WO2025108032A1 - Service execution - Google Patents

Abstract

Disclosed in the present description are a service execution method and apparatus, a storage medium and an electronic device, used for privacy protection. The method comprises determining a process number of a target process and determining a target injection point in the target process; on the basis of the process number and the target injection point, injecting a preset byte code program into the target injection point of the target process; and by means of the byte code program, acquiring original service data at the target injection point in the target process and calling a data security component to process the original service data to obtain processed service data, so as to continue to execute the remaining service corresponding to the process on the basis of the processed service data. According to the method, the data security component can be called by means of the byte code program to process the original service data at the target injection point in a service link, and then the process can continue to execute the service on the basis of the processed service data, such that compared with the prior art, the efficiency of adding a security processing policy in the service link is improved to a certain extent.

Description

Business Execution Technical Field

The present invention relates to the field of computer technology, and in particular to a method, device, storage medium and electronic device for executing a service.

Background Art

With the continuous development of information technology, various online platforms are enriching people's lives, and along with it comes a large demand for ensuring information security. That is, online platforms have the obligation and need to ensure the security of the privacy data of the platform and its users.

Therefore, within the online platform, data in certain business links need to be processed securely. For example, when data in the database needs to be displayed on the front-end page, the data needs to be desensitized before display. For another example, when storing data involving privacy, the data can be homomorphically encrypted before storage.

In the prior art, when a data security processing strategy needs to be added to a business link, code modification is required and then the system is put back online, which is often inefficient.

Therefore, how to improve the efficiency of adding data security processing strategies to the business chain is an urgent problem to be solved.

Summary of the invention

The present specification provides a method, device, storage medium and electronic device for executing a service to improve the efficiency of adding a data security processing function to a service link.

This manual adopts the following technical solution.

The present specification provides a method for executing a business, including: determining the process identifier of a target process used to execute a target business, and determining a target injection point in the target process; injecting a preset bytecode program into the target injection point of the target process according to the process identifier and the target injection point; obtaining, through the bytecode program, original business data required for use by the target process at the target injection point when executing the target business; calling, through the bytecode program, a pre-deployed data security component to process the original business data through the data security component to obtain processed business data; and continuing to execute the target business through the target process based on the processed business data.

Optionally, determining the process ID of a target process used to execute a target business includes: querying the process IDs of each running process; selecting a target process used to execute the target business from the processes, and determining the process ID of the target process.

Optionally, the original business data required for use at the target injection point when the target process executes the target business is obtained through the bytecode program, specifically including: obtaining, through the bytecode program, the original business data in the local variable table corresponding to the target injection point when the target process executes the target business, and pushing the original business data into the operand stack; calling, through the bytecode program, a pre-deployed data security component to process the original business data through the data security component to obtain processed business data, specifically including: calling, through the bytecode program, a data security component to process the original business data in the operand stack to obtain processed business data, and returning the processed business data to the operand stack; based on the processed business data, continuing to execute the target business through the target process, specifically including: replacing the original business data in the local variable table with the processed business data in the operand stack through the bytecode program, so as to continue to execute the target business through the target process based on the processed business data in the local variable table.

Optionally, the target injection point is identified by a fully qualified class name and a fully qualified method name.

The present specification provides a device for executing a business, including: a determination module, used to determine the process identifier of a target process used to execute a target business, and to determine a target injection point in the target process; an injection module, used to inject a preset bytecode program into the target injection point of the target process according to the process identifier and the target injection point; an acquisition module, used to obtain, through the bytecode program, original business data required to be used at the target injection point when the target process executes the target business; a calling module, used to call a pre-deployed data security component through the bytecode program, so as to process the original business data through the data security component to obtain processed business data; and an execution module, used to continue to execute the target business through the target process based on the processed business data.

Optionally, the determination module is specifically used to query the process identifiers of each running process; select a target process used to execute the target business from the processes, and determine the process identifier of the target process.

Optionally, the acquisition module is specifically used to, through the bytecode program, acquire the original business data in the local variable table corresponding to the target injection point when the target process executes the target business, and push the original business data into the operand stack; the calling module is specifically used to, through the bytecode program, call the data security component to process the original business data in the operand stack to obtain the processed business data, and return the processed business data to the operand stack; the execution module is specifically used to, through the The bytecode program replaces the original business data in the local variable table with the processed business data in the operand stack, so as to continue to execute the target business through the target process based on the processed business data in the local variable table.

Optionally, the target injection point is identified by a fully qualified class name and a fully qualified method name.

This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method for executing the above-mentioned service is implemented.

This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned service execution method when executing the program.

At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects.

In the method for executing a business provided in this specification, the process identifier of the target process used to execute the target business is determined, and the target injection point in the target process is determined. Then, according to the process identifier and the target injection point, the preset bytecode program can be injected into the target injection point of the target process, and then, the original business data required to be used at the target injection point when the target process executes the target business can be obtained through the bytecode program. Through the bytecode program, the pre-deployed data security component is called to process the original business data through the data security component to obtain the processed business data, and based on the processed business data, the target business is continued to be executed through the target process.

From the above content, it can be seen that the business execution method provided in this specification can obtain the business data that needs to be securely processed in the business chain through a pre-written bytecode program, and call the data security component through the bytecode program to process the original business data at the target injection point in the business chain of the process. The process can then continue to execute the business based on the processed business data, thereby improving the efficiency of adding security processing strategies to the business chain to a certain extent compared to the existing technology.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide further understanding of this specification and constitute a part of this specification. The illustrative embodiments of this specification and their descriptions are used to explain this specification and do not constitute improper limitations on this specification.

FIG1 is a schematic flow chart of a method for executing a service in this specification.

FIG. 2 is a schematic diagram of bytecode injection provided in this specification.

FIG. 3 is a schematic diagram of a device for executing a service provided in this specification.

FIG. 4 is a schematic diagram of an electronic device provided in this specification corresponding to FIG. 1 .

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

FIG1 is a flow chart of a method for executing a service in this specification, which specifically includes the following steps.

S100: Determine a process identifier of a target process used to execute a target business, and determine a target injection point in the target process.

S102: Injecting a preset bytecode program into a target injection point of the target process according to the process identifier and the target injection point.

When a server runs a software system, the software system can be used to execute one or more businesses. In order to execute the business, there may be many processes inside the server. Different businesses have different processes, and the functions executed by each process may be different.

As the need to ensure data security becomes increasingly important for online platforms, online platforms need to add data security processing strategies to continuous business links in software systems running in internal servers and other devices. This requires adding data security processing logic to the process.

Based on this, the server can determine the process ID of the target process used to execute the target business, and determine the target injection point in the target process. Then, according to the process ID and the target injection point, the preset bytecode program can be injected into the target injection point of the target process.

The server may query the process identifier of each running process (the process identifier may be a process id), and may select a target process used to execute a target business from each process, and determine the process identifier of the target process.

Specifically, there can be multiple target processes. For example, when a process needs to obtain data from a database through network transmission and display it on a front-end page (such as a web page or a user's app), the process can be the target process. For example, when a process needs to store acquired data in a system log, the process may be a target process.

It should be noted that the target process can be selected manually, so that after the process IDs of each process are queried, the process ID of the target process can be obtained.

Since the process ID of the same process may change each time the server is started, the application name and process ID corresponding to each process can be queried during the query. The application name and process ID of each process correspond one to one. The application name corresponding to the target process that needs data security processing among the processes used to execute the target business can be determined, and the process ID of the target process can be located by the application name. The application name and process ID of each process running in the server can be queried through the jps command.

The target business mentioned above can also be defined according to actual needs. For example, the server maintains payment business, transaction business, etc., and the business that needs to add data security processing can be selected as the target business.

S104: Acquire, through the bytecode program, original business data required for use at the target injection point when the target process executes the target business.

S106: calling a pre-deployed data security component through the bytecode program to process the original business data through the data security component to obtain processed business data.

S108: Based on the processed business data, continue to execute the target business through the target process.

After determining the process identifier of the target process and the target injection point in the target process, the preset bytecode program can be injected into the target injection point of the target process, so as to obtain the original business data at the target injection point in the target process through the bytecode program, and call the pre-deployed data security component through the bytecode program to process the original business data through the data security component to obtain processed business data, so as to continue to execute the above-mentioned target business based on the processed business data.

The above-mentioned bytecode program can be artificially written in the form of bytecode (Java bytecode), and the above-mentioned data security component can be in the form of a jar package. The function of the bytecode program is: after being injected into the target injection point, obtaining the original business data that needs to be securely processed at the target injection point, calling the data security component to process the original business data, and obtaining the processed business data.

It is necessary to combine Java's attach mechanism and instrumentation mechanism to inject the bytecode program. The process id can be specified through the attach mechanism to start the injector (agant program), and the bytecode program can be injected into the target process through the injector combined with the instrumentation mechanism.

Among them, through the above bytecode program, the local variables corresponding to the target injection point in the target process can be obtained The original business data in the local variable table is obtained by the bytecode program, and the original business data is pushed into the operand stack. Then, the data security component can be called through the bytecode program to process the original business data in the operand stack to obtain the processed business data, and the processed business data is returned to the operand stack. The bytecode program replaces the original business data in the local variable table with the processed business data in the operand stack to complete the processing of the original business data. Then, the target process can continue to execute the target business based on the processed business data in the local variable table.

It should be noted that the original business data mentioned here may be data that has security processing requirements, such as data involving user privacy. Therefore, the bytecode program can filter out data of the target type from the local variable table as the original business data, and the target type can be set manually.

FIG. 2 is a schematic diagram of bytecode injection provided in this specification.

As shown in Figure 2, assuming that the target injection point is located between logic A and logic B, after the bytecode program is injected, after the process executes to logic A, the bytecode program will call the data security component to perform security processing on the original business data, and put the processed business data back to the original location, and then the process can continue to execute logic B. Thus, it is possible to add data security processing strategies to the business chain without the user's awareness.

Therefore, the data security component mentioned above may be a program specifically used for processing data securely, for example, the data security component may encrypt or desensitize the data, etc. For another example, the data security component may also be used for security verification of users.

For example, original business data related to the user's identity can be obtained, and the user's identity can be authenticated through the data security component based on the original business data. The processed business data can be used to indicate whether the user's identity authentication is successful.

It should be noted that the above target injection points can be identified by fully qualified class names and fully qualified method names.

From the above content, it can be seen that the business execution method provided in this specification can obtain the business data that needs to be securely processed in the business chain through a pre-written bytecode program, and call the data security component through the bytecode program to process the original business data at the target injection point in the business chain of the process. The process can then continue to execute the business based on the processed business data, thereby improving the efficiency of adding security processing strategies to the business chain to a certain extent compared to the existing technology.

It should be noted that, for ease of description, the execution subject of the method is described as a server in the above content. The execution subject of the method can be a computer, a large service platform, etc., which is not limited here.

The above is a method for executing services provided in one or more embodiments of this specification. Based on the same idea, this specification also provides a device for executing services, as shown in FIG3 .

Figure 3 is a schematic diagram of a business execution device provided in this specification, which specifically includes: a determination module 301, used to determine the process identifier of the target process used to execute the target business, and determine the target injection point in the target process; an injection module 302, used to inject a preset bytecode program into the target injection point of the target process according to the process identifier and the target injection point; an acquisition module 303, used to obtain, through the bytecode program, the original business data required to be used by the target process at the target injection point when executing the target business; a calling module 304, used to call a pre-deployed data security component through the bytecode program, so as to process the original business data through the data security component to obtain processed business data; an execution module 305, used to continue to execute the target business through the target process based on the processed business data.

Optionally, the determination module 301 is specifically used to query the process identifiers of each running process; select a target process used to execute the target business from the processes, and determine the process identifier of the target process.

Optionally, the acquisition module 303 is specifically used to acquire, through the bytecode program, the original business data in the local variable table corresponding to the target injection point when the target process executes the target business, and push the original business data into the operand stack; the calling module 304 is specifically used to call the data security component through the bytecode program to process the original business data in the operand stack to obtain processed business data, and return the processed business data to the operand stack; the execution module 305 is specifically used to replace the original business data in the local variable table with the processed business data in the operand stack through the bytecode program, so as to continue to execute the target business through the target process based on the processed business data in the local variable table.

Optionally, the target injection point is identified by a fully qualified class name and a fully qualified method name.

This specification also provides a computer-readable storage medium, which stores a computer program. The computer program can be used to execute the above-mentioned service execution method.

This specification also provides a schematic structural diagram of the electronic device shown in Figure 4. As shown in Figure 4, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the above-mentioned service execution method. Of course, in addition to the software implementation method, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many improvements in today's method flows can be regarded as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented using hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer readable medium storing a computer readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that in addition to implementing the controller in a purely computer readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the means for implementing various functions included therein may also be considered as a structure within the hardware component. Or even, the means for implementing various functions may be considered as both a software module for implementing the method and a structure within the hardware component.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, A media player, a navigation device, an email device, a gaming console, a tablet computer, a wearable device, or a combination of any of these devices.

For the convenience of description, the above device is described by dividing it into various units according to its functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and/or hardware.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowchart and/or block diagram of the method, device (system), and computer program product according to the embodiment of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing nodes connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage nodes.

Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may be modified and varied in various ways. Any modification or alteration made within the spirit and principle of the present specification is Modifications, equivalent substitutions, improvements, etc. should all be included in the scope of the claims of this specification.

Claims (10)

A method for executing a business, comprising: Determine the process identifier of the target process used to execute the target business, and determine the target injection point in the target process; Injecting a preset bytecode program into the target injection point of the target process according to the process identifier and the target injection point; Obtaining, through the bytecode program, original business data required to be used at the target injection point when the target process executes the target business; By means of the bytecode program, a pre-deployed data security component is called to process the original business data by means of the data security component to obtain processed business data; Based on the processed business data, continue to execute the target business through the target process. The method according to claim 1, determining the process identifier of the target process used to execute the target business, comprises: Query the process ID of each running process; A target process used to execute the target business is selected from the processes, and a process identifier of the target process is determined. The method according to claim 1, obtaining, through the bytecode program, the original business data required to be used at the target injection point when the target process executes the target business, specifically comprises: Obtaining, through the bytecode program, original business data in the local variable table corresponding to the target injection point when the target process executes the target business, and pushing the original business data into the operand stack; The bytecode program is used to call a pre-deployed data security component to process the original business data through the data security component to obtain processed business data, specifically including: Calling a data security component through the bytecode program to process the original business data in the operand stack to obtain processed business data, and returning the processed business data to the operand stack; Based on the processed business data, continuing to execute the target business through the target process specifically includes: The original business data in the local variable table is replaced by the processed business data in the operand stack through the bytecode program, so as to continue to execute the target business through the target process based on the processed business data in the local variable table. According to the method described in claim 1, the target injection point is identified by a fully qualified class name and a fully qualified method name. A device for executing a service, comprising: A determination module, used to determine the process identifier of a target process used to execute a target business, and to determine a target injection point in the target process; An injection module, used for injecting a preset bytecode program into a target injection point of the target process according to the process identifier and the target injection point; An acquisition module, used to acquire, through the bytecode program, the original business data required to be used at the target injection point when the target process executes the target business; A calling module, used to call a pre-deployed data security component through the bytecode program, so as to process the original business data through the data security component to obtain processed business data; An execution module is used to continue executing the target business through the target process based on the processed business data. In the device as described in claim 5, the determination module is specifically used to query the process identifiers of each running process; select a target process used to execute the target business from the processes, and determine the process identifier of the target process. The device according to claim 5, wherein the acquisition module is specifically used to acquire, through the bytecode program, the original business data in the local variable table corresponding to the target injection point when the target process executes the target business, and push the original business data into the operand stack; The calling module is specifically used to call the data security component through the bytecode program to process the original business data in the operand stack to obtain processed business data, and return the processed business data to the operand stack; The execution module is specifically used to replace the original business data in the local variable table with the processed business data in the operand stack through the bytecode program, so as to continue to execute the target business through the target process based on the processed business data in the local variable table. In the device as described in claim 5, the target injection point is identified by a fully qualified class name and a fully qualified method name. A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 4. An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 4 when executing the program.