Method and device for introducing secure open source component based on process control
By creating isolation libraries and access libraries on private servers, pre-control of open source components is achieved, and problems such as delay in identifying and repairing security vulnerabilities, high costs and lack of prevention mechanisms in the existing technology are solved, which significantly improves security and management efficiency.
Patent Information
- Application Number
- CN202411774741.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-05
- Publication Date
- 2025-04-15
AI Technical Summary
In the prior art, security scanning is usually performed after open source components have been integrated into the project, resulting in delays in identifying and repairing security vulnerabilities, high repair costs, risk spread of public dependency libraries, and lack of prevention mechanisms.
By creating isolation libraries and access libraries on private servers, configuring the isolation library proxy external dependency library, storing secure components in the access library, realizing pre-control of open source components. Decide whether to initiate the introduction application process based on whether the component exists in the access database, and ensure the security of the component through the security tool scanning and approval process.
It effectively avoids the direct use of unsafe components, significantly improves security, reduces project risks, reduces the cost of repairing security problems in the later stage, enhances security between projects, and realizes traceability and statistics of component usage.
Smart Images
Figure CN119829049A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a method, device, computer-readable storage medium, electronic device and program product for introducing secure open source components based on process control. Background Art
[0002] With the popularity of open source software, modern software development projects increasingly rely on various open source components to speed up the development process and reduce costs. In order to manage these open source components, many organizations use private servers (such as Nexus) as dependency management tools. Private servers not only provide agents for external open source repositories, but also allow project teams to cache commonly used components into local dependency libraries, thereby speeding up compilation and building.
[0003] However, despite the convenience provided by private servers, a post-scanning method is now commonly used to identify security vulnerabilities in open source components. Specifically, developers specify the required open source components in the project configuration file, and the private server pulls the components in real time based on this configuration information and caches them into the dependency library. After that, the project is compiled and built using the configured dependency repository information. Once the project is built, Open Source Guard, XRay, or other security scanning tools are used to perform a security scan on the project to identify components with security vulnerabilities. The current limitations are as follows:
[0004] (1) Limitations of post-scanning: In existing technologies, security scanning occurs after a component has been pulled and may be referenced, which means that the identification and repair of security vulnerabilities are often performed after the component has been integrated into the project, which leads to delays in responding to and handling security vulnerabilities. (2) High repair costs: When a security vulnerability is discovered in a post-scan, multiple projects may already rely on the vulnerable component. At this point, repairing the security vulnerability not only involves code modifications for a single project, but may also require coordination between multiple projects and teams, resulting in a significant increase in repair costs. (3) Risk spread of common dependency libraries: Since dependency libraries are usually shared by multiple projects, an unsafe component introduced by one project may affect all projects that use the dependency library, increasing the security risks faced by the entire organization. (4) Lack of prevention mechanisms: Existing technologies lack effective prevention mechanisms to identify and intercept open source components that may have security risks in advance, which gives components with security vulnerabilities the opportunity to enter dependency libraries and be used by project teams. Summary of the invention
[0005] To address the deficiencies of the prior art, the present invention implements the prior control of open source components through the establishment of an isolation library and an access library, preventing unsafe open source components from being directly used by the project team. Through the management of the isolation library and the access library, the traceability and statistics of component use are achieved.
[0006] To achieve the above objectives, the technical solutions adopted by the present invention include:
[0007] A method for introducing secure open source components based on process control, characterized by comprising: creating an isolation library and an access library of open source components on a private server, configuring the isolation library to proxy an external dependency library, and storing secure components that can be used safely in the access library;
[0008] Fill in the open source component information in the configuration file, and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including:
[0009] If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer;
[0010] If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered;
[0011] According to the triggered introduction application process, the open source components are downloaded to the isolated library, and it is determined whether the open source components are newly added open source components based on the preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned using security tools. If the usage conditions are met, they will be copied to the access library to notify the developers to use them.
[0012] Exemplarily, the preset conditions include: when initiating the introduction application process, determining whether the open source component exists in the blacklist or the whitelist; if the open source component exists in the blacklist, terminating the introduction application process; if the open source component exists in the whitelist, the introduction application process triggers the pulling of the open source component to the access library, and after the pulling is completed, notifying the developer to use it.
[0013] Exemplarily, the preset condition also includes: performing security scanning or manual code inspection on newly added open source components that are not in the blacklist or whitelist.
[0014] Exemplarily, the method further includes: approving the results of security scanning or manual code inspection of the newly added open source components that are not in the blacklist or whitelist, and after approval, pulling the open source components to the access library and notifying developers to use them.
[0015] Specifically, the introduction of the approval process clarifies the criteria and responsible persons for determining whether open source components are allowed to be used.
[0016] Exemplarily, the method further includes: if the approval result of the introduction application process is passed, the open source component is copied from the isolation library to the access library; if the approval result of the introduction application process is not passed, the open source component is transferred to the exit library.
[0017] Specifically, the newly added exit library can help update the unsafe open source components of the blacklist in real time to further improve the review efficiency of the preliminary blacklist and whitelist, without the need for scanning and approval procedures by security tools.
[0018] Exemplarily, if the first open source component does not exist in the access library, a failure log will appear and the introduction application process will be triggered. It also includes that before pulling the open source component to the isolation library, the introduction application process triggers the execution of the build script for compilation. If the compilation fails, the introduction application process is triggered.
[0019] Specifically, the efficiency of introducing and managing open source components is improved by automating the process of building scripts and process control.
[0020] The present invention also provides a device for introducing a secure open source component based on process control, which is characterized by comprising:
[0021] Create a module to create an isolation library and access library for open source components, configure the isolation library to proxy the external dependency library, and store the secure components that can be used safely in the access library;
[0022] The configuration module is used to fill in the open source component information in the configuration file and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including:
[0023] If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer;
[0024] If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered;
[0025] The judgment module is used to download the open source components to the isolated library according to the triggered introduction application process, and judge whether the open source components are newly added open source components according to preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned by security tools. If the usage conditions are met, they will be copied to the access library to notify developers for use.
[0026] The present invention also provides a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.
[0027] The present invention also provides an electronic device, characterized in that it includes a processor and a memory;
[0028] The memory is used to store computer programs;
[0029] The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.
[0030] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.
[0031] The beneficial effects of the present invention are as follows: This technical solution realizes the prior control of open source components by establishing an isolation library and an access library, effectively avoiding the direct use of unsafe components, significantly improving security and reducing project risks. The combination of automated processes and build scripts not only improves the efficiency of component introduction and management, but also enhances the clarity of the approval process through the application of preset conditions and security scanning tools, ensuring the security of all components in the access library. In addition, the solution reduces the cost of later repairs of security issues through prior review, while encouraging developers to adopt safer components, indirectly improving code quality. Through the setting of an isolation library, the potential impact of unsafe components on common dependency libraries is reduced, thereby enhancing security between projects, achieving traceability and statistics of component use, and providing a safer, more reliable and efficient open source component management mechanism for software development projects. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] Figure 1 The present invention is a flow chart of the method for introducing secure open source components based on process control.
[0033] Figure 2 A schematic diagram of a device for introducing secure open source components based on process control according to the present invention. DETAILED DESCRIPTION
[0034] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0035] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.
[0036] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.
[0037] The first aspect of the present invention relates to a process flow of introducing a secure open source component based on process control. Figure 1 The method shown comprises:
[0038] Create an isolation library and access library for open source components on the private server, configure the isolation library to proxy the external dependency library, and store the secure components that can be used safely in the access library;
[0039] Fill in the open source component information in the configuration file, and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including:
[0040] If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer;
[0041] If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered;
[0042] According to the triggered introduction application process, the open source components are downloaded to the isolated library, and it is determined whether the open source components are newly added open source components based on the preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned using security tools. If the usage conditions are met, they will be copied to the access library to notify the developers to use them.
[0043] Specifically, create isolated libraries, entry libraries, and exit libraries for open source components on private servers; configure isolated libraries to proxy external dependency libraries, such as Alibaba Cloud's official Maven repository.
[0044] Users fill in the open source component information in the configuration file during the development process. For example, in a Maven project, fill in the component coordinate information in the pom file.
[0045] If the access library exists, execute the mvn clean compile command to automatically pull open source components from the access library when the project is compiled.
[0046] If the access repository does not exist, a failure log will appear when the mvn clean compile command is executed, and the import application process will be initiated.
[0047] According to the open source component information filled in by the project team, initiate the introduction application process, pull the open source components to the isolation library, and then determine whether the open source components are in the previously maintained open source component blacklist or whitelist. If they are in the blacklist, the process is terminated and they are not allowed to be used.
[0048] If it is on the whitelist, the introduction application process will trigger the copying of the open source component from the isolated library to the access library, and notify the project team to use it.
[0049] If the open source component is not on the blacklist or whitelist, it needs to be scanned by a security tool first, and the relevant functional department will determine whether it is allowed to use based on the security scan results. If there are special circumstances where scanning is unable to produce results, manual code inspection can be selected.
[0050] If approval is not passed, the developer is notified that use is not allowed.
[0051] If approved, the process will trigger a copy of the component from the isolated library to the access library, and the developers of the project team will be notified to use it.
[0052] Another aspect of the present invention also relates to a device for introducing a secure open source component based on process control, the structure of which is as follows: Figure 2 As shown, including:
[0053] Create a module to create an isolation library and access library for open source components, configure the isolation library to proxy the external dependency library, and store the secure components that can be used safely in the access library;
[0054] The configuration module is used to fill in the open source component information in the configuration file and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including:
[0055] If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer;
[0056] If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered;
[0057] The judgment module is used to download the open source components to the isolated library according to the triggered introduction application process, and judge whether the open source components are newly added open source components according to preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned by security tools. If the usage conditions are met, they will be copied to the access library to notify developers for use.
[0058] By using this device, the above-mentioned calculation processing method can be executed and the corresponding technical effects can be achieved.
[0059] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.
[0060] An embodiment of the present invention also provides an electronic device for executing the above method. As an implementation device of the method, the electronic device has at least a processor and a memory, and in particular, the memory stores data and related computer programs required for executing the method, such as storing set calculation programs, etc., and the processor calls the data and programs in the memory to execute all steps of the implementation method and obtains the corresponding technical effect.
[0061] Preferably, the electronic device may include a bus architecture, the bus may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same component, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor when performing operations.
[0062] In addition, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operation control) used may include a microprocessor or other processor device and / or a logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, which may store the above-mentioned related data information, and may also store a program for executing related information, and the processor may execute the program stored in the memory to realize information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it may be a key or a touch input device; the power supply is used to provide power to the electronic device; the display is used to display display objects such as images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide an audio output via the speaker and receive an audio input from the microphone, thereby realizing a common telecommunication function. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processor, so that recording can be performed on the machine through the microphone, and the sound stored on the machine can be played through the speaker.
[0063] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0064] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.
[0065] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.
[0067] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.
Claims
1. A method for introducing secure open source components based on process control, characterized in that: include: Create an isolation library and access library for open source components on the private server, configure the isolation library to proxy the external dependency library, and store the secure components that can be used safely in the access library; Fill in the open source component information in the configuration file, and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including: If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer; If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered; According to the triggered introduction application process, the open source components are downloaded to the isolated library, and it is determined whether the open source components are newly added open source components based on the preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned using security tools. If the usage conditions are met, they will be copied to the access library to notify the developers to use them.
2. The method according to claim 1, characterized in that The preset conditions include: when initiating the introduction application process, determining whether the open source component exists in the blacklist or the whitelist; If the open source component is on the blacklist, the introduction application process will be terminated; If the open source component exists in the whitelist, the introduction application process will trigger the pull of the open source component to the access library. After the pull is completed, the developer will be notified to use it.
3. The method according to claim 2, characterized in that The preset conditions also include: performing security scanning or manual code inspection on newly added open source components that are not in the blacklist or whitelist.
4. The method according to claim 3, characterized in that The method further includes: approving the result of security scanning or manual code inspection of the newly added open source components that are not in the blacklist or whitelist, and after approval, pulling the open source components to the access library and notifying developers to use them.
5. The method according to claim 1, characterized in that The method also includes: if the approval result of the introduction application process is passed, the open source component is copied from the isolation library to the admission library; if the approval result of the introduction application process is not passed, the open source component is transferred to the exit library.
6. The method according to claim 1, characterized in that If the first open source component does not exist in the access library, a failure log will appear and the introduction application process will be triggered. It also includes that before pulling the open source component to the isolation library, the introduction application process triggers the execution of the build script for compilation. If the compilation fails, the introduction application process is triggered.
7. A device for introducing secure open source components based on process control, characterized in that: include: Create a module to create an isolation library and access library for open source components, configure the isolation library to proxy the external dependency library, and store the secure components that can be used safely in the access library; The configuration module is used to fill in the open source component information in the configuration file and decide whether to initiate the introduction application process based on whether the open source component exists in the access library, including: If the first open source component exists in the access library, the first open source component is pulled from the access library during compilation for use by the developer; If the first open source component does not exist in the admission library, a failure log will appear and the introduction application process will be triggered; The judgment module is used to download the open source components to the isolated library according to the triggered introduction application process, and judge whether the open source components are newly added open source components according to preset conditions. If they are newly added open source components, the open source components in the newly added isolated library will be scanned by security tools. If the usage conditions are met, they will be copied to the access library to notify developers for use.
8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.
9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.
10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.