Section risk control method and device based on declaration configuration, medium and equipment

Abstract

The embodiment of the invention discloses a section risk control method based on declaration configuration, and the method comprises the steps: compiling a corresponding section module according to the operation environment characteristics of a business application program only through a declaration configuration file during the tangent point injection, and injecting the section module into the business application program through a section base. And executing a corresponding risk control processing process in response to the starting aspect module in the process of executing the business by the business application program. Due to the fact that section injection can be automatically achieved through the declarative configuration file, the maintenance difficulty and complexity of the tangent point and the section module are reduced, the requirement for intervention of professional technicians is lowered, the deployment speed of the section module is greatly increased, and the response speed in the case of risks is also remarkably increased.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer, and particularly relates to an aspect risk control method and device based on declaration configuration, a storage medium and equipment. BACKGROUND

[0002] At present, as a programming paradigm, aspect-oriented programming (AOP) is widely used in software modularization, code logic decoupling and the like. With the complication of business requirements and the popularity of distributed architecture, higher requirements are put forward for the flexibility and manageability of aspect injection.

[0003] In the prior art, the injection process of an aspect module needs to first propose specific requirements by a demand side, and then a team providing AOP technology intervenes to develop an aspect module for the requirements, that is, to write specific codes to define pointcut positions and enhancement logic, and then to compile, test and package, and finally to publish and deploy the module to a target application to take effect. For example, a risk control department proposes a content to be monitored, and a department responsible for AOP develops an aspect module according to the requirements and then deploys it. When a third party provides AOP services, the above process is more complicated.

[0004] It can be seen that the existing aspect module deployment method exposes problems of long iteration cycle and poor response timeliness when facing frequent changes in business requirements. From the proposal of requirements to the final online, the entire process involves multiple links such as cross-team communication, code development and software release, and users cannot quickly adjust the protection pointcut according to the real-time attack and defense situation, which greatly restricts the agility of operation and maintenance and security response.

[0005] Based on this, the present specification provides an aspect risk control method based on declaration configuration to partially solve the problems existing in the prior art. SUMMARY

[0006] The aspect risk control method, device, storage medium and electronic equipment based on declaration configuration provided in the present specification partially solve the problems existing in the prior art.

[0007] The technical scheme adopted by the embodiments of the present specification is as follows: The aspect risk control method based on declaration configuration provided in the present specification comprises the following steps: receiving a declaration configuration file sent by a business side, at least a pointcut position and aspect business logic being declared in the declaration configuration file; obtaining a running environment feature of a business application program in the application container; According to the running environment features and the declaration configuration text, a compilation is performed to obtain an aspect module matching the running environment features of the business application and a pointcut of the business application; By means of an aspect base pre-deployed in the application container, the aspect module is injected into the pointcut of the business application in the application container, so that when the aspect module is triggered during business execution, the aspect module is executed, triggering a corresponding risk control processing procedure of the aspect business logic.

[0008] The specification provides an aspect risk control device based on declaration configuration, and the device comprises: A receiving module is configured to receive a declaration configuration file sent by a business party, wherein the declaration configuration file at least declares a pointcut position and aspect business logic; An obtaining module is configured to obtain running environment features of a business application in an application container; A compiling module is configured to compile, according to the running environment features and the declaration configuration text, an aspect module matching the running environment features of the business application and a pointcut of the business application; A deployment and execution module is configured to inject, by means of an aspect base pre-deployed in the application container, the aspect module into the pointcut of the business application in the application container, so that when the aspect module is triggered during business execution, the aspect module is executed, triggering a corresponding risk control processing procedure of the aspect business logic.

[0009] The specification provides a computer readable storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor to implement the aspect risk control method based on declaration configuration.

[0010] The specification provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the aspect risk control method based on declaration configuration when executing the program.

[0011] The above at least one technical solution adopted by the embodiments of the specification can achieve the following beneficial effects: The embodiment of the present specification discloses a method for aspect risk control based on declarative configuration. When the pointcut injection is performed, only the declarative configuration file is needed. According to the running environment characteristics of the business application program, the corresponding aspect module is compiled, the aspect module is injected into the business application program through the aspect base, the aspect module is triggered during the execution of the business process of the business application program, and the corresponding risk control processing process is executed. Since the aspect injection can be automatically realized through the declarative configuration file, the maintenance difficulty and complexity of the pointcut and the aspect module are reduced, the need for professional technical personnel is reduced, the deployment speed of the aspect module is greatly improved, and the response speed when facing risks is also significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0012] The drawings described herein are used to provide further understanding of the present specification, constitute a part of the present specification, the illustrative embodiments of the present specification and the description thereof are used to explain the present specification, and do not constitute improper limitation on the present specification. In the drawings: Figure 1 A flowchart of an aspect risk control based on declarative configuration is provided for the embodiment of the present specification; Figure 2 A structural schematic diagram of an aspect base is provided for the embodiment of the present specification; Figure 3 A structural schematic diagram of dynamic pointcut configuration is provided for the embodiment of the present specification; Figure 4 A structural schematic diagram of a sub-control component parsing pointcut configuration is provided for the embodiment of the present specification; Figure 5 A schematic diagram of an aspect risk control device based on declarative configuration is provided for the embodiment of the present specification; Figure 6 A structural schematic diagram of an electronic device is provided for the embodiment of the present specification. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical scheme and advantages of the present specification clearer, the technical scheme of the present specification will be described clearly and completely in combination with the specific embodiments of the present specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present specification, not all the embodiments. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present specification.

[0014] The technical scheme provided by each embodiment of the present specification will be described in detail below in combination with the drawings.

[0015] Figure 1 A flowchart of an aspect risk control based on declarative configuration is provided for the embodiment of the present specification, which specifically includes the following steps: S100: receiving a declaration configuration file sent by a business party, wherein the declaration configuration file at least declares a pointcut position and aspect business logic.

[0016] In the embodiments of the present specification, the method shown in the figure is used to execute the business of the device. Figure 1 The device performing the business can be any electronic device, such as a computer, a server, or a server cluster composed of multiple servers, etc. For the convenience of description, the following will be described by taking a server as an example.

[0017] In order to solve the problem that the aspect injection process is complex and non-professional users are difficult to configure the aspect module or set the pointcut by themselves, in the embodiments of the present specification, a declarative configuration file, i.e., the declaration configuration text in the embodiments of the present specification, is proposed to reduce the requirements on the user side, and the process of automatically compiling the aspect module, identifying the pointcut, and injecting the aspect is performed in the background. Not only does it avoid the problem that multiple teams need to cooperate in the existing pointcut injection, resulting in poor timeliness of aspect injection, but also provides a favorable basis for realizing automatic compilation of aspect modules due to the universality of the declarative configuration text, thereby reducing the cost of manual operation and maintenance.

[0018] It should be noted that in the embodiments of the present specification, the aspect injection process is a technical process in aspect-oriented programming, which dynamically or statically integrates the enhancement logic to be injected into the pointcut of the business application. It includes the entire process from identifying the requirement of aspect injection to finally injecting the aspect module. The user side refers to the business operator of the business application, i.e., the user who operates and maintains the business application, and the service provider who provides the aspect injection service in the present specification is not the user side.

[0019] That is, in order to solve the problem that the aspect injection process is complex and the business operator is difficult to configure the aspect by themselves, the present specification proposes a declarative configuration process, which enables the business operator to complete the risk control strategy definition through the configuration file, and the subsequent compilation, identification, and injection process is automatically completed by the platform. Not only does it avoid the efficiency bottleneck of cross-team cooperation, but also significantly reduces the operation and maintenance complexity of the business operator due to the standardization of the configuration.

[0020] Specifically, the server is a server that provides aspect injection services, also commonly known as an aspect-oriented programming (AOP) console. The server is used to receive the declaration configuration file sent by the business operator, and according to the declaration configuration file, the aspect module is injected in the application container of the business application through the pre-configured aspect base. From the system architecture, the server is an AOP console, and the application container can be deployed in the server or other servers. Generally, in order to improve the business execution efficiency and maintenance convenience, the application container is deployed in a dedicated server. The device of the business party, such as a terminal or a server, can send the declaration configuration file to the console according to the request of the business party.

[0021] The declaration configuration file is written by the business party, and at least declares the pointcut position and the aspect business logic. The pointcut position refers to the business process node in the business application that needs to insert the aspect module, and the aspect business logic is the specific business function to be implemented from the aspect module injected into the business application.

[0022] The declaration configuration file in the specification is a structured text file using a declarative paradigm, and is therefore a declarative configuration file. In the declaration configuration file, the description of the expected state of the configuration object and / or the description of the business intent are included, rather than the execution steps of how to configure specifically. The declaration configuration file is usually a readable data serialization format, and its syntax is designed close to the natural language expression habit, with clear structure hierarchy but relatively loose constraints, allowing users to express requirements in a business-oriented manner without paying attention to the details of the underlying technical implementation. For example, it is still a markup language (YAML Ain't Markup Language, YAML), JSON, TOML, etc. As can be seen, the declaration configuration file referred to in the specification maintains the structured features that can be parsed by machines, and significantly reduces the technical threshold for writing and understanding, used to support the decoupling of business logic and technical implementation, thereby reducing the technical requirements of the business operator, and realizing the subsequent automatic compilation process, reducing the labor cost of the AOP service provider.

[0023] For example, the content of a certain declaration configuration file includes: pointcuts: - action: "add" module: "mysql.connector" class_path: "cursor.MySQLCursor" method: "execute" kind: 0x0000 args: [{1, ""}] rule_id:["SQL$FENCE"] The above is the profile content of the pointcut location, where action: "add" is annotated as # add: add pointcut del: remove pointcut, indicating that this line of configuration content specifies the operation type of the pointcut. module: "mysql.connector" is annotated as # module name, indicating that this line of configuration content specifies the target module name, that is, the name of the module that needs to be monitored or intercepted. class_path: "cursor.MySQLCursor" is annotated as # class path, indicating that this line of configuration content specifies the specific class path, which is the core class for executing SQL statements. method: "execute" is annotated as # method name, indicating that this line of configuration content specifies the target method name to be intercepted. kind: 0x0000 is annotated as # 0x0001: built-in module 0x0000: non-built-in, indicating that this line of configuration content is used to identify the type of target module to determine different monitoring and loading strategies. args: [{1, ""}] is annotated as # pointcut parameter extraction configuration, indicating that this line of configuration content defines how to extract data from the parameters of the target method for use by the detection logic, for example {1, ""} indicates extracting the parameter with index 1 (the second parameter). rule_id: ["SQL$FENCE"] is annotated as # risk detection strategy, indicating that this line of configuration content associates the current pointcut with one or more security detection policy rules, and when the pointcut is triggered, the logic defined in the corresponding rules will be executed.

[0024] policies: - key: "SQL" rules: - code: "SQL$FENCE" level: "M" config: enable: true lcsRatio: 0.0 matchers: - code: "SqlBlackList" kind: "string" patterns: - "%SELECT * FROM%" action: "block_pre" The above is the aspect business logic in the configuration file, and the example is a specific risk control strategy, which includes: key: "SQL", indicating that this line of configuration content defines the unique classification identifier of the strategy, which is used to group and manage the rules.

[0025] rules: indicates that the line of configuration content marks the beginning of a specific detection rule, and one or more rule definitions are included below. Includes: code: "SQL$FENCE", which indicates that the line of configuration content defines the unique code of the rule, corresponding to the rule_id in the pointcut configuration. level: "M" indicates that the line of configuration content specifies the risk level of rule triggering, for example, high, medium, and low are represented by H, M, and L respectively.

[0026] config: indicates that the line of configuration content marks the beginning of the detailed configuration of the rule. enable: true indicates that the line of configuration content controls whether the rule is enabled, true for enabled, and false for disabled. lcsRatio: 0.0 indicates that the line of configuration content defines the threshold of string similarity matching, 0.0 indicating that complete matching is required.

[0027] matchers: indicates that the line of configuration content marks the beginning of a specific matching condition, and one or more matcher definitions are included below. Among them, code: "SqlBlackList" indicates that the line of configuration content defines the type of matcher, such as SqlBlackList indicating SQL black list detector. kind: "string" indicates that the line of configuration content specifies the data type processed by the matcher, which is a string type.

[0028] patterns: indicates that the line of configuration content marks the beginning of the matching pattern, and one or more specific matching patterns are included below. Among them, "%SELECT * FROM%" indicates that the line of configuration content defines a specific matching pattern, which is used to detect specific patterns in SQL statements.

[0029] action: "block_pre" indicates that the line of configuration content defines the processing method after successful pattern matching, such as "block_pre" indicating blocking before execution.

[0030] Based on the above declaration configuration file, the server can correspondingly compile the aspect module executable by the business application without human intervention, and inject it into the corresponding business application, so that the newly added risk control processing process of the business side business process is realized through the aspect module.

[0031] S102: Obtain the running environment characteristics of the business application in the application container.

[0032] Due to the reduction of the technical ability requirement of the business party, even if the business party does not have professional AOP technical ability, the active aspect injection can be realized by writing the declaration configuration file. Therefore, after the server receives the declaration configuration file, the declaration configuration text is irrelevant to the computer language of the business application program. The server needs to determine what kind of aspect module needs to be written in the subsequent step to adapt to the business application program, so the server can further obtain the running environment characteristics of the business application program in the application container. The running environment characteristics at least include the programming language of the business application program.

[0033] Specifically, after receiving the declaration configuration file, the server can determine the business application program to which the declaration configuration file is directed. For example, the identification of the business application program contained in the declaration configuration file is determined. Then, the application container in which the business application program is deployed is determined, and the running environment characteristics of the business application program at runtime are identified from the aspect base pre-deployed in the application container.

[0034] Of course, if the management console only provides AOP services for one business application program, it is not necessary to determine the identification, and the running environment characteristics of the business application program can be directly determined.

[0035] The running environment characteristics at least include the programming language of the business application program, and can also include the environment information of the application container, such as the version of the operating system or the architecture. The database on which the business application program runs, such as module: "mysql.connector", depends on a specific third-party library, and the version difference may also cause the difference of internal implementation classes and methods, etc. As long as the information required for compiling the aspect module, the server can obtain it from the application container. In this specification, such information is uniformly referred to as running environment characteristics.

[0036] S104: According to the running environment characteristics and the declaration configuration text, the aspect module matching the running environment characteristics of the business application program and the pointcut of the business application program are compiled.

[0037] In the embodiments of the present disclosure, after determining the running environment feature, the server can compile the declaration configuration text into an aspect module matching the business application according to the running environment feature, and can also determine the pointcut of the business application. Since the code framework, statement structure, etc. of the business application of different programming languages are different, even the applications for implementing the same business, the aspect business logic in the declaration configuration text needs to be compiled into an aspect module conforming to the business application based on the running environment feature. Similarly, the pointcut of the same business logic in different programming languages and different environments may also have different actual code entry positions, so the position of the pointcut in the declaration configuration text also needs to be determined based on the running environment feature to correspond to the pointcut in the business application.

[0038] For example, the aspect business logic is to record a security audit log after the user logs in successfully. In a web application written in Java and a client application written in Python, the required codes for implementation are different. In Java, the Spring annotation-driven model can be used to implement it through reflection and dynamic proxy. In Python, the built-in signal mechanism of Django can be used to implement it through decorator and callback function. If the pointcut is to intercept the operation of executing SQL query, the pointcut position can be the selectOne or selectList method in the org.mybatis.spring.SqlSessionTemplate class for a Java application using the MyBatis framework. In a Python application using the Django ORM framework, the pointcut position can be the _execute private method in the django.db.models.query.QuerySet class.

[0039] Specifically, the server can generate a general module corresponding to the declaration configuration text and determine the pointcut of the business application through a risk control component of an aspect base in the application container according to the running environment feature and the declaration configuration text, where the general module is used to implement the aspect business logic contained in the declaration configuration text.

[0040] Figure 2The structure diagram of the aspect base provided in the specification, wherein the aspect base comprises a master control component, i.e., a ranger component, for loading after the application container is started, as a control component of the aspect base, for sequentially loading, initializing and scheduling other modules (such as rasp.so and inject.so) according to the configuration of the aspect base, to ensure that the components in the aspect base are started and cooperated in the correct order. The risk control component is rasp.so, which is used to parse the declaration configuration text submitted by the user, and encapsulates an abstract aspect business logic in the declaration configuration file into a general Advice, i.e., a general module. And according to the pointcut description in the configuration, combined with the currently recognized running environment characteristics, the specific pointcut corresponding position is determined, for example, the call function or class, etc. The compilation engine is inject.so, which receives the general Advice and pointcut information from rasp.so, and combines the running environment characteristics to compile into a cut aspect module that can run in the application container, and the business application can call the cut aspect module directly. That is Figure 2 The solid arrow part in the figure. And the business application can also execute the general module by compiling it into a cut aspect module in real time after triggering the pointcut during the execution of the business process, that is Figure 2 The dashed arrow part in the figure, which will be described in detail in the subsequent embodiments.

[0041] Among them, the risk control component as the "brain" responsible for parsing in the aspect base, is used to extract key information from the declaration configuration file, one is the aspect business logic expected to be implemented by the user (for example "prevent all SQL queries containing SELECT * FROM"), the other is the business location expected to be intervened by the user, i.e. "where to execute the logic", for example "at all SQL execution method entry".

[0042] Based on the extracted key information, the risk control component can encapsulate the abstract business logic into a general Advice, i.e., a general module. The general module is a pure functional logic unit independent of programming language and running environment, which defines what the aspect module "wants to do" finally, but does not specify "how to implement it specifically".

[0043] Based on the extracted key information, the risk control component can also determine the pointcut according to the pointcut description in the declaration configuration file, based on the running environment characteristics, such as whether the application uses the mysql.connector library of Python or the MyBatis framework of Java, etc., to search and match in the code structure and dependent library of the business application, to accurately locate the specific class, method or function that needs to be intercepted, so as to complete the determination of the pointcut.

[0044] Then, according to the running environment characteristics, the general module is compiled into an aspect module matching the running environment characteristics of the business application through the compiling engine of the aspect base.

[0045] Specifically, the compiling engine receives the general module and the pointcut from the risk control component, analyzes the running environment characteristics of the business application, including but not limited to the specific version of the programming language, the specific API of the related framework, and the difference of the running environment such as JVM or CPython interpreter. The compiler or the adapter is started to take the general Advice logic as the input, and outputs an executable aspect module matching the running environment of the business application through matching conversion, code generation or bytecode weaving operation. For example, for the Python environment, the compiling engine can generate a.so file containing bytecode instructions, and for the Java environment, a class file conforming to the JVM specification can be generated.

[0046] Then in the subsequent step, the compiling engine can dynamically weave the compiled aspect module into the pointcut position determined by the risk control component, thereby completing the entire aspect injection process, and seamlessly integrating the business risk control logic declared by the business party into the business application.

[0047] Of course, the above process is described by taking the server calling the aspect base as an example. If the application container is deployed on the server, it can be regarded as a call between modules inside the server. If the application container is deployed on other servers, the above process can be performed by the risk control component and the compiling engine in the server, and after determining the aspect module and the pointcut, it is issued to the corresponding aspect base. Alternatively, the server can also send the configuration file to the corresponding aspect base, and the risk control component and the compiling engine in the aspect base can construct the aspect module and determine the pointcut. Of course, whether to use remote compilation or local compilation is set according to the needs, and the present specification does not limit it.

[0048] S106: injecting the aspect module into the pointcut of the business application in the application container through the aspect base pre-deployed in the application container, so that when the aspect module is triggered during business execution, the aspect module is executed, and the risk control process corresponding to the aspect business logic is triggered.

[0049] As described in step S104, after the aspect module is compiled, the aspect module can be injected into the business application by the compiling engine, and the aspect module is written into the business application by directly modifying the function pointer or covering the machine code / bytecode of the method. When the business execution triggers the pointcut, the control is directly jumped to the aspect module for execution, and then returned after execution. In the embodiment of the present specification, the aspect module is used for risk control processing, so that after the pointcut is triggered, the risk control processing corresponding to the aspect business logic can be executed.

[0050] For example, the business party may know that there is a problem in its own business, but needs to retain the corresponding log and running parameters for further risk judgment or discrimination. Then, a pointcut can be added in the corresponding business process with problems to execute the acquisition of running parameters and the recording of corresponding logs, return the business logic flow of the business party server, and send the declaration configuration file to the AOP console (i.e. the server in the present specification), and then the server injects the aspect module into the business application after building the aspect module. When the business application executes the business, the pointcut is triggered, and the corresponding data is recorded and returned to the server of the business party.

[0051] Alternatively, in the embodiment of the present specification, the compiling engine can also use a dynamic adaptation method to weave the pointcut into the business application, and jump to the aspect base when the business application runs the pointcut, and execute the aspect module.

[0052] Specifically, the compiling engine first implants a universal jump instruction independent of the environment at the pointcut position of the business application. The logic of this instruction is very simple, that is, when it is executed here, a universal Advice function is called, which does not contain specific risk control logic.

[0053] Therefore, the jump instruction is configured to call the universal Advice function generated by the risk control module. This universal Advice function is written in a cross-platform intermediate representation (such as bytecode, WASM or some custom DSL), which defines the business logic of risk control (for example, “check SQL injection”), but does not depend on any specific local environment.

[0054] When the business execution triggers the pointcut, the business execution process calls the universal Advice function through the jump instruction, and then the compiling engine of the aspect base intervenes to convert and execute the universal Advice function into the local code of the business application in real time according to the characteristics of the current running environment, and then execute the code to complete the risk control process.

[0055] The specific mode can be set as needed, and the specification is not limited. If the aspect module is pre-compiled, since the aspect module has been pre-compiled into local code for a specific environment, it has almost no additional performance overhead when executed in the target application, the behavior is determined, and the resource consumption is controllable. This way of directly replacing the original execution flow is mature, stable and reliable, and can provide higher execution efficiency and determinacy in core business systems that are extremely sensitive to performance jitter or have highly single and stable running environments.

[0056] If the aspect module is dynamically woven, the specific business risk control logic can be abstracted into a general Advice function independent of the running environment, and the dynamic adaptation of the Advice function can be performed by a compilation engine when the pointcut is triggered, so that a configuration can be deployed and run in different target environments. Even if new environments and new systems are added later, it does not affect the implementation of aspect injection in the new environment. This enables security policies to be managed as a unified asset, shortening the response cycle from vulnerability discovery to network protection to minutes, greatly reducing the complexity and cost of operation and maintenance in a multi-technology stack and complex environment.

[0057] Based on Figure 1 As shown in the aspect risk control method based on the declaration configuration, when the pointcut injection is performed, only a declarative configuration file is needed, and the corresponding aspect module can be compiled according to the running environment characteristics of the business application program. The aspect module is injected into the business application program through the aspect base, and the corresponding risk control processing process is executed in response to the aspect module triggered during the execution of the business process of the business application program. Since the aspect injection can be automatically implemented through the declarative configuration file, the maintenance difficulty and complexity of the pointcut and the aspect module are reduced, the need for professional technical personnel is reduced, the deployment speed of the aspect module is greatly improved, and the response speed when facing risks is also significantly improved.

[0058] In one or more embodiments of the specification, when the server needs to provide AOP services for multiple business parties, the server needs to determine the business application program that needs aspect injection in step S102. Specifically, the server can determine the business application program to which the aspect business logic is to be injected according to the declaration configuration file. That is, the identification of the business application program should be included in the declaration configuration file.

[0059] After that, the server can identify the application container in which the business application program is deployed as a target container from the deployed application containers. The server can include deployment records of the business application program, or determine the target container in which the business application program is deployed by accessing each application container, and the specification does not limit the specific means.

[0060] Then, the server can obtain the running environment characteristics of the business application program in the target container.

[0061] Further, when the server provides AOP services for multiple business parties, the server can also adopt a subscription mode when injecting the aspect module, and the aspect module is distributed by the business application. Of course, the subscription mode can also be combined with the dynamic injection mode to achieve on-demand distribution of aspects, and the injection of aspects can be accurately controlled.

[0062] This achieves the service and standardization of AOP capabilities, enabling business parties to obtain the required risk control capabilities on demand, just like subscribing to cloud services. On this basis, the mode realizes precise control and agile delivery of strategies, and the operator can accurately distribute strategies according to business attributes or technical environments and smoothly promote changes through the gray release mechanism, thereby significantly reducing the operation and maintenance risk while ensuring security. Finally, the combination of declaration configuration files, general advice, dynamic injection, and subscription mode not only optimizes resource utilization and avoids loading redundant functions by business applications, but also lays a solid foundation for building an extensible AOP capability ecosystem, enabling new aspect functions to be quickly promoted and reused as standardized products, greatly improving the agility and operation efficiency of the entire technical system.

[0063] Specifically, the server can register the pointcut in the aspect base according to the obtained pointcut. The aspect base records the pointcut in the pointcut registration table maintained by the risk control component inside the compilation engine of the aspect base after determining the specific pointcut position according to the declaration configuration text. This operation associates the class, method, or function of the business application with a specific risk control strategy, establishing an accurate targeting target for subsequent injection actions.

[0064] Then the server can send update notifications to the corresponding application according to the subscription records of the aspect base. When new or updated aspect modules need to be distributed, the notification service of the aspect base will query its subscription records, accurately identify all business application instances that need to apply this module, and asynchronously send update notifications to them. The notification usually contains metadata such as module version, identifier, and acquisition address to ensure the lightweight and efficiency of communication.

[0065] Finally, the business application can send an acquisition request to the server according to the subscription after receiving the update notification. Then the server responds to the acquisition request sent by the business application to inject the aspect module into the pointcut of the business application, or inject the pointcut trigger function, and compile the aspect module when the pointcut is triggered.

[0066] Specifically, when receiving an update notification or actively polling for a check, the business application initiates an acquisition request to the aspect base. After verifying the legality of the request, the base returns the corresponding aspect module data. Subsequently, the compilation engine triggers the dynamic weaving of the received aspect module into the corresponding join point location registered by the business application. This weaving process is usually completed at runtime without restarting the business application, thereby achieving hot updates.

[0067] That is, in the embodiments of the present specification, when determining the aspect module and the join point of the business application, the risk control component can generate a general module corresponding to the declaration configuration text and determine the join point of the business application according to the running environment characteristics and the declaration configuration text, and the general module is used to implement the aspect business logic contained in the declaration configuration text.

[0068] Instead of issuing the general module to the business application, the aspect base pre-deployed in the application container weaves the enhanced logic into the join point when the business application in the application container is running.

[0069] When the join point is triggered during business execution, the compilation engine of the aspect base compiles the general module into an aspect module matching the running environment characteristics of the business application according to the running environment characteristics, and executes the aspect module to trigger the risk control processing process corresponding to the aspect business logic.

[0070] Figure 3 The structure diagram of the dynamic join point configuration provided in the present specification is shown in FIG. 1. After the management and control console receives the declaration configuration file (YAML), dynamic configuration is performed. The main control module (such as ranger.so) of the aspect base of the application container notifies the risk control component to register the join point in the compilation engine according to the monitored configuration, and then realizes real-time hot insertion of the join point through subscription of the business application.

[0071] The traditional static compilation period enhancement is changed to runtime dynamic weaving, realizing the hot plugging of the join point and the aspect business logic. On the basis of this architecture, combined with the subscription mode, the fine management and large-scale operation of the ability distribution are further realized. Specifically, the business party does not need to bind specific aspect logic in the development stage in advance, but subscribes to the corresponding AOP ability service according to its own needs in the running period. When new risk control strategies or business observation needs arise, the operator only needs to publish new ability modules in the aspect base, and the system can automatically identify the target business application through the subscription relationship and accurately push the update to the corresponding application instance. The combination of this subscription mechanism and dynamic weaving technology makes the deployment of aspect capabilities no longer dependent on the traditional application release process, realizes the complete decoupling of security strategies and business logic, forms an AOP ability ecology that can be taken as needed and takes effect immediately, and finally builds a self-adaptive technology system with continuous evolution capability.

[0072] In one or more embodiments of this specification, such as Figure 4 As shown in the structural diagram, when generating the general module corresponding to the declaration configuration text and determining the pointcut of the business application, the risk control component of the aspect base can first parse the declaration configuration file. The risk control component first loads and parses the declaration configuration file submitted by the user, which can verify the integrity of the file structure, the validity of key fields, and the logical consistency between configuration items, verifying that the configuration is a legal and executable strategy. For example, it will confirm whether the specified target module exists and whether the method is accessible, thereby avoiding injection failures due to configuration errors at the earliest stage.

[0073] Based on the parsing results and the pre-defined general-language rule matcher, the parameters in the declaration configuration file are extracted, and the matching logic code for the declaration configuration file is determined. Once the verification passes, the component extracts the input data necessary for the risk control logic execution from the configuration. For example, it parses the second parameter of the target method to be monitored from `args: [{1, ""}]`; and extracts the SQL pattern string for matching from `patterns: ["%SELECT * FROM%"]`. Furthermore, it transforms the business intent declared in the configuration, such as "perform SQL blacklist detection," into corresponding, executable general-language logic code units through an internal mapping table. For example, the `SqlBlackList` matcher defined under `matchers` is instantiated into a specific detection function. This function is platform-independent; it defines standard input, output, and processing flows, but its specific implementation does not depend on any specific programming language or runtime environment.

[0074] Based on the extracted parameters and logic code, a general module corresponding to the declaration configuration text is generated, and the pointcuts of the business application are determined, and the pointcuts are associated with the general module. Finally, the component binds and packages the extracted parameters with the determined logic code units to generate a complete general module. The general module is a self-contained functional entity that clearly describes: under what conditions, which data is used, and what risk control logic is executed. It typically exists as a cross-platform intermediate representation (such as custom bytecode, an abstract syntax tree, or a JSON structure), providing a unified input for subsequent dynamic compilation.

[0075] Meanwhile, the component accurately locates the specific point in the business application according to the information such as module, class_path and method in the configuration, in combination with the characteristics of the running environment. Then, a mapping relationship is established to associate the point with the general module just generated. The mapping relationship is crucial, so that when the business execution flow reaches the point, the aspect base can accurately know which general module should be called to execute the risk control logic.

[0076] Finally, the point is registered in the compilation engine, so that the compilation engine weaves the point in the application, and when the point is triggered, the general module in the risk control component is called through the interface, and is compiled into an aspect module for execution.

[0077] The above is a kind of aspect risk control method based on declaration configuration provided by the embodiment of the present specification, based on the same idea, the present specification also provides corresponding device, storage medium and electronic equipment.

[0078] Figure 5 A kind of aspect risk control device based on declaration configuration provided by the embodiment of the present specification, the device includes: The receiving module 401 is used to receive the declaration configuration file sent by the business party, and the declaration configuration file at least declares the point position and aspect business logic; The acquisition module 402 is used to acquire the running environment characteristics of the business application in the application container; The compilation module 403 is used to compile the aspect module matched with the running environment characteristics of the business application and the point of the business application according to the running environment characteristics and the declaration configuration text; The deployment and execution module 404 is used to inject the aspect module into the point of the business application in the application container through the aspect base pre-deployed in the application container, so that when the aspect module is triggered in the business execution process, the aspect module is executed, and the risk control processing process corresponding to the aspect business logic is triggered.

[0079] Optionally, the acquisition module 402 is used to identify the running environment characteristics of the business application in the application container through the aspect base pre-deployed in the application container;Wherein, the running environment characteristics at least include the programming language of the business application.

[0080] Optionally, the compiling module 403 is configured to generate a general module corresponding to the declaration configuration text and determine a pointcut of the business application program according to the running environment feature and the declaration configuration text, the general module being used to implement aspect business logic contained in the declaration configuration text; and compile the general module into an aspect module matching the running environment feature of the business application program according to the running environment feature and through a compiling engine of the aspect base.

[0081] Optionally, the obtaining module 402 is configured to determine a business application program to which the aspect business logic is to be injected according to the declaration configuration file; identify an application container in which the business application program is deployed as a target container from each application container that has been deployed; and obtain a running environment feature of the business application program in the target container, wherein the running environment feature at least includes a programming language of the business application program.

[0082] Optionally, the compiling module 403 is configured to perform pointcut registration in the aspect base according to the obtained pointcut; send an update notification to a corresponding application program according to a subscription record of the aspect base; and inject the aspect module into the pointcut of the business application program in response to an acquisition request sent by the business application program.

[0083] Optionally, the compiling module 403 is configured to generate a general module corresponding to the declaration configuration text and determine a pointcut of the business application program according to the running environment feature and the declaration configuration text, the general module being used to implement aspect business logic contained in the declaration configuration text; The deployment execution module 404 is configured to weave the enhancement logic to the pointcut in a business application program in the application container through an aspect base pre-deployed in the application container when the business application program is running; compile the general module into an aspect module matching the running environment feature of the business application program according to the running environment feature through a compiling engine of the aspect base when the pointcut is triggered in a business execution process; and execute the aspect module to trigger a risk control processing process corresponding to the aspect business logic.

[0084] Optionally, the compiling module 403 is configured to parse the declaration configuration file through a risk control component of the aspect base; extract parameters in the declaration configuration file and determine a logic code matched by the declaration configuration file according to a parsing result and a preset general language rule matcher; generate a general module corresponding to the declaration configuration text and determine a pointcut of the business application program according to the extracted parameters and the logic code, and associate the pointcut with the general module.

[0085] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the above-described declarative configuration-based aspect risk control method.

[0086] based on Figure 1 The aspect-based risk control method based on declaration configuration shown in this specification also provides embodiments. Figure 6 The diagram shows the structure of the electronic device. Figure 6 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile storage, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to implement the aforementioned declarative configuration-based aspect-based risk control method.

[0087] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1.A method for aspect risk control based on declaration configuration, the method comprising: receiving a declaration configuration file sent by a business party, the declaration configuration file at least declaring a pointcut position and aspect business logic; obtaining a running environment feature of a business application in an application container; compiling, according to the running environment feature and the declaration configuration text, an aspect module matching the running environment feature of the business application and a pointcut of the business application; injecting, by an aspect base pre-deployed in the application container, the aspect module into the pointcut of the business application in the application container, so that when the aspect module is triggered during business execution, the aspect module is executed, triggering a risk control processing procedure corresponding to the aspect business logic. 2.The method of claim 1, wherein obtaining the running environment feature of the business application in the application container comprises: identifying, by the aspect base pre-deployed in the application container, the running environment feature of the business application in the application container; wherein the running environment feature at least includes a programming language of the business application. 3.The method of claim 1, wherein compiling, according to the running environment feature and the declaration configuration text, the aspect module matching the running environment feature of the business application and the pointcut of the business application comprises: generating, by a risk control component of the aspect base in the application container, a general module corresponding to the declaration configuration text and determining the pointcut of the business application according to the running environment feature and the declaration configuration text, the general module being used to implement the aspect business logic contained in the declaration configuration text; compiling, by a compiling engine of the aspect base, the general module into the aspect module matching the running environment feature of the business application according to the running environment feature. 4.The method of claim 1, wherein obtaining the running environment feature of the business application in the application container comprises: determining, according to the declaration configuration file, the business application to which the aspect business logic is to be injected; identifying, from each deployed application container, an application container in which the business application is deployed as a target container; obtaining the running environment feature of the business application in the target container; wherein the running environment feature at least includes a programming language of the business application. 5.The method of claim 4, wherein injecting, by the aspect base pre-deployed in the application container, the aspect module into the pointcut of the business application in the application container comprises: performing pointcut registration at the aspect base according to the obtained pointcut; sending an update notification to the corresponding application according to a subscription record of the aspect base; in response to an acquisition request sent by the business application, injecting the aspect module into the pointcut of the business application. 6.The method of claim 4, wherein the compiling the aspect module matching the running environment feature of the business application and the pointcut of the business application according to the running environment feature and the declared configuration text comprises: generating the general module corresponding to the declared configuration text and determining the pointcut of the business application by the risk control component of the aspect base in the application container according to the running environment feature and the declared configuration text, wherein the general module is used to implement the aspect business logic contained in the declared configuration text; and injecting the aspect module into the pointcut of the business application in the application container by the aspect base pre-deployed in the application container, so that when the aspect module is triggered during the business execution process, the aspect module is executed to trigger the risk control processing process corresponding to the aspect business logic, and the injecting the aspect module into the pointcut of the business application in the application container comprises: weaving the enhanced logic to the pointcut during the runtime of the business application in the application container by the aspect base pre-deployed in the application container; and compiling the general module into the aspect module matching the running environment feature of the business application according to the running environment feature by the compiling engine of the aspect base when the pointcut is triggered during the business execution process. 7.The method of claim 3 or 6, wherein the generating the general module corresponding to the declared configuration text and determining the pointcut of the business application comprises: parsing the declared configuration file by the risk control component of the aspect base; extracting the parameters in the declared configuration file and determining the logic code matching the declared configuration file according to the parsing result and the rule matcher of the preset general language; and generating the general module corresponding to the declared configuration text and determining the pointcut of the business application according to the extracted parameters and the logic code, and associating the pointcut with the general module. 8.An aspect risk control device based on declared configuration, the device comprising: a receiving module configured to receive a declared configuration file sent by a business party, wherein the declared configuration file at least declares a pointcut position and aspect business logic; an obtaining module configured to obtain a running environment feature of a business application in an application container; a compiling module configured to compile an aspect module matching the running environment feature of the business application and a pointcut of the business application according to the running environment feature and the declared configuration text; and a deployment and execution module configured to inject the aspect module into the pointcut of the business application in the application container by an aspect base pre-deployed in the application container, so that when the aspect module is triggered during the business execution process, the aspect module is executed to trigger a risk control processing process corresponding to the aspect business logic. 9.A computer readable storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor to implement the method of any one of claims 1-7. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ 10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and loadable on the processor, the processor implementing the method of any of claims 1-7 when executing the program.

Images