chain and off-chain to optimize the SBOM data processing and storage efficiency;

[0151] Fourth, the present disclosure implements an instant warning function by real-time monitoring of the vulnerability library and intelligently associating the SBOM of the affected components, thereby significantly improving the software security response speed.

[0152] The present disclosure also provides an information processing device, Figure 8 A schematic diagram showing the structure of an information processing device in an exemplary embodiment of the present disclosure is shown; Figure 8 As shown, the information processing device 800 may include an information acquisition module 810, a key information determination module 820 and a storage module 830. Among them:

[0153] The information acquisition module 810 is used to acquire the software material information of each software; each software is composed of multiple components;

[0154] A key information determination module 820 is used to determine key material information from the software material information; the key material information includes a material version identifier of the software material information and a component dependency relationship between the multiple components;

[0155] The storage module 830 is used to encrypt the key material information and store the encrypted key material information in the blockchain.

[0156] In an exemplary embodiment of the present disclosure, after acquiring the software material information of each software, the storage module 830 is further configured to:

[0157] Determining secondary material information from the software material information, the secondary material information including component information of each component; the component information including original component identification, component version identification and component license information;

[0158] The secondary material information is encrypted and the encrypted secondary material information is stored in a local database.

[0159] In an exemplary embodiment of the present disclosure, the storage module 830 encrypts the secondary material information and stores the encrypted secondary material information in a local database, including:

[0160] Generate a derived component identifier according to the original component identifier and the component version identifier of each component;

[0161] Performing data flattening processing on the component information of each component to obtain each standard component information block corresponding to each component information; the standard component information block does not contain a nested relationship;

[0162] Each standard component information block corresponding to each component is encrypted to obtain an encrypted component information block, and the derived component identifier is associated with the encrypted component information block and stored in a local database.

[0163] In an exemplary embodiment of the present disclosure, the storage module 830 generates a derived component identifier according to the original component identifier and the component version identifier, including:

[0164] Concatenate the original component identifier and the component version identifier to generate concatenation information;

[0165] The splicing information is encrypted to obtain the derived component identifier.

[0166] In an exemplary embodiment of the present disclosure, the storage module 830 is further configured to:

[0167] identifying a risk component among the plurality of components;

[0168] Obtaining risk information corresponding to the risk component, and encrypting the risk information to obtain encrypted risk information;

[0169] The derivative component identifier corresponding to the risk component is associated with the encrypted risk information and stored in a local database.

[0170] In an exemplary embodiment of the present disclosure, the storage module 830 is further configured to:

[0171] In response to monitoring a risk information change event of a target risk component, obtaining the changed risk information;

[0172] According to the derivative component identifier corresponding to the target risk component, searching the local database for the encrypted risk information associated with the target risk component;

[0173] The encrypted risk information is updated based on the changed risk information.

[0174] In an exemplary embodiment of the present disclosure, after updating the encrypted risk information based on the changed risk information, the storage module 830 is further configured to:

[0175] Adding a version update record of the software material information of the target risk component to the blockchain;

[0176] The version update record includes an updated material version identifier and a location pointer pointing to the updated material version identifier.

[0177] In an exemplary embodiment of the present disclosure, the storage module 830 is further configured to:

[0178] In response to the changed risk information satisfying a preset warning condition, generating warning information for the changed risk information; the preset warning condition and the hazard level of the changed risk information have a preset correlation relationship;

[0179] Triggering an early warning notification regarding the early warning information.

[0180] The specific details of each module in the above-mentioned information processing device have been described in detail in the corresponding information processing method, so they will not be repeated here.

[0181] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0182] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0183] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0184] The present disclosure also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or may exist independently without being assembled into the electronic device.

[0185] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0186] Computer-readable storage media can send, propagate or transmit programs for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable storage medium can be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0187] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiments.

[0188] In addition, an electronic device capable of implementing the above method is also provided in an embodiment of the present disclosure.

[0189] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0190] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0191] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include, but are not limited to: at least one processor 910, at least one memory 920, a bus 930 connecting different system components (including the memory 920 and the processor 910), and a display 940.

[0192] The memory stores program codes, which can be executed by the processor 910, so that the processor 910 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processor 910 can perform the following steps: Figure 1 As shown in: Step S110, obtain the software material information of each software; each software is composed of multiple components; Step S120, determine the key material information from the software material information; the key material information includes the material version identification of the software material information and the component dependency relationship between multiple components; Step S130, encrypt the key material information and store the encrypted key material information in the blockchain.

[0193] The memory 920 may include a readable medium in the form of a volatile storage, such as a random access memory (RAM) 9201 and / or a cache memory 9202 , and may further include a read-only memory (ROM) 9203 .

[0194] The memory 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0195] Bus 930 may be a bus representing one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0196] The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. In addition, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0197] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. An information processing method, characterized in that: include: Get the software material information of each software; Each of the software is composed of multiple components; Determining key material information from the software material information; The key material information includes the material version identifier of the software material information and the component dependency relationship between the multiple components; The key material information is encrypted and the encrypted key material information is stored in the blockchain.

2. The method according to claim 1, characterized in that After obtaining the software material information of each software, the method further includes: Determining secondary material information from the software material information, the secondary material information including component information of each component; the component information including original component identification, component version identification and component license information; The secondary material information is encrypted and the encrypted secondary material information is stored in a local database.

3. The method according to claim 2, characterized in that The encrypting the secondary material information and storing the encrypted secondary material information in a local database includes: Generate a derived component identifier according to the original component identifier and the component version identifier of each component; Performing data flattening processing on the component information of each component to obtain each standard component information block corresponding to each component information; the standard component information block does not contain a nested relationship; Each standard component information block corresponding to each component is encrypted to obtain an encrypted component information block, and the derived component identifier is associated with the encrypted component information block and stored in a local database.

4. The method according to claim 3, characterized in that: The generating a derived component identifier according to the original component identifier and the component version identifier includes: Concatenate the original component identifier and the component version identifier to generate concatenation information; The splicing information is encrypted to obtain the derived component identifier.

5. The method according to claim 3 or 4, characterized in that: The method further comprises: identifying a risk component among the plurality of components; Obtaining risk information corresponding to the risk component, and encrypting the risk information to obtain encrypted risk information; The derivative component identifier corresponding to the risk component is associated with the encrypted risk information and stored in a local database.

6. The method according to claim 5, characterized in that The method further comprises: In response to monitoring a risk information change event of a target risk component, obtaining the changed risk information; According to the derivative component identifier corresponding to the target risk component, searching the local database for the encrypted risk information associated with the target risk component; The encrypted risk information is updated based on the changed risk information.

7. The method according to claim 6, characterized in that After updating the encrypted risk information based on the changed risk information, the method further includes: Adding a version update record of the software material information of the target risk component to the blockchain; The version update record includes an updated material version identifier and a location pointer pointing to the updated material version identifier.

8. The method according to claim 6, characterized in that The method further comprises: In response to the changed risk information satisfying a preset warning condition, generating warning information for the changed risk information; the preset warning condition and the hazard level of the changed risk information have a preset correlation relationship; Triggering an early warning notification regarding the early warning information.

9. An information processing device, characterized in that: include: An information acquisition module is used to obtain software material information of each software; Each of the software is composed of multiple components; A key information determination module, used to determine key material information from the software material information; the key material information includes a material version identifier of the software material information and a component dependency relationship between the multiple components; The storage module is used to encrypt the key material information and store the encrypted key material information in the blockchain.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the information processing method according to any one of claims 1 to 8 is implemented.

11. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the information processing method according to any one of claims 1 to 8 by executing the executable instructions.

Images