Service implementation method and device, equipment, storage medium and product

Abstract

The invention provides a service implementation method and device, equipment, a storage medium and a product. The method comprises the following steps: sending a registration subscription request to a local server through a system insight tool; wherein the registration subscription request comprises a machine code of a system where the client is located, license information of the system where the client is located, and a client public key of the client; starting an insight daemon process through the system insight tool; after the system insight tool is successfully registered and subscribed and the insight daemon process is started, realizing a first service for a system where the client is located through the insight daemon process; wherein the first service comprises one or more of the following items: system information collection, heartbeat keep-alive information sending, safety information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a service implementation method, apparatus, device, storage medium, and product. Background Technology

[0002] An operating system (OS) is a computer program that manages and controls computer hardware and software resources. It is the most basic system software that runs directly on the "bare metal," and all other software must run with the support of the operating system. Depending on the application, operating systems can include personal operating systems and enterprise operating systems. Because enterprise operating systems are typically used for critical business systems, stability and security are particularly important compared to personal operating systems.

[0003] Currently, in distributed system architectures, the management and optimization of enterprise-level operating systems are mainly achieved by subscribing to analytics services provided by vendor websites. This subscription-based analytics service is highly dependent on the vendor's website server, making it impossible to build an internal usage environment within the enterprise's local area network on demand. This results in poor stability, security, isolation, and self-controllability, making it difficult to meet the high stability and security requirements of enterprise-level operating systems in business scenarios. Summary of the Invention

[0004] This application provides a service implementation method, apparatus, device, storage medium, and product that can solve the problems of poor stability, security, isolation, and autonomous controllability in subscription analysis services in related technologies, and can meet the application requirements of high stability and high security for enterprise-level operating systems in enterprise business scenarios.

[0005] The technical solution of this application embodiment is implemented as follows: This application provides a service implementation method applied to a client, the method comprising: Using the system insight tool, a registration / subscription request is sent to the local server; wherein, the registration / subscription request includes: the machine code of the system where the client is located, the license information of the system where the client is located, and the client's public key; Start the insight daemon process using the system insight tool; After the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the system where the client is located through the insight daemon; wherein, the first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

[0006] In some exemplary embodiments, sending a registration / subscription request to a local server via a system insight tool includes: The system insight tool uses its registration and authentication module to invoke a first command to obtain the machine code of the system where the client is located. The registration and authentication module reads the certificate file in the first directory of the client's system to obtain the license information of the client's system. The registration and authentication module reads the encrypted file in the second directory of the system where the client is located to obtain the client's public key. The registration and authentication module sends the registration and subscription request to the local server.

[0007] In some exemplary embodiments, before sending the registration / subscription request to the local server via the system insight tool, the method further includes: The key pair for the client is generated using the key module of the system insight tool; wherein the key pair includes: the client's private key and its corresponding client public key; The key module stores the key pair in an encrypted file in the second directory of the client's system. After successful registration and subscription to the system insight tool via its registration and authentication module, the server-side public key issued by the local server is stored in the encrypted file.

[0008] In some exemplary embodiments, the implementation of the first service for the system where the client resides through the insight daemon includes one or more of the following: The system information collection module of the insight daemon process is used to obtain the system information of the system where the client is located; The heartbeat keep-alive module of the insight daemon sends heartbeat online information to the local server according to the pre-configured heartbeat information sending time interval; The logging module of the insight daemon process records the log information to be recorded to the log file; Through the data transmission and encryption module in the insight daemon process, based on the client's public key and the server's public key issued by the local server, the data to be transmitted is encrypted and transmitted to the local server so that the local server can perform data analysis. The data standardization module of the insight daemon process standardizes the data to be standardized according to preset standardization rules. The data synchronization module in the Insight Daemon process synchronizes the data to be synchronized from the local server to the local database.

[0009] In some exemplary embodiments, the method further includes: After the system insight tool is successfully registered and subscribed and the insight daemon is started, the security scanning tool is invoked through the insight daemon. The security scanning tool provides a second service for the system where the client is located; wherein the second service includes one or more of the following: security hardening, vulnerability scanning, intrusion detection, report generation, and remediation suggestion generation.

[0010] In some exemplary embodiments, the step of invoking the security scanning tool through the insight daemon includes: The security information collection module of the insight daemon calls the security scanning tool according to the pre-configured security scanning time interval.

[0011] This application provides a service implementation apparatus for a client, the apparatus comprising: The registration unit is used to send a registration subscription request to the local server through a system insight tool; wherein, the registration subscription request includes: the machine code of the system where the client is located, the license information of the system where the client is located, and the client's public key; The startup unit is used to start the insight daemon process through the system insight tool; The first service implementation unit is used to implement a first service for the system where the client is located through the insight daemon process after the system insight tool is successfully registered and subscribed and the insight daemon process is started; wherein, the first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

[0012] This application provides an electronic device, the electronic device comprising: Memory is used to store executable instructions or computer programs. The processor, when executing computer-executable instructions or computer programs stored in the memory, implements the service implementation method provided in the embodiments of this application.

[0013] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions. When the computer program or computer-executable instructions are executed by a processor, they implement the service implementation method provided in this application.

[0014] This application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, they implement the service implementation method provided in this application.

[0015] The embodiments of this application have the following beneficial effects: This application provides a service implementation method, apparatus, device, storage medium, and product. The client sends a registration and subscription request to the local server through a system insight tool based on the machine code and license information of the system where the client is located, as well as the client's public key. After the system insight tool successfully registers and subscribes and the insight daemon starts, the client can use the insight daemon to implement the first service for the system where the client is located (such as system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, data synchronization, etc.). In this way, the client can provide the first service to the system it is running through a combination of system insight tools and insight daemons. Since the client registers and subscribes to the local server using the machine code, license information, and public key of the client's system, it avoids the deep binding between the client and the manufacturer's official website server by eliminating the need for the client to directly connect to the server via the Internet. On the other hand, it allows the client and the local server to run securely within the internal environment of the enterprise's LAN. By providing analysis services for the client's system through the local server, the security and privacy of the service are ensured. This solves the problems of poor stability, security, isolation, and self-controllability in subscription analysis services in related technologies, and thus meets the application requirements of high stability and high security for enterprise-level operating systems in enterprise business scenarios. Attached Figure Description

[0016] Figure 1 This application provides a schematic diagram of the architecture of a subscription analysis system. Figure 2 This is a first flowchart illustrating a service implementation method provided in an embodiment of this application; Figure 3 This is a second flowchart illustrating a service implementation method provided in an embodiment of this application. Figure 4 A first architecture diagram of an application embodiment of a service implementation method provided in this application; Figure 5 This is a first schematic diagram of a security scanning tool in a client-side service implementation method provided in an embodiment of this application; Figure 6This is a second schematic diagram of a security scanning tool in a client-side service implementation method provided in an embodiment of this application; Figure 7 A third schematic diagram of a security scanning tool in a client-side service implementation method provided in an embodiment of this application; Figure 8 A fourth schematic diagram of a security scanning tool in a client-side service implementation method provided in an embodiment of this application; Figure 9 This is a second architecture diagram of an application embodiment of a service implementation method provided in this application. Figure 10 This is a schematic diagram of the structure of a service implementation device provided in an embodiment of this application; Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0017] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] In the description of this application, references are made to "some exemplary embodiments," which describe a subset of all possible embodiments. However, it is understood that "some exemplary embodiments" may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0020] In the description of this application, the terms "first," "second," etc., are used merely to distinguish similar objects and do not represent a specific order of objects, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in a sequence other than that illustrated or described herein.

[0021] In the description of this application, "multiple" means two or more. Terms such as "one or more," "one or more items," or "one or more items" indicate any one, any two, or more than two of a plurality. For example, including one or more of A, B, and C can mean including any one, any two, or more elements selected from the set consisting of A, B, and C.

[0022] In the description of this application, the terms "module," "unit," or "component" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented, wholly or partially, using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of a larger module or unit that includes the functionality of that module or unit.

[0023] Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application.

[0024] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0025] For ease of understanding, the system architecture to which the service implementation method of this application is applicable will be described below.

[0026] In some exemplary embodiments, the service implementation method of this application embodiment can be applied to a subscription analysis system. Figure 1 This application provides an example of an architecture diagram of a subscription analysis system. Figure 1 As shown, the subscription analytics system may include: one or more remote servers, one or more local servers, and one or more clients. Figure 1 The example illustrates two remote servers, three local servers, and eight clients. The example shows remote server 11-1, remote server 11-2, local server 12-1, local server 12-2, local server 12-3, and clients 13-1, client 13-2, client 13-3, client 13-4, client 13-5, client 13-6, client 13-7, and client 13-8.

[0027] The local server can be a device including a local server-side component, which is installed on a local server system. For example, ... Figure 1 As shown, the exemplary illustrations include local server 121 installed on local server 12-1, local server 122 installed on local server 12-2, and local server 123 installed on local server 12-3.

[0028] The client can be a device that includes a client application, which is installed on the client system (hereinafter also referred to as the client's operating system or the system on which the client resides). For example, such as Figure 1 As shown, exemplary embodiments illustrate client 131 installed on client system 13-1, client 132 installed on client system 13-2, client 133 installed on client system 13-3, client 134 installed on client system 13-4, client 135 installed on client system 13-5, client 136 installed on client system 13-6, client 137 installed on client system 13-7, and client 138 installed on client system 13-8. For example, as... Figure 1 As shown, this example illustrates that clients 131, 132, and 133 interact with local server 121, clients 134, 135, and 136 interact with local server 122, and clients 137 and 138 interact with local server 123. The clients communicate with the local server via a network. The local server communicates with a remote server via a network.

[0029] As an example, the client system can use an enterprise-grade Linux operating system. For instance, the client system could use BigCloud Enterprise Linux (BCLinux). BCLinux is an enterprise-grade Linux operating system based on open-source communities (such as OpenAnolis and OpenEuler), deeply customized to meet the different business needs of enterprises. It is designed for enterprise server applications, cloud computing, big data, and other scenarios, and features stability and security. An open-source community, also known as an open-source code community, is a network platform that publishes software source code according to relevant open-source software license agreements. Examples of open-source communities include OpenAnolis and OpenEuler.

[0030] As an example, the client and local server can be functional modules, software modules, or other possible forms, such as software packages. This application does not limit these aspects.

[0031] As examples, remote servers can be open-source community servers, official servers, etc. Open-source community servers are servers used by network platforms to publish software source code according to the corresponding open-source software license agreements. For example, open-source community servers could be OpenAnolis servers, openEuler servers, etc. Official servers, on the other hand, could be the vendor's server for the client system, or an official server providing information, data, software, etc., related to system security. For example, when the client's system is an enterprise-grade Linux operating system, the official server could be the official website server of the vendor providing that enterprise-grade Linux operating system, a cloud server, etc.

[0032] As an example, taking an enterprise-grade Linux operating system as the client's system, the subscription analytics system is a suite of tools and services designed to help users manage and optimize their enterprise-grade Linux operating system environments. For instance, it provides in-depth intelligent analysis of the system by collecting information about the enterprise-grade Linux operating system in real time, performing system performance analysis, system health checks, security vulnerability scanning, encrypted communication, logging, and report generation. This helps identify and resolve potential problems. Furthermore, it ensures the system performance and security of the enterprise-grade Linux operating system by providing upgrade patches, vulnerability fixes, and security updates through subscriptions.

[0033] It should be understood that Figure 1 The number of clients and local servers shown is merely illustrative. Depending on implementation needs, there can be any number of clients and local servers.

[0034] Currently, in distributed system architectures, monitoring and analysis of client operating systems can be achieved by subscribing to analytics services provided by vendor websites. This primarily involves identifying system performance issues, causes of slow system performance, and potential security threats, thereby managing and optimizing client systems. However, this subscription-based analytics service is deeply tied to the vendor's website server and cannot be deployed on demand within an enterprise's internal network environment. This results in issues with stability, security, isolation, and self-control, making it difficult to meet the high stability and security requirements of enterprise-level operating systems in business scenarios.

[0035] This application provides a service implementation method, apparatus, device, storage medium, and product. A client can implement a first service for its system using a combination of system insight tools and insight daemons, or a second service using a combination of system insight tools, insight daemons, and security scanning tools. Since the client registers and subscribes to the local server using the machine code and license information of its system, as well as the client's public key, it avoids direct internet connection between the client and the vendor's website server, preventing deep binding between them. Furthermore, it allows the client and local server to run securely within the enterprise's local area network, providing analysis services for the client's system through the local server, ensuring service security and privacy. This solves the problems of poor stability, security, isolation, and self-controllability in related technologies for subscription analysis services, thus meeting the high stability and security requirements of enterprise-level operating systems in business scenarios and making it more suitable for enterprise application environments.

[0036] In some exemplary embodiments, the service implementation methods provided in the various embodiments of this application are applicable to various scenarios that require monitoring, management, and analysis of enterprise-level operating systems, such as cloud computing, big data, edge computing, and distributed systems.

[0037] The following will refer to the accompanying drawings, from... Figure 1 The service implementation method provided in this application embodiment is described from the perspective of the client.

[0038] Figure 2 This is a first flowchart illustrating a service implementation method provided in an embodiment of this application. For example, the executing entity of this service implementation method can be a client installed on the client's operating system. As an example, the client may include: a system insight tool and an insight daemon. Figure 2 As shown, the service implementation method may include: S201, through the system insight tool, sends a registration subscription request to the local server; the registration subscription request includes: the machine code of the client's system, the license information of the client's system, and the client's public key; S202, start the insight daemon process through the system insight tool; S203 After the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the system where the client is located through the insight daemon; the first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

[0039] The System Insight tool is the main control program on the client side. As an example, System Insight can provide basic services such as key generation and subscription registration. Furthermore, System Insight can provide primary services to the client's system by controlling and managing the Insight daemon.

[0040] The Insight Daemon (insightD) runs in the background on the client machine and is a daemon corresponding to the system insight tool. It provides primary services to the client's system. A daemon is a special process that runs in the background, usually independent of the client machine, and periodically performs a certain task or waits to process certain events, providing long-running services.

[0041] The first service refers to monitoring, management, and analysis services for the client's system (such as an enterprise-level operating system) by subscribing to software services (such as vulnerability updates, software upgrades, and data analysis) provided by the local server.

[0042] Here, the client's operating system refers to the operating system of the client machine on which the client is installed. For example, the client's operating system could be an enterprise-grade Linux operating system. For instance, the client's operating system could be the Big Cloud Enterprise Operating System (BCLinux).

[0043] Among them, the machine code is a unique identifier of the system on which the client resides, and is used to request license information from the client.

[0044] The machine code and license information are used by the local server to verify the client's identity during the registration and subscription process. This allows for secure registration and authentication without relying on simple usernames and passwords.

[0045] The client's public key is used by the local server to verify the signed data sent by the client during data transmission.

[0046] Among them, successful registration and subscription of the system insight tool, i.e., successful registration and subscription of the client, means that the client's system has successfully registered with the local server, and the local server can provide software services based on the subscription.

[0047] As an example, when the registration and authentication module receives a first response from the local server indicating successful registration and subscription, it determines that the system insight tool registration and subscription has been successful.

[0048] Thus, in this embodiment of the application, the client sends a registration and subscription request to the local server through the system insight tool, based on the machine code and license information of the client's system and the client's public key. After the system insight tool successfully registers and subscribes and the insight daemon starts, the client can use the insight daemon to implement the first service for the client's system (such as system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, data synchronization, etc.). In this way, the client can achieve primary service for the client's system through a combination of system insight tools and insight daemons. Since the client registers and subscribes to the local server using the machine code, license information, and public key of the client's system, it avoids the client's need to directly connect to the manufacturer's official website server via the Internet, thus avoiding deep binding between the client and the manufacturer's official website server. On the other hand, it enables the client and the local server to run securely within the internal environment of the enterprise's LAN. By providing analysis services for the client's system through the local server, the security and privacy of the service are ensured. This solves the problems of poor stability, security, isolation, and independent controllability of subscription analysis services in related technologies. In turn, it can meet the application requirements of high stability and high security of enterprise-level operating systems in enterprise business scenarios.

[0049] Figure 3 This is a second flowchart illustrating a service implementation method provided in an embodiment of this application. For example, the executing entity of this service implementation method can be a client installed on the client's operating system. As an example, the client may include: a system insight tool, an insight daemon, and a security scanning tool. Figure 3 As shown, the service implementation method may include: S201 sends a registration / subscription request to the local server through the system insight tool.

[0050] The registration and subscription request includes: the machine code of the client's system, the license information of the client's system, and the client's public key.

[0051] S202, start the insight daemon process through the system insight tool.

[0052] S203: After the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is provided to the system where the client is located through the insight daemon.

[0053] The first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

[0054] S301: After the system insight tool is successfully registered and subscribed and the insight daemon is started, the security scanning tool is invoked through the insight daemon.

[0055] S302, through security scanning tools, implements a second service for the system where the client is located; the second service includes one or more of the following: security hardening, vulnerability scanning, intrusion detection, report generation, and remediation suggestion generation.

[0056] The first service and the second service refer to monitoring, management and analysis services for the client's system (such as an enterprise-level operating system) by subscribing to software services (such as vulnerability updates, software upgrades, data analysis, etc.) provided by the local server.

[0057] As an example, security hardening may include one or more of the following: security baseline management, detection engine management, hardening and restoration engine management, security parameter control (such as controlling security hardening configuration items based on security parameters), one-click hardening completion, automatic inspection, one-click configuration restoration, etc.

[0058] As an example, vulnerability scanning may include one or more of the following: updating vulnerability databases, full scan, targeted scan, etc.

[0059] As an example, intrusion detection can include one or more of the following: malware detection (such as rootkit detection, including file modification detection, log modification detection, network modification detection, and malicious core module detection), anomaly detection (such as file anomaly detection, process anomaly detection, program behavior detection, memory modification detection, resource consumption detection, account management detection, and system behavior anomaly detection), and attack blocking (such as immediate termination, restart denial, and timely cleanup). Among these, a rootkit is a special type of malware whose main function is to persistently and covertly reside in the target system by hiding itself and its related files, processes, and network connections. Its purpose is to maintain the highest system privileges to access the computer without authorization, posing a significant threat to the security of enterprise-level Linux operating systems.

[0060] As an example, report generation may include one or more of the following: vulnerability report generation, console report generation, Hyper Text Markup Language (HTML) report generation, threat report generation, detection report generation, etc.

[0061] As an example, the remediation suggestion generation may include one or more of the following: generating remediation suggestions for vulnerabilities existing in the system, generating remediation suggestions for security issues existing in the system, generating update suggestions for software versions in the system, etc.

[0062] As an example, the second service may also include one or more of the following: report export, function management, configuration management, security baseline management, detection engine management, hardening and restoration engine management, community multi-member discovery, community unified confirmation and release, one-click vulnerability data retrieval, etc. For example, detection engine management may include intrusion detection tools such as malware detection tools (e.g., chkrootkit tool) and detection tools from the Euler community (openEuler) (e.g., secDetector tool).

[0063] For example, when the second service is security enhancement, for the client's system (such as enterprise-level Linux operating systems like BCLinux), the client can use the daemon to call security scanning tools to check system security configurations, software package security vulnerabilities, and the security of critical system files, which can provide suggestions to improve system performance and stability, thereby ensuring the security defense performance of the client's system.

[0064] For example, when the second service is vulnerability scanning, for the client's system (such as enterprise-level Linux operating systems like BCLinux), the client can use the insight daemon to call security scanning tools to discover known security vulnerabilities and recommend patches or updates to fix these issues.

[0065] For example, when the second service generates a report, the report may include a problem description, scope of impact, severity, and remediation recommendations.

[0066] Thus, in this embodiment, the client sends a registration / subscription request to the local server using the system insight tool, based on the machine code and license information of the client's system and the client's public key. After successful registration / subscription using the system insight tool and the insight daemon starting, the client can not only perform the first service (such as system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, data synchronization, etc.) for the client's system through the insight daemon, but also call the security scanning tool through the insight daemon to perform the second service (such as security hardening, vulnerability scanning, intrusion detection, report generation, remediation suggestion generation, etc.) for the client's system. In this way, the client can combine system insight tools, insight daemons, and security scanning tools to provide a second service for the client's system. Since the client registers and subscribes to the local server using the machine code and license information of the client's system and the client's public key, on the one hand, the client does not need to connect directly to the manufacturer's official website server via the Internet, avoiding deep binding between the client and the manufacturer's official website server. On the other hand, it enables the client and the local server to run securely within the internal environment of the enterprise's LAN, providing analysis services for the client's system through the local server. This solves the problems of poor stability, security, isolation, and independent controllability of subscription analysis services in related technologies, and thus meets the application requirements of high stability and high security for enterprise-level operating systems in enterprise business scenarios.

[0067] In some exemplary embodiments, S201, a registration / subscription request is sent to the local server via a system insight tool, including: A1, through the registration and authentication module of the system insight tool, calls the first command to obtain the machine code of the system where the client is located; A2, through the registration and authentication module, reads the certificate file in the first directory of the client's system to obtain the license information of the client's system; A3, through the registration and authentication module, reads the encrypted file in the second directory of the client's system to obtain the client's public key; A4 sends a registration / subscription request to the local server through the registration and authentication module.

[0068] In some exemplary embodiments, before S201 sends a registration / subscription request to the local server via a system insight tool, the service implementation method further includes: B1. Before sending the registration / subscription request, the key pair for the client is generated using the key module of the system insight tool. The key pair includes the client's private key and its corresponding client public key. B2, through the key module, stores the key pair in an encrypted file in the second directory of the client's system; B3, through the registration and authentication module, after successfully registering and subscribing to the system insight tool, stores the server-side public key issued by the local server into an encrypted file.

[0069] The client's key pair (a private key and a public key) is obtained through an encryption algorithm. Each key pair obtained through this algorithm is unique; the public key is the publicly available part of the key pair and can be shared (e.g., stored on the local server); the private key is the non-public part, kept by the client. If data is encrypted with the private key, it must be decrypted with the corresponding public key. Conversely, if data is encrypted with the public key, it must be decrypted with the corresponding private key.

[0070] As an example, during the process of the System Insight tool sending a registration / subscription request to the local server, the tool's key module also generates a client private key and a corresponding client public key. The client (such as the System Insight tool or the Insight daemon) can hold the client private key and the client public key, while the local server can hold the client public key. Thus, the client private key and the corresponding client public key can be used for encrypted data transmission between the client (such as the System Insight tool or the Insight daemon) and the local server.

[0071] For example, a client-side private key is used by the client (such as a system insight tool or insight daemon) to sign the data to be sent during data transmission.

[0072] For example, the client's public key is used by the local server to verify the signed data sent by the client during data transmission.

[0073] As an example, the encryption algorithm can be an asymmetric encryption algorithm such as the Rivest-Shamir-Adleman (RSA) algorithm, Elliptic Curve Cryptography (ECC), or Digital Signature Algorithm (DSA). For example, the client's key pair can be obtained using the RSA algorithm.

[0074] As an example, the key pair on the local server (i.e., a server-side private key and a server-side public key) is obtained through an encryption algorithm. When the local server receives a registration / subscription request from the client, it authenticates the client based on the machine code and license information in the request. After successful authentication, the local server can issue the server-side public key to the client, allowing the client to encrypt the data to be sent during data transmission.

[0075] For example, the server-side public key is used by clients (such as system insight tools or insight daemons) to encrypt data to be sent during data transmission.

[0076] For example, the server-side private key is used by the local server to decrypt data sent by the client during data transmission.

[0077] In some exemplary embodiments, S202, the insight daemon is started through the system insight tool, including: the insight daemon is started by calling a start command through the control module of the system insight tool.

[0078] In some other exemplary embodiments, S202, the insight daemon is started through the system insight tool, including: calling a restart command through the control module of the system insight tool to restart the insight daemon.

[0079] In some other exemplary embodiments, after starting the insight daemon process through the system insight tool in S202, the service implementation method may further include: calling a stop command through the control module of the system insight tool to stop the insight daemon process.

[0080] Thus, in this embodiment of the application, the client can control the state of the observation daemon (such as starting, restarting, or stopping) through the system insight tool.

[0081] In some exemplary embodiments, S203, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the client's system through the insight daemon, including one or more of the following: C1 obtains system information about the client's system by observing the system information collection module of the daemon process; C2, by observing the heartbeat keep-alive module of the daemon process, sends heartbeat online information to the local server according to the pre-configured heartbeat information sending interval; C3, by observing the logging module of the daemon process, records the log information to be logged to the log file; C4, by observing the data transmission and encryption modules in the daemon process, encrypts the data to be transmitted to the local server based on the client's public key and the server's public key issued by the local server, so that the local server can perform data aggregation and analysis. C5, through the data standardization module of the daemon process, performs standardization processing on the data to be standardized according to preset standardization rules; C6, by observing the data synchronization module in the daemon process, synchronizes the data to be synchronized from the local server to the local database.

[0082] As an example, system information may include one or more of the following: Basic Input Output System (BIOS) information, Central Processing Unit (CPU) information, memory information, network information, kernel module information, software installation information, system log information, etc.

[0083] For example, software installation information can be the installation information of the software packages installed on the client's system (such as software version information), or the installation information of the client's system (such as software version information).

[0084] As an example, the log information to be recorded can include error messages and interaction information. Error messages are generated during the client's operation, while interaction information is generated during the interaction between the client and the local server.

[0085] As an example, log files are used to facilitate later troubleshooting and log information management.

[0086] As an example, the data to be standardized may include one or more of the following: system information collected by the system information collection module in the Insight daemon, log information recorded by the log recording module in the Insight daemon, and security information collected by the security information collection module in the Insight daemon. For example, security information may include one or more of the following: vulnerability scan reports, intrusion detection reports, vulnerability remediation suggestions, etc., generated by security scanning tools.

[0087] In some exemplary embodiments, C2, by observing the daemon's heartbeat keep-alive module and sending heartbeat online information to the local server according to a pre-configured heartbeat information sending time interval, may include: sending heartbeat online information to the local server via an application program interface (API) according to a pre-configured heartbeat information sending time interval. This allows the local server to perceive the online status of the node where the client is located in real time.

[0088] As an example, the heartbeat message sending interval can be configured through a configuration file.

[0089] As an example, by observing the heartbeat keep-alive module of the daemon process, and sending heartbeat online information to the local server through the application programming interface according to the pre-configured heartbeat information sending time interval, it can include: by observing the heartbeat keep-alive module of the daemon process, and sending heartbeat online information to the local server through the application programming interface according to the pre-configured heartbeat information sending time interval in the configuration file.

[0090] An Application Programming Interface (API) is a collection of definitions, procedures, and protocols that enable communication between different applications. A primary function of an API is to provide a common set of functionalities. Representational State Transfer (REST) ​​is a common style for APIs. As examples, APIs can use tabular representational state transfer application programming interfaces (RESTAPI), RESTful APIs, etc. Of course, other types of APIs can also be used, such as Simple Object Access Protocol (SOAPAPI).

[0091] Among them, REST API is a commonly used interoperability interface between web application capabilities based on the Internet. That is, it is an API that follows the REST style. The system corresponding to the API that follows the REST style is a REST style system. The characteristics of the REST style system include: all information exposed to the outside world is a resource, and the resources are identified by the Uniform Resource Identifier (URI) of web technology; and the operations on the exposed resources, including adding, modifying, deleting, and retrieving, which correspond to POST (add), PUT (modify), DELETE (delete), and GET (retrieve) in the Hypertext Transfer Protocol of web technology, respectively.

[0092] RESTful APIs are a design style based on the Hypertext Transfer Protocol (HTTP) for building web services in distributed systems. It's a concise, scalable, and easy-to-understand application program interface (API) design pattern widely used in the development of modern web and mobile applications. RESTful APIs abstract the functional modules of an application as resources. Each resource has a unique, generic resource identifier (URI) for access and manipulation. RESTful APIs provide a unified interface, including operations on resources using HTTP verbs (GET, POST, PUT, DELETE, etc.) and HTTP status codes to convey the results of operations. Using RESTful APIs, developers can retrieve resources using HTTP GET requests, create resources using POST requests, update resources using PUT requests, and delete resources using DELETE requests. API responses are typically returned in JavaScript Object Notation (JSON) or Extensible Markup Language (XML) format, representing the state, attributes, and relationships of resources. RESTful APIs are widely used in various internet services, such as social media platforms, e-commerce websites, and mobile applications.

[0093] SOAP API is an interface for interconnecting application software systems based on the WebService mechanism. SOAP API facilitates interoperability between application software developed on different operating systems and in different languages. A SOAP API message consists of a message header and a message body. The message header carries common information for common processing such as authentication; the message body carries business-related information for business-specific processing.

[0094] In some exemplary embodiments, C6, by observing the data synchronization module in the daemon process, synchronizes the data to be synchronized from the local server to the local database, which may include: C61, by observing the data synchronization module in the daemon process, obtains the data to be synchronized from the local server according to the pre-configured basic information time interval; C62 synchronizes the data to be synchronized to the local database.

[0095] As an example, the basic information time interval can be configured through a configuration file.

[0096] As an example, C61, by observing the data synchronization module in the daemon process, obtains the data to be synchronized from the local server according to the pre-configured basic information time interval in the configuration file. This can include: by observing the data synchronization module in the daemon process, obtaining the data to be synchronized from the local server according to the pre-configured basic information time interval in the configuration file.

[0097] As an example, the data to be synchronized may include one or more of the following: vulnerability update data, vulnerability patch data, security update data, upgrade patch data, and system assessment data from a remote server.

[0098] As an example, the remote server can include: an open-source community server and the official server of the client's operating system. For example, the open-source community server could be the OpenAnolis server or the openEuler server. Similarly, the official server of the client's operating system could be the official server of an enterprise-grade Linux operating system, such as the official server of BCLinux.

[0099] In some exemplary embodiments, taking the data to be transmitted as system information collected by the system information collection module in the insight daemon as an example, in S203, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the client's system through the insight daemon, which may include: C1 obtains system information about the client's system by observing the system information collection module of the daemon process; C4, by observing the data transmission and encryption modules of the daemon process, uses the client's public key and the server's public key issued by the local server, and uses system information as the data to be transmitted, to encrypt and transmit the data to the local server so that the local server can perform data aggregation and analysis.

[0100] As an example, system information may include one or more of the following: system configuration, performance metrics, security vulnerability information, and other operational status data of the client's system.

[0101] Thus, in this embodiment of the application, the client can monitor the system information of the system running on the client by observing the daemon process. Moreover, the monitoring of system information involves sensitive information. During the upload process, the system information is encrypted and transmitted to the local server based on the client's public key and the server's public key issued by the local server, ensuring the security of data transmission. Therefore, under the premise of protecting the security of system information, performance analysis of system information by the local server can help identify the causes of system slowness or other performance problems.

[0102] In other exemplary embodiments, taking the data to be transmitted as including log information recorded by the log recording module of the insight daemon as an example, in S203, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the client's system through the insight daemon, which may include: C3, by observing the logging module of the daemon process, records the log information to be logged to the log file; C4, by observing the data transmission and encryption modules in the daemon process, uses the client's public key and the server's public key issued by the local server as the data to be transmitted, and encrypts the data to be transmitted to the local server so that the local server can perform data aggregation and analysis.

[0103] Thus, in this embodiment of the application, the client can record a large amount of log information generated by the system running during the operation of the client by observing the daemon process. Since effective log recording can help to quickly locate system problems, the event correlation technology can be used to identify related log entries, which can facilitate the discovery and resolution of problems more quickly.

[0104] In some further exemplary embodiments, taking the data to be transmitted as including: system information collected by the system information collection module in the insight daemon and log information recorded by the log recording module of the insight daemon, in step S203, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the client's system through the insight daemon, which may include: C1 obtains system information about the client's system by observing the system information collection module of the daemon process; C3, by observing the logging module of the daemon process, records the log information to be logged to the log file; C4, by observing the data transmission and encryption modules in the daemon process, uses the client's public key and the server's public key issued by the local server as the data to be transmitted, and uses system information and log information in the log file as the data to be transmitted. It encrypts the data to be transmitted and transmits it to the local server so that the local server can perform data aggregation and analysis.

[0105] In some further exemplary embodiments, taking the data to be standardized as including system information collected by the system information collection module in the insight daemon process, and the data to be transmitted as standardized data, in step S203, after the system insight tool is successfully registered and subscribed and the insight daemon process is started, the first service is implemented for the client's system through the insight daemon process, which may include: C1 obtains system information about the client's system by observing the system information collection module of the daemon process; C5 uses the data standardization module of the daemon process to take system information as the data to be standardized and performs standardization processing on the data to be standardized according to the preset standardization rules to obtain the standardized data (i.e. the standardized system information). C4, by observing the data transmission and encryption modules in the daemon process, uses the client's public key and the server's public key issued by the local server as the data to be transmitted, and encrypts the data to be transmitted to the local server so that the local server can perform data aggregation and analysis.

[0106] In some further exemplary embodiments, taking the data to be standardized as including: log information recorded by the logging module of the insight daemon, and the data to be transmitted as standardized data, S203, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the client's system through the insight daemon, which may include: C3, by observing the logging module of the daemon process, records the log information to be logged to the log file; C5, through the data standardization module of the daemon process, uses the log information in the log file as the data to be standardized, and performs standardization processing on the data to be standardized according to the preset standardization rules to obtain the standardized data (i.e. the standardized log information). C4, by observing the data transmission and encryption modules in the daemon process, uses the client's public key and the server's public key issued by the local server as the data to be transmitted, and encrypts the data to be transmitted to the local server so that the local server can perform data aggregation and analysis.

[0107] In some further exemplary embodiments, taking the data to be standardized as including: system information collected by the system information collection module in the insight daemon process and log information recorded by the log recording module in the insight daemon process, and the data to be transmitted as standardized data, in S203, after the system insight tool is successfully registered and subscribed and the insight daemon process is started, the first service is implemented for the system where the client is located through the insight daemon process, which may include: C1 obtains system information about the client's system by observing the system information collection module of the daemon process; C3, by observing the logging module of the daemon process, records the log information to be logged to the log file; C5, through the data standardization module of the daemon process, uses system information and log information in log files as the data to be standardized, and performs standardization processing on the data to be standardized according to preset standardization rules to obtain standardized data; C4, by observing the data transmission and encryption modules in the daemon process, uses the client's public key and the server's public key issued by the local server as the data to be transmitted, and encrypts the data to be transmitted to the local server so that the local server can perform data aggregation and analysis.

[0108] In some exemplary embodiments, C4, by observing the data transmission and encryption module in the daemon process, encrypts and transmits the data to be transmitted to the local server based on the client's public key and the server's public key issued by the local server, so that the local server can perform data aggregation and analysis, may include: C41, based on the client's private key and the second public key issued by the local server, signs and encrypts the data to be transmitted to obtain the signed and encrypted data; C42, based on a preset transmission protocol, sends the signed and encrypted data to the local server.

[0109] As an example, the default transport protocol can be HTTP, Hypertext Transfer Protocol Secure (HTTPS), etc.

[0110] As an example, C41, based on the client's private key and the second public key issued by the local server, signs and encrypts the data to be transmitted to obtain the signed and encrypted data, which may include: C411, according to the preset encryption algorithm, signs the data to be sent based on the client's private key; C412, based on the second public key issued by the local server, encrypts the signed data to obtain the signed and encrypted data.

[0111] Thus, in this embodiment of the application, the security and reliability of data transmission can be guaranteed.

[0112] In some exemplary embodiments, S301, after the system insight tool is successfully registered and subscribed and the insight daemon is started, the security scanning tool is invoked through the insight daemon, including: invoking the security scanning tool according to a pre-configured security scanning time interval through the security information collection module of the insight daemon to realize the second service.

[0113] In some exemplary embodiments, S302, implementing a second service for the system where the client is located using a security scanning tool includes: implementing a second service for the system where the client is located using a security scanning tool according to a pre-configured security scanning time interval.

[0114] As an example, the security scan interval can be configured via a configuration file.

[0115] In some exemplary embodiments, the service implementation method may include the following steps: D1 sends a registration / subscription request to the local server using a system insight tool. The registration / subscription request includes the machine code of the client's system, the license information of the client's system, and the client's public key.

[0116] D2, through the system insight tool, starts the insight daemon process.

[0117] D3, after successfully registering and subscribing to the system insight tool and starting the insight daemon, invokes the security scanning tool through the insight daemon; D4 uses security scanning tools to perform vulnerability scans on the client's system; D5 analyzes the scan results using security scanning tools, generates reports and remediation suggestions, and obtains data to be standardized; D6, by observing the daemon process, standardizes the data to be standardized according to preset standardization rules to obtain the data to be transmitted; D7, by observing the daemon process, encrypts and transmits the data to be transmitted to the local server based on the client's public key and the server's public key issued by the local server.

[0118] Thus, in this embodiment, the client performs vulnerability scanning on its own system, analyzes and generates a problem report and remediation suggestions, standardizes the data, and uploads it to the local server. This allows the local server to focus solely on statistical analysis and display of the data, without being responsible for vulnerability scanning and analysis of the client's system. This significantly reduces the data processing and storage burden on the local server.

[0119] For ease of understanding, the service implementation methods in the embodiments of this application will be described below with reference to exemplary application examples.

[0120] This application provides an application embodiment of a service implementation method, which provides a subscription analysis system. Figure 4 This is a first architecture diagram of an application embodiment of a service implementation method provided in this application, as shown in the following figure. Figure 4As shown, this subscription analytics system can include a client and a local server. As an example, the client can include a system insight tool, an insight daemon, and a security scanning tool. These tools can be a series of software packages installed with the client's system (such as an enterprise-grade Linux operating system like BCLinux). For example, the system insight tool can provide services such as initiating registration authentication with the local server, key pair generation, providing operational help prompts, and controlling the background insight daemon. The insight daemon runs in the background of the client's system and can collect various system data, periodically retrieve the latest security patches and vulnerabilities from the local server, invoke the security scanning tool to perform health and security checks on the client's system and generate security reports and remediation suggestions, format and standardize the generated data before sending it to the local server, and send heartbeat keep-alive information to the local server. The security scanning tool can provide services such as security hardening, vulnerability scanning and intrusion detection, report generation, and remediation suggestions. The local server can consist of a series of software packages provided on the system repository (such as enterprise-grade Linux operating systems like BCLinux) that runs on the local server. These packages provide statistical analysis and storage of data uploaded by the client, web page display, authentication and registration, and synchronization of data from remote servers. For example, the remote server could be an openEuler server or the official BCLinux server. As an example, the client can use security detection tools to invoke intrusion detection tools, such as the chkrootkit tool or the openEuler secDetector tool. Similarly, the client can use a daemon to invoke intrusion detection tools like the chkrootkit tool or the openEuler secDetector tool.

[0121] In some exemplary embodiments, such as Figure 4 As shown, the system insight tool may include: a registration and authentication module, a key module, a control module, and a help module.

[0122] As an example, the registration and authentication module of the System Insight tool is used to call the first command to obtain the machine code of the client's system; read the certificate file in the first directory of the client's system to obtain the license information of the client's system; read the encrypted file in the second directory of the client's system to obtain the client's public key; and send a registration subscription request to the local server. For example, the registration and authentication module of the System Insight tool obtains the machine code of the client's system by calling the sys-id command. For example, it obtains the system machine code (sys-id) by reading the configuration file (such as the Setting.ini file) in the / opt / bclinux-insight / dist directory. For example, it obtains the license information of the client's system by reading the certificate file (such as the Authorization.txt file) in the / etc / bclinux / license directory; and it obtains the client's public key by reading the encrypted file (such as the .pem file) in the / opt / bclinux-insight / dist directory. For example, in enterprise-level Linux operating systems, such as BCLinux, the / opt / bclinux-insight / dist directory typically stores configuration files and related components of the System Insight tool. A PEM file is typically a PEM (Privacy Enhanced Mail) file that can store client-generated key pairs (including a private key and a client public key), a server-generated public key, or other encrypted data (such as certificates).

[0123] As an example, the registration and authentication module of the System Insight tool is also used to determine that the System Insight tool has successfully registered and subscribed when it receives a first response from the local server indicating successful registration and subscription. After successful registration and subscription, the module stores the server-side public key issued by the local server in an encrypted file. For example, the registration and authentication module of the System Insight tool is also used to store the server-side public key issued by the local server in an encrypted file (such as a .pem file) under the / opt / bclinux-insight / dist directory after successful registration and subscription.

[0124] As an example, the registration and authentication module of the system insight tool is also used to display relevant error messages when the registration and authentication module receives a second response from the local server indicating that the registration has failed.

[0125] As an example, the key module of the System Insight tool is used to generate key pairs for clients. Each key pair includes a client's private key and its corresponding public key. The key pair is stored in an encrypted file in a second directory of the client's system. For instance, the key module of the System Insight tool uses the RSA algorithm to generate a key pair for the client and saves the generated key pair to an encrypted file (such as a .pem file) in the / opt / bclinux-insight / dist directory.

[0126] As an example, the help module of the System Insight tool outputs operational help information to guide users on how to use the client. For instance, entering the command-line argument "bclinux-insight --help (or -h)" will retrieve the help information for the System Insight tool. Performing this action will display the System Insight tool's help information.

[0127] As an example, such as Figure 4 As shown, the control module of the System Insight tool is used to control the status of the Insight daemon (such as starting, restarting, and stopping) by inputting different command-line parameters. For example, entering the command-line parameter "bclinux-insight[--register]" registers the system to the server. If it has not yet been registered, this operation must be performed first. For example, entering the command-line parameter "bclinux-insight [--start]" starts the Insight daemon. If the Insight daemon is registered but not running, this operation will start it. If the Insight daemon is already running, this operation will output the message "Daamon is already running". For example, entering the command-line parameter "bclinux-insight --stop" stops the Insight daemon. If the Insight daemon is registered and running, this operation will stop it. For example, entering the command-line parameter "bclinux-insight --restart" restarts the Insight daemon. This operation will first stop the daemon and then immediately restart it.

[0128] In some exemplary embodiments, such as Figure 4 As shown, the Insight Daemon process may include: a system information collection module, a heartbeat keep-alive module, a log recording module, a data transmission and encryption module, a data standardization module, a data synchronization module, and a security information collection module.

[0129] As an example, the system information collection module of the Insight Daemon is used to collect system information such as BIOS information, CPU, memory, network, kernel module information, system package installation information, and log information.

[0130] As an example, the heartbeat keep-alive module of the insight daemon is used to send heartbeat online information to the local server through an application programming interface (such as a RESTful API) according to the heartbeat information sending interval pre-configured in the configuration file, so that the local server can perceive the online status of the node where the client is located in real time.

[0131] As an example, the logging module of the Insight Daemon is used to record error information generated by the client during operation and data information generated during the interaction between the client and the local server to the log file for troubleshooting and log management.

[0132] As an example, the data standardization module of the Insight Daemon is used to standardize data (such as various collected and generated data) according to preset standardization rules, so that the standardized data can be transmitted to the local server as encrypted data.

[0133] As an example, the data transmission and encryption module of the insight daemon is used to encrypt and transmit data to the local server based on the client's public key and the server's public key issued by the local server, enabling the local server to perform data aggregation and analysis. For example, secure encryption based on RSA keys and data transmission functions based on the HTTPS protocol ensure the security and reliability of data transmission.

[0134] As an example, the data synchronization module in the Insight Daemon is used to periodically obtain vulnerability update data, vulnerability patch data, security update data, upgrade patch data, and system assessment data from the remote server from the local server according to the basic information time intervals pre-configured in the configuration file; and synchronize the data to be synchronized from the local server to the local database.

[0135] As an example, the security information collection module of the Insight Daemon is used to call security scanning tools according to the security scanning time intervals pre-configured in the configuration file, collect system vulnerability information, and generate security reports and remediation suggestions.

[0136] For example, the configuration file of a system insight tool may include one or more of the following information: scan interval (e.g., 48 hours), heartbeat sending interval (e.g., 60 minutes), basic information interval (e.g., 72 hours), log storage directory, maximum number of log entries per log file, and system machine code (sys-id).

[0137] In some exemplary embodiments, the security scanning tool is designed as a modular security hardening tool, characterized by a loosely coupled code structure and pluggable, independent functionality. As an example, such as... Figure 5As shown, security scanning tools can perform one or more of the following: security hardening (such as security baseline management, detection engine management, and hardening / restore engine management), vulnerability scanning (such as updating vulnerability databases, targeted scanning, and full scanning), intrusion detection (such as malware detection, anomaly probes, and attack blocking), configuration management, function management, report and remediation suggestion generation (such as report generation and remediation suggestion generation), and report export. For example, ... Figure 5 and Figure 6 As shown, security hardening can include one or more of the following: security baseline management, detection engine management (such as intrusion detection tools like chkrootkit and secDetector from the openEuler community), hardening restoration engine management, security parameter control (such as controlling security hardening configuration items based on security parameters), security hardening, one-click hardening completion, automatic inspection, one-click configuration restoration, and report generation (such as generating console reports and Hypertext Markup Language reports for automatic inspections). For example, ... Figure 5 and Figure 7 As shown, vulnerability scanning can include one or more of the following: discovery by multiple community members, unified confirmation and release by the community, one-click acquisition of vulnerability data, updating the vulnerability database, full scan, targeted scan, vulnerability report generation, etc. For example, such as... Figure 5 and Figure 8 As shown, intrusion detection can include one or more of the following: malware detection (such as rootkit detection, including file modification detection, log modification detection, network spoofing detection, and malicious core module detection), anomaly detection (such as file anomaly detection, process anomaly detection, program behavior anomaly detection, memory modification anomaly detection, resource consumption anomaly detection, account management anomaly detection, and system behavior anomaly detection), attack blocking (such as immediate termination, restart denial, and timely cleanup), report output (such as detection report output and threat report output), and other detection (such as detection provided by other detection tools besides chkrootkit and secDetector). For example, ... Figure 5 and Figure 8 As shown, intrusion detection tools include: intrusion detection tools targeting malware (such as the chkrootkit tool), the secDetector tool from the openEuler community, and other detection tools. For example, anomaly detection can include: using anomaly probes (such as file anomaly probes, process anomaly probes, program behavior probes, memory modification probes, resource consumption probes, account management probes, and process anomaly probes) from the openEuler community's detection tools (such as the secDetector tool) to perform anomaly detection, and using attack blocking functions such as immediate termination, restart rejection, and timely cleanup from the openEuler community's detection tools (such as the secDetector tool). For example, Figure 5 and Figure 8 As shown, malware detection can include: using intrusion detection tools (such as chkrootkit tools) to perform rootkit detection, such as file modification detection, log modification detection, network spoofing detection, and malicious core module detection. As an example, report generation can include one or more of the following: vulnerability report generation, console report generation, HTML report generation, threat report generation, and detection report generation. As an example, remediation suggestion generation can include one or more of the following: generating remediation suggestions for vulnerabilities existing in the system, generating remediation suggestions for security issues existing in the system, and generating update suggestions for software versions in the system.

[0138] In some exemplary embodiments, the security scanning tool may include: a security hardening module, a vulnerability scanning module, an intrusion detection module, and a basic module.

[0139] As an example, the security hardening module of a security scanning tool provides services such as security baseline management, detection engine management, hardening and restoration engine management, security parameter control (e.g., controlling security hardening configuration items based on security parameters), one-click hardening, automatic inspection, and one-click configuration restoration. For instance, the security hardening module supports multiple baseline selection and allows for customized security baselines. It controls security hardening configuration items through preset parameters in a pre-defined file (e.g., the secscanner.cfg file), which can be flexibly adjusted according to user needs. Hardening, automatic inspection, and configuration restoration can be completed with a single click. The automatic inspection function allows for simultaneous viewing of various hardening results (e.g., console reports and HTML reports) during runtime.

[0140] As an example, the vulnerability scanning module of a security scanning tool provides services such as updating the vulnerability database, full-scale scanning, and targeted scanning. For instance, it retrieves the latest security bulletins and Common Vulnerabilities and Exposures (CVE) vulnerability data from the local server and saves this data to the local database; it can scan for system component vulnerabilities with a single click, directly displaying the components with vulnerabilities detected and their related vulnerability information; and after completing the vulnerability scan, it automatically generates a JSON file displaying the vulnerabilities present in the system and their corresponding information.

[0141] As an example, the intrusion detection module of a security scanning tool is used for rootkit detection (such as file modification detection, log modification detection, network modification detection, and malicious kernel detection), anomaly detection (such as file anomaly detection, process anomaly detection, program behavior detection, memory modification detection, resource consumption detection, account management detection, and system behavior anomaly detection), and attack blocking (such as immediate termination, restart denial, and timely cleanup). For example, the chkrootkit tool is used to perform rootkit detection on the file system, and the secDetector tool is used to perform rootkit detection on the kernel. Customizable configuration files are provided on the user side, suggestions are offered based on the results, and visual reports are generated. For example, based on the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) attack pattern library, key attack scenarios such as rootkits and abnormal process privilege escalation are identified, and detection capabilities are built by combining multiple professional intrusion detection tools such as chkrootkit and secDetector.

[0142] As an example, the basic module of a security scanning tool is used to analyze and process the security patches, vulnerability information, and update information provided by the local server with the data obtained from the local security scan to generate a security report and remediation suggestions.

[0143] In some exemplary embodiments, Figure 9 This is a second architecture diagram of an application embodiment of a service implementation method provided in this application, as shown in the example. Figure 9As shown, the subscription analysis system can include a client and a local server. The client can send various data to the local server via an application programming interface (API). The local server can include a display module, an authentication and registration module, a security report module, a data analysis and storage module, and a community data synchronization module. For example, the display module on the local server provides web page access and display functionality for hosts within the local area network (LAN). Any host within the LAN can view relevant information about its local system through a browser, and the local server can view information about all registered hosts under its name (i.e., the systems where all registered clients reside). For example, the authentication and registration module on the local server receives and verifies registration and subscription requests sent by various clients within the LAN, issues server public keys (such as the server's RSA public key), and records host-related information for successfully registered clients. For example, the security report module on the local server collects and summarizes various data submitted by registered clients under its name and generates reports. For example, the data analysis and storage module on the local server analyzes and summarizes the latest data and reports submitted by registered clients under its name, generates reports, and saves the reports as local files. For example, the community data synchronization module on the local server is used to periodically obtain the latest security patches, vulnerabilities, updates and other information from remote servers such as open source community servers (such as openEuler community servers) and official website servers (such as BCLinux official servers) and save them to local files for subsequent data analysis and report generation.

[0144] Thus, in this embodiment, by combining the client and the local server, the client sends a registration and subscription request to the local server using the system insight tool, based on the machine code and license information of the client's system and the client's public key. After successful registration and subscription using the system insight tool and the insight daemon starting, the client can not only provide the first service (such as system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, data synchronization, etc.) for the client's system through the insight daemon, but also call the security scanning tool through the insight daemon to provide the second service (such as security hardening, vulnerability scanning, intrusion detection, report generation, remediation suggestion generation, etc.) for the client's system. In this way, the client can combine system insight tools, insight daemons, and security scanning tools to provide a second service for the client's system. Since the client registers and subscribes to the local server using the machine code and license information of the client's system and the client's public key, on the one hand, the client does not need to connect directly to the manufacturer's official website server via the Internet, avoiding deep binding between the client and the manufacturer's official website server. On the other hand, it enables the client and the local server to run securely within the internal environment of the enterprise's LAN, providing analysis services for the client's system through the local server. This solves the problems of poor stability, security, isolation, and independent controllability of subscription analysis services in related technologies, and thus meets the application requirements of high stability and high security for enterprise-level operating systems in enterprise business scenarios.

[0145] Embodiments of this application provide a service implementation apparatus. Figure 10 This is a schematic diagram of the structure of a service implementation device provided in an embodiment of this application, such as... Figure 10 As shown, the service implementation apparatus may include: Registration unit 1001 is used to send a registration subscription request to the local server through the system insight tool; wherein, the registration subscription request includes: the machine code of the client's system, the license information of the client's system, and the client's public key; Startup unit 1002 is used to start the insight daemon process through the system insight tool; The first service implementation unit 1003 is used to implement the first service for the client's system through the insight daemon process after the system insight tool is successfully registered and subscribed and the insight daemon process is started. The first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

[0146] In some exemplary embodiments, the registration unit is used to send a registration subscription request to a local server through a system insight tool, including: calling a first command through the registration and authentication module of the system insight tool to obtain the machine code of the client's system; reading a certificate file in a first directory of the client's system through the registration and authentication module to obtain the license information of the client's system; reading an encrypted file in a second directory of the client's system through the registration and authentication module of the system insight tool to obtain the client's public key; and sending a registration subscription request to the local server through the registration and authentication module of the system insight tool.

[0147] In some exemplary embodiments, the service implementation apparatus further includes: a key generation unit, configured to generate a key pair for the client through the key module of the system insight tool before the registration unit sends a registration subscription request to the local server through the system insight tool; wherein the key pair includes: a client private key and its corresponding client public key; the key pair is stored in an encrypted file in a second directory of the client's system through the key module of the system insight tool; and the server public key issued by the local server is stored in an encrypted file after the system insight tool successfully registers and subscribes through the registration and authentication module of the system insight tool.

[0148] In some exemplary embodiments, the first service implementation unit is configured to implement a first service for the client's system through the insight daemon after the system insight tool has been successfully registered and subscribed and the insight daemon has started, including one or more of the following: By observing the system information collection module of the daemon process, system information of the client's system can be obtained; By observing the heartbeat keep-alive module of the daemon process, heartbeat online information is sent to the local server according to the pre-configured heartbeat information sending interval; By observing the logging module of the daemon process, the log information to be logged is recorded to the log file; By observing the data transmission and encryption modules in the daemon process, the data to be transmitted is encrypted and transmitted to the local server based on the client's public key and the server's public key issued by the local server, so that the local server can perform data analysis. By observing the data standardization module of the daemon process, the data to be standardized is processed according to preset standardization rules; By observing the data synchronization module in the daemon process, the data to be synchronized from the local server is synchronized to the local database.

[0149] In some exemplary embodiments, the service implementation apparatus may further include: The invocation unit is used to invoke the security scanning tool through the insight daemon after the system insight tool has been successfully registered and subscribed and the insight daemon has started. The second service implementation unit is used to implement a second service for the system where the client is located through security scanning tools; wherein the second service includes one or more of the following: security hardening, vulnerability scanning, intrusion detection, report generation, and remediation suggestion generation.

[0150] In some exemplary embodiments, the second service implementation unit is used to invoke a security scanning tool according to a pre-configured security scanning time interval through the security information collection module of the insight daemon.

[0151] Embodiments of this application provide an electronic device that may include: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in memory, implements one or more of the service implementation methods provided in the embodiments of this application.

[0152] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. This electronic device can be applied to... Figure 2 In one service implementation method provided in the corresponding embodiment, such as... Figure 11 As shown, the electronic device 1100 may include a processor 1101, a memory 1102, and a bus 1103. The various components in the electronic device 1100 are coupled together via the bus 1103. Wherein: Bus 1103 is used to realize the communication connection between processor 1101 and memory 1102; Memory 1102 is used to store computer-executable instructions or computer programs; When processor 1101 executes computer-executable instructions or computer programs stored in memory 1102, it implements the service implementation method in one or more exemplary embodiments described above.

[0153] In some exemplary embodiments, bus 1103 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. For example, bus 1103 may be divided into a data bus, a power bus, an address bus, a control bus, a status signal bus, etc. For ease of illustration, in... Figure 11 The bus 1103 is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0154] In some exemplary embodiments, the electronic device can be implemented as various types of terminals such as laptops, tablets, desktop computers, set-top boxes, smartphones, smart speakers, smartwatches, smart TVs, and in-vehicle terminals, or it can be implemented as a server. For example, the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0155] In some exemplary embodiments, the processor may be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor may be a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or any conventional processor, etc.

[0156] This application provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the service implementation method provided in this application can be implemented, for example, as... Figure 2 The service implementation method is shown.

[0157] This application provides a computer program product, which includes a computer program or computer-executable instructions. When the computer-executable instructions or the computer program are executed by a processor, the service implementation method provided in this application can be implemented, for example, as... Figure 2 The illustrated service implementation method. For example, the computer program or computer-executable instructions are stored in a computer-readable storage medium, the processor of the electronic device reads the computer program or computer-executable instructions from the computer-readable storage medium, and the processor executes the computer program or computer-executable instructions, causing the electronic device to perform the service implementation method provided in the embodiments of this application.

[0158] In some exemplary embodiments, the aforementioned computer-readable storage medium / memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; or it may be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0159] In some embodiments, a computer program or computer-executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0160] As an example, a computer program or computer-executable instructions may, but not necessarily, correspond to a file in a file system. It may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hypertext Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0161] As an example, a computer program or computer-executable instructions may be deployed to execute on one electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected by a communication network.

[0162] It should be noted that the descriptions of the above embodiments of the apparatus, devices, storage media, or products are similar to the descriptions of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device, storage medium, or product embodiments of this application, those skilled in the art should refer to the descriptions of the method embodiments of this disclosure for understanding. Further details will not be repeated here.

[0163] The features disclosed in the several methods, apparatuses, devices, storage media or product embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments, apparatuses, devices, storage media or product embodiments.

[0164] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A service implementation method, characterized in that, Applied to a client, the method includes: Using the system insight tool, a registration / subscription request is sent to the local server; wherein, the registration / subscription request includes: the machine code of the system where the client is located, the license information of the system where the client is located, and the client's public key; Start the insight daemon process using the system insight tool; After the system insight tool is successfully registered and subscribed and the insight daemon is started, the first service is implemented for the system where the client is located through the insight daemon; wherein, the first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

2. The method according to claim 1, characterized in that, The step of sending a registration / subscription request to the local server via system insight tools includes: The system insight tool uses its registration and authentication module to invoke a first command to obtain the machine code of the system where the client is located. The registration and authentication module reads the certificate file in the first directory of the client's system to obtain the license information of the client's system. The registration and authentication module reads the encrypted file in the second directory of the system where the client is located to obtain the client's public key. The registration and authentication module sends the registration and subscription request to the local server.

3. The method according to claim 1, characterized in that, Before sending the registration / subscription request to the local server via the system insight tool, the method further includes: The key pair for the client is generated using the key module of the system insight tool; wherein the key pair includes: the client's private key and its corresponding client public key; The key module stores the key pair in an encrypted file in the second directory of the client's system. After successful registration and subscription to the system insight tool via its registration and authentication module, the server-side public key issued by the local server is stored in the encrypted file.

4. The method according to claim 1, characterized in that, The provision of the first service for the system where the client resides through the insight daemon process includes one or more of the following: The system information collection module of the insight daemon process is used to obtain the system information of the system where the client is located; The heartbeat keep-alive module of the insight daemon sends heartbeat online information to the local server according to the pre-configured heartbeat information sending time interval; The logging module of the insight daemon process records the log information to be recorded to the log file; Through the data transmission and encryption module in the insight daemon process, based on the client's public key and the server's public key issued by the local server, the data to be transmitted is encrypted and transmitted to the local server so that the local server can perform data analysis. The data standardization module of the insight daemon process standardizes the data to be standardized according to preset standardization rules. The data synchronization module in the Insight Daemon process synchronizes the data to be synchronized from the local server to the local database.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: After the system insight tool is successfully registered and subscribed and the insight daemon is started, the security scanning tool is invoked through the insight daemon. The security scanning tool provides a second service for the system where the client is located; wherein the second service includes one or more of the following: security hardening, vulnerability scanning, intrusion detection, report generation, and remediation suggestion generation.

6. The method according to claim 5, characterized in that, The process of calling a security scanning tool through the insight daemon includes: The security information collection module of the insight daemon calls the security scanning tool according to the pre-configured security scanning time interval.

7. A service implementation apparatus, characterized in that, Applied to a client, the device includes: The registration unit is used to send a registration subscription request to the local server through a system insight tool; wherein, the registration subscription request includes: the machine code of the system where the client is located, the license information of the system where the client is located, and the client's public key; The startup unit is used to start the insight daemon process through the system insight tool; The first service implementation unit is used to implement a first service for the system where the client is located through the insight daemon process after the system insight tool is successfully registered and subscribed and the insight daemon process is started; wherein, the first service includes one or more of the following: system information collection, heartbeat keep-alive information sending, security information collection, log recording, data standardization, data transmission and encryption, and data synchronization.

8. An electronic device, characterized in that, The electronic device includes: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, the method as described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, the method as described in any one of claims 1 to 6 is implemented.

Images