Service execution method and device, storage medium and electronic equipment

Abstract

The invention discloses a service execution method and device, a storage medium and electronic equipment, a plurality of function extension modules are loaded through a security aspect base pre-deployed in a service application program, and each function extension module comprises a plurality of tangency points. And aiming at each function extension module, injecting a plurality of tangency points of the function extension module into the built-in function called by the service application program. And configuring a cutting program corresponding to each cutting point, the cutting program being in a binary form, and the cutting program being used for expanding a service function. When the business application program calls the built-in function injected with the tangency point, the tangency point injected into the built-in function is triggered, the tangent plane program injected with the tangency point is executed, and business function expansion in the execution process of the business application program is achieved. The aspect program is in a binary form which can be directly executed by the operating system, so that the operating system can directly execute the aspect program to realize function extension.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular, to a business execution method and device, a storage medium, and an electronic device. BACKGROUND

[0002] There are many types of programming languages that can be used by technical personnel when developing a business, which makes the technical personnel need to pay attention to the syntax characteristics of each programming language for writing. Then, even if the same function is implemented, the written code also has differences and does not have universality. Especially in the case of function extension of the business, due to the poor universality of the code, the technical personnel need to modify the code a lot, resulting in an increase in workload.

[0003] For example, the related technology can realize function extension through Inline Hook or GOT Hook function, but since the signatures of the called function functions in different programming languages are different, the calling modes need to be processed respectively, which requires the technical personnel to adjust the calling code for each function function to ensure normal calling, resulting in a large workload of the technical personnel.

[0004] In order to improve the universality of the extension code of the business, the present application provides a business execution method. SUMMARY

[0005] The present application provides a business execution method, device, storage medium and electronic device to at least partially solve the above problems existing in the prior art.

[0006] The present application adopts the following technical solutions:

[0007] The present application provides a business execution method, comprising:

[0008] A security aspect pedestal pre-deployed in a business application program is loaded with a plurality of function extension modules, each function extension module including a plurality of pointcuts;

[0009] For each function extension module, a plurality of pointcuts of the function extension module are injected into an inbuilt function called by the business application program;

[0010] A corresponding aspect program of each pointcut is configured, the aspect program being in binary form, and the aspect program being used to extend business functions;

[0011] When the inbuilt function is called, the pointcut injected into the inbuilt function is triggered, the corresponding aspect program of the triggered pointcut is determined, and the aspect program is executed to obtain a business extension result.

[0012] The present application provides a business execution device, comprising:

[0013] a function extension loading module, configured to load a plurality of function extension modules through a security aspect base pre-deployed in the business application, each function extension module comprising a plurality of pointcuts;

[0014] an injection module, configured to inject the pointcuts of each function extension module into built-in functions invoked by the business application;

[0015] a pointcut configuration module, configured to configure an aspect program corresponding to each pointcut, the aspect program being in binary form, and the aspect program being configured to extend business functions;

[0016] an execution module, configured to, when the built-in functions are invoked, trigger the pointcuts in the built-in functions, determine the aspect program corresponding to the triggered pointcuts, and execute the aspect program to obtain a business extension result.

[0017] The specification provides a computer readable storage medium, which stores a computer program, and the computer program, when executed by a processor, implements the business execution method.

[0018] The specification provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor, when executing the program, implements the business execution method.

[0019] The above technical solutions adopted by the specification can achieve the following beneficial effects:

[0020] In the business execution method provided by the specification, the security aspect base can load function extension modules, the function extension modules comprise pointcuts, the pointcuts can be injected into built-in functions invoked by the business application, and aspect programs corresponding to the pointcuts can be configured. Since the aspect programs are business programs of extended functions, executing the aspect programs can complete business function extension. After the configuration is completed, when the built-in functions injected with the pointcuts are invoked, the pointcuts are triggered. Then, the aspect programs corresponding to the pointcuts are executed, and thus, business extension functions are achieved. In addition, since the aspect programs are in binary form and can be directly executed by an operating system, the generality of the extension code of the business is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings, which are included to provide a further understanding of the specification, constitute a part of the specification, and the illustrative embodiments of the specification and their description serve to explain the specification, and do not limit the specification in any way. In the drawings:

[0022] Figure 1 FIG. 1 is a flowchart of a business execution method provided by the specification.

[0023] Figure 2 A security aspect base structure diagram provided for the present application;

[0024] Figure 3 Another business execution flowchart provided for the present application;

[0025] Figure 4 A pointcut configuration flowchart provided for the present application;

[0026] Figure 5 An event reporting flowchart provided for the present application;

[0027] Figure 6 Another business execution flowchart provided for the present application;

[0028] Figure 7 A business execution device diagram provided for the present application;

[0029] Figure 8 An electronic device diagram corresponding to Figure 1 provided for the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with the embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative work fall within the scope of protection of the present application.

[0031] In order to realize the function expansion of the business, and ensure the universality of the expansion program, reduce the workload of the developer, and improve the efficiency of the business function expansion, the present application provides a business execution method, by adopting the security aspect, the pointcut is first injected into the built-in function called by the business application program, and then the aspect program for business function expansion is configured for each pointcut. Then, when the business code of the business application program is executed, if the built-in function injected with the pointcut is called, the aspect program is executed. Since the aspect program is in the original binary form, the operating system running the business application program can directly execute the aspect program without additional modification by the developer, thereby ensuring the universality of the expansion program.

[0032] It should be noted that the security aspect refers to adding or modifying an aspect program in the running logic of the business application without modifying the business application by using aspect-oriented programming (AOP), and the aspect program can be used to implement a program of a security aspect business, a program of a business function extension, etc. If the aspect program is a program of a security aspect business, the program of the security aspect business can be decoupled from the business application while implementing the security aspect business, thereby avoiding the development iteration problem caused by high coupling.

[0033] It can be understood that when the business is executed, the business application usually executes the business through the calling between methods. Therefore, any method in the business application can be used as an entry point of the aspect program, i.e., the above-mentioned pointcut, and the aspect program is injected into the corresponding pointcut. When the business application executes to the pointcut, i.e., calls the method of the business application corresponding to the pointcut, the aspect program injected at the pointcut is executed.

[0034] Generally, the code responsible for the process of injecting the aspect program into the pointcut has high reusability, and therefore, the program implementing this process is usually abstracted as a service module, i.e., a security aspect base.

[0035] The business application can be a business application that provides a business service in a server of a business platform. The business service can be a business service provided by the server of the business platform to a user, such as a query business, a payment business, etc. The business service can also be a business service provided by a certain server of the business platform to other servers, such as a settlement business, etc. Of course, as described above, in order to decouple the program of the business function extension from the business application, the application specification makes the program of the business function extension and the business application interweave with each other when the business is executed, but they are parallel to each other and can be maintained independently, thereby improving the flexibility of the business function extension.

[0036] The execution subject of the application specification can be an operating system that can operate the business application, which can be deployed in any computing device, such as a server, a terminal, etc., and the application specification does not limit this. For ease of description, the business execution method provided by the application specification is described below with the server as the execution subject.

[0037] The technical solutions provided by the embodiments of the application specification are described in detail below with reference to the accompanying drawings.

[0038] Figure 1 A flowchart of a business execution method provided by the application specification is shown in the figure, which specifically includes the following steps:

[0039] S100: loading several function extension modules through a security aspect base pre-deployed in the business application, each of which includes several pointcuts.

[0040] The security aspect base in the present application is developed based on a native language, and is compiled into a server executable binary file when deployed in the business application. The binary file is not only universal, but also does not need to be compiled when executed by the server, so that the business execution efficiency is higher.

[0041] Figure 2 A security aspect base structure diagram is provided in the present application, as shown in Figure 2 .

[0042] The security aspect base structure includes function extension modules, business function modules and language related modules, wherein the function extension modules and the business function modules are independent of the programming language for writing the business application, and the language related modules are related to the programming language for writing the business application. The content independent of the programming language for writing the business application is abstracted as the function extension modules and the business function modules, which support dynamic loading and are more flexible, and support instant function extension.

[0043] The server can load the language related modules first, then load the business function modules, and finally load the function extension modules when the application starts.

[0044] Figure 3 Another business execution flowchart is provided in the present application, as shown in Figure 3 .

[0045] Specifically, when the application starts, the server can load the native extension module through the security aspect base, i.e. load the function extension modules, the business function modules and the language related modules. First, the language related modules are loaded, i.e. inject_lang.so is loaded, and the loading is implemented by calling the initialization function of the language related modules. The language related modules also include a function of recording logs, and there is a plug-in interface for connecting plug-ins. The language related modules have the basic capabilities of aspects, including function interceptors, function wrappers, pointcut function executors and function object lookups. The specific use process is described in conjunction with step S102. The language related modules also include a plug-in loading function for loading the business function modules, i.e. libranger.so, and the loading is implemented by calling the initialization function in the business function modules. The business function modules also include a function module related to a client, which can be a task thread, and interacts with a remote server to implement timer functions, registration functions, heartbeat sending functions, configuration obtaining functions and event reporting functions.

[0046] For example, a heartbeat is sent to the server, so that the server can know that the business function module is running. The server can be an operation and maintenance platform.

[0047] It should be noted that the server and the server are not the same concept. The server is a computing device that operates a business application program, and the server is an object that provides a business function by the server through the business application program. The business function module sends a heartbeat to the server, which can also be understood as the server sending a heartbeat to the server.

[0048] The business function module also includes module management functions, which can specifically load, unload and upgrade modules. The modules managed by the business function module are a plurality of function extension modules. The business function module can load the function extension module librasp.so by calling the initialization function ranger_init. At the same time, the business function module can also create a fork child process, which can also create another child process to create a process, that is, to create a client, register, create a heartbeat thread, and also create an event consumption process to wait for a reporting opportunity. Generally, the reportable event can be preset, and when the event occurs, the time can be reported to the server. That is, wait for the event, when the event occurs, determine whether the event is the preset reportable event, if so, report, if not, the program ends.

[0049] The function extension module includes an aspect configuration, which can include a pointcut list, and the pointcut list includes a plurality of points. The aspect configuration can also include an aspect program, which can be a subsequent configuration pointcut program in the pointcut list.

[0050] The onFire in the function extension module is a trigger function. When the server identifies an event that needs to be concerned, such as an attack behavior trying to exploit vulnerabilities, the onFire method can be called to handle the event, and the specific processing logic is the aspect program corresponding to the pointcut list. For example, the aspect program can monitor the event and report the event to the server. It can be understood that the aforementioned extended business function is a monitoring function. Generally, a technical person can develop security monitoring and defense functions for business application programs developed using different programming languages, but the same attack type needs to be developed repeatedly in different languages, resulting in increased workload.

[0051] Currently, technical personnel also attempt to implement security monitoring and defense using a unified technical framework. For example, related technologies can implement the capture of some risky system functions through Inline Hook or GOT Hook functions, thereby injecting a monitoring program. However, because the signatures of different function functions are different, the calling manner needs to be processed separately, which requires technical personnel to adjust the calling code for each function function to ensure normal calling, resulting in a large workload for technical personnel. The business execution method provided in the specification can achieve the generality of the security monitoring and defense program in the application scenario for security monitoring and defense, and by injecting an aspect program for security monitoring and defense into a join point, when the join point is triggered, the binary form of the aspect program is executed, thereby achieving security monitoring and defense.

[0052] The function extension module also includes a destruction function for destroying the function extension module before the application ends running. That is, after the user's service program ends, the resources are released, and the function extension module is destroyed. Resource release means that the aspect configuration in the function extension module is destroyed, so that the aspect program corresponding to the join point is reconfigured for next use.

[0053] S102: For each function extension module, inject several join points of the function extension module into the built-in function called by the business application program.

[0054] The security aspect base can load multiple function extension modules at the same time, and then, in order to implement business function extension, the server can first inject several join points of each function extension module into the built-in function called by the business application program. The specification does not limit which built-in function the join point needs to be injected into, and can be configured as needed. The built-in function that needs to execute the aspect program can be recorded in the join point list to achieve join point injection.

[0055] Specifically, the built-in function called by the business application program is determined, the interceptor is created based on the join point and the built-in function, the interceptor includes the join point and the built-in function, the built-in function list in which the built-in function is located is determined, and the built-in function is updated to the interceptor in the built-in function list.

[0056] In other words, the server can determine the built-in function that needs to inject the join point through the function object lookup capability in the language-related module. Then, through the function wrapping capability in the language-related module, an interceptor including the join point and the built-in function is created to implement a runtime function interceptor. The built-in function in the list storing the built-in function to which the join point is injected is replaced by the function interceptor to implement function replacement. Then, before executing the built-in function, the join point is triggered first, and then the built-in function is executed.

[0057] It should be noted that the business application programs developed by the script languages such as PHP, Python and JavaScript are all run in an interpreter environment, and the runtime of the interpreter provides basic interfaces, and the built-in functions that can be called by the interfaces exist in global objects, that is, the interpreter can directly call the built-in functions through the interfaces.

[0058] For example, the built-in functions of PHP exist in a global hash table, the built-in functions of Python exist in a global dictionary Dict, and the built-in functions of Node.js exist in a global map in a separate JavaScript running environment.

[0059] Through the function replacement, the server can directly call the built-in function injected with the point of cut through the interface of the interpreter, and if the point of cut is configured with a corresponding aspect program, the server can execute the aspect program to realize the business function expansion.

[0060] S104: Configure the aspect program corresponding to each point of cut, the aspect program is in binary form, and the aspect program is used to expand the business function.

[0061] In the present application, the aspect program configured subsequently and the corresponding relationship between the aspect program and the point of cut can be obtained in the business function module. Specifically, a configuration request can be sent to the server to obtain the configuration information returned by the server, the corresponding relationship between the point of cut and the aspect program is determined according to the configuration information, the aspect program is injected into the point of cut according to the corresponding relationship, and the configuration is completed. In other words, according to the corresponding relationship, each point of cut in the point of cut list in the function expansion module is matched with the aspect program, and the matching is saved.

[0062] It should be noted that since the security aspect base has been compiled into an executable binary file when deployed, the aspect program injected into the point of cut by the security aspect base is also in binary form. For the server, the program in binary form can be directly executed, so the server can directly execute the aspect program after the point of cut is triggered, and the universality of the business expansion function is realized.

[0063] S106: When the built-in function is called, the point of cut injected into the built-in function is triggered, the aspect program corresponding to the triggered point of cut is determined, and the aspect program is executed to obtain a business expansion result.

[0064] Now, the application will be described in detail Figure 3After the expression is made and the configuration is completed, the server can load the user code, which is the business code of the business application, and execute it. When the built-in function injected with the pointcut is called in the business code executed by the server, the pointcut in the built-in function is triggered, the aspect program corresponding to the pointcut in the function extension module is determined, and the aspect program is executed by the pointcut function executor in the language related module to obtain the business extension result.

[0065] It should be noted that the pointcut can also not be configured with an aspect program. Then, even if the pointcut is triggered, since the pointcut is not configured with a corresponding aspect program, it is not necessary to enter the pointcut function, i.e., the aspect program is not executed. Then, the server can normally execute the called built-in function.

[0066] Based on Figure 1 As shown in the business execution method, the security aspect base can load the function extension module, the function extension module includes the pointcut, the pointcut can be injected into the built-in function called by the business application, and the aspect program corresponding to the pointcut is configured. Since the aspect program is an extended function business program, the business function extension can be completed by executing the aspect program. After the configuration is completed, when the built-in function injected with the pointcut is called, the pointcut is triggered. Then, the aspect program corresponding to the pointcut is executed, so that the business extension function is realized. In addition, since the aspect program is in a binary form that can be directly executed by the operating system, the generality of the extension code of the business is realized.

[0067] For step S104, Figure 4 A pointcut configuration process diagram is provided for the present application specification, as shown in Figure 4 .

[0068] When the aspect program corresponding to the pointcut is configured, the server can also determine, for each pointcut, whether the pointcut has a corresponding interceptor. If yes, when the configured aspect program is different from the aspect program maintained by the interceptor, the configured aspect program is inserted into the aspect program linked list maintained by the interceptor. If not, the interceptor corresponding to the pointcut is created, and the configured aspect program is inserted into the aspect program linked list maintained by the created interceptor.

[0069] The judgment of whether the interception exists corresponding to the pointcut is because there can be multiple function extension modules, and there can be the same pointcut between multiple function extension modules. When the configured aspect program is the same as the aspect program maintained by the interceptor, it is not necessary to repeat the configuration. In other words, for the same pointcut and the same aspect program, it is stored once in the interceptor. Different aspect programs of the same pointcut can also be stored in the same interceptor, without the need to create an interceptor again, saving computing space. The interceptor is obtained by wrapping the built-in function that the pointcut and the business application need to call. If there is no corresponding interceptor, the original object corresponding to the pointcut function needs to be found, that is, the built-in function injected by the pointcut is determined. Then, by means of function wrapping, a new pointcut entry function is constructed, that is, the interceptor obtained by wrapping the built-in function that the pointcut and the business application need to call. And the original function object in the global hash table is overwritten, that is, the built-in function in the global hash table is replaced by the interceptor.

[0070] As shown in Figure 3 , the aspect program exists corresponding to the calling mechanism, which can be executed before the call of the original function in Figure 3 , that is, at before in Figure 3 , or can be executed after the call of the original function, that is, at return in Figure 3 .

[0071] In other words, the server can also determine the calling mechanism of the configured aspect program, and the calling mechanism includes any one of calling before executing the built-in function, not calling, calling after executing the built-in function without exception, or calling when an exception occurs during execution of the built-in function; the calling mechanism is stored in the interceptor.

[0072] After executing the aspect program, if the execution result needs to be reported, the execution result can be sent to the client in the form of shared memory (Shared Memory, shm), and the client reports to the server.

[0073] Figure 5 An event reporting process schematic diagram is provided in the specification of the present application, as shown in Figure 5 .

[0074] Taking the runtime application self-protection technology (Runtime Application Self-Protection, RASP) as an application scenario, when the operation corresponding to the built-in function is a preset operation, the business extension result is sent to a security management platform, and the preset operation includes any one of deserialization operation, external command execution operation, SQL injection operation, directory traversal operation, and cross-site scripting operation. The security management platform is the RASP Console in Figure 5 .

[0075] Specifically, in Figure 5 RASP Console is a security management platform for alarm display, so that maintenance personnel can perform corresponding data protection operations. Maintenance personnel can configure through RASP Console. SpaceStack is an operation and maintenance platform that can perform data forwarding and configuration changes. The configuration changes can be changes to the aspect program corresponding to the pointcut. It can also be setting the conditions for event reporting, that is, configuring the operation corresponding to the built-in function as what kind of operation, and selecting to report the business extension result. The interface service (api server) is a data channel that connects various clients of the base station, used to issue configurations and transmit various data such as heartbeat data.

[0076] Take hp, Python, and JAVA as examples to illustrate the corresponding processes of the three programming languages, which are php process, Python process, and node process, respectively. Since the number of processes for each programming language can be multiple in the actual business execution process, in order to facilitate data reporting, for each programming language, the event collection of multiple processes of the programming language can be collected in a forked process through shared memory, and the data is transmitted to the interface service by the forked process, so as to be reported to the security management platform.

[0077] The configuration in the specification can be updated in real time without restarting the application to complete the configuration update, and then various functional extension requirements can be realized at any time as needed. Specifically, the server can also respond to the configuration update operation of the functional extension module to obtain updated configuration information; according to the updated configuration information, update the aspect program corresponding to the pointcut in the functional extension module.

[0078] Figure 6 Another business execution flowchart provided in the specification is shown in Figure 6

[0079] ​The application is illustrated by taking the extended function as the security function and taking the application scene as an example. The files such as app.js, app.py and index.php are the main codes of the business application. The libraries required by the business application include builtin module cul.so, mysqli.so and the like. The module for injecting the security function is inject_lang.so, that is, the language related module. When the application is started, the loader can be used to load the application script, the libraries required by the application and the language related module, so as to obtain the loaded script. The loader can also be used to load the shared library file and load other modules of the business application. Then, the compiler is used to compile the loaded script, so as to obtain the compiled bytecode. The bytecode can be executed by a virtual machine (VM) environment. The core engine of PHP is zend and the core engine of node.js is v8. The runtime includes a hash table for storing the function processor and the interceptor,

[0080] Figure 6 The language related module includes the call mechanism of the aspect program corresponding to the pointcut, such as call_atbefore, call_origin, call_atEnd and call_atThrow. The language related module also includes the plugin api.

[0081] When the VM engine executes the bytecode obtained after the compilation, the built-in function such as mysqli.query can be called. The call mechanism is also included in the VM engine. Before the call mechanism is used, the pointcut is triggered and the interceptor is searched, so as to determine the aspect program corresponding to the pointcut stored in the interceptor, and then the corresponding call mechanism is used to execute the pointcut program.

[0082] Figure 6 The function extension module and the business function module are also included. The content included in the function extension module and the business function module has been described above, and will not be described here again. The two business function modules communicate with each other through the inter-process communication (IPC) mechanism. This is because the forked process is used to collect multiple events and report them together, so there are two business function modules.

[0083] The above is the business execution method provided by one or more embodiments of the application. Based on the same idea, the application also provides a corresponding business execution device. As shown in Figure 7 The device includes:

[0084] The function extension loading module 700 is configured to load a plurality of function extension modules through a security aspect base pre-deployed in the business application, each function extension module including a plurality of pointcuts;

[0085] The injection module 702 is configured to inject the pointcuts of each function extension module into built-in functions called by the business application;

[0086] The pointcut configuration module 704 is configured to configure an aspect program corresponding to each pointcut, the aspect program being in binary form, and the aspect program being used to extend business functions;

[0087] The execution module 706 is configured to, when the built-in functions are called, the pointcuts injected into the built-in functions being triggered, determine the aspect program corresponding to the triggered pointcuts, and execute the aspect program to obtain a business extension result.

[0088] Optionally, the injection module 702 is specifically configured to determine built-in functions called by the business application; create an interceptor based on the pointcut and the built-in function, the interceptor including the pointcut and the built-in function; determine a built-in function list in which the built-in function is located; and update the built-in function as the interceptor in the built-in function list.

[0089] Optionally, the pointcut configuration module 704 is specifically configured to, for each pointcut, determine whether the pointcut has a corresponding interceptor; if yes, insert the configured aspect program into an aspect program linked list maintained by the interceptor when the configured aspect program is different from an aspect program maintained by the interceptor; and if not, create an interceptor corresponding to the pointcut, and insert the configured aspect program into an aspect program linked list maintained by the created interceptor.

[0090] Optionally, the apparatus further includes:

[0091] The call mechanism determination module is configured to determine a call mechanism of the configured aspect program, the call mechanism including any one of calling before executing the built-in function, not calling, calling when no exception occurs after executing the built-in function, and calling when an exception occurs after executing the built-in function; and store the call mechanism into the interceptor.

[0092] Optionally, the apparatus further includes:

[0093] The reporting module is configured to, when an operation corresponding to the built-in function is a preset operation, send the business extension result to a security management platform, the preset operation including any one of a deserialization operation, an external command execution operation, a SQL injection operation, a directory traversal operation, and a cross-site scripting operation.

[0094] Optionally, the apparatus further includes:

[0095] The tangent point configuration update module is used to obtain updated configuration information in response to the configuration update operation of the function extension module; and update the tangent point corresponding to the tangent point in the function extension module according to the updated configuration information.

[0096] This application also provides a computer-readable storage medium, which stores a computer program that can be used to execute the above Figure 1 Provides business execution methods.

[0097] This application also provides Figure 8 The structural diagram of the electronic device shown in FIG. Figure 8 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to software implementation, this application specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0098] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0099] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0100] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0101] For the sake of description, the above apparatuses are described in various units with functions respectively. Of course, the functions of the units can be implemented in one or more software and / or hardware in the implementation of the present application.

[0102] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk memory, CD-ROM, optical memory, etc.) containing computer usable program code.

[0103] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0104] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0105] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks ​ means for functionally implementing the steps listed in the flowchart block or blocks.

[0106] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0107] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer-readable media.

[0108] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0109] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that processes, methods, articles or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device that includes the element.

[0110] Those skilled in the art will appreciate that embodiments of the present application specification can be provided as methods, systems or computer program products. Therefore, the present application specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The present application specification can be described in the general context of computer-executable instructions, such as program modules, executed by computers. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0112] Each of the embodiments in the specification of the present application is described in a progressive manner, and the same or similar parts between the embodiments can be mutually referred to, and each of the embodiments focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0113] The above only describes the embodiments of the specification of the present application, and is not intended to limit the specification of the present application. The specification of the present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the specification of the present application shall be included in the scope of claims of the present application.

Claims

1. A service execution method, comprising: By pre-deploying the security aspect base in the business application, several function extension modules are loaded. Each function extension module includes several cut points. For each function extension module, injecting several cut points of the function extension module into the built-in function called by the business application; Configure the section program corresponding to each section point. The section program is in binary form and is used to expand business functions. When the built-in function is called, the tangent point injected into the built-in function is triggered, and the aspect program corresponding to the triggered tangent point is determined and executed to obtain a business extension result.

2. The method according to claim 1, wherein a plurality of cut points are injected into the built-in function called by the business application, specifically comprising: Determining a built-in function called by the business application; Based on the pointcut and the built-in function, creating an interceptor, the interceptor including the pointcut and the built-in function; Determine the built-in function list where the built-in function is located; In the built-in function list, the built-in function is updated to the interceptor.

3. The method according to claim 1 or 2, wherein configuring a section program corresponding to each section point comprises: For each cut point, determine whether there is a corresponding interceptor for the cut point; If so, when the configured aspect program is different from the aspect program maintained by the interceptor, the configured aspect program is inserted into the aspect program linked list maintained by the interceptor; If not, create the interceptor corresponding to the cut point and insert the configured aspect program into the aspect program list maintained by the created interceptor.

4. The method of claim 3, further comprising: Determine a calling mechanism for the configured aspect program, the calling mechanism including any one of calling before executing the built-in function, not calling, calling after executing the built-in function if no exception occurs, and calling when an exception occurs during execution of the built-in function; The calling mechanism is stored in the interceptor.

5. The method of claim 1, further comprising: When the operation corresponding to the built-in function is a preset operation, the business expansion result is sent to the security management and control platform, and the preset operation includes any one of a deserialization operation, an external command execution operation, an SQL injection operation, a directory traversal operation, and a cross-site scripting operation.

6. The method of claim 1, further comprising: In response to the configuration update operation of the function expansion module, acquiring updated configuration information; According to the updated configuration information, the section program corresponding to the section point in the function extension module is updated.

7. A service execution device, comprising: Function extension loading module, used to load several function extension modules through the security aspect base pre-deployed in the business application. Each function extension module includes several cut points. An injection module, configured to inject, for each function extension module, several cut points of the function extension module into the built-in function called by the business application; A tangent point configuration module is used to configure a tangent program corresponding to each tangent point. The tangent program is in binary form and is used to expand business functions. The execution module is used to trigger the pointcut injected into the built-in function when the built-in function is called, determine the aspect program corresponding to the triggered pointcut, and execute it to obtain the business expansion result.

8. In the device as described in claim 7, the injection module is specifically used to determine the built-in function called by the business application; create an interceptor based on the pointcut and the built-in function, and the interceptor includes the pointcut and the built-in function; determine the built-in function list where the built-in function is located; in the built-in function list, update the built-in function to the interceptor.

9. In the device as described in claim 7 or 8, the point-cut configuration module is specifically used to determine whether there is a corresponding interceptor for each point-cut; if so, when the configured aspect program is different from the aspect program maintained by the interceptor, the configured aspect program is inserted into the aspect program linked list maintained by the interceptor; if not, an interceptor corresponding to the point-cut is created, and the configured aspect program is inserted into the aspect program linked list maintained by the created interceptor.

10. The apparatus of claim 9, further comprising: A calling mechanism determination module is used to determine the calling mechanism of the configured aspect program, wherein the calling mechanism includes any one of calling before executing the built-in function, not calling, calling when no exception occurs after executing the built-in function, and calling when an exception occurs during execution of the built-in function; and the calling mechanism is stored in the interceptor.

11. The apparatus of claim 7, further comprising: The reporting module is used to send the business expansion result to the security management and control platform when the operation corresponding to the built-in function is a preset operation, and the preset operation includes any one of a deserialization operation, an external command execution operation, an SQL injection operation, a directory traversal operation, and a cross-site scripting operation.

12. The apparatus of claim 7, further comprising: a tangent point configuration update module, configured to obtain updated configuration information in response to a configuration update operation of the function extension module; According to the updated configuration information, the section program corresponding to the section point in the function extension module is updated.

13. A computer-readable storage medium storing a computer program, wherein the computer program implements the method according to any one of claims 1 to 6 when executed by a processor.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the program.

Images