File tamper-proofing processing method and device and related equipment

Abstract

The invention provides a file tamper-proof processing method and device and related equipment, and relates to the technical field of data processing. The method comprises the following steps: in response to a target software package uploaded by a first user, generating a first software bill of material file, generating a first user private key according to user information of the first user, and encrypting component information of each component in the first software bill of material file by using the first user private key to obtain a first resource list; in response to a second software bill of material file uploaded by a second user for the target software package, generating a second user private key according to user information of the second user, and encrypting component information of each component in the second software bill of material file by using the second user private key to obtain a second resource list; and comparing whether the first resource list is consistent with the second resource list or not, and determining whether the first software bill of material file is tampered or not according to a comparison result. According to the invention, the security and authenticity of the software bill of material file can be ensured.

Description

Background Art

[0002] The Software Bill of Materials (SBOM) is a document that records the structure and composition of a software product. The SBOM lists all the components used in the software. Through the SBOM, the source of the software components can be traced, and potential security risks can be discovered and dealt with in a timely manner. Therefore, the SBOM itself is also a file that needs to be protected. Once the SBOM is tampered with, the component-related information it provides will lose credibility and cannot effectively support the security and compliance management of the software.

[0003] In order to ensure the security and authenticity of the software bill of materials and prevent it from being tampered with, encryption algorithms are currently mainly used to encrypt the software bill of materials. However, once the encryption is cracked or the software bill of materials is illegally modified during transmission or storage, its security and authenticity are difficult to guarantee.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a file tamper-proof processing method, device and related equipment, which at least to a certain extent overcome the problem that the security and authenticity of software material list files are difficult to ensure.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a file tamper-proof processing method is provided, comprising: in response to a first user uploading a target software package, generating a first software bill of materials file, generating a first user private key according to user information of the first user, and using the first user private key to encrypt component information of each component in the first software bill of materials file respectively to obtain a first resource list, wherein the first software bill of materials file contains component information of one or more components in the target software package, and the first resource list contains encrypted results of component information of each component; in response to a second software bill of materials file uploaded by a second user for the target software package, generating a second user private key according to user information of the second user, and using the second user private key to encrypt component information of each component in the second software bill of materials file respectively to obtain a second resource list, wherein the second software bill of materials file contains component information of one or more components in the target software package, and the second resource list contains encrypted results of component information of each component; comparing whether the first resource list is consistent with the second resource list, and determining whether the first software bill of materials file has been tampered with according to the comparison result.

[0008] In some embodiments, the method further includes: obtaining user information of a first user, generating a first user identifier of the first user based on the user information of the first user, and encrypting the first user identifier to obtain a private key of the first user; obtaining user information of a second user, generating a second user identifier of the second user based on the user information of the second user, and encrypting the second user identifier to obtain a private key of the second user.

[0009] In some embodiments, the method further includes: encrypting the first user private key to obtain an encrypted first user private key; encrypting the second user private key to obtain an encrypted second user private key; and displaying the encrypted first user private key and the encrypted second user private key.

[0010] In some embodiments, determining whether the first software bill of materials file has been tampered with based on the comparison results includes: if the first resource list and the second resource list are consistent, determining that the first software bill of materials file has not been tampered with; if the first resource list and the second resource list are inconsistent, determining that the first software bill of materials file has been tampered with.

[0011] In some embodiments, the first software bill of materials file includes first structured data, and the second software bill of materials file includes second structured data, and the method further includes: obtaining a key specification and an encryption algorithm; determining component information of each component in the first software bill of materials file based on the first structured data in the first software bill of materials file; encrypting the component information of each component in the first software bill of materials file based on the symmetric encryption key specification and encryption algorithm, and obtaining a first encryption result value corresponding to each component; determining the component information of each component in the second software bill of materials file based on the second structured data in the second software bill of materials file; encrypting the component information of each component in the second software bill of materials file based on the symmetric encryption key specification and encryption algorithm, and obtaining a second encryption result value corresponding to each component.

[0012] In some embodiments, the method also includes: obtaining a first encryption result value corresponding to each component in the first software bill of materials file; obtaining a second encryption result value corresponding to each component in the second software bill of materials file; using the first user private key to separately encrypt the component information of each component in the first software bill of materials file to obtain a first resource list, including: using the first user private key to separately encrypt the first encryption result value corresponding to each component in the first software bill of materials file to obtain a third encryption result value corresponding to each component in the first software bill of materials file; obtaining a first resource list based on the third encryption result value corresponding to each component in the first software bill of materials file; using the second user private key to separately encrypt the component information of each component in the second software bill of materials file to obtain a second resource list, including: using the second user private key to separately encrypt the second encryption result value corresponding to each component in the second software bill of materials file to obtain a fourth encryption result value corresponding to each component in the second software bill of materials file; obtaining a second resource list based on the fourth encryption result value corresponding to each component in the second software bill of materials file.

[0013] In some embodiments, after using the first user private key to encrypt the component information of each component in the first software bill of materials file, the method also includes: adding a hash-based message authentication code field to the component information description field of each component in the first software bill of materials file; storing the second encryption result value corresponding to each component in the first software bill of materials file in the hash-based message authentication code field corresponding to each component in the first software bill of materials file, to generate a third software bill of materials file; after using the second user private key to encrypt the component information of each component in the second software bill of materials file, the method also includes: adding a hash-based message authentication code field to the component information description field of each component in the second software bill of materials file; storing the fourth encryption result value corresponding to each component in the second software bill of materials file in the hash-based message authentication code field corresponding to each component in the second software bill of materials file, to generate a fourth software bill of materials file.

[0014] In some embodiments, the first software bill of materials file includes multiple components, and the second software bill of materials file includes multiple components. The method further includes: if the first resource list and the second resource list are inconsistent, determining the difference data items in the first resource list and the second resource list; mapping the difference data items to the third software bill of materials file and the fourth software bill of materials file to obtain difference components, and the difference components include one or more of tampered components, newly added components and deleted components.

[0015] In some embodiments, when the first structured data and / or the second structured data are data in Json format, each object in the first structured data and / or the second structured data represents information related to a component; when the first structured data and / or the second structured data are data in extensible markup language format, each tag in the first structured data and / or the second structured data represents information related to a component.

[0016] According to another aspect of the present disclosure, a file tamper-proof processing device is also provided, including: a first encryption module, used to generate a first software bill of materials file in response to a first user uploading a target software package, generate a first user private key according to the user information of the first user, and use the first user private key to encrypt the component information of each component in the first software bill of materials file respectively to obtain a first resource list, wherein the first software bill of materials file contains the component information of one or more components in the target software package, and the first resource list contains the encrypted results of the component information of each component; a second encryption module, used to generate a second user private key according to the user information of the second user in response to a second software bill of materials file uploaded by a second user for the target software package, and use the second user private key to encrypt the component information of each component in the second software bill of materials file respectively to obtain a second resource list, wherein the second software bill of materials file contains the component information of one or more components in the target software package, and the second resource list contains the encrypted results of the component information of each component; a comparison module, used to compare whether the first resource list is consistent with the first resource list, and determine whether the first software bill of materials file has been tampered with according to the comparison result.

[0017] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned file anti-tampering processing methods by executing the executable instructions.

[0018] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the file anti-tampering processing method described in any one of the above is implemented.

[0019] According to another aspect of the present disclosure, a computer program product is provided, including: a computer program or instructions, which implement any one of the above-mentioned file tamper-proof processing methods when executed by a processor.

[0020] The file anti-tampering processing method, device, electronic device and storage medium provided in the embodiments of the present disclosure relate to the field of data processing technology. The method includes: in response to a first software bill of materials file uploaded by a first user for a target software package, a first user private key is generated according to the user information of the first user, and the component information of each component in the first software bill of materials file is encrypted using the first user private key to obtain a first resource list, wherein the first software bill of materials file contains component information of one or more components in the target software package, and the first resource list contains the encrypted results of the component information of each component; in response to a second software bill of materials file uploaded by a second user for the target software package, a second user private key is generated according to the user information of the second user, and the component information of each component in the second software bill of materials file is encrypted using the second user private key to obtain a second resource list, wherein the second software bill of materials file contains component information of one or more components in the target software package, and the second resource list contains the encrypted results of the component information of each component; comparing the first resource list with the first resource list to see if they are consistent, and determining whether the first software bill of materials file has been tampered with according to the comparison result. The present invention generates a dedicated private key based on the user information of each user, and uses the user private keys of different users to encrypt the component information in the corresponding software bill of materials file, associates the software bill of materials file with the user information, ensures the source of the software bill of materials file is reliable, and ensures the confidentiality and integrity of the data. By comparing the encryption results of different software bill of materials files, it can be identified whether the software bill of materials has been tampered with, ensuring the security and authenticity of the software bill of materials file.

[0021] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0023] Figure 1 A schematic diagram showing the system architecture of a method for preventing file tampering according to an embodiment of the present disclosure is shown;

[0024] Figure 2 A flowchart of a method for preventing file tampering in an embodiment of the present disclosure is shown;

[0025] Figure 3A flow chart of a method for generating a first user private key and a second user private key in an embodiment of the present disclosure is shown;

[0026] Figure 4 A flow chart of a method for encrypting and displaying a user's private key in an embodiment of the present disclosure is shown;

[0027] Figure 5 A flow chart of a method for encrypting a software bill of materials file in an embodiment of the present disclosure is shown;

[0028] Figure 6 A flow chart of a method for obtaining a resource list in an embodiment of the present disclosure is shown;

[0029] Figure 7 A flowchart of a method for file tamper-proofing in an embodiment of the present disclosure is shown;

[0030] Figure 8 A flow chart of a method for determining a tampered component in an embodiment of the present disclosure is shown;

[0031] Fig. 9 A specific method flow chart of a file tamper-proof processing method in an embodiment of the present disclosure is shown;

[0032] Fig.10 A specific method flow chart of a file tamper-proof processing method in an embodiment of the present disclosure is shown;

[0033] Fig.11 A schematic diagram of a file tamper-proof processing device in an embodiment of the present disclosure is shown;

[0034] Fig.12 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0035] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0036] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0037] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0038] Software Bill of Materials (SBOM): A detailed list of all components, libraries, and dependencies used in the software build process, listing the various elements that make up the software application, including open source software components, third-party libraries, frameworks, tools, etc. Each element will have detailed information in the SBOM, such as name, version number, license information, dependencies, etc.

[0039] Currently, the commonly used SBOM file standards include the CycloneDX standard, SPDX (Software Package Data Exchange), SWID (Software Identification) and ISO / IEC 19770-2. Among them, the CycloneDX standard is used to describe various types of components, including software packages, libraries and hardware, and supports multiple formats of output. SPDX is mainly used to describe the licensing information and component information of the software package. SWID tracks and manages software components through unique identifiers. ISO / IEC 19770-2 is a standard issued by the International Organization for Standardization, mainly used for IT asset management, including the description and management of software components.

[0040] A hash operation is an algorithm that converts data of any length into a fixed-length output. A hash function accepts an input (such as a piece of text or a file) and, after a series of mathematical operations, outputs a fixed-length string, which is the hash value. The hash value is unique, and even if the input data changes slightly, the generated hash value will be completely different. Common hash algorithms include MD5, SHA-1, and SHA-256.

[0041] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0042] Figure 1FIG. 1 shows an exemplary system architecture diagram to which the file anti-tampering processing method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture may include a terminal device 101 , a network 102 and a server 103 .

[0043] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, and can be a wired network or a wireless network.

[0044] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0045] The terminal device 101 can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0046] Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0047] The server 103 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0048] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0049] Those skilled in the art will know that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration, and any number of terminal devices, networks and servers may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0050] Under the above system architecture, a method for file tamper-proofing is provided in an embodiment of the present disclosure. The method can be executed by any electronic device with computing and processing capabilities.

[0051] In some embodiments, the file anti-tampering processing method provided in the embodiments of the present disclosure can be executed by a terminal device of the above-mentioned system architecture; in other embodiments, the file anti-tampering processing method provided in the embodiments of the present disclosure can be executed by a server in the above-mentioned system architecture; in other embodiments, the file anti-tampering processing method provided in the embodiments of the present disclosure can be implemented by the terminal device and the server in the above-mentioned system architecture through interaction.

[0052] Figure 2 A flowchart of a method for preventing file tampering in an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the file tamper-proof processing method provided in the embodiment of the present disclosure includes the following steps:

[0053] S202, in response to the first user uploading the target software package, generating a first software bill of materials file, generating a first user private key according to the user information of the first user, and using the first user private key to encrypt the component information of each component in the first software bill of materials file respectively to obtain a first resource list.

[0054] In this embodiment, the target software package is a set of software that has been developed and is ready to be deployed or tested. The first software bill of materials file contains component information of one or more components in the target software package. Component information includes component names, version numbers, license information, and dependencies between components. The user information of the first user may include user account, phone number, and email address. The first user private key is an exclusive private key of the first user generated based on the user information of the first user, which is unique and highly confidential.

[0055] Specifically, in the above steps, when the first user uploads the target software package, in order to improve the transparency of the software supply chain, a hash operation can be performed on the target software package to obtain a hash value of the target software package, and the hash value of the target software package is written into the software bill of materials file of the target software package to obtain a first software inventory file.

[0056] When the software material list is tampered with, the component-related information it provides will lose credibility. In this embodiment, after obtaining the first software inventory file, the first user private key is used to encrypt each component information in the first software material list, obtain the encrypted result value of each component, and generate the first resource list.

[0057] In some embodiments, the first software bill of materials file includes multiple fields. Taking the software bill of materials file in the SPDX standard format as an example, the first software bill of materials file may include SPDX ID (Software Package Data Exchange Identifier), spdxVersion (Software Package Data Exchange Version), fileMd5 (File MD5 (Message-Digest Algorithm 5) Value), packages (Software Packages), name (name), data License (data license), documentNamespace (document namespace) and other field contents. The component information of one or more components in the target software package can be specifically stored in the packages field. When the component information of each component in the first software bill of materials file is encrypted separately using the first user's private key, other fields in the first software bill of materials file can also be encrypted separately to obtain encryption result values ​​corresponding to other fields.

[0058] In this embodiment, the first software inventory file of the target software package is encrypted using the private key of the user who uploaded the target software package. This can associate the first software inventory file with the user information, ensure that the source of the first software inventory file is reliable, and restrict other users' access to the first software inventory file from the source, thereby reducing the possibility of the first software inventory file being tampered with.

[0059] S204, in response to a second software bill of materials file uploaded by a second user for a target software package, generating a second user private key according to the user information of the second user, and using the second user private key to encrypt component information of each component in the second software bill of materials file respectively to obtain a second resource list.

[0060] In this embodiment, the second user and the first user may be the same user or different users. The second software bill of materials file contains component information of one or more components in the target software package, and the second resource list contains encrypted results of component information of each component.

[0061] Specifically, for the same target software package, on the basis of generating the first software bill of materials file, the second user will upload the second software bill of materials file, and the second software bill of materials file may be the same as the first software bill of materials file, or may be a different bill of materials file from the first software bill of materials file. When the second user uploads the second software bill of materials file for the target software package, the system will generate a second user private key for the second user based on the user information of the second user. Using the second user private key, encrypt each component information in the second software bill of materials, obtain the encrypted result value of each component, and generate a second resource list.

[0062] In some embodiments, when the component information of each component in the second software bill of materials file is encrypted separately using the second user private key, other fields in the second software bill of materials file may also be encrypted separately to obtain encryption result values ​​corresponding to the other fields.

[0063] S206: Compare the first resource list and the second resource list to see if they are consistent, and determine whether the first software bill of materials file has been tampered with based on the comparison result.

[0064] The first resource list contains detailed information about each component in the target software package after the first software bill of materials is encrypted, and the second resource list contains detailed information about each component in the target software package after the second software bill of materials is encrypted. By comparing the contents of the first resource list and the second resource list one by one to see if they are consistent, it can be determined whether the first software bill of materials file has been tampered with.

[0065] In some embodiments, if other fields of the first software building material list file are encrypted to obtain encryption result values ​​corresponding to the other fields of the first software building material list file, and other fields of the second software building material list file are encrypted to obtain encryption result values ​​corresponding to the other fields of the second software building material list file, the encryption result values ​​corresponding to the other fields of the first software building material list file and the encryption result values ​​corresponding to the other fields of the second software building material list file can also be compared to determine whether the first software building material list file has been tampered with.

[0066] In some embodiments, determining whether the first software bill of materials file has been tampered with based on the comparison results may include: if the first resource list and the second resource list are consistent, determining that the first software bill of materials file has not been tampered with; if the first resource list and the second resource list are inconsistent, determining that the first software bill of materials file has been tampered with.

[0067] It is understandable that for the same target software package, there is only one correct software bill of materials. When the first resource list and the second resource list are consistent, it means that the first software bill of materials and the second software bill of materials are the same. On the contrary, if there is an inconsistency between the two lists, it means that the file has been modified between the generation of the two lists. Therefore, it can be determined that the first software bill of materials file has been tampered with. By comparing the two resource lists, tampering behavior can be effectively detected, and the integrity and authenticity of the software bill of materials can be verified.

[0068] For example, suppose the first user is different from the second user. The private key of the first user is A, the private key of the second user is B, the first software bill of materials includes components 1, 2 and 3, and the first resource list obtained based on S202 includes A1, A2 and A3; the second software bill of materials also includes components 1, 2 and 3, and the second resource list obtained based on S204 includes B1, B2 and B3. Comparing A1, A2 and A3 in the first resource list with B1, B2 and B3 in the second resource list, the two are obviously inconsistent, so it can be determined that the first software bill of materials has been tampered with.

[0069] For another example, assume that the first user and the second user are the same. The private key of the first user is A, the private key of the second user is also A, the first software bill of materials includes components 1, 2 and 3, and the first resource list obtained based on S202 includes A1, A2 and A3; the second software bill of materials also includes components 1, 2 and 4, and the second resource list obtained based on S204 includes A1, A2 and A4. Comparing A1, A2 and A3 in the first resource list with A1, A2 and A4 in the second resource list, A3 and A4 are inconsistent, so it can be determined that the first software bill of materials has been tampered with.

[0070] In some embodiments, Figure 3This is a flow chart of a method for generating a first user private key and a second user private key according to an embodiment of the present disclosure. Figure 3 As shown, the method also includes:

[0071] S302: Obtain user information of a first user, generate a first user identifier of the first user according to the user information of the first user, and encrypt the first user identifier to obtain a private key of the first user.

[0072] It should be noted that in this embodiment, the user information is obtained in various ways: the user can actively upload the user information, such as the information that the user actively fills in the system when uploading the software package; the system can also collect some information in a legal and compliant manner, such as automatically associating the user's phone number and email address through the user account. The first user identifier is a unique identifier generated based on the user information of the first user, and this identifier is usually unique and exclusive to the first user.

[0073] Generating the first user identification of the first user based on the user information of the first user can be specifically implemented in the following manner: the user account, phone number, email address and other information of the user are generated into a string of fixed length, namely userId, through a hash algorithm. This userId is unique and the original information cannot be reversed, thereby ensuring the security and privacy of the user information. This userId will be stored in the database of the system and associated with the user's user information.

[0074] Since the first user identification is unique, the first user identification is encrypted to obtain the first user private key that is exclusive to the first user. In some embodiments, the first user identification can be written into the first software bill of materials file.

[0075] There are multiple possible encryption methods for encrypting the first user identifier, such as symmetric encryption, asymmetric encryption, and hash encryption.

[0076] With the rapid development of quantum computing, traditional encryption algorithms are facing the risk of being cracked. In some embodiments, in order to resist quantum computing attacks, the disclosed embodiments can use a quantum-resistant encryption algorithm to encrypt the first user identifier. Specifically, quantum-resistant encryption algorithms such as ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) have advantages in key encapsulation compared to other quantum-resistant algorithms. ML-KEM can include multiple parameter sets such as ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The length of the parameter set directly affects the encryption strength and computational efficiency. In this embodiment, ML-KEM-512 can be used to encrypt the first user identifier to obtain the first user private key. Since the parameter set of ML-KEM-512 is relatively short, it can improve the encryption performance under the premise of ensuring a certain degree of security.

[0077] S304: Obtain user information of the second user, generate a second user identifier of the second user according to the user information of the second user, and encrypt the second user identifier to obtain a private key of the second user.

[0078] In this embodiment, user information about the second user is collected, which may include the second user's user account, email address, telephone number and other information. Using the collected user information of the second user, a unique identifier, namely the second user identifier, is generated through a hash algorithm, and this identifier is used to distinguish different users in the system. The second user identifier is encrypted using encryption technology to generate a second user private key. It is understandable that the algorithm used in the specific implementation process in this embodiment can refer to S302, and this disclosure will not go into details here. In some embodiments, the second user identifier can be written into the second software bill of materials file.

[0079] In this embodiment, a user-specific private key is generated based on the user's unique user identifier, and then the private key is used to encrypt the calculation result values ​​of each field in the software bill of materials file, thereby realizing the association between the SBOM file and the user, limiting other users' access to the SBOM file, and reducing the possibility of the SBOM being tampered with.

[0080] In some embodiments, considering the risk of theft if the generated user private key is directly displayed in the system, the first user private key and the second user private key are encrypted before being displayed. Figure 4 A flowchart of a method for encrypting and displaying a user's private key provided in an embodiment of the present application. Figure 4 As shown, the method also includes:

[0081] S402: Encrypt the first user private key to obtain the encrypted first user private key.

[0082] In this embodiment, the private key of the first user is converted into an encrypted form through a specific encryption algorithm (such as symmetric encryption or asymmetric encryption) to prevent unauthorized access and use.

[0083] S404: Encrypt the second user private key to obtain an encrypted second user private key.

[0084] In this embodiment, the second user's private key is encrypted to ensure that the second user's private key is also protected, thereby ensuring the security of the second user's private key.

[0085] S406: Display the encrypted first user private key and the encrypted second user private key.

[0086] In this embodiment, by displaying the encrypted user private key, even if others can see the user's private key on the system, what they see is an encrypted form, which can prevent it from being obtained by others.

[0087] In this embodiment, the user's private key will be encrypted on the system before being displayed to the user, so that even if the user's private key is intercepted during transmission or storage, others cannot easily obtain the user's private key.

[0088] In some embodiments, Figure 5 The present invention is a flowchart of a method for encrypting a software bill of materials file. Figure 5 As shown, the method also includes:

[0089] S502, obtaining a key specification and an encryption algorithm.

[0090] Key specifications refer to the standards and procedures that should be followed in cryptography for key generation, storage, distribution, update, and destruction. An encryption algorithm is a series of computational steps and rules for converting plaintext into ciphertext. Common key specifications include symmetric encryption and asymmetric encryption. In symmetric encryption, the same key is used for encryption and decryption; in asymmetric encryption, there are public keys and private keys, the public key can be made public, and the private key is kept secret.

[0091] In this embodiment, the key specification can be a SecretKeySpec class, and the encryption algorithm can be a Mac (Message Authentication Code) class. Among them, the SecretKeySpec class is a class in the Java encryption extension, which is used to specify the specification of a key. The SecretKeySpec class defines the type of key and the specific value of the key. Through the SecretKeySpec class, corresponding keys can be prepared for different encryption algorithms. The Mac class represents the message authentication code algorithm, which is an encryption technology that ensures data integrity and authentication. Unlike ordinary encryption algorithms, Mac not only encrypts data, but also generates a fixed-length summary to verify the authenticity and non-tampering of the data.

[0092] S504: Determine component information of each component in the first software bill of materials file based on the structured data in the first software bill of materials file.

[0093] In this embodiment, the first software bill of materials file includes first structured data, and the first structured data includes component information of one or more components in the target software package. That is, the first software bill of materials file stores data related to component information in the form of structured data, such as component name, version, dependency, etc.

[0094] In some embodiments, when the first structured data is data in Json format, each object in the first structured data represents information related to a component; when the first structured data is data in Extensible Markup Language (xml) format, each tag in the first structured data represents information related to a component.

[0095] The following is an example of component information in an SBOM file in XML format provided by an embodiment of the present disclosure:

[0096] <packages>

[0097] <spdxid> SPDXRef-attrs-19.2.0< / spdxid>

[0098] <copyrighttext> NOASSERTION< / copyrighttext>

[0099] <downloadlocation> NOASSERTION< / downloadlocation>

[0100] <filesanalyzed> false< / filesanalyzed>

[0101] <name> attrs< / name>

[0102] <description> {"filePath":["test1.zip / test1 / pytest-7.3.1-py3-none-any.whl / attrs:19.2.0"],"ecosystem":"python"}< / description>

[0103] <originator> attrs< / originator>

[0104] <versioninfo> 19.2.0< / versioninfo>

[0105] <licenseconcluded> MIT< / licenseconcluded>

[0106] <licensedeclared> MIT< / licensedeclared>

[0107] < / packages>

[0108] The following is an example of component information in a SBOM file in JSON format provided by an embodiment of the present disclosure:

[0109] "packages":[{

[0110] "SPDXID":"SPDXRef-examples-1.0",

[0111] "copyrightText":"NOASSERTION",

[0112] "downloadLocation":"NOASSERTION",

[0113] "filesAnalyzed":false,

[0114] "name":"examples",

[0115] "originator":"com.aiclient",

[0116] "versionInfo":"1.0",

[0117] "description":{"filePath":["D:\\xxxxxx\\xxtest\\ai-client.zip

[0118] \\service\\pom.xml / [com.aiprime.safe:service:${revision}] / [com.aiclient:exa mples:1.0]"],"ecosystem":"java"}

[0119] }]

[0120] By parsing the first structured data in the first software bill of materials file, specific information of each component can be obtained, including the component identification (such as name and version number), function description, interface information, and dependency relationship with other components.

[0121] S506: Based on the key specification and encryption algorithm of the symmetric encryption, the component information of each component in the first software bill of materials file is encrypted respectively to obtain a first encryption result value corresponding to each component.

[0122] For example, each component information in the first software bill of materials file can be encrypted separately based on the Mac class and the SecretKeySpec class to generate a corresponding encryption result value. Each encryption result value is unique, which can effectively prevent tampering and forgery.

[0123] S508: Determine component information of each component in the second software bill of materials file based on the second structured data in the second software bill of materials file.

[0124] In some embodiments, when the second structured data is data in Json format, each object in the second structured data represents information related to a component; when the second structured data is data in Extensible Markup Language format, each tag in the second structured data represents information related to a component.

[0125] In this embodiment, the component information of each component in the second software bill of materials file can be obtained by parsing the second structured data in the second software bill of materials file.

[0126] S510, based on the key specification and the encryption algorithm, encrypt the component information of each component in the second software bill of materials file respectively to obtain a second encryption result value corresponding to each component.

[0127] It should be noted that, in this embodiment, when the component information of each component in the second software bill of materials file is encrypted separately, the selected key specification and encryption algorithm should be the same as the key specification and encryption algorithm selected when encrypting the first software bill of materials file.

[0128] For example, each component information in the second software bill of materials file may be encrypted separately based on the Mac class and the SecretKeySpec class to generate an encryption result value corresponding to each component.

[0129] In this embodiment, by combining the key with the algorithm, the generated encryption result value has extremely high uniqueness and security, can effectively prevent tampering and forgery attacks, and has high stability and reliability.

[0130] Figure 6 The following is a flow chart of a method for obtaining a resource list shown in the present disclosure. Figure 6 As shown, before using the first user private key to encrypt the component information of each component in the first software bill of materials file, the method also includes:

[0131] S602: Obtain a first encryption result value corresponding to each component in the first software bill of materials file.

[0132] In this embodiment, the first encryption result value corresponding to each component is the result of an encryption process performed once on each component in the first software bill of materials file.

[0133] S604, obtaining a second encryption result value corresponding to each component in the second software bill of materials file.

[0134] In this embodiment, the second encryption result value corresponding to each component is the result of an encryption process performed once on each component in the second software bill of materials file.

[0135] S606: Use the first user private key to encrypt the first encryption result value corresponding to each component in the first software bill of materials file to obtain a third encryption result value corresponding to each component in the first software bill of materials file.

[0136] Each component in the first software bill of materials file already has an encrypted value (first encrypted result value). In this embodiment, the first encrypted result value of each component in the first software bill of materials file is encrypted again using the first user's private key, and the new encrypted result, i.e., the third encrypted result value, is obtained, so that the encrypted result value corresponding to each component is associated with the user information of the first user.

[0137] S608: Obtain a first resource list based on the second encryption result value corresponding to each component in the first software bill of materials file.

[0138] S610: Use the second user private key to encrypt the second encryption result value corresponding to each component in the second software bill of materials file to obtain a fourth encryption result value corresponding to each component in the second software bill of materials file.

[0139] In this embodiment, each component in the second software bill of materials file already has an encrypted value (second encrypted result value). In this embodiment, the encrypted first encrypted result value of each component in the second software bill of materials file is encrypted again using the second user's private key, and the obtained new encryption result, i.e., the fourth encrypted result value, makes the encryption result value corresponding to each component associated with the user information of the second user.

[0140] S612: Obtain a second resource list based on the fourth encryption result value corresponding to each component in the second software bill of materials file.

[0141] Figure 7 The following is a flowchart of a method for file tamper-proofing shown in the present disclosure. Figure 7 As shown, the method also includes:

[0142] S702: Add a hash-based message authentication code field to the component information description field of each component in the first software bill of materials file.

[0143] In this embodiment, the component information description field is a field used to describe the characteristics and attributes of each component in detail. The hash-based message authentication code field is a field used to verify data integrity and authenticity and is used to store a message authentication code. A message authentication code can be generated by generating a hash value for component information using a specific algorithm (such as a message authentication code algorithm).

[0144] It should be noted that in addition to the necessary fields required by the standard, different software bill of materials files may also add other fields. For example, the component information of each component in the first software bill of materials file may specifically include a description field, and the description field may be assigned to many other fields as a set, so the hmacCode (Hash-based Message Authentication Code) field may be added as a new field to the decryption field.

[0145] S704, storing the second encryption result value corresponding to each component in the first software bill of materials file into the hash-based message authentication code field corresponding to each component in the first software bill of materials file to generate a third software bill of materials file.

[0146] In this embodiment, after obtaining the second encryption result value corresponding to each component in the first software bill of materials file, the second encryption result value corresponding to each component is stored in the hmacCode field newly added to the description field corresponding to each component, for example: description:{"field 1":"field 1 description","hmacCode":"[x1,x2,...,xn]",...}, where x1, x2 and xn represent the second encryption result value, and a third software bill of materials file is generated.

[0147] It should be noted that the third software material list file includes not only the component information of one or more components in the first software material list file, but also the first encryption result value and the third encryption result value corresponding to each component in the first software material list file. The first encryption result value is encrypted based on the key specification and the encryption algorithm, and the third encryption result value is encrypted by using the first user's private key to obtain the first encryption result value.

[0148] S706: Add a hash-based message authentication code field to the component information description field of each component in the second software bill of materials file.

[0149] In this embodiment, similar to adding a hash-based message authentication code field in the first software bill of materials file, a hash-based message authentication code field is also added to the component information description field of each component in the second software bill of materials file to store the fourth encryption result value.

[0150] S708, storing the fourth encryption result value corresponding to each component in the second software bill of materials file into the hash-based message authentication code field corresponding to each component in the second software bill of materials file to generate a fourth software bill of materials file.

[0151] It should be noted that the fourth software bill of materials file includes not only the component information of one or more components in the second software bill of materials file, but also the second encrypted result value and the fourth encrypted result value corresponding to each component in the second software bill of materials file. The second encrypted result value is encrypted based on the key specification and the encryption algorithm, and the fourth encrypted result value is encrypted by the second encrypted result value using the second user private key.

[0152] In this embodiment, by adding a hash-based message authentication code field, the security and reliability of component information can be enhanced, thereby ensuring that the component information has not been tampered with during the use and management of the software bill of materials, and also facilitating subsequent tracing of component changes.

[0153] In some embodiments, Figure 8 The present disclosure shows a method flow chart for determining a tampered component. Figure 8 As shown, the method also includes:

[0154] S802: If the first resource list and the second resource list are inconsistent, determine the difference data items between the first resource list and the second resource list.

[0155] In this embodiment, the first resource list includes the second encryption result value for each component in the first software material list, and the second resource list includes the fourth encryption result value for each component in the second software material list. If the first resource list and the second resource list are inconsistent, it means that there is a difference between the component information in the first software material list file and the component information in the second software material list file. By determining the difference data items in the first resource list and the second resource list, different encryption result values ​​in the first resource list and the second resource list can be obtained.

[0156] S804, mapping the difference data items to the third software bill of materials file and the fourth software bill of materials file to obtain difference components.

[0157] Since the third software bill of materials file not only includes the component information of one or more components in the first software bill of materials file, but also includes the first encryption result value and the third encryption result value corresponding to each component in the first software bill of materials file. And the fourth software bill of materials file includes the component information of one or more components in the second software bill of materials file, and the second encryption result value and the fourth encryption result value corresponding to each component in the second software bill of materials file. The difference data items (different encryption result values, which may include one or more of the third encryption result value and the fourth encryption result value) are respectively mapped to the third software bill of materials file and the fourth software bill of materials file. Since the third encryption result value and the fourth encryption result value are uniquely corresponding in their respective software bill of materials files, the difference components can be determined in the third software bill of materials file and the fourth software bill of materials file. It should be noted that the difference components may include one or more of tampered components, newly added components and deleted components.

[0158] In this embodiment, the resource list containing the encrypted result values ​​corresponding to each component of the two software bill of materials files can not only determine whether the software bill of materials files have been tampered with, but also further determine the component information that has been added / deleted / tampered with in the software bill of materials files, thereby ensuring the security and authenticity of the software bill of materials files and improving the transparency of the software supply chain.

[0159] In some embodiments, Fig. 9 The following is a specific method flow chart of a file tamper-proof processing method shown in the present disclosure. Fig. 9 As shown, the method is implemented by a software supply chain security management platform, which is deployed on a system that executes a file anti-tampering processing method, and includes:

[0160] S901, the user fills in personal information and generates a unique userID for the user.

[0161] S902, the platform generates a unique private key for the user based on ML-KEM-512 according to the user information and userID.

[0162] S903: The user uploads a software package.

[0163] S904: The platform hashes the software package and generates SBOM1.

[0164] S905, the platform performs operations on the important information in SBOM1 based on the Mac class and the SecretKeySpec class to obtain the operation result values ​​of each component.

[0165] In this embodiment, SBOM1 is in the SPDX standard format, and important information may include fields such as SPDXID, spdxVersion, fileMd5, packages, name, dataLicense, documentNamespace, etc. The important information in SBOM1 is calculated based on the Mac class and SecretKeySpec class to perform encryption operations on the contents of fields such as SPDXID, spdxVersion, fileMd5, packages, name, dataLicense, documentNamespace, etc.

[0166] Among them, for the packages field in the SBOM1 file, each component information in the packages field is calculated separately. The SBOM1 file stores the component information of each component as structured data. For the SBOM1 file in json format, an object in the packages field of the SBOM file represents the relevant information of a component. For the SBOM1 file in xml format, a packages tag in the packages field of the SBOM file represents a component information.

[0167] S906, the platform encrypts the operation result value of each component based on the user's private key to obtain the encrypted operation result value of each component.

[0168] S907, write the encrypted calculation result values ​​of each component into the SBOM and store it as reslist1 to obtain SBOM2.

[0169] S908, the user uploads SBOM3.

[0170] S909, perform the same encryption operation on the important information in SBOM3 to obtain reslist2.

[0171] In this embodiment, referring to S905 to S907, the important information in SBOM3 is calculated based on the Mac class and the SecretKeySpec class to obtain the calculation result value of each component, and then the platform encrypts the calculation result value of each component based on the user private key to obtain the encrypted calculation result value of each component. It should be noted that the user private key used in this embodiment corresponds to the user private key of the user who uploaded the SBOM3.

[0172] S910, loop through the reslist tables stored in SBOM2 and SBOM3 respectively.

[0173] S911, determine whether reslist1 and reslist2 are consistent, if so, go to S912; if not, go to S913.

[0174] S912, not tampered with, go to S914.

[0175] S913, confirm the added, deleted and modified component information, and go to S915.

[0176] S914, perform SBOM detection on SBOM1.

[0177] In this embodiment, the SBOM detection is to detect the SBOM of the target software package, the main purpose of which is to ensure that the composition, source and version of the software package are accurate and to identify potential security risks or compliance issues.

[0178] S915, prompting that the SBOM anti-tampering verification failed.

[0179] Fig.10 The following is a specific method flow chart of a file tamper-proof processing method shown in the present disclosure. Fig.10 As shown, the method is implemented by a software supply chain security management platform, which is deployed on a system that executes a file anti-tampering processing method, and includes:

[0180] S1001, convert each component set in the packages field into a JSON string and sort them.

[0181] In this embodiment, the packages field contains a collection of one or more components, and each component object is converted into a string in JSON format using a JSON serialization function in a programming language (such as JavaScript's JSON.stringify) to convert the object into a readable text format.

[0182] Specifically, when converting each component object into a string in JSON format, sort the components as needed. For example, you can sort by name, version number, etc. in ascending or descending order. The sorted array will ensure that the order of the components is consistent, which is convenient for subsequent processing.

[0183] S1002, the platform selects a sufficiently long and random key.

[0184] S1003, obtaining the result value of each component set based on the Mac class, the SecretKeySpec class and the key set by the platform.

[0185] S1004, define reslist1 and reslist2 to store encryption result values ​​of different sets in SBOM2 and SBOM3.

[0186] S1005, determine whether reslist1 and reslist2 are consistent, if so, go to S1006; if not, go to S1007.

[0187] S1006, determine whether the length of reslist1 is less than reslist2, if so, go to S1008; if not, go to S1009.

[0188] S1007, not tampered with.

[0189] S1008, traverse the encryption result values ​​in reslist1 in reslist2.

[0190] In this embodiment, the encrypted result values ​​in reslist1 are traversed in reslist2 to determine the remaining and / or inconsistent result values ​​in reslist1 and reslist2.

[0191] S1009, traverse the encryption result values ​​in reslist2 in reslist1.

[0192] In this embodiment, the encrypted result values ​​in reslist2 are traversed in reslist1 to determine the remaining and / or inconsistent result values ​​in reslist1 and reslist2.

[0193] S1010, map the remaining and / or inconsistent result values ​​to the SBOM file.

[0194] In this embodiment, the remaining or inconsistent result values ​​are mapped to a SBOM (software bill of materials) file. The SBOM includes an SBOM4 generated based on the software package and an SBOM5 uploaded by the user. The software package is uploaded by the user, and the SBOM6 is obtained by hashing the software package uploaded by the user, and the SBOM4 is obtained by encrypting the SBOM6 using the user's private key.

[0195] S1011, component information corresponding to the remaining and / or inconsistent result values ​​is added / tampered with.

[0196] In this embodiment, a resource list with a smaller length is traversed and compared with a resource list with a larger length, so as to optimize performance, simplify logic, and improve resource utilization efficiency.

[0197] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0198] Based on the same inventive concept, the present disclosure also provides a file tamper-proof processing device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0199] Fig.11 A schematic diagram of a file tamper-proof processing device in an embodiment of the present disclosure is shown. Fig.11 As shown, the device includes: a first encryption module 111, a second encryption module 112 and a comparison module 113

[0200] The first encryption module 111 is used to generate a first software bill of materials file in response to a first user uploading a target software package, generate a first user private key according to the user information of the first user, and use the first user private key to encrypt the component information of each component in the first software bill of materials file respectively to obtain a first resource list, wherein the first software bill of materials file contains component information of one or more components in the target software package, and the first resource list contains the encrypted results of the component information of each component; the second encryption module 112 is used to generate a second user private key according to the user information of the second user in response to a second software bill of materials file uploaded by a second user for the target software package, and use the second user private key to encrypt the component information of each component in the second software bill of materials file respectively to obtain a second resource list, wherein the second software bill of materials file contains component information of one or more components in the target software package, and the second resource list contains the encrypted results of the component information of each component; the comparison module 113 is used to compare whether the first resource list is consistent with the first resource list, and determine whether the first software bill of materials file has been tampered with according to the comparison result.

[0201] In some embodiments, the first encryption module 111 is also used to: obtain user information of the first user, generate a first user identifier of the first user based on the user information of the first user, and encrypt the first user identifier to obtain a first user private key; the second encryption module 112 is also used to: obtain user information of the second user, generate a second user identifier of the second user based on the user information of the second user, and encrypt the second user identifier to obtain a second user private key.

[0202] In some embodiments, the first encryption module 111 is also used to: encrypt the first user private key to obtain an encrypted first user private key; the second encryption module 112 is also used to: encrypt the second user private key to obtain an encrypted second user private key; and display the encrypted first user private key and the encrypted second user private key.

[0203] In some embodiments, the comparison module 113 is specifically used to: if the first resource list and the second resource list are consistent, determine that the first software material list file has not been tampered with; if the first resource list and the second resource list are inconsistent, determine that the first software material list file has been tampered with.

[0204] In some embodiments, the first software bill of materials file includes first structured data, and the second software bill of materials file includes second structured data. The first encryption module 111 is also used to: obtain a key specification and an encryption algorithm; determine component information of each component in the first software bill of materials file based on the first structured data in the first software bill of materials file; based on the key specification and encryption algorithm of symmetric encryption, separately encrypt the component information of each component in the first software bill of materials file to obtain a first encryption result value corresponding to each component; the second encryption module 112 is also used to: determine component information of each component in the second software bill of materials file based on the second structured data in the second software bill of materials file; based on the key specification and encryption algorithm of symmetric encryption, separately encrypt the component information of each component in the second software bill of materials file to obtain a second encryption result value corresponding to each component.

[0205] In some embodiments, the first encryption module 111 is also used to: obtain a first encryption result value corresponding to each component in the first software bill of materials file; use the first user private key to encrypt the first encryption result value corresponding to each component in the first software bill of materials file, and obtain a third encryption result value corresponding to each component in the first software bill of materials file; obtain a first resource list based on the third encryption result value corresponding to each component in the first software bill of materials file; the second encryption module 112 is also used to: obtain a second encryption result value corresponding to each component in the second software bill of materials file; use the second user private key to encrypt the second encryption result value corresponding to each component in the second software bill of materials file, and obtain a fourth encryption result value corresponding to each component in the second software bill of materials file; obtain a second resource list based on the fourth encryption result value corresponding to each component in the second software bill of materials file.

[0206] In some embodiments, the first encryption module 111 is also used to: add a hash-based message authentication code field to the component information description field of each component in the first software bill of materials file; store the second encryption result value corresponding to each component in the first software bill of materials file into the hash-based message authentication code field corresponding to each component in the first software bill of materials file, and generate a third software bill of materials file; the second encryption module 112 is also used to: add a hash-based message authentication code field to the component information description field of each component in the second software bill of materials file; store the fourth encryption result value corresponding to each component in the second software bill of materials file into the hash-based message authentication code field corresponding to each component in the second software bill of materials file, and generate a fourth software bill of materials file.

[0207] In some embodiments, the first software bill of materials file includes multiple components, and the second software bill of materials file includes multiple components. The comparison module 113 is also used to: if the first resource list and the second resource list are inconsistent, determine the difference data items in the first resource list and the second resource list; map the difference data items to the third software bill of materials file and the fourth software bill of materials file to obtain difference components, and the difference components include one or more of tampered components, newly added components and deleted components.

[0208] In some embodiments, when the first structured data and / or the second structured data is data in Json format, each object in the first structured data and / or the second structured data represents information related to a component; when the first structured data and / or the second structured data is data in extensible markup language format, each tag in the first structured data and / or the second structured data represents information related to a component.

[0209] It should be noted that the examples and application scenarios implemented by the modules in the above-mentioned device embodiment are the same as those of the corresponding steps in the method embodiment, but are not limited to the contents disclosed in the above-mentioned method embodiment. It should be noted that the above-mentioned modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0210] Those skilled in the art will appreciate that various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0211] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present disclosure, the electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned file tamper-proof processing methods by executing the executable instructions. Since the principle of solving the problem in the electronic device embodiment is similar to that in the above-mentioned method embodiment, the implementation of the electronic device embodiment can refer to the implementation of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0212] Refer to the following Fig.12 1200 according to this embodiment of the present disclosure is described. Fig.12 The electronic device 1200 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0213] like Fig.12 As shown, the electronic device 1200 is in the form of a general computing device. The components of the electronic device 1200 may include but are not limited to: at least one processing unit 1210, at least one storage unit 1220, and a bus 1230 connecting different system components (including the storage unit 1220 and the processing unit 1210).

[0214] The storage unit stores program codes, which can be executed by the processing unit 1210, so that the processing unit 1210 executes the steps described in the above “exemplary method” section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 1210 may execute the following steps of the above method embodiment: in response to a first user uploading a target software package, generating a first software bill of materials file, generating a first user private key according to the user information of the first user, and using the first user private key to encrypt the component information of each component in the first software bill of materials file respectively, to obtain a first resource list, wherein the first software bill of materials file includes component information of one or more components in the target software package, and the first resource list includes encrypted results of the component information of each component; in response to a second software bill of materials file uploaded by a second user for the target software package, generating a second user private key according to the user information of the second user, and using the second user private key to encrypt the component information of each component in the second software bill of materials file respectively, to obtain a second resource list, wherein the second software bill of materials file includes component information of one or more components in the target software package, and the second resource list includes encrypted results of the component information of each component; comparing whether the first resource list is consistent with the second resource list, and determining whether the first software bill of materials file has been tampered with according to the comparison result.

[0215] The storage unit 1220 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 12201 and / or a cache storage unit 12202 , and may further include a read-only storage unit (ROM) 12203 .

[0216] The storage unit 1220 may also include a program / utility 12204 having a set (at least one) of program modules 12205, such program modules 12205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0217] Bus 1230 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0218] The electronic device 1200 may also communicate with one or more external devices 1240 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1200, and / or communicate with any device that enables the electronic device 1200 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1250. Furthermore, the electronic device 1200 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1260. As shown, the network adapter 1260 communicates with other modules of the electronic device 1200 via a bus 1230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1200, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0219] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0220] Based on the same inventive concept, the embodiment of the present disclosure also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned file tamper-proof processing methods is implemented. Since the principle of solving the problem in the embodiment of the computer-readable storage medium is similar to that in the above-mentioned method embodiment, the implementation of the embodiment of the computer-readable storage medium can refer to the implementation of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0221] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0222] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0223] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0224] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0225] Based on the same inventive concept, a computer program product is also provided in the embodiments of the present disclosure, including a computer program product, including: a computer program or an instruction, wherein when the computer program or the instruction is executed by a processor, the file anti-tampering processing method of any one of the above method embodiments is implemented. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0226] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0227] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0228] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0229] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for preventing file tampering, characterized in that: include: In response to a first user uploading a target software package, a first software bill of materials file is generated, a first user private key is generated according to the user information of the first user, and the component information of each component in the first software bill of materials file is respectively encrypted using the first user private key to obtain a first resource list, wherein the first software bill of materials file includes component information of one or more components in the target software package, and the first resource list includes encrypted results of the component information of each component; In response to a second software bill of materials file uploaded by a second user for the target software package, a second user private key is generated according to the user information of the second user, and the component information of each component in the second software bill of materials file is respectively encrypted using the second user private key to obtain a second resource list, wherein the second software bill of materials file includes component information of one or more components in the target software package, and the second resource list includes encrypted results of the component information of each component; The first resource list is compared with the second resource list to determine whether they are consistent, and based on the comparison result, whether the first software bill of materials file has been tampered with.

2. The file tamper-proof processing method according to claim 1, characterized in that: The method further comprises: Acquire user information of a first user, generate a first user identifier of the first user according to the user information of the first user, and encrypt the first user identifier to obtain a private key of the first user; The user information of the second user is obtained, a second user identifier of the second user is generated according to the user information of the second user, and the second user identifier is encrypting to obtain a private key of the second user.

3. The file tamper-proof processing method according to claim 2, characterized in that: The method further comprises: Encrypting the first user private key to obtain an encrypted first user private key; Encrypting the second user private key to obtain an encrypted second user private key; The encrypted first user private key and the encrypted second user private key are displayed.

4. The file tamper-proof processing method according to claim 1, characterized in that: The determining, according to the comparison result, whether the first software bill of materials file has been tampered with includes: If the first resource list and the second resource list are consistent, determining that the first software bill of materials file has not been tampered with; If the first resource list and the second resource list are inconsistent, it is determined that the first software bill of materials file has been tampered with.

5. The file tamper-proof processing method according to claim 1, characterized in that: The first software bill of materials file includes first structured data, the second software bill of materials file includes second structured data, and the method further includes: Get key specifications and encryption algorithms; Determining component information of each component in the first software bill of materials file based on the first structured data in the first software bill of materials file; Based on the key specification and encryption algorithm of the symmetric encryption, encrypt the component information of each component in the first software bill of materials file respectively to obtain a first encryption result value corresponding to each component; Determining component information of each component in the second software bill of materials file based on the second structured data in the second software bill of materials file; Based on the key specification and encryption algorithm of the symmetric encryption, the component information of each component in the second software bill of materials file is encrypted respectively to obtain a second encryption result value corresponding to each component.

6. The file tamper-proof processing method according to claim 5, characterized in that: The method further comprises: Obtaining first encryption result values ​​corresponding to each component in the first software bill of materials file; Obtain a second encryption result value corresponding to each component in the second software bill of materials file; The using the first user private key to encrypt the component information of each component in the first software material list file to obtain a first resource list includes: Using the first user private key, encrypt the first encryption result value corresponding to each component in the first software material list file respectively to obtain a third encryption result value corresponding to each component in the first software material list file; Obtaining a first resource list based on the third encryption result value corresponding to each component in the first software bill of materials file; The using the second user private key to encrypt the component information of each component in the second software bill of materials file to obtain a second resource list includes: Using the second user private key, encrypt the second encryption result value corresponding to each component in the second software bill of materials file respectively to obtain a fourth encryption result value corresponding to each component in the second software bill of materials file; A second resource list is obtained based on the fourth encryption result value corresponding to each component in the second software bill of materials file.

7. The file tamper-proof processing method according to claim 6, characterized in that: After encrypting the component information of each component in the first software bill of materials file using the first user private key, the method further includes: Adding a hash-based message authentication code field to the component information description field of each component in the first software bill of materials file; storing the second encryption result value corresponding to each component in the first software bill of materials file into the hash-based message authentication code field corresponding to each component in the first software bill of materials file to generate a third software bill of materials file; After encrypting the component information of each component in the second software bill of materials file respectively using the second user private key, the method further includes: Adding a hash-based message authentication code field to the component information description field of each component in the second software bill of materials file; The fourth encryption result value corresponding to each component in the second software bill of materials file is stored in the hash-based message authentication code field corresponding to each component in the second software bill of materials file to generate a fourth software bill of materials file.

8. The file tamper-proof processing method according to claim 7, characterized in that: The first software bill of materials file includes a plurality of components, the second software bill of materials file includes a plurality of components, and the method further includes: If the first resource list and the second resource list are inconsistent, determining the difference data items between the first resource list and the second resource list; The difference data items are mapped to the third software bill of materials file and the fourth software bill of materials file to obtain difference components, where the difference components include one or more of tampered components, newly added components and deleted components.

9. The file tamper-proof processing method according to claim 5, characterized in that: When the first structured data and / or the second structured data are data in Json format, each object in the first structured data and / or the second structured data represents information related to a component; when the first structured data and / or the second structured data are data in extensible markup language format, each tag in the first structured data and / or the second structured data represents information related to a component.

10. A file tamper-proof processing device, characterized in that: include: A first encryption module is used to generate a first software bill of materials file in response to a first user uploading a target software package, generate a first user private key according to the user information of the first user, and use the first user private key to encrypt component information of each component in the first software bill of materials file to obtain a first resource list, wherein the first software bill of materials file includes component information of one or more components in the target software package, and the first resource list includes encrypted results of component information of each component; a second encryption module, configured to generate a second user private key according to the user information of the second user in response to a second software bill of materials file uploaded by a second user for the target software package, and to use the second user private key to encrypt component information of each component in the second software bill of materials file respectively to obtain a second resource list, wherein the second software bill of materials file includes component information of one or more components in the target software package, and the second resource list includes encrypted results of the component information of each component; The comparison module is used to compare whether the first resource list is consistent with the first resource list, and determine whether the first software material list file has been tampered with according to the comparison result.

11. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the file anti-tampering processing method according to any one of claims 1 to 9 by executing the executable instructions.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the file tamper-proof processing method according to any one of claims 1 to 9 is implemented.

13. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the file anti-tampering processing method described in any one of claims 1 to 9.

Images