Security configuration data processing method and device, storage medium and equipment

Abstract

The embodiment of the invention discloses a security configuration data processing method and device, a storage medium and equipment, which can be applied to scenes of cloud technology, data security, file management and the like. And the security configuration system sends the reference execution data of the target module, the security configuration data and the deployment information of the target module to the security configuration agent. And in response to a security data configuration deployment request of the target module, when detecting that the target execution data is matched with the reference execution data and the target path is matched with the deployment information, sending the security configuration data to the target module. Developers do not need to carry out the encryption process, and the key leakage risk is avoided. On the basis of a trust chain formed among the security configuration system, the security configuration agent and the target module, security configuration sending is performed after content verification is performed on the target module, and the security of the security data configuration process is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a secure configuration data processing method, apparatus, storage medium, and device. Background Technology

[0002] During continuous integration and continuous delivery, developers' code is deployed to virtual machines or servers. When configuring the code, developers use a configuration platform to distribute configuration information to the appropriate devices so that the code can access this information.

[0003] In related technologies, when developers need to configure program code involving security data, they first encrypt this security data to generate an encrypted configuration file, and then distribute the encrypted configuration file through a configuration platform.

[0004] However, this approach has two problems: First, developers who keep the encryption keys themselves are vulnerable to leakage; second, because configuration platforms typically connect to multiple different program codes, it's impossible to prevent other program codes from spoofing and intercepting the encrypted configuration files for cracking. Therefore, the above method can lead to the leakage of secure data. Summary of the Invention

[0005] This application provides a secure configuration data processing method, apparatus, storage medium, and device, which can improve the security of the secure data configuration process.

[0006] To address the aforementioned technical problems, this application provides the following technical solutions:

[0007] A method for processing security configuration data, comprising:

[0008] After establishing a connection with the security configuration system, a digital certificate is sent to the security configuration system for authentication;

[0009] The system receives reference execution data, security configuration data, and deployment information of the target module sent by the security configuration system after successful authentication. The security configuration data is used to configure security data for the target module.

[0010] In response to the configuration and deployment request of the target module, obtain the target path and target execution data of the target module;

[0011] When a match is detected between the target execution data and the reference execution data, and a match is detected between the verification results of the target path and the deployment information, the security configuration data is sent to the target module.

[0012] A method for processing security configuration data, comprising:

[0013] Obtain reference execution data, security configuration data, and deployment information of the target module on the deployment device. The security configuration data is used to configure security data for the target module.

[0014] Connect to a security configuration agent located on the same deployment device as the target module, perform identity verification on the security configuration agent, and when the identity verification is successful, encrypt and send the reference execution data, the security configuration data, and the deployment information to the security configuration agent.

[0015] A security configuration data processing device, comprising:

[0016] System connection module: Used to send digital certificates to the security configuration system for authentication after establishing a connection with the security configuration system.

[0017] Data receiving module: Used to receive reference execution data, security configuration data and deployment information of the target module sent by the security configuration system after successful authentication. The security configuration data is used to configure the security data of the target module.

[0018] Request and Response Module: Used to respond to configuration and deployment requests from the target module and obtain the target path and target execution data of the target module.

[0019] Data delivery module: When a match is detected between the target execution data and the reference execution data, as well as a match between the verification results of the target path and the deployment information, the security configuration data is sent to the target module.

[0020] In some embodiments, the security configuration data processing device further includes a file verification module for:

[0021] The preset path for reference execution data is obtained from the deployment information. When the target path and the preset path are consistent, it is determined that the verification result of the target path and the deployment information match.

[0022] Obtain the execution data type of the target execution data. If the target execution data and the reference execution data are consistent based on the execution data type, then the target execution data and the reference execution data are considered to be matched.

[0023] In some implementations, the file verification module is also used for:

[0024] When the data type being executed is an executable file, obtain the reference hash value indicated by the reference execution data and calculate the target hash value of the target execution data;

[0025] When the target hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0026] In some implementations, the file verification module is also used to: when the execution data type includes bytecode type, obtain a reference hash value of the reference execution data indicator, wherein the reference hash value is a reference archive hash value generated based on the reference archive package;

[0027] Obtain the target archive package of the target execution data, and calculate the target archive hash value of the target archive package;

[0028] When the target archive hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0029] In some implementations, the file verification module is also used to: when the execution data type includes a code file type, obtain a reference hash value of the reference execution data indicator, wherein the reference hash value is a reference file hash value generated based on the reference code file in the reference folder;

[0030] Obtain the target code file in the target path and calculate the target file hash value of the target code file;

[0031] When the target file hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0032] In some embodiments, the secure configuration data processing device further includes a first encryption module for:

[0033] The first encrypted configuration data is obtained by encrypting the security configuration data using a preset key;

[0034] The first encrypted configuration data is stored in memory or the storage of the deployed device.

[0035] In some embodiments, the security configuration data processing apparatus further includes a data locking module for:

[0036] If the number of consecutive requests for configuration deployment is detected to be greater than or equal to a preset number within a preset time period, the first encrypted configuration data is locked.

[0037] Send configuration data lock information to the target module;

[0038] Upon receiving the preset unlock key sent by the target module, the first encrypted configuration data is unlocked.

[0039] A security configuration data processing device, comprising:

[0040] Data acquisition module: Used to acquire reference execution data, security configuration data and deployment information of the target module on the deployment device. The security configuration data is used to configure security data for the target module.

[0041] Authentication module: Used to connect to the security configuration agent located on the same deployment device as the target module, verify the identity of the security configuration agent, and when the identity verification is successful, encrypt and send the reference execution data, security configuration data and deployment information to the security configuration agent.

[0042] In some embodiments, the secure configuration data processing device further includes a second encryption module for:

[0043] Obtain the business type of the target module, select the encryption mode according to the business type, and encrypt the security configuration data using the encryption mode to obtain the second encrypted configuration data;

[0044] When a configuration data retrieval request is received from the security configuration agent, the second encrypted configuration data is decrypted to obtain the security configuration data.

[0045] In some implementations, the data acquisition module is further configured to:

[0046] Receive execution data and deployment information from the continuous integration and continuous delivery system, and obtain reference execution data based on the execution data information;

[0047] Obtain the module name, determine the target module based on the module name and deployment information, obtain the security configuration name and security configuration content associated with the target module, and obtain the security configuration data.

[0048] In some implementations, the data acquisition module is further configured to:

[0049] Before the target module is in the final stage of release, at least one piece of execution data received will be used as reference execution data;

[0050] Once the target module is in the final release phase, the latest received execution data will be used as the reference execution data.

[0051] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the security configuration data processing method described above.

[0052] A computer program product or computer program includes computer instructions stored in a storage medium. A processor of a computer device reads the computer instructions from the storage medium and executes the computer instructions to perform the steps in the above-described secure configuration data processing method.

[0053] The secure configuration data processing method provided in this application establishes a connection with a secure configuration system, sends a digital certificate to the system for authentication, and receives reference execution data, secure configuration data, and deployment information of the target module sent by the secure configuration system after successful authentication. The secure configuration data is used to configure secure data for the target module. Responding to the target module's secure data configuration deployment request, the method obtains the target path and target execution data of the target module. When a match is detected between the target execution data and reference execution data, and between the target path and deployment information, the secure configuration data is sent to the target module. This application embodiment eliminates the need for developers to perform the encryption process, avoiding the risk of key leakage. After the secure configuration system verifies the identity of the secure configuration agent, it uses the deployment information and reference executable file of the target module sent by the secure configuration system to perform file-level verification of the path-related information and execution data information of the target module deployed on the same machine. After successful verification, the secure configuration data is sent to the target module, preventing other modules from obtaining secure configuration data using forged identities. Based on the trust chain formed between the secure configuration system, the secure configuration agent, and the target module, further content verification of the path and execution data information is performed before secure configuration is sent, improving the security of the secure data configuration process.

[0054] Other features and advantages of this disclosure will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the disclosure. The objectives and other advantages of this disclosure may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A schematic diagram of the implementation environment for the security configuration data processing method provided in this application embodiment;

[0057] Figure 2 This is a flowchart illustrating the security configuration data processing method provided in an embodiment of this application;

[0058] Figure 3 This is a schematic diagram illustrating the security configuration system receiving execution data information and deployment information provided in this application embodiment;

[0059] Figure 4 This is a schematic diagram of the input interface of the security configuration system provided in the embodiments of this application;

[0060] Figure 5 This is a schematic diagram illustrating the encryption of security configuration data provided in an embodiment of this application;

[0061] Figure 6 This is a schematic diagram illustrating the distribution of security configuration data by the security configuration system provided in this application embodiment;

[0062] Figure 7 This is a flowchart illustrating the security configuration data processing method provided in an embodiment of this application;

[0063] Figure 8 This is a schematic diagram illustrating the distribution of security configuration data provided in an embodiment of this application;

[0064] Figure 9 This is a flowchart of identity verification for the target module provided in an embodiment of this application;

[0065] Figure 10 This is a schematic diagram illustrating whether the target execution data and the reference execution data match, provided in an embodiment of this application.

[0066] Figure 11 This is a schematic diagram illustrating the response process of the security configuration agent to the target module provided in this application embodiment;

[0067] Figure 12 This is another flowchart illustrating the security configuration data processing method provided in the embodiments of this application;

[0068] Figure 13 This is a schematic diagram of the structure of the security configuration data processing device provided in the embodiments of this application;

[0069] Figure 14 Another schematic diagram of the structure of the security configuration data processing device provided in the embodiments of this application;

[0070] Figure 15 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0071] To enable those skilled in the art to better understand the solutions of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0072] It is understood that in the specific implementation of this application, security data is involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the developers is required, and the collection, use and processing of related data must comply with relevant laws, regulations and standards.

[0073] It should be noted that while some processes described in the specification, claims, and accompanying drawings contain multiple steps that appear in a specific order, it should be clearly understood that these steps may not be performed in the order they appear herein, or may be performed in parallel. The step numbers are merely used to distinguish different steps and do not represent any particular order of execution. Furthermore, descriptions such as "first," "second," or "objective" in this document are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0074] Before providing a further detailed description of the embodiments of this disclosure, the terms and concepts used in these embodiments are explained, and they are subject to the following interpretations:

[0075] A binary file refers to a file stored in binary format on an external device. In this embodiment, the binary file is an executable file stored in binary form. An executable file is a file that can be loaded and executed by an operating system; in different operating system environments, executable programs have different presentation methods.

[0076] In the software development process, developers submit functional code to a Continuous Integration (CI) system for automated compilation and code testing, ensuring that code changes do not cause integration issues. Code that passes CI testing is then moved to a Continuous Delivery (CD) system and deployed to different testing environments for more in-depth automated testing, including integration and performance testing. After passing tests, the release system deploys the corresponding code version as a development module to deployment devices in the production environment, such as servers or virtual machines. Next, a configuration system dynamically configures the development module, allowing its behavior to be adjusted without redeployment. For example, managing database connection information within the development module: developers store configurations in the configuration system, which then distributes these configurations to the deployment devices at fixed intervals. Finally, the development module runs in the production environment, executing specific functions based on the configuration provided by the configuration system.

[0077] During continuous integration and continuous delivery, developers' code is deployed to virtual machines or servers. When configuring the code, developers use a configuration system to distribute configuration information to the appropriate devices so that the code can access this information.

[0078] In related technologies, when developers need to configure security-related data in program code, such as critical business information, security credentials, or high-level security data, they first encrypt this configuration information to generate encrypted configuration files. These encrypted configuration files are then distributed to the devices where the program code is deployed via a release system, and thus accessed by the corresponding program code. After obtaining the encrypted configuration files, the program code uses the encryption key to decrypt them, thereby obtaining the relevant security data configuration information.

[0079] However, this approach presents two problems: First, developers need to perform the encryption process on their development devices or via the internet, requiring them to keep a separate encryption key. In these development environments, the risk of key leakage is significant. Second, configuration systems typically manage the configuration processes of multiple different codebases, meaning multiple codebases can connect to the configuration system. When a developer's codebase decrypts the encrypted configuration file, it needs the encryption key. If the encryption key is written into the codebase, it is vulnerable to attacks from other codebases, leading to its leakage. If the encryption key is stored in the configuration file, any codebase on the deployed device could potentially obtain the encrypted configuration file after spoofing it and decrypt it using the compromised key. Therefore, this method poses a significant security risk in configuration processes involving secure data.

[0080] To address the aforementioned issues, this application proposes a secure configuration data processing method that eliminates the need for developers to perform encryption, thus avoiding the risk of key leakage. After the secure configuration system verifies the identity of the secure configuration agent, it uses the deployment information of the target module sent by the secure configuration system and a reference executable file to perform file-level verification of the path-related information and execution data of the target module deployed on the same machine. Upon successful verification, the secure configuration data is sent to the target module, preventing other modules from obtaining the secure configuration data using forged identities. Based on the trust chain formed between the secure configuration system, the secure configuration agent, and the target module, further content verification of the path and execution data information is performed before secure configuration data is sent, enhancing the security of the secure data configuration process.

[0081] Please see Figure 1 , Figure 1The schematic diagram of the implementation environment for the security configuration data processing method provided in the embodiments of this application includes at least: a continuous integration and continuous delivery system 101, a security configuration system 102, a security configuration agent 103, and a deployment device 104.

[0082] In this process, developers submit the program code of functional modules to the Continuous Integration and Continuous Delivery System 101. The Continuous Integration and Continuous Delivery System 101 then automatically checks, compiles, and tests this code. Once the code passes all checks and tests, the Continuous Integration and Continuous Delivery System 101 packages the code into a binary file, which is an executable file containing all the necessary components of the program code and can run independently on deployment device 104. Next, the release system deploys this executable file as a module to deployment device 104. It is understandable that the Continuous Integration and Continuous Delivery System 101 can also be broken down into a Continuous Integration System and a Continuous Delivery System, with the Continuous Integration System handling automated checks and compilation, and the Continuous Delivery System handling testing and packaging.

[0083] The deployment device 104 is a computer device, which can be either a terminal or a server. Terminals include, but are not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, and aircraft. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and big data and artificial intelligence platforms. Additionally, the deployment device 104 can also be a node server in a blockchain network.

[0084] Next, when developers configure a certain functional module for security data, they use it as the target module and submit the security configuration data of the target module to the security configuration system 102. The security configuration system 102 simultaneously obtains the reference execution data of the target module and the deployment information of the target module from the continuous integration and continuous delivery system 101. The deployment information here is used to indicate the deployment device 104 where the target module is deployed and the path information of the deployment on the deployment device 104.

[0085] In addition, the security configuration system 102 deploys a security configuration agent 103 on each deployment device 104. The security configuration agent 103 is deployed on the same machine as all functional modules on the deployment device 104, and can manage the configuration information of all functional modules on the deployment device 104. After the security configuration system 102 and the security configuration agent 103 successfully authenticate each other, the security configuration system 102 sends the reference execution data, security configuration data, and deployment information of the target module to the security configuration agent 103. The security configuration agent 103 uses this data to verify the target module. When the verification is successful, it sends the security configuration data to the target module, and the target module uses the security configuration data to configure the relevant security data.

[0086] For example, this security configuration data processing method can be executed individually by the security configuration system 102 and the security configuration agent 103, or jointly by the security configuration system 102 and the security configuration agent 103. The following description uses execution in the security configuration agent 103 as an example. After establishing a connection with the security configuration system 102, the security configuration agent 103 sends a digital certificate to the security configuration system 102 for authentication. After successful authentication by the security configuration system 102, it receives reference execution data, security configuration data, and deployment information of the target module sent by the security configuration system 102. The security configuration data is used to configure security data for the target module. It responds to the target module's security data configuration deployment request, obtains the target path and target execution data sent by the target module, and when a match is detected between the target execution data and the reference execution data, and between the target path and the deployment information, it sends the security configuration data to the target module. The entire process does not require developers to perform the encryption process, which can avoid the risk of key leakage. At the same time, based on the trust chain formed between the security configuration system, the security configuration agent and the target module, the path and execution data information are further verified to prevent other functional modules on the deployment device from obtaining security configuration data by using forged identities.

[0087] It should be noted that, Figure 1 The schematic diagram of the implementation environment of the security configuration data processing method shown is merely an example. The scenarios of the security configuration data processing method described in this application embodiment are for the purpose of more clearly illustrating the technical solutions of this application embodiment and do not constitute a limitation on the technical solutions provided in this application embodiment. As those skilled in the art will know, with the evolution of the security configuration data processing method and the emergence of new business scenarios, the technical solutions provided in this application embodiment are also applicable to similar technical problems.

[0088] The embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, data security, and file management.

[0089] In this application embodiment, the description will focus on a security configuration data processing device, which can be integrated into a computer device with a storage unit and a microprocessor, thus possessing computing capabilities. Please refer to... Figure 2 , Figure 2 This is a flowchart illustrating the security configuration data processing method provided in this application embodiment. When the security configuration data processing method is executed by the security configuration system, it includes steps 201 to 202:

[0090] In step 201, the reference execution data, security configuration data, and deployment information of the target module on the deployment device are obtained.

[0091] The target module is the functional module selected by the developers that requires security data configuration, and it is deployed on the deployment device. Deployment information indicates which deployment device the target module is located on, and its specific path within that device.

[0092] The security data can be critical business information, security credentials, or high-level security data. This data is crucial for the normal operation of functional modules and must not be perceived by other modules in plaintext to avoid security risks. Security configuration data refers to the configuration data used to configure the security data of functional modules, such as database account passwords or tickets required for program operation. Since the same functional module may be deployed on multiple deployment devices, configuring the functional module on each deployment device individually is impractical. Therefore, this application embodiment uses a security configuration system to host the security configuration data of each functional module. If the target module wants to use this security configuration data, it can obtain it through the security configuration system.

[0093] In one implementation, reference Figure 3 , Figure 3 This is a schematic diagram illustrating the security configuration system receiving execution data information and deployment information provided in this application embodiment. Figure 3 Developers submit the relevant code and deployment information of the target module to the continuous integration and continuous delivery system. The continuous integration and continuous delivery system performs code checks, compilation, and packaging to obtain execution data information generated from the code. Then, the security configuration system receives the execution data and deployment information sent by the continuous integration and continuous delivery system.

[0094] In one implementation, the execution data information can be a string of information obtained by hashing the binary file corresponding to the code that has been verified by the continuous integration and continuous delivery system using the national cryptographic SM3 hash algorithm.

[0095] In one implementation, the security configuration system obtains reference execution data based on the received execution data information. This reference execution data is used for subsequent identity verification of the target module. If the developers release the target module's code through the continuous integration and continuous delivery system and do not modify it further, then the reference execution data is the execution data information sent from the continuous integration and continuous delivery system to the security configuration system.

[0096] In one implementation, when developers need to modify the target module, they only need to send the updated code to the continuous integration and continuous delivery system for automated compilation to obtain the updated execution data. However, code change releases are an ongoing process that may involve multiple deployment devices. Therefore, updating the target module and its corresponding deployment path on each deployment device also requires a process. During this time, the continuous integration and continuous delivery system continuously receives execution data during the change process, and the security configuration system also continuously receives different execution data. In this scenario, before the target module change process is complete, the security configuration system uses all execution data received during this period as reference execution data. Only after the change process is complete, considered the target module release phase finished, is the latest execution data used as the reference execution data.

[0097] In other words, in this embodiment of the application, before the target module is in the release completion phase, the security configuration system uses at least one received execution data information as reference execution data. After the target module is in the release completion phase, the security configuration system uses the most recently received execution data information as reference execution data.

[0098] In one implementation, the developer then sends the module name, security configuration name, and security configuration content to the security configuration system. For example, data can be entered through an input interface provided by the security configuration system. (See reference...) Figure 4 , Figure 4 This is a schematic diagram of the input interface of the security configuration system provided in this application embodiment. Since developers may be responsible for multiple different functional modules, and in this case, the security data configuration needs to be performed on one of the functional modules, this functional module is designated as the target module. Furthermore, a functional module may include multiple different configuration items, and each configuration item may include multiple different configuration contents; therefore, the configuration-related data needs to be determined in the input interface. Therefore, developers... Figure 4 The input interface shows the target module's module name, the security configuration name of the configuration item, and the specific security configuration content of the configuration item. The module name and the security configuration name can uniquely identify a security configuration.

[0099] The input interface shown above allows developers to input the corresponding module name, security configuration name, and security configuration content in plaintext, without needing to perform encryption operations in their own development environment, thus avoiding security risks caused by the leakage of encryption keys.

[0100] Alternatively, in one implementation, the data can be entered through a program, eliminating the need for developers to manually input the relevant data. Instead, the system can automatically obtain the security configuration data via a relevant interface, thus avoiding the involvement of developers and further enhancing the security of the security configuration data.

[0101] In one embodiment, since developers may deploy the same functional modules on different deployment devices, it is only necessary to configure security data for the functional modules on one or a few deployment devices, such as for canary releases. Therefore, deployment information can be used to determine the selected deployment device and its path on the deployment device. That is, after the security configuration system obtains the module name through the input interface, it can uniquely identify one or more target modules based on the module name and deployment information. Then, the security configuration name and content obtained from the input interface are associated with the target module to obtain the security configuration data corresponding to the target module. Associating security configuration data with target modules in this way avoids mismatches in security configuration data, thereby reducing security risks. It is understood that if developers want to configure a precise range of target modules on certain deployment devices, this embodiment can also add an input field for deployment device number or device address to the input interface, thereby accurately locating the target module and controlling the scope of the security configuration data.

[0102] In one implementation, reference Figure 3 After synchronizing the target module based on the module name and deployment information, the security configuration system stores the reference execution data, deployment information, and the target module's module name in the database.

[0103] Because security configuration data is high-security data, its security must be guaranteed throughout the entire deployment process. Therefore, the security configuration system in this embodiment of the application needs to encrypt the security configuration data after obtaining it through the input interface or API. (Refer to...) Figure 5 , Figure 5 This is a schematic diagram illustrating the encryption of security configuration data provided in an embodiment of this application. Figure 5In the process, the security configuration system checks the data entered by the developers. Once the format of the input data is correct and the input data is confirmed to be complete, the security configuration data is sent to the encryption machine for encryption to obtain the second encrypted configuration data. Then, the encryption machine returns the second encrypted configuration data to the security configuration system, which then stores the second encrypted configuration data in the database.

[0104] An encryption machine is a hardware device used to encrypt data. The encryption process is implemented in hardware. Compared to software encryption, hardware encryption typically offers higher processing speed and security because the hardware can be designed to perform only encryption-related tasks and provides stronger protection against physical intrusion. This embodiment utilizes an encryption machine with a specific encryption algorithm to protect secure configuration data from unauthorized access. The specific encryption process is as follows: The service type of the target module is obtained; an encryption mode is selected based on the service type; and the encryption machine is used to encrypt the secure configuration data using the encryption mode to obtain the second encrypted configuration data. Since different service scopes have different data security standards, different encryption modes may correspond to them. In this embodiment, the service type is determined based on the service scope of the business; for example, the service type is divided into domestic business and international business. Furthermore, different encryption modes are selected for different service types. For example, the secure configuration data corresponding to domestic business can be encrypted using the national standard SM4-GCM encryption mode, while the secure configuration data corresponding to international business can be encrypted using the AES-GCM encryption mode. It is understood that the encryption mode corresponding to different service types can be selected according to actual needs, and this embodiment does not limit this selection.

[0105] In one implementation, the security configuration system may receive security configuration data from multiple different developers configuring target modules within a certain period of time. Since the time for using this security configuration data has not yet arrived, it needs to be stored. In this embodiment, because the encryption machine is only responsible for encryption, the encrypted second encrypted configuration data is stored in the database, thereby ensuring that the second encrypted configuration data can be persisted to the disk and achieving secure storage.

[0106] In step 202, the security configuration agent located on the same deployment device as the target module is connected, and the identity of the security configuration agent is verified. When the identity verification is successful, the reference execution data, security configuration data and deployment information are encrypted and sent to the security configuration agent.

[0107] In one implementation, the security configuration agent periodically establishes a connection with the security configuration system. This connection can be an HTTPS connection. The agent retrieves information about whether updated security configuration data is available for the functional modules deployed on the same machine that it manages within a previous time period. Therefore, in this embodiment, the security configuration system decides whether to distribute security configuration data based on the request information from the security configuration agent. The distribution process is specifically described as follows: upon receiving a configuration data retrieval request from the security configuration agent, the system decrypts the second encrypted configuration data to obtain the security configuration data.

[0108] Reference Figure 6 , Figure 6 This is a schematic diagram illustrating the distribution of security configuration data by the security configuration system provided in this application embodiment. The security configuration system receives a configuration data retrieval request sent by the security configuration agent. Since the target module is one of the functional modules managed by the security configuration agent, the configuration data retrieval request includes at least retrieving the security configuration data corresponding to the target module. At this time, a connection is established between the security configuration agent and the security configuration system. The security configuration system receives its own digital certificate sent by the security configuration agent. Since the security configuration agent is deployed on the deployment device by the security configuration system, the security configuration system stores the digital certificate of the security configuration agent. The digital certificate sent by the security configuration agent is compared with the digital certificate pre-stored in the security configuration system. If they match, it proves that the security configuration agent is deployed by the security configuration system, and there is a trust basis between them. Based on this trust, the security configuration system retrieves the relevant encrypted security configuration data requested by the security configuration agent from the database, that is, retrieves the second encrypted configuration data. Then, the security configuration system calls the encryption machine to decrypt the second encrypted configuration data. After decryption, the system receives the decrypted security configuration data returned by the encryption machine. The security configuration data, deployment information, and reference execution data are sent to the security configuration agent via an HTTPS connection.

[0109] It is understandable that in this embodiment of the application, the process of the security configuration system sending data to the security configuration agent via HTTPS connection still requires the data to be encrypted during transmission to ensure that the security configuration data will not be intercepted by attack methods such as packet sniffing due to plaintext transmission.

[0110] In this embodiment, the encryption process of secure configuration data using a secure configuration system eliminates the need for developers to perform encryption, thus avoiding the risk of key leakage. Only after the secure configuration system has verified the identity of the secure configuration agent, based on this trust, is the secure configuration data, deployment information, and reference execution data of the target module sent to the secure configuration agent. Data distribution through the secure configuration agent enhances the security of the secure data configuration process.

[0111] The following describes the data delivery process after the security configuration agent receives the security configuration data, deployment information, and reference execution data of the target module in this embodiment of the application.

[0112] In this embodiment, the description will focus on a security configuration data processing device, which can be integrated into the deployment device. Please refer to [link to relevant documentation]. Figure 7 , Figure 7 This is a flowchart illustrating the security configuration data processing method provided in this application embodiment. When the security configuration data processing method is executed by the security configuration agent, it includes steps 701 to 704:

[0113] In step 701, after establishing a connection with the security configuration system, a digital certificate is sent to the security configuration system for authentication.

[0114] Among them, reference Figure 6 The security configuration agent periodically establishes communication connections with the security configuration system, such as HTTPS, and then sends its digital certificate to the security configuration system. Since the security configuration agent is deployed on the deployment device by the security configuration system, the security configuration system stores the agent's digital certificate. The digital certificate sent by the security configuration agent is compared with the pre-stored digital certificate in the security configuration system. If they match, it proves that the security configuration agent is deployed by the security configuration system, and there is a trust basis between them. At this point, the security configuration system's authentication of the security configuration agent is successful. If they do not match, it means that there is no trust between them, and the security configuration system's authentication of the security configuration agent fails. Only after the security configuration system has successfully authenticated the security configuration agent will the subsequent security configuration data distribution process proceed, thus improving the security of the security data configuration process.

[0115] In step 702, the reference execution data, security configuration data, and deployment information of the target module sent by the security configuration system after successful authentication are received.

[0116] Specifically, based on the trust established between the security configuration agent and the security configuration system, the system receives the target module's reference execution data, security configuration data, and deployment information, which are encrypted and sent by the security configuration system after successful authentication.

[0117] In one implementation, the security configuration agent may receive data corresponding to multiple functional modules it manages. This data may not be requested in a timely manner. Therefore, for the security of data throughout the overall process, the security configuration agent also encrypts the received data and stores the encrypted data for later use. Combined with... Figure 6The specific process is described as follows: The security configuration data is encrypted using a preset key to obtain first encrypted configuration data, which is then stored in memory or the storage of the deployment device. The preset key is the security configuration agent's own private key and does not participate in the data transmission process between the security configuration agent and other functional modules, thus avoiding the security risk of key leakage.

[0118] In one implementation, the security configuration agent is deployed on the same deployment device as other functional modules. Therefore, the encrypted first configuration data is stored in the memory of the deployment device, which enables persistent storage. Even if the deployment device needs to be restarted or fails, the data will not be lost. In addition, the memory can protect the data from hardware failure or accidental deletion through backup and redundancy mechanisms, which means that the availability of the data can be improved.

[0119] In one implementation, to mitigate the security risk of attacks on the deployment device leading to the storage of the first encrypted configuration data in memory, embodiments of this application may directly store the first encrypted configuration data in memory without persistent storage. While this sacrifices some availability, memory provides very fast read and write speeds, improving the efficiency of subsequently sending relevant security configuration data to the target module.

[0120] It is understood that the embodiments of this application may select the corresponding storage location for the first encrypted configuration data according to actual needs.

[0121] In step 703, in response to the configuration and deployment request of the target module, the target path and target execution data of the target module are obtained.

[0122] In one implementation, when the target module needs to configure security data, it sends a configuration deployment request to the security configuration agent. At this time, the security configuration agent responds to the received configuration deployment request from the target module, obtains the target path and target execution data of the target module, performs identity verification on the target module, and sends the corresponding security configuration data after the verification is successful.

[0123] In one implementation, the target path of the target module is its running path or installation path on the deployment device, and the target execution data can be the running code of the target module on the deployment device. Since the security configuration agent can manage information such as the processes of all functional modules on the same deployment device, it can directly obtain the target path and target execution data of the target module. Furthermore, to improve the response efficiency of the security configuration agent, in this embodiment, when the target module sends a configuration deployment request to the security configuration agent, it can carry its target path and target execution data, so that the security configuration agent can directly obtain the target path and target execution data.

[0124] In one embodiment, if the target module frequently requests secure configuration data within a short period of time, the secure configuration agent will define such requests as abnormal requests and take abnormal handling measures. The specific process is described as follows: when the number of consecutive requests for configuration deployment is detected to be greater than or equal to a preset number within a preset time period, the first encrypted configuration data is locked. For example, the preset time period can be 1 second, and the preset number can be 10 times; that is, if 10 consecutive requests are received within 1 second, it is determined to be an abnormal request. Further, configuration data locking information is sent to the target module. When the preset unlocking key sent by the target module is received, the first encrypted configuration data is unlocked. The preset unlocking key is pre-agreed upon by the secure configuration agent and each functional module. The preset unlocking keys corresponding to different functional modules can be the same or different; this embodiment does not limit this.

[0125] Reference Figure 8 , Figure 8 This is a schematic diagram illustrating the distribution of security configuration data provided in an embodiment of this application. Figure 8 If a target module sends N configuration deployment requests to the security configuration agent within a preset time period, where N is greater than or equal to the preset number set by the security configuration agent, the security configuration agent considers the target module to be an attacker impersonating someone else. Therefore, it needs to respond quickly. First, it locks the first encrypted configuration data related to the target module. Locking means that regardless of whether the first encrypted configuration data is stored in memory or the deployment device's storage, it cannot be accessed by any entity, thus ensuring the security of the configuration data distribution process. Next, the security configuration agent returns a configuration data lock message to the target module, informing it of the abnormal response. Then, if the target module is not an impersonating module but is making frequent requests for special reasons, it can send a pre-agreed unlocking key to the security configuration agent. Upon receiving the unlocking key, the security configuration agent unlocks the first encrypted configuration data; unlocking here means the first encrypted configuration data is no longer locked.

[0126] In one implementation, the security configuration agent provides a corresponding retrieval interface to the target module, responding to the target module's configuration deployment requests through this interface. The provided retrieval interface can be generated using common languages ​​such as C++, Java, Go, Python, or Node.js. Taking C++ as an example, the retrieval interface is represented as: `std::stringGetSecretConfig(std::string moduleName, std::string configName)`, where `moduleName` represents the name of the target module, `configName` represents the security configuration name, and `moduleName` needs to be matched with the target module's name. Figure 4 The module name in the input interface must be consistent with the configName. Figure 4 The security configuration name in the input interface should remain consistent.

[0127] In step 704, when a match is detected between the target execution data and the reference execution data, as well as a match between the target path and the deployment information, the security configuration data is sent to the target module.

[0128] In one implementation, after the security configuration agent obtains the target execution data and target path of the target module, it needs to use the obtained data to further verify the identity of the target module, thereby realizing a trust chain between the security configuration system, the security configuration agent and the target module.

[0129] In one implementation, reference Figure 9 , Figure 9 This is a flowchart of identity verification for a target module provided in an embodiment of this application, which specifically includes the following steps:

[0130] Step 901: Obtain the preset path of the reference execution data from the deployment information. When the target path and the preset path are consistent, it is determined that the target path and the deployment information match.

[0131] The deployment information includes the path of the reference execution data that the developer expects to change on the deployment device. Therefore, in this embodiment, the security configuration agent obtains this path from the deployment information as the preset path for the reference execution data. It then compares the actual path of the target module on the deployment device (i.e., the target path) with the preset path. If they match, it can be determined to some extent that the target module on the target path is the functional module the developer wants to operate on. If the target path and the preset path match, it is determined that the target path and the deployment information match; if they do not match, it is determined that the verification result of the target path and the deployment information does not match.

[0132] Step 902: Obtain the execution data type of the target execution data. If the target execution data and the reference execution data are consistent based on the execution data type, then the target execution data and the reference execution data are considered to be matched.

[0133] The reference execution data reflects the specific code of the functional module that the developer intends to modify. Therefore, to further determine the identity of the target module, it is necessary to compare the code of the target module on the deployment device with the expected code. Authentication at the code level can improve the accuracy of authentication. However, considering the differences in code implementation methods corresponding to different execution data types, this embodiment combines execution data types for code-level verification. Specifically, this embodiment first obtains the execution data type of the target execution data, and then determines whether the target execution data and the reference execution data are consistent based on the execution data type. If they are consistent, it can be determined to some extent that the code corresponding to the target module is the code that the developer wants to update. If the target execution data and the reference execution data are consistent, the verification results of the target execution data and the reference execution data are determined to match; if the target execution data and the reference execution data are inconsistent, the verification results of the target execution data and the reference execution data are determined to be inconsistent.

[0134] It is understandable that, for the sake of development consistency, the code corresponding to the reference execution data and the code corresponding to the target execution data have the same execution data type. The following describes how, in this embodiment of the application, it is determined whether the target execution data and the reference execution data are consistent based on the execution data type.

[0135] In one implementation, the data types to be executed include three categories: executable file type, bytecode type, and code file type. The executable file type can be an executable file generated using C++ or Go. The bytecode type is bytecode generated using, for example, Java. The code file type is code files generated using, for example, Python. This embodiment is for illustrative purposes only and does not represent a limitation on the data types to be executed.

[0136] In one implementation, when the data type being executed is an executable file, the reference execution data is the hash value corresponding to the executable binary file, and this hash value is used as the reference hash value. The security configuration agent can obtain the reference hash value indicated by the reference execution data. Next, since the target execution data is an executable binary file, the hash value corresponding to this binary file is calculated as the target hash value of the target execution data. In this embodiment, after obtaining the target hash value of the target module on the deployment device, the target hash value is compared with the reference hash value passed in through the continuous integration and continuous delivery system. If the target hash value and the reference hash value are consistent, it is determined that the target execution data and the reference execution data match; if the target hash value and the reference hash value are inconsistent, it is determined that the target execution data and the reference execution data do not match.

[0137] In one implementation, when the executable data type includes bytecode, the reference executable data is the hash value corresponding to a compressed package containing all source files and dependent libraries. This compressed package is called a reference archive, and its type is JAR. The reference archive hash value generated by the reference archive is used as the reference hash value, and the security configuration agent can obtain the reference hash value indicated by the reference executable data. Next, since the target executable data is also a JAR archive, it is called the target archive. After obtaining the target archive, the hash value corresponding to the target archive is calculated as the target archive hash value. In this embodiment, after obtaining the target archive hash value of the target module on the deployment device, the target archive hash value is compared with the reference hash value passed through the continuous integration and continuous delivery system. If the target archive hash value and the reference hash value are consistent, it is determined that the target executable data and the reference executable data match; if they are inconsistent, it is determined that the target executable data and the reference executable data do not match.

[0138] In one implementation, when the execution data type includes code file types, the final compilation artifact structure cannot be determined because the code corresponding to this execution data type does not need to be compiled in advance. In this case, the reference execution data is all the reference code files in the reference folder used to store related code, which is recursively traversed by the continuous integration and continuous delivery system during the integration phase. For example, all Python code files in the reference folder are treated as reference code files. After sorting the reference code files according to a preset sorting rule, the reference file hash values ​​are calculated in batches and used as reference hash values. The security configuration agent can obtain the reference hash values ​​indicated by the reference execution data. Next, for the target module, the security configuration system obtains the target code files in the folder corresponding to the target path and repeats a recursive traversal process similar to that in the continuous integration phase to calculate the target file hash values ​​of the target code files. In this embodiment, after obtaining the target file hash value of the target module on the deployment device, the target file hash value is compared with the reference hash value passed through the continuous integration and continuous delivery system. If the target file hash value and the reference hash value are consistent, it is determined that the target execution data and the reference execution data match; if the target file hash value and the reference hash value are inconsistent, it is determined that the target execution data and the reference execution data do not match.

[0139] Furthermore, when the data type being executed includes code files, the dependent library files corresponding to the reference code files may not all be located in the reference folder; they may also be in other paths within the system. This application's embodiments address this situation by implementing static code analysis. During the continuous integration phase, all code files that might use security configuration data are examined, and a reference hash value is calculated. During the runtime verification process, it is checked whether only these relevant code files use security configuration data, and whether the target file's hash value falls within the range of the reference hash value.

[0140] Reference Figure 10 , Figure 10 This is a schematic diagram illustrating whether the target execution data and the reference execution data match, as provided in the embodiments of this application. Figure 10First, the execution data type is determined. When the execution data type is an executable file, the target hash value is compared with the passed-in reference hash value. The comparison result determines whether the target execution data and the reference execution data match. When the execution data type includes bytecode, the reference hash value is obtained from the reference archive hash value of the reference archive package, and the hash value corresponding to the target archive package is calculated as the target archive hash value. The target archive hash value is then compared with the passed-in reference hash value, and the comparison result determines whether the target execution data and the reference execution data match. When the execution data type includes code files, the reference hash value is determined based on the reference file hash value of the reference code file in the reference folder, and the target file hash value is calculated from the target code file in the target path. The target file hash value is then compared with the passed-in reference hash value, and the comparison result determines whether the target execution data and the reference execution data match.

[0141] In one implementation, reference Figure 11 , Figure 11 This is a schematic diagram illustrating the response process of the security configuration agent to the target module provided in this application embodiment. Figure 11 In the process, the target module sends a configuration deployment request to the security configuration agent. Based on the configuration deployment request, the security configuration agent obtains the target path and target execution data of the target module. Then, it checks the matching results between the target execution data and the reference execution data, as well as the matching results between the target path and the deployment information. When a match is detected between the target execution data and the reference execution data, and between the target path and the deployment information, the agent obtains the first encrypted configuration data from the memory or the storage of the deployment device, decrypts the first encrypted configuration data using its own preset key to obtain the secure configuration data, and sends the secure configuration data to the target module for the target module to perform relevant configuration.

[0142] In one implementation, if developers make changes to the target module, the reference execution data is determined based on the change's status when matching. During the change process, the continuous integration and continuous delivery systems continuously acquire execution data, and the security configuration system also continuously receives different execution data. In this scenario, before the target module's change process is complete and before the target module reaches the end of its release phase, the security configuration system uses all received execution data during this period as reference execution data and distributes it to the security configuration agent. Only after the change process is complete, and the target module's release phase is considered over, does the security configuration system use the latest execution data as reference execution data and distribute it to the security configuration agent.

[0143] In one implementation, the above process can be understood as follows: before the change begins, the security configuration system and security configuration agent only recognize the old reference execution data and the corresponding deployment information. After the change release begins, the continuous integration and continuous delivery system synchronizes the new execution data information to the security configuration system. At this point, the security configuration system considers both the old and new execution data information to meet the developers' expectations and have the necessary permissions for security configuration data. Therefore, it synchronizes all received execution data information as reference execution data to the security configuration agent. At the end of the change release, the security configuration system considers the latest execution data information to be the final version determined by the developers and synchronizes it as reference execution data to the security configuration agent. At this point, the previously determined reference execution file information becomes obsolete. This method ensures the continuity of changes and significantly improves the fault tolerance rate of configuring security data during the change process.

[0144] This application's embodiments eliminate the need for developers to perform the encryption process, avoiding the risk of key leakage. After the secure configuration system verifies the identity of the secure configuration agent, it uses the deployment information of the target module sent by the secure configuration system and the reference executable file to perform file-level verification of the path-related information and execution data information of the target module deployed on the same machine. Upon successful verification, the secure configuration data is sent to the target module, preventing other modules from obtaining secure configuration data using forged identities. Based on the trust chain formed between the secure configuration system, the secure configuration agent, and the target module, further content verification of the path and execution data information is performed before secure configuration is sent, enhancing the security of the secure data configuration process.

[0145] Based on the methods described in the above embodiments, the following examples will provide further detailed explanations.

[0146] Please refer to the following: Figure 12 , Figure 12 This is another flowchart illustrating the security configuration data processing method provided in this application embodiment. The method flow may include:

[0147] In step 1201, the security configuration system obtains the reference execution data, security configuration data, and deployment information of the target module on the deployment device.

[0148] In this process, developers submit the relevant code and deployment information of the target module to the continuous integration and continuous delivery system. The continuous integration and continuous delivery system then performs code checks, compilation, and packaging to obtain execution data information generated from the code. Finally, the continuous integration and continuous delivery system sends the execution data information and deployment information to the security configuration system.

[0149] In this process, developers send the module name, security configuration name, and security configuration content to the security configuration system through the input interface provided by the system. Specifically, developers... Figure 4 The illustrated input interface allows users to input the target module's name, the security configuration name of the configuration item, and the specific security configuration content of the configuration item. The security configuration system checks the data entered by the developer. Once the input data format is verified to be correct and the input is confirmed, the system associates the security configuration name and content obtained from the input interface with the target module to obtain the corresponding security configuration data for the target module. This security configuration data is then sent to an encryption machine for encryption to obtain second encrypted configuration data. The encryption machine then returns the second encrypted configuration data to the security configuration system, which in turn stores the second encrypted configuration data in its database.

[0150] In step 1202, the security configuration system connects to the security configuration agent located on the same deployment device as the target module and performs identity verification on the security configuration agent.

[0151] The security configuration system receives a configuration data retrieval request from the security configuration agent. Since the target module is one of the functional modules managed by the security configuration agent, the request must include retrieving the security configuration data corresponding to the target module. At this point, a connection is established between the security configuration agent and the security configuration system. The security configuration system receives its own digital certificate from the security configuration agent. Because the security configuration agent is deployed on the deployment device, the security configuration system stores the agent's digital certificate. The system compares the digital certificate sent by the agent with the pre-stored digital certificate in its system. If they match, it proves that the security configuration agent was deployed by the security configuration system, establishing a trustworthy relationship, and the identity verification is successful.

[0152] In step 1203, when the identity verification is successful, the security configuration system will encrypt and send the reference execution data, security configuration data and deployment information to the security configuration agent.

[0153] Based on the trusted identity verification, the security configuration system retrieves the relevant encrypted security configuration data requested by the security configuration agent from the database; that is, it retrieves the second encrypted configuration data. Next, the security configuration system calls the encryption machine to decrypt the second encrypted configuration data. After decryption, it receives the decrypted security configuration data returned by the encryption machine. The security configuration data, deployment information, and reference execution data are then sent to the security configuration agent via an HTTPS connection.

[0154] In step 1204, the security configuration agent encrypts the security configuration data using a preset key to obtain first encrypted configuration data, and stores the first encrypted configuration data in memory or the storage of the deployment device.

[0155] The security configuration agent is deployed on the same machine as other functional modules on the deployment device. Therefore, the encrypted first configuration data is stored in the memory of the deployment device, which can achieve persistent storage. Even if the deployment device needs to be restarted or fails, the data will not be lost. In addition, the memory can protect the data from hardware failure or accidental deletion through backup and redundancy mechanisms, which means that the availability of data can be improved.

[0156] To mitigate the security risks of attacks on the deployment device leading to the loss of the first encrypted configuration data stored in the memory, this embodiment of the application can also directly store the first encrypted configuration data in memory without persistent storage. While this sacrifices some availability, memory provides very fast read and write speeds, improving the efficiency of subsequently sending the relevant security configuration data to the target module.

[0157] In step 1205, the security configuration agent responds to the configuration deployment request of the target module and obtains the target path and target execution data of the target module.

[0158] When a target module needs to configure security data, it sends a configuration deployment request to the security configuration agent. The security configuration agent responds to the received configuration deployment request from the target module, obtains the target path and target execution data of the target module, verifies the identity of the target module, and sends the corresponding security configuration data after the verification is successful.

[0159] In this embodiment, the target path of the target module is its running path or installation path on the deployment device, and the target execution data can be the running code of the target module on the deployment device. Since the security configuration agent can manage the processes and other information of all functional modules on the same deployment device, it can directly obtain the target path and target execution data of the target module. Furthermore, to improve the response efficiency of the security configuration agent, in this embodiment, when the target module sends a configuration deployment request to the security configuration agent, it can carry its target path and target execution data, so that the security configuration agent can directly obtain the target path and target execution data.

[0160] In one implementation, if the target module frequently requests secure configuration data within a short period, the secure configuration agent will define such requests as abnormal requests and take abnormal handling measures. The specific process is described as follows: when the number of consecutive configuration deployment requests is detected to be greater than or equal to a preset number within a preset time period, the first encrypted configuration data is locked, and configuration data locking information is sent to the target module. Upon receiving the preset unlocking key from the target module, the first encrypted configuration data is unlocked. The preset unlocking key is pre-agreed upon by the secure configuration agent and each functional module. Different functional modules may use the same or different preset unlocking keys; this embodiment does not impose such limitations.

[0161] In step 1206, when the security configuration agent detects that the target execution data and reference execution data match, as well as that the target path and deployment information match, it sends the security configuration data to the target module.

[0162] In one implementation, after the security configuration agent obtains the target execution data and target path of the target module, it needs to use the obtained data to further verify the identity of the target module, thereby establishing a trust chain between the security configuration system, the security configuration agent, and the target module. The specific verification process is described as follows: Obtain the preset path of the reference execution data from the deployment information; when the target path and the preset path are consistent, it is determined that the target path and deployment information match; obtain the execution data type of the target execution data; and if the target execution data and the reference execution data are consistent based on the execution data type, it is determined that the target execution data and the reference execution data match.

[0163] The deployment information includes the path of the reference execution data that the developer expects to change on the deployment device. Therefore, in this embodiment, the security configuration agent obtains this path from the deployment information as the preset path for the reference execution data. It then compares the actual path of the target module on the deployment device (i.e., the target path) with the preset path. If they match, it can be determined to some extent that the target module on the target path is the functional module the developer wants to operate on. If the target path and the preset path match, it is determined that the target path and the deployment information match; if they do not match, it is determined that the verification result of the target path and the deployment information does not match.

[0164] In one implementation, the execution data types in this embodiment include three categories: executable file type, bytecode type, and code file type. It is understood that, for development consistency, the code corresponding to the reference execution data and the code corresponding to the target execution data have the same execution data type. The verification process is described as follows: First, determine the execution data type. When the execution data type is an executable file type, compare the target hash value with the input reference hash value, and determine whether the target execution data and the reference execution data match based on the comparison result. When the execution data type includes bytecode type, use the reference archive hash value of the reference archive package as the reference hash value, and calculate the hash value corresponding to the target archive package as the target archive hash value. Compare the target archive hash value with the input reference hash value, and determine whether the target execution data and the reference execution data match based on the comparison result. When the execution data type includes code file type, determine the reference hash value based on the reference file hash value of the reference code file in the reference folder, and obtain the target file hash value of the target code file in the target path. Compare the target file hash value with the input reference hash value, and determine whether the target execution data and the reference execution data match based on the comparison result.

[0165] Specifically, when a match is detected between the target execution data and the reference execution data, as well as a match between the target path and the deployment information, the first encrypted configuration data is retrieved from the memory or the storage of the deployment device. The first encrypted configuration data is then decrypted using its own preset key to obtain secure configuration data. The secure configuration data is then sent to the target module for the target module to perform relevant configurations.

[0166] As described above, this application establishes a trust chain between the continuous integration and continuous delivery system, the secure configuration system, the secure configuration agent, and the target module, performing multi-factor authentication. It identifies the true target module at the file level, preventing any functional module not compiled or released by the continuous integration and continuous delivery system from obtaining secure configuration data. This avoids attackers with unauthorized permissions from obtaining secure configuration data, thus improving the security of the secure configuration data. Throughout the process, developers do not need to be aware of the encryption keys. Developers only need to input the secure configuration data in plaintext into the input interface provided by the secure configuration system. The secure configuration system automatically encrypts and stores this secure configuration data and then sends the encrypted secure configuration data to the secure configuration agent, i.e., the production environment where the target module is deployed, based on the configuration data retrieval request. When the target module needs to use the secure configuration data, the target module also does not need to be aware of the preset key used by the secure configuration agent. The secure configuration agent automatically verifies and identifies the target module's identity. If the target module's identity verification passes, it is considered to have the right to obtain the secure configuration data. Therefore, the agent responds to the target module's configuration deployment request and sends the decrypted secure configuration data to the target module. As can be seen from the developer's perspective, it only requires plaintext input of security configuration data to be used synchronously in the corresponding target module, without needing to know any keys or perform additional encryption / decryption processing in the target module's code, thus improving both security and ease of use.

[0167] The secure configuration data processing method provided in this embodiment establishes a connection with the secure configuration system, sends a digital certificate to the system for authentication, and receives reference execution data, secure configuration data, and deployment information of the target module sent by the secure configuration system after successful authentication. The secure configuration data is used to configure secure data for the target module. Responding to the target module's secure data configuration deployment request, the method obtains the target path and target execution data of the target module. When a match is detected between the target execution data and reference execution data, and between the target path and deployment information, the secure configuration data is sent to the target module. This embodiment eliminates the need for developers to perform the encryption process, avoiding the risk of key leakage. After the secure configuration system verifies the identity of the secure configuration agent, it uses the deployment information and reference executable file of the target module sent by the secure configuration system to perform file-level verification of the path-related information and execution data information of the target module deployed on the same machine. After successful verification, the secure configuration data is sent to the target module, preventing other modules from obtaining secure configuration data using forged identities. Based on the trust chain formed between the secure configuration system, the secure configuration agent, and the target module, further content verification of the path and execution data information is performed before secure configuration is sent, improving the security of the secure data configuration process.

[0168] To facilitate better implementation of the secure configuration data processing method provided in this application, this application also provides an apparatus based on the aforementioned secure configuration data processing method. The meanings of the terms used are the same as in the secure configuration data processing method described above, and specific implementation details can be found in the descriptions within the method embodiments.

[0169] Please see Figure 13 , Figure 13 This is a schematic diagram of the structure of a security configuration data processing device provided in an embodiment of this application. The security configuration data processing device is applied to a deployment device and may include a system connection module 1301, a data receiving module 1302, a request response module 1303, and a data distribution module 1304, etc.

[0170] System connection module 1301: Used to send a digital certificate to the security configuration system for authentication after establishing a connection with the security configuration system.

[0171] Data receiving module 1302: Used to receive reference execution data, security configuration data and deployment information of the target module sent by the security configuration system after authentication. The security configuration data is used to configure the security data of the target module.

[0172] Request / Response Module 1303: Used to respond to the configuration and deployment requests of the target module and obtain the target path and target execution data of the target module.

[0173] Data delivery module 1304: When a match is detected between the target execution data and the reference execution data, and a match is detected between the verification results of the target path and the deployment information, the security configuration data is sent to the target module.

[0174] In some implementations, the security configuration data processing apparatus further includes a file verification module (unidentified), used for:

[0175] The preset path for reference execution data is obtained from the deployment information. When the target path and the preset path are consistent, it is determined that the verification result of the target path and the deployment information match.

[0176] Obtain the execution data type of the target execution data. If the target execution data and the reference execution data are consistent based on the execution data type, then the target execution data and the reference execution data are considered to be matched.

[0177] In some implementations, the file verification module is also used for:

[0178] When the data type being executed is an executable file, obtain the reference hash value indicated by the reference execution data and calculate the target hash value of the target execution data;

[0179] When the target hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0180] In some implementations, the file verification module is also used to: when the execution data type includes bytecode type, obtain a reference hash value of the reference execution data indicator, wherein the reference hash value is a reference archive hash value generated based on the reference archive package;

[0181] Obtain the target archive package of the target execution data, and calculate the target archive hash value of the target archive package;

[0182] When the target archive hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0183] In some implementations, the file verification module is also used to: when the execution data type includes a code file type, obtain a reference hash value of the reference execution data indicator, wherein the reference hash value is a reference file hash value generated based on the reference code file in the reference folder;

[0184] Obtain the target code file in the target path and calculate the target file hash value of the target code file;

[0185] When the target file hash value and the reference hash value are the same, it is determined that the target execution data and the reference execution data are matched.

[0186] In some embodiments, the secure configuration data processing apparatus further includes a first encryption module (unidentified), used for:

[0187] The first encrypted configuration data is obtained by encrypting the security configuration data using a preset key;

[0188] The first encrypted configuration data is stored in memory or the storage of the deployed device.

[0189] In some embodiments, the security configuration data processing apparatus further includes a data locking module (unidentified) for:

[0190] If the number of consecutive requests for configuration deployment is detected to be greater than or equal to a preset number within a preset time period, the first encrypted configuration data is locked.

[0191] Send configuration data lock information to the target module;

[0192] Upon receiving the preset unlock key sent by the target module, the first encrypted configuration data is unlocked.

[0193] The specific implementation of each of the above units can be found in the previous embodiments, and will not be repeated here.

[0194] As described above, in this embodiment, after establishing a connection with the security configuration system through the system connection module 1301, a digital certificate is sent to the security configuration system for authentication. The data receiving module 1302 receives the reference execution data, security configuration data, and deployment information of the target module sent by the security configuration system after successful authentication. The security configuration data is used to configure security data for the target module. The request response module 1303 responds to the security data configuration deployment request of the target module, obtaining the target path and target execution data of the target module. When the data delivery module 1304 detects a match between the target execution data and the reference execution data, and a match between the target path and the deployment information, it sends the security configuration data to the target module. This embodiment eliminates the need for developers to perform the encryption process, avoiding the risk of key leakage. After the security configuration system verifies the identity of the security configuration agent, it uses the deployment information and reference executable file of the target module sent by the security configuration system to perform file-level verification of the path-related information and execution data information of the target module deployed on the same machine. After successful verification, the security configuration data is sent to the target module, preventing other modules from obtaining security configuration data using forged identities. Based on the trust chain formed between the security configuration system, security configuration agent, and target module, the path and execution data information are further verified before security configuration is sent, thereby improving the security of the security data configuration process.

[0195] To facilitate better implementation of the secure configuration data processing method provided in this application, this application also provides an apparatus based on the aforementioned secure configuration data processing method. The meanings of the terms used are the same as in the secure configuration data processing method described above, and specific implementation details can be found in the descriptions within the method embodiments.

[0196] Please see Figure 14 , Figure 14 This is a schematic diagram of the structure of a security configuration data processing device provided in an embodiment of this application. The security configuration data processing device can be integrated into a computer device that has a storage unit and a microprocessor installed, thus having computing power. The security configuration data processing device may include a data acquisition module 1401 and an authentication module 1402, etc.

[0197] Data acquisition module 1401: used to acquire reference execution data, security configuration data and deployment information of the target module on the deployment device. The security configuration data is used to configure security data for the target module.

[0198] Authentication module 1402: Used to connect to the security configuration agent located on the same deployment device as the target module, to verify the identity of the security configuration agent, and when the identity verification is successful, to encrypt and send the reference execution data, security configuration data and deployment information to the security configuration agent.

[0199] In some embodiments, the secure configuration data processing device further includes a second encryption module (unidentified), used for:

[0200] Obtain the business type of the target module, select the encryption mode according to the business type, and encrypt the security configuration data using the encryption mode to obtain the second encrypted configuration data;

[0201] When a configuration data retrieval request is received from the security configuration agent, the second encrypted configuration data is decrypted to obtain the security configuration data.

[0202] In some embodiments, the data acquisition module 1401 is further configured to:

[0203] Receive execution data and deployment information from the continuous integration and continuous delivery system, and obtain reference execution data based on the execution data information;

[0204] Obtain the module name, determine the target module based on the module name and deployment information, obtain the security configuration name and security configuration content associated with the target module, and obtain the security configuration data.

[0205] In some embodiments, the data acquisition module 1401 is further configured to:

[0206] Before the target module is in the final stage of release, at least one piece of execution data received will be used as reference execution data;

[0207] Once the target module is in the final release phase, the latest received execution data will be used as the reference execution data.

[0208] The specific implementation of each of the above units can be found in the previous embodiments, and will not be repeated here.

[0209] This application also provides a computer device, which can be a terminal or a server, such as... Figure 15 As shown, taking a terminal as an example, it illustrates a structural diagram of the computer device involved in the embodiments of this application. Specifically:

[0210] The computer device may include radio frequency (RF) circuitry 1501, a memory 1502 including one or more computer-readable storage media, an input unit 1503, a display unit 1504, a sensor 1505, audio circuitry 1506, a wireless fidelity (WiFi) module 1507, a processor 1508 including one or more processing cores, and a power supply 1509, among other components. Those skilled in the art will understand that... Figure 15The terminal structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0211] RF circuit 1501 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and hands it over to one or more processors 1508 for processing; additionally, it transmits uplink data to the base station. Typically, RF circuit 1501 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, RF circuit 1501 can also communicate wirelessly with networks and other devices. Wireless communication can use any communication standard or protocol, including but not limited to GSM, GPRS, CDMA, WCDMA, LTE, email, and SMS.

[0212] The memory 1502 can be used to store software programs and modules. The processor 1508 executes various functional applications and information retrieval by running the software programs and modules stored in the memory 1502. The memory 1502 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the terminal (such as audio data, phone book, etc.). In addition, the memory 1502 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 1502 may also include a memory controller to provide access to the memory 1502 for the processor 1508 and the input unit 1503.

[0213] The input unit 1503 can be used to receive input digital or character information, and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to object settings and function control. Specifically, in one embodiment, the input unit 1503 may include a touch-sensitive surface and other input devices. The touch-sensitive surface, also known as a touch display or touchpad, can collect touch operations on or near the object (e.g., operations performed by the object using a finger, stylus, or any suitable object or accessory on or near the touch-sensitive surface), and drive corresponding connection devices according to a pre-set program. Optionally, the touch-sensitive surface may include a touch detection device and a touch controller. The touch detection device detects the touch orientation of the object and the signal generated by the touch operation, transmitting the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 1508, and can receive and execute commands from the processor 1508. Furthermore, various types of touch-sensitive surfaces, such as resistive, capacitive, infrared, and surface acoustic wave, can be used. In addition to the touch-sensitive surface, the input unit 1503 may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0214] Display unit 1504 can be used to display information input by an object or information provided to an object, as well as various graphical object interfaces of the terminal. These graphical object interfaces can be composed of graphics, text, icons, video, and any combination thereof. Display unit 1504 may include a display panel, optionally configured as a liquid crystal display (LCD), organic light-emitting diode (OLED), or similar form. Furthermore, a touch-sensitive surface may cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it transmits the information to processor 1508 to determine the type of touch event. Subsequently, processor 1508 provides corresponding visual output on the display panel according to the type of touch event. Although in Figure 15 In this context, the touch-sensitive surface and the display panel are two separate components for implementing input and output functions. However, in some embodiments, the touch-sensitive surface and the display panel can be integrated to achieve both input and output functions.

[0215] The terminal may also include at least one sensor 1505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel according to the ambient light level, and the proximity sensor can turn off the display panel and / or backlight when the terminal is moved to the ear. As a type of motion sensor, a gravity acceleration sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, tapping), etc. Other sensors that the terminal may also be equipped with, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0216] Audio circuitry 1506, a speaker, and a microphone provide an audio interface between the device and the terminal. Audio circuitry 1506 converts received audio data into electrical signals, transmits them to the speaker, and the speaker converts them into sound signals for output. Conversely, the microphone converts collected sound signals into electrical signals, which are then received by audio circuitry 1506, converted back into audio data, processed by processor 1508, and then transmitted via RF circuitry 1501 to, for example, another terminal, or output to memory 1502 for further processing. Audio circuitry 1506 may also include an earphone jack to facilitate communication between a peripheral headset and the terminal.

[0217] WiFi is a short-range wireless transmission technology. A terminal using the WiFi module 1507 can help users send and receive emails, browse web pages, and access streaming media, providing them with wireless broadband internet access. Although Figure 15 WiFi module 1507 is shown, but it is understood that it is not a necessary component of the terminal and can be omitted as needed without changing the essence of the invention.

[0218] The processor 1508 is the control center of the terminal, connecting various parts of the phone via various interfaces and lines. It executes software programs and / or modules stored in the memory 1502, and calls data stored in the memory 1502, to perform various functions and process data, thereby providing overall monitoring of the phone. Optionally, the processor 1508 may include one or more processing cores; preferably, the processor 1508 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1508.

[0219] The terminal also includes a power supply 1509 (such as a battery) to power various components. Preferably, the power supply can be logically connected to the processor 1508 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 1509 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0220] Although not shown, the terminal may also include a camera, Bluetooth module, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 1508 in the terminal loads the executable files corresponding to the processes of one or more applications into the memory 1502 according to the following instructions, and the processor 1508 runs the applications stored in the memory 1502 to realize various functions:

[0221] After establishing a connection with the security configuration system, a digital certificate is sent to the security configuration system for authentication;

[0222] After successful authentication, the system receives reference execution data, security configuration data, and deployment information for the target module. The security configuration data is used to configure security data for the target module.

[0223] Respond to the configuration and deployment request of the target module, and obtain the target path and target execution data of the target module;

[0224] When a match is detected between the target execution data and the reference execution data, and a match is detected between the verification results of the target path and the deployment information, the security configuration data is sent to the target module.

[0225] Alternatively, obtain the target module's reference execution data, security configuration data, and deployment information of the target module on the deployment device. The security configuration data is used to configure security data for the target module.

[0226] The connection is made to the security configuration agent located on the same deployment device as the target module. The security configuration agent is verified. When the identity verification is successful, the reference execution data, security configuration data and deployment information are encrypted and sent to the security configuration agent.

[0227] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed description of the security configuration data processing method above, which will not be repeated here.

[0228] As described above, in this embodiment, the computer device establishes a connection with the security configuration system, sends a digital certificate to the system for authentication, and receives reference execution data, security configuration data, and deployment information of the target module sent by the security configuration system after successful authentication. The security configuration data is used to configure the target module's security data. Responding to the target module's security data configuration deployment request, the system obtains the target module's target path and target execution data. When a match is detected between the target execution data and reference execution data, and between the target path and deployment information, the security configuration data is sent to the target module. This embodiment eliminates the need for developers to perform encryption, avoiding the risk of key leakage. After the security configuration system verifies the identity of the security configuration agent, it uses the deployment information and reference executable file of the target module sent by the security configuration system to perform file-level verification of the path-related information and execution data information of the target module deployed on the same machine. After successful verification, the security configuration data is sent to the target module, preventing other modules from obtaining security configuration data using forged identities. Based on the trust chain formed between the security configuration system, the security configuration agent, and the target module, further content verification of the path and execution data information is performed before sending the security configuration data, enhancing the security of the security data configuration process.

[0229] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0230] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the security configuration data processing methods provided in embodiments of this application. For example, the instructions can execute the following steps:

[0231] After establishing a connection with the security configuration system, a digital certificate is sent to the security configuration system for authentication;

[0232] After successful authentication, the system receives reference execution data, security configuration data, and deployment information for the target module. The security configuration data is used to configure security data for the target module.

[0233] Respond to the configuration and deployment request of the target module, and obtain the target path and target execution data of the target module;

[0234] When a match is detected between the target execution data and the reference execution data, and a match is detected between the verification results of the target path and the deployment information, the security configuration data is sent to the target module.

[0235] Alternatively, obtain the target module's reference execution data, security configuration data, and deployment information of the target module on the deployment device. The security configuration data is used to configure security data for the target module.

[0236] The connection is made to the security configuration agent located on the same deployment device as the target module. The security configuration agent is verified. When the identity verification is successful, the reference execution data, security configuration data and deployment information are encrypted and sent to the security configuration agent.

[0237] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations of the above embodiments.

[0238] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0239] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0240] Since the instructions stored in the computer-readable storage medium can execute the steps of any of the security configuration data processing methods provided in the embodiments of this application, the beneficial effects that any of the security configuration data processing methods provided in the embodiments of this application can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0241] In this application embodiment, the term "module" refers to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0242] The foregoing has provided a detailed description of a secure configuration data processing method, apparatus, and computer-readable storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A secure configuration data processing method, characterized by, The method comprises the following steps: after establishing a connection with a security configuration system, sending a digital certificate to the security configuration system for identity verification; receiving reference execution data, security configuration data and deployment information of a target module sent by the security configuration system after the identity verification is passed, the security configuration data being used for security data configuration of the target module; in response to a configuration deployment request of the target module, obtaining target path and target execution data of the target module; when it is detected that the target execution data matches the reference execution data and the verification result of the target path and the deployment information matches, sending the security configuration data to the target module.

2. The security configuration data processing method according to claim 1, characterized by, Before the step of sending the security configuration data to the target module when it is detected that the target execution data matches the reference execution data and the verification result of the target path and the deployment information matches, the method comprises the following steps: obtaining a preset path of the reference execution data from the deployment information, and when the target path is consistent with the preset path, determining that the verification result of the target path and the deployment information matches; obtaining an execution data type of the target execution data, and when it is determined that the target execution data is consistent with the reference execution data according to the execution data type, determining that the target execution data matches the reference execution data.

3. The security configuration data processing method according to claim 2, characterized by, The step of determining that the target execution data matches the reference execution data when it is determined that the target execution data is consistent with the reference execution data according to the execution data type comprises the following steps: when the execution data type is an executable file type, obtaining a reference hash value indicated by the reference execution data, and calculating a target hash value of the target execution data; when the target hash value is consistent with the reference hash value, determining that the target execution data matches the reference execution data.

4. The security configuration data processing method according to claim 2, characterized by, The step of determining that the target execution data matches the reference execution data when it is determined that the target execution data is consistent with the reference execution data according to the execution data type comprises the following steps: when the execution data type comprises a bytecode type, obtaining a reference hash value indicated by the reference execution data, the reference hash value being a reference archive hash value generated according to a reference archive package; obtaining a target archive package of the target execution data, and calculating a target archive hash value of the target archive package; when the target archive hash value is consistent with the reference hash value, determining that the target execution data matches the reference execution data.

5. The security configuration data processing method according to claim 2, characterized by, The step of determining that the target execution data matches the reference execution data when it is determined that the target execution data is consistent with the reference execution data according to the execution data type comprises the following steps: when the execution data type comprises a code file type, the step of obtaining a reference hash value indicated by the reference execution data, the reference hash value being a reference file hash value generated according to a reference code file in a reference folder; obtaining a target code file in the target path, and calculating a target file hash value of the target code file; when the target file hash value is consistent with the reference hash value, determining that the target execution data matches the reference execution data.

6. The security configuration data processing method according to any one of claims 1 to 5, characterized by, Before responding to the security data configuration request of the target module, the method further comprises: encrypting the security configuration data by using a preset key to obtain first encrypted configuration data; storing the first encrypted configuration data in the memory or the memory of the deployment device.

7. The security configuration data processing method according to claim 6, characterized by, Before sending the security configuration data to the target module, the method further comprises: locking the first encrypted configuration data when detecting that the number of continuous configuration deployment requests is greater than or equal to a preset number within a preset time period; sending configuration data locking information to the target module, and unlocking the first encrypted configuration data when receiving a preset unlocking key sent by the target module.

8. A secure configuration data processing method, characterized by, comprises: obtaining reference execution data, security configuration data of a target module, and deployment information of the target module on a deployment device, the security configuration data being used for security data configuration of the target module; connecting a security configuration agent located in the same deployment device as the target module, performing identity verification on the security configuration agent, and sending the reference execution data, the security configuration data, and the deployment information to the security configuration agent in an encrypted manner when the identity verification is passed.

9. The security configuration data processing method according to claim 8, characterized by, Before sending the reference execution data, the security configuration data, and the deployment information to the security configuration agent in an encrypted manner, the method further comprises: obtaining a business type of the target module, selecting an encryption mode according to the business type, encrypting the security configuration data by using the encryption mode to obtain second encrypted configuration data; decrypting the second encrypted configuration data to obtain the security configuration data when receiving a configuration data acquisition request sent by the security configuration agent.

10. The security configuration data processing method according to claim 8, characterized by, The method of obtaining reference execution data, security configuration data of a target module, and deployment information of the target module on a deployment device comprises: receiving execution data information and deployment information sent by a continuous integration and continuous delivery system, and obtaining reference execution data according to the execution data information; obtaining a module name, determining the target module according to the module name and the deployment information, obtaining a security configuration name and security configuration content associated with the target module to obtain the security configuration data.

11. The security configuration data processing method according to claim 10, characterized by, The method of obtaining reference execution data according to the execution data information comprises: before the target module is in a release end stage, regarding at least one received execution data information as the reference execution data; after the target module is in the release end stage, regarding the latest received execution data information as the reference execution data.

12. A secure configuration data processing apparatus, characterized by comprising: comprises: a system connection module for sending a digital certificate to a security configuration system for identity verification after establishing a connection with the security configuration system; a data receiving module for receiving reference execution data, security configuration data, and deployment information of a target module sent by a security configuration system after identity verification, the security configuration data being used for security data configuration of the target module; a request response module for responding to a configuration deployment request of the target module, obtaining a target path and target execution data of the target module; The data issuing module is configured to send the security configuration data to the target module when it is detected that the target execution data matches the reference execution data and the checking result of the target path and the deployment information matches.

13. A secure configuration data processing apparatus, characterized by comprising: The method comprises the following steps: The data obtaining module is configured to obtain reference execution data of a target module, security configuration data for configuring security data of the target module, and deployment information of the target module on a deployment device. The identity verification module is configured to connect a security configuration agent located on the same deployment device as the target module, perform identity verification on the security configuration agent, and send the reference execution data, the security configuration data, and the deployment information to the security configuration agent in an encrypted manner when the identity verification is passed.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a plurality of instructions adapted to be loaded by the processor to perform the steps in the security configuration data processing method according to any one of claims 1 to 11.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor performs the computer program to implement the steps in the security configuration data processing method according to any one of claims 1 to 11.

Images