Policy file generation method and device, storage medium, and electronic device

Abstract

The application provides a strategy file generation method and device, a storage medium and an electronic device, and the method comprises the following steps: constructing a sample strategy material; performing data cleaning on the sample strategy material to obtain training sample data; performing transfer learning on an open source model by using the training sample data to obtain an initial strategy generation model; performing reinforcement learning on the initial strategy generation model to obtain a target strategy generation model; obtaining software research and development materials of a target vehicle model, inputting the software research and development materials into the target strategy generation model, and generating a mandatory access control (MAC) strategy file of the target vehicle model, wherein the MAC strategy file comprises a mapping relationship between a plurality of groups of resource objects and operation permissions, and the software research and development materials comprise software code and environment information of the software code. Through the embodiment, the technical problem of low efficiency of editing a MAC strategy file in the prior art is solved, and the difficulty of mandatory access mode policy writing is reduced.

Description

Technical Field

[0001] This invention relates to the field of software technology, and more specifically, to a method and apparatus for generating policy documents, a storage medium, and an electronic device. Background Technology

[0002] In related technologies, as automobiles rapidly evolve towards connectivity and intelligence, they are no longer independent environments separate from the internet. Vehicles integrate complex functions such as entertainment and remote control, leading to significant security vulnerabilities in traditional access control mechanisms (such as Autonomous Access Control (DAC) or Role-Based Access Control (RBAC)). Due to the high-frequency interactions between vehicles and the cloud and third-party applications in dynamic network environments, traditional strategies are susceptible to privilege abuse, lateral movement attacks, and zero-day vulnerabilities. When hackers breach boundary protection through OTA interfaces, the autonomous authorization mechanism of DAC struggles to prevent attackers from moving laterally within the vehicle control network, potentially tampering with ECU (Electronic Control Unit) firmware, hijacking autonomous driving decision modules, or stealing user biometric data. Mandatory Access Control (MAC), by implementing a Multi-Level Security Model (MLS) and a Biba integrity model, provides fine-grained control over critical resources such as remote control, entertainment, and key data based on system-level security labels. Even if the superuser account is compromised, attackers cannot bypass the pre-defined security rules of MAC, thus building a defense-in-depth system at the operating system level to ensure vehicle security and data sovereignty in complex attack and defense scenarios. However, the current mandatory access control mode requires professional editing and review, is difficult to update, and is prone to vulnerabilities. When applied, it has problems such as high professionalism, high learning cost, high application difficulty, and arbitrary request for permissions after application development.

[0003] No efficient and accurate solution has yet been found to address the aforementioned issues in the relevant technologies. Summary of the Invention

[0004] This invention provides a method and apparatus for generating strategy documents, a storage medium, and an electronic device to solve technical problems in related technologies.

[0005] According to an embodiment of the present invention, a method for generating a policy file is provided, comprising: constructing sample policy materials; cleaning the sample policy materials to obtain training sample data; using the training sample data to perform transfer learning on an open-source model to obtain an initial policy generation model; performing reinforcement learning on the initial policy generation model to obtain a target policy generation model; acquiring software development materials for a target vehicle model, inputting the software development materials into the target policy generation model, and generating a mandatory access control (MAC) policy file for the target vehicle model, wherein the MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions, and the software development materials include software code and environmental information of the software code.

[0006] Optionally, constructing sample policy materials includes: obtaining a sample policy file; parsing multiple policy unit files contained in the sample policy file, obtaining code snippets associated with the sample policy file, obtaining system service configurations associated with the sample policy file, and obtaining environment variable configurations associated with the sample policy file; and constructing sample policy materials using the multiple policy unit files, the code snippets, the system service configurations, and the environment variable configurations.

[0007] Optionally, parsing the sample policy file containing multiple policy unit files includes: collecting sample policy files from a policy repository; extracting structured information from the sample policy files, wherein the structured information includes at least one of the following: subject type, object type, object class, permission set, TE rule, macro definition, and constraint condition; and performing semantic parsing on the structured information to obtain multiple policy units.

[0008] Optionally, obtaining the code fragment associated with the sample policy file includes: performing a function-level scan of the source code repository of the sample policy file to identify all function calls involving access to system resources, wherein the operation type of the function call includes at least one of the following: file operation, network operation, inter-process communication; extracting the resource identifier of the operation object of the function call from the source code repository, and parsing the executable file path of the function call; constructing a first association between the subject type of the sample policy file and the executable file path, constructing a second association between the object type of the sample policy file and the function call, and constructing a third association between the resource identifier and the permission set of the sample policy file.

[0009] Optionally, obtaining the system service configuration associated with the sample policy file includes: collecting the initialization script of the system startup service of the sample policy file; collecting the system initialization process or the process startup context controlled by the service manager from the initialization script, wherein the process startup context includes: service name, executable file path, SE context, user information or group information, SELinux rule mapping, and system attributes, wherein the SELinux rule mapping is used to characterize the association between the initialization script and the type_transition rule, and the system attributes are used to trigger SELinux state changes or daemon restarts.

[0010] Optionally, obtaining the environment variable configuration associated with the sample policy file includes: identifying the target process related to the environment variables of the sample policy file; collecting the access file path of the target process and recording the environment variable information of the target process, wherein the environment variable information includes: process name, environment variable name, and environment variable value, and the environment variable configuration includes the access file path and the environment variable information; and constructing a fourth association relationship between the environment variable information and the access file path.

[0011] Optionally, after cleaning the sample strategy materials to obtain training sample data, the method further includes: extracting strategy units from the training sample data; constructing simulated application behavior using the strategy information of the strategy units; inputting the simulated application behavior as prompt words into a large language model and outputting a simulated MAC strategy; and adding the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data.

[0012] Optionally, after generating the mandatory access control (MAC) policy file for the target vehicle model, the method further includes: visually verifying the MAC policy file; after the visual verification of the MAC policy file passes, compiling the MAC policy file into a mod file, and encapsulating the mod file into a pp file, wherein the pp file is used to load into the processor kernel of the target vehicle model.

[0013] Optionally, after generating the MAC policy file for the target vehicle model, the method further includes: detecting editing instructions for the MAC policy file; for each resource object in the MAC policy file, searching for the corresponding operation permission type in the MAC policy file; searching for a visualization element in a visualization element set that matches the operation permission type; using the visualization element to display the mapping relationship between the resource object and its corresponding operation permission type on a visualization interface, wherein the visualization element set includes multiple visualization elements, each visualization element corresponding to an operation permission type; and editing the MAC policy file in the visualization interface.

[0014] Optionally, editing the MAC policy file in the visualization interface includes: loading new resources of the target vehicle type to be stored in the target vehicle type of the MAC policy file in the visualization interface; searching for a target resource of the same type as the new resource in the resource object set of the MAC policy file; searching for the operation permission type of the target resource in the MAC policy file and highlighting the first visualization element of the operation permission type in the visualization interface; detecting the selection command of the first visualization element in the visualization interface and binding the operation permission type to the new resource to update the MAC policy file.

[0015] Optionally, editing the MAC policy file in the visualization interface includes: monitoring the permission update instruction of the target resource object in the MAC policy file, wherein the permission update instruction is used to instruct the historical permission type of the target resource object to be modified to the target permission type; searching for a second visualization element that matches the target permission type in the visualization element set, and using the second visualization element to update the mapping relationship between the target resource object and its corresponding operation permission type in the visualization interface.

[0016] According to another embodiment of the present invention, a policy file generation apparatus is provided, comprising: a first construction module for constructing sample policy materials; a cleaning module for cleaning the sample policy materials to obtain training sample data; a first training module for performing transfer learning on an open-source model using the training sample data to obtain an initial policy generation model; a second training module for performing reinforcement learning on the initial policy generation model to obtain a target policy generation model; and a generation module for acquiring software development materials of a target vehicle model, inputting the software development materials into the target policy generation model, and generating a mandatory access control (MAC) policy file for the target vehicle model, wherein the MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions, and the software development materials include software code and environmental information of the software code.

[0017] Optionally, the first construction module includes: an acquisition unit for acquiring a sample strategy file; a parsing unit for parsing multiple strategy unit files contained in the sample strategy file, acquiring code snippets associated with the sample strategy file, acquiring system service configurations associated with the sample strategy file, and acquiring environment variable configurations associated with the sample strategy file; and a construction unit for constructing sample strategy materials using the multiple strategy unit files, the code snippets, the system service configurations, and the environment variable configurations.

[0018] Optionally, the parsing unit includes: a first acquisition subunit, used to acquire sample policy files from the policy repository; an extraction subunit, used to extract structured information from the sample policy files, wherein the structured information includes at least one of the following: subject type, object type, object class, permission set, TE rule, macro definition, and constraint condition; and a parsing subunit, used to perform semantic parsing on the structured information to obtain multiple policy units.

[0019] Optionally, the parsing unit includes: a first identification subunit, configured to perform a function-level scan of the source code repository of the sample policy file to identify all function calls involving access to system resources, wherein the operation type of the function call includes at least one of the following: file operation, network operation, inter-process communication; an extraction subunit, configured to extract the resource identifier of the operation object of the function call from the source code repository, and parse the executable file path of the function call; and a first construction subunit, configured to construct a first association relationship between the subject type of the sample policy file and the executable file path, construct a second association relationship between the object type of the sample policy file and the function call, and construct a third association relationship between the resource identifier and the permission set of the sample policy file.

[0020] Optionally, the parsing unit includes: a second collection subunit, used to collect the initialization script of the system startup service in the sample policy file; and a third collection subunit, used to collect the system initialization process or the process startup context controlled by the service manager from the initialization script, wherein the process startup context includes: service name, executable file path, SE context, user information or group information, SELinux rule mapping, and system attributes, wherein the SELinux rule mapping is used to characterize the association between the initialization script and the type_transition rule, and the system attributes are used to trigger SELinux state changes or daemon restarts.

[0021] Optionally, the parsing unit includes: a second identification subunit, used to identify target processes related to the environment variables of the sample policy file; a fourth acquisition subunit, used to acquire the access file path of the target process and record the environment variable information of the target process, wherein the environment variable information includes: process name, environment variable name, and environment variable value, and the environment variable configuration includes the access file path and the environment variable information; and a second construction subunit, used to construct a fourth association relationship between the environment variable information and the access file path.

[0022] Optionally, the apparatus further includes: an extraction module, configured to extract strategy units from the training sample data after the cleaning module performs data cleaning on the sample strategy materials to obtain training sample data; a second construction module, configured to construct simulated application behavior using the strategy information of the strategy units; an output module, configured to input the simulated application behavior as prompt words into a large language model and output a simulated MAC strategy; and an addition module, configured to add the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data.

[0023] Optionally, the device further includes: a verification module, configured to perform visual verification of the MAC policy file after the generation module generates the mandatory access control MAC policy file for the target vehicle model; and a packaging module, configured to compile the MAC policy file into a mod file and package the mod file into a pp file after the visual verification of the MAC policy file passes, wherein the pp file is used to load into the processor kernel of the target vehicle model.

[0024] Optionally, the device further includes: a detection module, configured to detect editing instructions for the MAC policy file after the generation module generates the MAC policy file for the target vehicle model; a search module, configured to search for the corresponding operation permission type in the MAC policy file for each resource object; a display module, configured to search for a visual element matching the operation permission type in a set of visual elements, and display the mapping relationship between the resource object and its corresponding operation permission type on a visual interface using the visual element, wherein the set of visual elements includes multiple visual elements, and each visual element corresponds to an operation permission type; and an editing module, configured to edit the MAC policy file in the visual interface.

[0025] Optionally, the editing module includes: a loading unit, configured to load new resources of the target vehicle type to be stored in the MAC policy file on the visualization interface; a first search unit, configured to search for a target resource of the same type as the new resource in the resource object set of the MAC policy file; a display unit, configured to search for the operation permission type of the target resource in the MAC policy file and highlight the first visual element of the operation permission type on the visualization interface; and a binding unit, configured to detect the selection command of the first visual element on the visualization interface and bind the operation permission type to the new resource to update the MAC policy file.

[0026] Optionally, the editing module includes: a monitoring unit, used to monitor permission update instructions for target resource objects in the MAC policy file, wherein the permission update instructions are used to instruct the historical permission type of the target resource object to be modified to the target permission type; and a second search unit, used to search for a second visual element that matches the target permission type in the set of visual elements, and use the second visual element to update the mapping relationship between the target resource object and its corresponding operation permission type in the visualization interface.

[0027] According to another aspect of the embodiments of this application, a storage medium is also provided, the storage medium including a stored program that executes the above steps when the program is run.

[0028] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein: the memory is used to store computer programs; and the processor is used to execute the steps in the above method by running the programs stored in the memory.

[0029] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the steps in the above-described method.

[0030] The beneficial effects of this invention are:

[0031] 1. By constructing sample policy materials with rich contextual information, the trained target policy generation model can achieve a leap from "what" to "why". The model can not only understand the policy rules, but also understand the code root cause and system configuration background that generate the rules, enabling it to have true reasoning ability. It can generate the finest-grained policies that are highly matched with the actual behavior of the application, solving problems such as high learning cost, high application difficulty, and arbitrary permission requests after application development. It effectively reduces the difficulty of writing forced access mode policies and improves the accuracy and rationality of policies.

[0032] 2. If the application permission design in the MAC policy file is unreasonable, permissions or feedback can be configured or provided through manual intervention in the visual interface. It can automatically compile, deploy, verify policies, confirm the effectiveness of generated policies, and make them usable out of the box, reducing the application difficulty of the forced access mode. Attached Figure Description

[0033] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0034] Figure 1 This is a hardware structure block diagram of a car according to an embodiment of the present invention;

[0035] Figure 2 This is a flowchart of a method for generating a strategy file according to an embodiment of the present invention;

[0036] Figure 3 This is a flowchart illustrating the construction logic of virtual objects in an embodiment of the present invention;

[0037] Figure 4 This is a structural block diagram of a strategy document generation apparatus according to an embodiment of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of them. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present application can be combined with each other.

[0039] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0040] Example 1

[0041] The method embodiment provided in Embodiment 1 of this application can be executed in an automobile, server, processor, security controller, autonomous driving / assisted driving / intelligent driving controller, or similar processing device. Taking its operation in an automobile as an example, Figure 1 This is a hardware structure block diagram of a car according to an embodiment of the present invention. For example... Figure 1 As shown, a car may include one or more ( Figure 1 Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. Optionally, the vehicle may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned automobile. For example, the automobile may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0042] The memory 104 can be used to store vehicle programs, such as application software programs and modules, like the vehicle program corresponding to a method for generating a vehicle strategy file in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the vehicle program stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the vehicle via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a vehicle's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0044] This embodiment provides a method for generating a policy file. Figure 2This is a flowchart of a method for generating a strategy file according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0045] Step S201: Construct sample strategy materials;

[0046] Optionally, the sample policy materials include policy unit files and context files related to the sample policy files, such as code snippets, system service configurations, and environment variable configurations.

[0047] Step S202: Perform data cleaning on the sample strategy materials to obtain training sample data;

[0048] The collected sample strategy materials are stored in a data warehouse. After data cleaning, the cleaned data is stored in the material system to improve the quality of the training data.

[0049] Step S203: Use the training sample data to perform transfer learning on the open-source model to obtain the initial policy generation model;

[0050] Step S204: Perform reinforcement learning on the initial policy generation model to obtain the target policy generation model;

[0051] The learning effect is enhanced by comparing the generated predicted policy file with the real policy file through the initial policy generation model, manually intervening in the generated differences, labeling the output results, optimizing and repeating the training.

[0052] Step S205: Obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code.

[0053] In this embodiment, the MAC policy file is the carrier for managing permissions for all resource objects in the device. Operation permissions refer to the permissions for reading, writing, adding, and deleting main files.

[0054] Through the above steps, sample policy materials are constructed; data cleaning is performed on the sample policy materials to obtain training sample data; transfer learning is performed on the open-source model using the training sample data to obtain an initial policy generation model; reinforcement learning is performed on the initial policy generation model to obtain a target policy generation model; software development materials for the target vehicle model are obtained, and the software development materials are input into the target policy generation model to generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes mapping relationships between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code. This solves the technical problem of low efficiency in editing MAC policy files in the prior art, and also addresses the problems of high learning costs, high application difficulty, and arbitrary permission requests after application development. It effectively reduces the difficulty of writing mandatory access control policies and improves the accuracy and rationality of the policies.

[0055] In one embodiment of this example, constructing sample policy materials includes: obtaining a sample policy file; parsing multiple policy unit files contained in the sample policy file, obtaining code snippets associated with the sample policy file, obtaining system service configurations associated with the sample policy file, and obtaining environment variable configurations associated with the sample policy file; and constructing sample policy materials using the multiple policy unit files, the code snippets, the system service configurations, and the environment variable configurations.

[0056] In this embodiment, code snippets, system service configurations, and environment variable configurations serve as contextual information for the sample policy file. By acquiring associated contextual information, the information silos between the policy file and the system runtime environment are broken down. Automated methods are used to collect contextual information closely related to policy generation, and a "code-behavior-permission" ternary mapping relationship is constructed. This provides the model with semantically rich training material far exceeding pure policy text, enabling it to understand "why this policy is needed," rather than just "how to write this policy." Finally, all the collected multidimensional information is integrated into a unified, structured policy knowledge graph, which serves as the training material for the model.

[0057] In one example, parsing the sample policy file containing multiple policy unit files includes: collecting the sample policy file from the policy repository; extracting the structured information of the sample policy file, wherein the structured information includes at least one of the following: subject type, object type, object class, permission set, TE rule, macro definition, and constraint condition; and performing semantic parsing on the structured information to obtain multiple policy units.

[0058] Policy sample files can be collected from multiple authorized and authoritative policy repositories (such as the official Red Hat / CentOS repository, Android AOSPSELinux policies, and existing policies for in-vehicle terminals). The collected content includes raw files with extensions such as *.te and *.fc. The parser extracts structured information such as subject and object types, object classes, permission sets, TE (Type Enforcement) rules (allow, dontaudit, neverallow, etc.), macro definitions, and constraints, forming semantic policy units.

[0059] In one example, obtaining the code snippet associated with the sample policy file includes: performing a function-level scan of the source code repository of the sample policy file to identify all function calls involving access to system resources, wherein the operation type of the function call includes at least one of the following: file operation, network operation, and inter-process communication; extracting the resource identifier of the operation object of the function call from the source code repository, and parsing the executable file path of the function call; constructing a first association between the subject type of the sample policy file and the executable file path, constructing a second association between the object type of the sample policy file and the function call, and constructing a third association between the resource identifier and the permission set of the sample policy file.

[0060] This example establishes a causal relationship between the application's source code (or binary) and its required permissions. Static code analysis is employed, integrating the SAST (Static Application Security Testing) tool to scan the source code repository, achieving function-level data collection and identifying all function calls involving system resource access (such as Linux system calls and library functions), for example: file operations (open, read, write, mkdir, unlink), network operations (socket, bind, connect, listen), and inter-process communication (shmget, msgsnd, semop). Path / parameter collection is performed using scanning to extract the specific resource identifiers operated on by these function calls, such as: file paths (" / var / lib / app / config.json", " / tmp / app-socket"), port numbers (8080, 9092), and IPC key values ​​(0x12345). Build system integration: The project's build configuration files (such as Makefile, CMakeLists.txt, Android.bp) are parsed to collect the names and paths of the final generated executable files / shared libraries (such as / system / bin / my_daemon, ...). The extracted triples (executable file path, system call, resource path) are associated and stored with the rules (subject type, object type, permission) extracted from the policy, forming a sample that the model can learn.

[0061] In one example, obtaining the system service configuration associated with the sample policy file includes: collecting the initialization script of the system startup service of the sample policy file; and collecting the process startup context controlled by the system initialization process or service manager from the initialization script. The process startup context includes: service name, executable file path, SE (Security-Enhanced) context, user information or group information, SELinux rule mapping, and system properties. The SELinux rule mapping is used to characterize the association between the initialization script and the type_transition rule, and the system properties are used to trigger SELinux state changes or daemon restarts.

[0062] By capturing the process startup context controlled by the system initialization process or service manager, SELinux domain translation (domain_trans) rules can be defined.

[0063] The system collects system service startup initialization scripts (containing information such as resources and permissions required for service startup), such as Init Scripts (e.g., *.rc files). It parses Android Init language or systemd unit files, collecting information including service name (my_service), executable file path ( / vendor / bin / my_service), SE context (explicitly set seclabels (e.g., u:object_r:my_service_exec:s0) or context inherited from the parent process), user / group information (user system, group net_raw), SELinux rule mapping (associating the above initialization scripts with the corresponding type_transition rules in the policy. For example, a rule `type_transition init my_service_exec:process my_service_t;` originates from the definition in the RC file), and system properties (collecting properties set via setprop; some properties may trigger SELinux state changes or daemon restarts).

[0064] In one example, obtaining the environment variable configuration associated with the sample policy file includes: identifying the target process related to the environment variables of the sample policy file; collecting the access file path of the target process and recording the environment variable information of the target process, wherein the environment variable information includes: process name, environment variable name, and environment variable value, and the environment variable configuration includes the access file path and the environment variable information; and constructing a fourth association relationship between the environment variable information and the access file path.

[0065] In this embodiment, environment variable configuration refers to the configuration of computer environment variables. The computer environment is the operating system software of the device, such as the Android system. Environment variables are a way to configure, access, or launch applications and services in a quick way.

[0066] Identify objects in environment variables that affect program behavior or resource access patterns, record (process name, environment variable name, environment variable value), and logically associate them with file paths subsequently accessed by that process. This helps the model understand why a process accesses resources under a non-standard path. In the test environment, use `strace -e trace=execve` or a custom wrapper to monitor the startup parameters and environment variables of important processes. By analyzing shell scripts, Dockerfiles, etc., collect environment variables set via `export`, and extract path or permission information from these environment variables. For example, `LD_LIBRARY_PATH` is the dynamic library search path, associated with file read / execute permissions; `TMPDIR` and `TEMP` are temporary file directories, associated with file creation / read / write permissions; `HOME` and `USERPROFILE` are user directories, associated with file read / write permissions.

[0067] In one embodiment of this example, after cleaning the sample strategy materials to obtain training sample data, the method further includes: extracting strategy units from the training sample data; constructing simulated application behavior using the strategy information of the strategy units; inputting the simulated application behavior as prompt words into a large language model and outputting a simulated MAC strategy; and adding the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data.

[0068] To address the scarcity of training data for MAC policies, this implementation automatically generates a large number of high-quality instruction-output pairs based on the collected structured policy units. It employs a large language model or other generative models, with simulated application behavior as input and mandatory access control policies as output. For example, the instruction "Generate a policy for the web server process httpd_t listening on TCP port 8080, allowing it to read and write files in the / var / www / html / directory." generates the rule `allow httpd_t httpd_log_t:file { create open read write append getattr lock};`

[0069] This approach greatly enriches the scale and diversity of training data, enabling models to better respond to natural language or structured instructions in different scenarios.

[0070] Optionally, after generating the mandatory access control (MAC) policy file for the target vehicle model, the method further includes: visually verifying the MAC policy file; after the visual verification of the MAC policy file passes, compiling the MAC policy file into a mod file, and encapsulating the mod file into a pp file, wherein the pp file is used to load into the processor kernel of the target vehicle model.

[0071] In this embodiment, the mod and pp files are system files with the .mod and .pp extensions, respectively, compiled from the MAC policy file code and recognized by the operating system.

[0072] In one embodiment of this example, after generating the MAC policy file for the target vehicle model, the method further includes: detecting editing instructions for the MAC policy file; for each resource object in the MAC policy file, searching for a corresponding operation permission type in the MAC policy file; searching for a visualization element in a visualization element set that matches the operation permission type; using the visualization element to display the mapping relationship between the resource object and its corresponding operation permission type on a visualization interface, wherein the visualization element set includes multiple visualization elements, each visualization element corresponding to an operation permission type; and editing the MAC policy file in the visualization interface.

[0073] Optionally, operation permission types include read, write, add, delete, etc., and visual elements can be the line type (such as thickness) and color of the connecting lines. In the visualization interface, one side displays the resource object set through a list, and the other side displays the carriers of operation permissions through a list, connected by visual elements.

[0074] In one example, editing the MAC policy file in the visualization interface includes: loading new resources of the target vehicle type to be stored in the target vehicle type of the MAC policy file in the visualization interface; searching for a target resource of the same type as the new resource in the resource object set of the MAC policy file; searching for the operation permission type of the target resource in the MAC policy file and highlighting the first visualization element of the operation permission type in the visualization interface; detecting the selection command of the first visualization element in the visualization interface and binding the operation permission type to the new resource to update the MAC policy file.

[0075] If a series of newly added OEM resources have the same operation permissions, you can select to associate them with a certain generated policy file in the view. After selection, the relevant resource permission configuration information of the policy file will be automatically added.

[0076] In one example, editing the MAC policy file in the visualization interface includes: monitoring the permission update instruction of the target resource object in the MAC policy file, wherein the permission update instruction is used to instruct the historical permission type of the target resource object to be modified to the target permission type; searching for a second visualization element that matches the target permission type in the visualization element set, and using the second visualization element to update the mapping relationship between the target resource object and its corresponding operation permission type in the visualization interface.

[0077] Manually updating permissions by directly modifying the policy file will automatically reflect the security policy of the policy file in the MAC policy file view.

[0078] After generating the MAC policy file, it is dynamically mapped to the resource object. Security attributes are dynamically displayed to the resource based on the operation permission type. Based on dynamic binding, it can have a two-way influence. The resource object can be dynamically assigned to the corresponding security policy, and the effect of dynamically changing the security policy file can also be displayed on the resource object.

[0079] This embodiment provides a method for supporting the intelligent generation of mandatory access control policy configurations for intelligent connected vehicles. This method addresses issues such as high learning costs, application difficulty, and arbitrary permission requests after application development during system construction. The system architecture of this embodiment includes: a data acquisition module, a model training module, a reinforcement learning module, and a policy application module. The data acquisition module includes various data acquisition devices that can collect data including, but not limited to, deployed policies on the target device (including but not limited to subject / object information, context information, access control rules, TE rules, constraints, etc.), a high-quality policy repository, and supporting code, SELinux official syntax, and examples. The model training module primarily uses high-quality open-source models for transfer learning, specifically learning to generate mandatory access control policies. The transfer learning data comes from the cleaned data collected by the data acquisition module and data generated by the model's diverse instructions. Reinforcement Learning Module: After training the model through the model training module, the reinforcement learning module enhances the learning effect through multi-sample generation, sandbox testing and verification, and supervised fine-tuning (SFT) dataset with human intervention. It strengthens the learning effect by automatically verifying the sample code generation strategy and comparing it with the original sample code strategy, manually intervening in the output of differences, labeling and optimizing the output results, and repeating the training. Policy Application Module: By inputting R&D materials (including code, configuration, and deployment environment policy information) into the large model, a policy file for the R&D application is generated and the application is compiled and deployed. Using the trained model, the code to be deployed and verified, and the environment policy are input into the model to automatically generate a mandatory access mode policy. The generated policy is visually checked and fine-tuned with the environment policy to ensure permissions are met. The confirmed policy file is then compiled, deployed, and the application is verified.

[0080] Figure 3 This is a flowchart illustrating the data acquisition module of the intelligent generation strategy system according to an embodiment of the present invention, including:

[0081] Component S11, a high-quality strategy acquisition component;

[0082] High-quality open-source repository code collection, including but not limited to the official Red Hat / CentOS policy repository and the Android Open Source Project (AOSP) SELinux policy; vehicle terminal policy resource collection, collecting all deployed policy resource information of the terminal, including but not limited to subject and object information, context information, access control rules, TE rules, constraints, etc.; storing the collected data in a data warehouse, and through data cleaning, storing the cleaned data in the model material library to improve the quality of the data to be trained.

[0083] Component S12, a diverse instruction generation module.

[0084] Diverse instructions are generated using open-source models and added to the model material library. Due to the limited training data for the forced access mode strategy, diverse instruction generation strategy data needs to be used based on the model to enrich the training dataset.

[0085] The solution in this embodiment collects diverse data to support the generation of mandatory access mode policies, which can effectively reduce the difficulty of writing mandatory access mode policies; it can visually observe the resources used and permissions obtained by the developed applications through policy visualization, which can effectively avoid arbitrary permission requests during the development and design process. If the application permission design is unreasonable, permissions can be configured or application change plans can be provided through manual intervention; it can also automatically compile, deploy, and verify policies to confirm the effectiveness of the generated policies, making them ready to use out of the box and reducing the application difficulty of mandatory access mode.

[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0087] Example 2

[0088] This embodiment also provides a policy document generation apparatus, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0089] Figure 4 This is a structural block diagram of a strategy document generation apparatus according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0090] The first construction module 41 is used to construct sample strategy materials;

[0091] The cleaning module 42 is used to clean the sample strategy materials to obtain training sample data.

[0092] The first training module 43 is used to perform transfer learning on the open-source model using the training sample data to obtain an initial policy generation model.

[0093] The second training module 44 is used to perform reinforcement learning on the initial policy generation model to obtain the target policy generation model.

[0094] The generation module 45 is used to obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code.

[0095] Optionally, the first construction module includes: an acquisition unit for acquiring a sample strategy file; a parsing unit for parsing multiple strategy unit files contained in the sample strategy file, acquiring code snippets associated with the sample strategy file, acquiring system service configurations associated with the sample strategy file, and acquiring environment variable configurations associated with the sample strategy file; and a construction unit for constructing sample strategy materials using the multiple strategy unit files, the code snippets, the system service configurations, and the environment variable configurations.

[0096] Optionally, the parsing unit includes: a first acquisition subunit, used to acquire sample policy files from the policy repository; an extraction subunit, used to extract structured information from the sample policy files, wherein the structured information includes at least one of the following: subject type, object type, object class, permission set, TE rule, macro definition, and constraint condition; and a parsing subunit, used to perform semantic parsing on the structured information to obtain multiple policy units.

[0097] Optionally, the parsing unit includes: a first identification subunit, configured to perform a function-level scan of the source code repository of the sample policy file to identify all function calls involving access to system resources, wherein the operation type of the function call includes at least one of the following: file operation, network operation, inter-process communication; an extraction subunit, configured to extract the resource identifier of the operation object of the function call from the source code repository, and parse the executable file path of the function call; and a first construction subunit, configured to construct a first association relationship between the subject type of the sample policy file and the executable file path, construct a second association relationship between the object type of the sample policy file and the function call, and construct a third association relationship between the resource identifier and the permission set of the sample policy file.

[0098] Optionally, the parsing unit includes: a second collection subunit, used to collect the initialization script of the system startup service in the sample policy file; and a third collection subunit, used to collect the system initialization process or the process startup context controlled by the service manager from the initialization script, wherein the process startup context includes: service name, executable file path, SE context, user information or group information, SELinux rule mapping, and system attributes, wherein the SELinux rule mapping is used to characterize the association between the initialization script and the type_transition rule, and the system attributes are used to trigger SELinux state changes or daemon restarts.

[0099] Optionally, the parsing unit includes: a second identification subunit, used to identify target processes related to the environment variables of the sample policy file; a fourth acquisition subunit, used to acquire the access file path of the target process and record the environment variable information of the target process, wherein the environment variable information includes: process name, environment variable name, and environment variable value, and the environment variable configuration includes the access file path and the environment variable information; and a second construction subunit, used to construct a fourth association relationship between the environment variable information and the access file path.

[0100] Optionally, the apparatus further includes: an extraction module, configured to extract strategy units from the training sample data after the cleaning module performs data cleaning on the sample strategy materials to obtain training sample data; a second construction module, configured to construct simulated application behavior using the strategy information of the strategy units; an output module, configured to input the simulated application behavior as prompt words into a large language model and output a simulated MAC strategy; and an addition module, configured to add the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data.

[0101] Optionally, the device further includes: a verification module, configured to perform visual verification of the MAC policy file after the generation module generates the mandatory access control MAC policy file for the target vehicle model; and a packaging module, configured to compile the MAC policy file into a mod file and package the mod file into a pp file after the visual verification of the MAC policy file passes, wherein the pp file is used to load into the processor kernel of the target vehicle model.

[0102] Optionally, the device further includes: a detection module, configured to detect editing instructions for the MAC policy file after the generation module generates the MAC policy file for the target vehicle model; a search module, configured to search for the corresponding operation permission type in the MAC policy file for each resource object; a display module, configured to search for a visual element matching the operation permission type in a set of visual elements, and display the mapping relationship between the resource object and its corresponding operation permission type on a visual interface using the visual element, wherein the set of visual elements includes multiple visual elements, and each visual element corresponds to an operation permission type; and an editing module, configured to edit the MAC policy file in the visual interface.

[0103] Optionally, the editing module includes: a loading unit, configured to load new resources of the target vehicle type to be stored in the MAC policy file on the visualization interface; a first search unit, configured to search for a target resource of the same type as the new resource in the resource object set of the MAC policy file; a display unit, configured to search for the operation permission type of the target resource in the MAC policy file and highlight the first visual element of the operation permission type on the visualization interface; and a binding unit, configured to detect the selection command of the first visual element on the visualization interface and bind the operation permission type to the new resource to update the MAC policy file.

[0104] Optionally, the editing module includes: a monitoring unit, used to monitor permission update instructions for target resource objects in the MAC policy file, wherein the permission update instructions are used to instruct the historical permission type of the target resource object to be modified to the target permission type; and a second search unit, used to search for a second visual element that matches the target permission type in the set of visual elements, and use the second visual element to update the mapping relationship between the target resource object and its corresponding operation permission type in the visualization interface.

[0105] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0106] Example 3

[0107] Embodiments of the present invention also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0108] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0109] S1, construct sample strategy materials;

[0110] S2, perform data cleaning on the sample strategy materials to obtain training sample data;

[0111] S3, use the training sample data to perform transfer learning on the open source model to obtain the initial policy generation model;

[0112] S4, perform reinforcement learning on the initial policy generation model to obtain the target policy generation model;

[0113] S5, obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code.

[0114] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0115] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0116] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0117] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0118] S1, construct sample strategy materials;

[0119] S2, perform data cleaning on the sample strategy materials to obtain training sample data;

[0120] S3, use the training sample data to perform transfer learning on the open source model to obtain the initial policy generation model;

[0121] S4, perform reinforcement learning on the initial policy generation model to obtain the target policy generation model;

[0122] S5, obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code.

[0123] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0124] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0126] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0127] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for generating a strategy file, characterized in that, include: Constructing sample strategy materials, wherein constructing sample strategy materials includes: obtaining a sample strategy file; parsing multiple strategy unit files contained in the sample strategy file, obtaining code snippets associated with the sample strategy file, obtaining system service configurations associated with the sample strategy file, and obtaining environment variable configurations associated with the sample strategy file; and constructing sample strategy materials using the multiple strategy unit files, the code snippets, the system service configurations, and the environment variable configurations. The sample strategy materials are cleaned to obtain training sample data. After cleaning the sample strategy materials to obtain the training sample data, the method further includes: extracting strategy units from the training sample data; constructing simulated application behavior using the strategy information of the strategy units; inputting the simulated application behavior as prompt words into a large language model and outputting a simulated MAC strategy; adding the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data. The training sample data is used to perform transfer learning on the open-source model to obtain an initial policy generation model; The initial policy generation model is subjected to reinforcement learning to obtain the target policy generation model; Obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code. The method further includes, after generating the mandatory access control (MAC) policy file for the target vehicle model, visually verifying the MAC policy file; after the visual verification of the MAC policy file passes, compiling the MAC policy file into a mod file and encapsulating the mod file into a pp file, wherein the pp file is used to load into the processor kernel of the target vehicle model. After generating the MAC policy file for the target vehicle model, the method further includes: detecting editing instructions for the MAC policy file; for each resource object in the MAC policy file, searching for the corresponding operation permission type in the MAC policy file; searching for a visualization element in a visualization element set that matches the operation permission type; using the visualization element to display the mapping relationship between the resource object and its corresponding operation permission type on a visualization interface, wherein the visualization element set includes multiple visualization elements, each visualization element corresponding to an operation permission type; and editing the MAC policy file in the visualization interface.

2. The method according to claim 1, characterized in that, Parsing the sample policy file contains multiple policy unit files, including: Collect sample policy files from the policy repository; Extract the structured information from the sample strategy file, wherein the structured information includes at least one of the following: subject type, object type, object class, permission set, TE rule, macro definition, and constraint condition; The structured information is semantically parsed to obtain multiple policy units.

3. The method according to claim 1, characterized in that, Obtaining the code snippet associated with the sample strategy file includes: A function-level scan is performed on the source code repository of the sample policy file to identify all function calls involving access to system resources. The operation types of the function calls include at least one of the following: file operations, network operations, and inter-process communication. Extract the resource identifier of the operation object of the function call from the source code repository, and parse the executable file path of the function call; The system constructs a first association between the subject type of the sample policy file and the executable file path, a second association between the object type of the sample policy file and the function call, and a third association between the resource identifier and the permission set of the sample policy file.

4. The method according to claim 1, characterized in that, Obtaining the system service configuration associated with the sample policy file includes: The initialization script for the system startup service that collects the sample strategy file; The system initialization process or the process startup context controlled by the service manager is collected from the initialization script. The process startup context includes: service name, executable file path, SE context, user information or group information, SELinux rule mapping, and system properties. The SELinux rule mapping is used to characterize the association between the initialization script and the type_transition rule, and the system properties are used to trigger SELinux state changes or daemon restarts.

5. The method according to claim 1, characterized in that, Obtaining the environment variable configuration associated with the sample strategy file includes: Identify target processes related to the environment variables in the sample policy file; Collect the access file path of the target process and record the environment variable information of the target process. The environment variable information includes: process name, environment variable name, and environment variable value. The environment variable configuration includes the access file path and the environment variable information. Construct a fourth association between the environment variable information and the accessed file path.

6. The method according to claim 1, characterized in that, Editing the MAC policy file in the visual interface includes: The new resources to be stored in the target vehicle model where the MAC strategy file is located are loaded into the visualization interface; Search the resource object set of the MAC policy file for a target resource of the same type as the newly added resource. Find the operation permission type of the target resource in the MAC policy file, and highlight the first visual element of the operation permission type in the visualization interface; The selection command of the first visual element is detected in the visualization interface, and the operation permission type is bound to the newly added resource to update the MAC policy file.

7. The method according to claim 1, characterized in that, Editing the MAC policy file in the visual interface includes: Monitor the permission update instructions for the target resource object in the MAC policy file, wherein the permission update instructions are used to instruct the historical permission type of the target resource object to be modified to the target permission type; Find a second visual element in the set of visual elements that matches the target permission type, and use the second visual element to update the mapping relationship between the target resource object and its corresponding operation permission type in the visualization interface.

8. A strategy document generation apparatus, characterized in that, include: A first construction module is used to construct sample strategy materials, wherein the first construction module includes: an acquisition unit for acquiring a sample strategy file; a parsing unit for parsing multiple strategy unit files contained in the sample strategy file, acquiring code snippets associated with the sample strategy file, acquiring system service configurations associated with the sample strategy file, and acquiring environment variable configurations associated with the sample strategy file; and a construction unit for constructing sample strategy materials using the multiple strategy unit files, the code snippets, the system service configurations, and the environment variable configurations. The cleaning module is used to clean the sample strategy materials to obtain training sample data. The first training module is used to perform transfer learning on the open-source model using the training sample data to obtain an initial policy generation model. The second training module is used to perform reinforcement learning on the initial policy generation model to obtain the target policy generation model. The generation module is used to obtain the software development materials of the target vehicle model, input the software development materials into the target policy generation model, and generate a mandatory access control (MAC) policy file for the target vehicle model. The MAC policy file includes a mapping relationship between multiple sets of resource objects and operation permissions. The software development materials include software code and the environment information of the software code. The device further includes: an extraction module, used to extract strategy units from the training sample data after the cleaning module cleans the sample strategy materials to obtain training sample data; a second construction module, used to construct simulated application behavior using the strategy information of the strategy units; an output module, used to input the simulated application behavior as prompt words into a large language model and output a simulated MAC strategy; and an addition module, used to add the simulated application behavior and the simulated MAC strategy as sample pairs to the training sample data. The device further includes: a verification module, used to perform visual verification of the MAC policy file after the generation module generates the mandatory access control MAC policy file for the target vehicle model; and a packaging module, used to compile the MAC policy file into a mod file and package the mod file into a pp file after the visual verification of the MAC policy file passes, wherein the pp file is used to load into the processor kernel of the target vehicle model. The device further includes: a detection module, used to detect editing instructions for the MAC policy file after the generation module generates the MAC policy file for the target vehicle model; a search module, used to search for the corresponding operation permission type in the MAC policy file for each resource object; a display module, used to search for a visual element matching the operation permission type in a set of visual elements, and use the visual element to display the mapping relationship between the resource object and its corresponding operation permission type on a visual interface, wherein the set of visual elements includes multiple visual elements, each visual element corresponding to an operation permission type; and an editing module, used to edit the MAC policy file in the visual interface.

9. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 7 when it is run.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 7.

Images