CN112182518A

CN112182518A - Software deployment method and device

Info

Publication number: CN112182518A
Application number: CN202011010885.5A
Authority: CN
Inventors: 彭飞; 付和萍; 林建斌
Original assignee: China Construction Bank Corp
Current assignee: China Construction Bank Corp
Priority date: 2020-09-23
Filing date: 2020-09-23
Publication date: 2021-01-05

Abstract

The invention discloses a software deployment method and device, and relates to the technical field of computers. A specific implementation mode of the method comprises the steps of receiving a deployment instruction, obtaining various hardware information of equipment to be deployed of a software package at present, generating a bitmap corresponding to the deployment equipment, and calculating to obtain a unique identifier of the deployment equipment based on a timestamp; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package; and acquiring second data corresponding to the software package stored in a database file to compare the first data with the second data, and executing the deployment instruction if the first data is the same as the second data. Therefore, the implementation mode of the invention can solve the problems of low source code security and poor user experience in the conventional software deployment.

Description

Software deployment method and device

Technical Field

The invention relates to the technical field of computers, in particular to a software deployment method and device.

Background

Due to the particularities of the project, it is undesirable for anyone to see the source code. It is easy for traditional programming languages to protect source code on the Web as long as it is not published. Unfortunately, the source code of the Java program is easily stolen by others, and as long as there is a decompiler, anyone can analyze the code of others, the flexibility of Java makes the source code easily stolen.

In the process of implementing the invention, the inventor finds that at least the following problems exist in the prior art:

in the prior art, Java class files may be "blurred" such that the effect of the decompiler processing the class files is significantly compromised. However, it is not difficult to modify the decompiler to be able to process these obfuscated class files, so obfuscation techniques cannot simply be relied upon to secure the source code. Also, applications can be encrypted with popular encryption tools, where the end user must decrypt before running the application. After decryption, however, the end user has a copy of the class file that is not encrypted, which is no different from not encrypting it beforehand.

Disclosure of Invention

In view of this, embodiments of the present invention provide a software deployment method and apparatus, which can solve the problems of low source code security and poor user experience in existing software deployment.

In order to achieve the above object, according to an aspect of the embodiments of the present invention, a software deployment method is provided, including receiving a deployment instruction, obtaining various hardware information of a device to be deployed of a software package at present, generating a bitmap corresponding to the deployment device, and further obtaining a unique identifier of the deployment device based on timestamp calculation; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package; and acquiring second data corresponding to the software package stored in a database file to compare the first data with the second data, and executing the deployment instruction if the first data is the same as the second data.

Optionally, the obtaining various hardware information of the current device to be deployed of the software package, and generating a bitmap corresponding to the deployed device includes:

acquiring various hardware information of the current equipment to be deployed of the software package to obtain a field value of a preset target hardware attribute;

and generating a bitmap corresponding to the deployment equipment according to the field value of the target hardware attribute.

Optionally, calculating the unique identifier of the deployment device based on the timestamp includes:

calculating the current timestamp to generate an integer based on a preset algorithm, determining a corresponding weight mode according to a preset mapping relation, further performing weight assignment on each byte in the bitmap, and calculating to obtain a unique identifier of the deployment device according to a field value of each byte in the bitmap

Optionally, calling a preset encryption engine according to the unique identifier to encrypt the software package, including:

and calling a preset encryption engine according to the unique identifier, and encrypting the software package by adopting an irreversible encryption algorithm MD 5.

Optionally, after encrypting the software package by using the irreversible encryption algorithm MD5, the method includes:

and carrying out 128-bit AES algorithm encryption on the result encrypted by the MD5 again to obtain the first data of the encrypted software package.

Optionally, after comparing the first data with the second data, the method includes:

if the comparison result of the first data and the second data is different, marking the equipment as abnormal equipment, adding the abnormal equipment into a preset abnormal equipment list, and returning a message of failed deployment.

Optionally, before obtaining various hardware information of the current device to be deployed of the software package, the method includes:

acquiring a reserved field in a first attribute of a current device to be deployed of the software package, judging whether the value of the reserved field is a preset threshold value, if so, listing the device as an abnormal device list, and returning a message of failed deployment; and if not, acquiring various hardware information of the current equipment to be deployed of the software package.

In addition, the invention also provides a software deployment device, which comprises an acquisition module, a deployment module and a deployment module, wherein the acquisition module is used for receiving the deployment instruction, acquiring various hardware information of the current equipment to be deployed of the software package, generating a bitmap corresponding to the deployment equipment, and further calculating to obtain the unique identifier of the deployment equipment based on the timestamp; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package; and the processing module is used for acquiring second data corresponding to the software package stored in a database file so as to compare the first data with the second data, and if the first data is the same as the second data, the deployment instruction is executed.

One embodiment of the above invention has the following advantages or benefits: the invention can carry out flexible configuration according to the weight of the bitmap, and adopts an irreversible encryption algorithm, so that the security of the source code is ensured, and the bugs of software decompilated and multi-machine deployment are eliminated fundamentally. Moreover, the weight mode can be determined according to the time stamp, and a cracker does not know the internal logic at all. When the user installs, the background is checked in the whole process, the program side does not need to be required to register information such as codes, the deployment process is greatly shortened, and good experience is left for the user. In addition, the verification mechanism under a specific local area network mode is fully satisfied, a verification server does not need to be deployed, and all verifications are completed locally. Meanwhile, the user experience can be maximally unaffected in the deployment process, and the user cannot feel any verification mechanism in the middle.

Further effects of the above-mentioned non-conventional alternatives will be described below in connection with the embodiments.

Drawings

The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:

fig. 1 is a schematic diagram of a main flow of a software deployment method according to a first embodiment of the present invention;

FIG. 2 is a schematic diagram of a main flow of a software deployment method according to a second embodiment of the present invention;

FIG. 3 is a schematic diagram of the main modules of a software deploying apparatus according to an embodiment of the present invention;

FIG. 4 is an exemplary system architecture diagram in which embodiments of the present invention may be employed;

fig. 5 is a schematic block diagram of a computer system suitable for use in implementing a terminal device or server of an embodiment of the invention.

Detailed Description

Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, in which various details of embodiments of the invention are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

Fig. 1 is a schematic diagram of a main flow of a software deployment method according to a first embodiment of the present invention, as shown in fig. 1, the software deployment method includes:

step S101, receiving a deployment instruction, acquiring various hardware information of the current equipment to be deployed of the software package, generating a bitmap corresponding to the deployment equipment, and calculating to obtain a unique identifier of the deployment equipment based on a timestamp.

In some embodiments, the field value of the preset target hardware attribute may be obtained by obtaining various types of hardware information of the current device to be deployed of the software package. And then, generating a bitmap corresponding to the deployment equipment according to the field value of the target hardware attribute.

The target hardware attribute may include a CPU ID, an OS VERSION, a hard disk serial number, network card information, and BIOS information. The CPU is a Central Processing Unit. OS VERSION is Operating System VERSION of Operating System VERSION. The BIOS is a Message-Digest Algorithm basic input output system.

In a further embodiment, an integer is generated by calculating the current timestamp based on a preset algorithm, a corresponding weight mode is determined according to a preset mapping relationship, and then weight assignment is performed on each byte in the bitmap, so that the unique identifier of the deployment device is calculated according to the field value of each byte in the bitmap. Wherein, the timestamp is the current machine timestamp, and the format is TIMESTAMP:

YYYY-MM-DD HH24:MI:SS.SSSSSSSSS'

it should be further noted that before obtaining various hardware information of the current to-be-deployed device of the software package, a reserved field in a first attribute of the current to-be-deployed device of the software package may be obtained, whether a value of the reserved field is a preset threshold value is judged, if yes, the device is listed as an abnormal device list, and a deployment failure message is returned; and if not, acquiring various hardware information of the current equipment to be deployed of the software package. Preferably, the first attribute may be BIOS information.

It can be seen that the invention creatively uses the bitmap mode with configurable weight to quantitatively analyze the information of computer resources and the like. That is, there are tens of items of computer resource information, and whether each item is useful or not, or what weight each item occupies, can be configured in a bitmap of one byte. The selection of the weight mode determines which mode is adopted according to the time stamp and a specific algorithm, and the mode is hidden and cannot be cracked. For example: assuming that 2 bytes are used, the length of 16 bits in total is used to represent the bitmap, the specific correspondence is:

bit 1-computer resource information 1

Bit 2-computer resource information 2

……

Bit 15-computer resource information 15

16 th bit-computer resource information 16

The correspondence may be predefined in the program.

It should be noted that the weight patterns include N types, the time stamp is arithmetically and logically calculated based on a preset algorithm (e.g., boolean, arithmetic, relational, etc.) to generate an integer of [0, N-1], and then the corresponding weight pattern is selected according to a preset mapping relationship.

And step S102, calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package.

In some embodiments, a preset encryption engine is called according to the unique identifier, and the software package can be encrypted by using the irreversible encryption algorithm MD 5. MD5 is a widely used cryptographic hash function, Message-Digest Algorithm.

In a further embodiment, the result encrypted by using MD5 may be encrypted again by using 128-bit AES algorithm to obtain the first data of the encrypted software package. Wherein, AES is Advanced Encryption Standard.

Step S103, second data corresponding to the software package stored in a database file is obtained, the first data and the second data are compared, and if the first data and the second data are the same, the deployment instruction is executed.

In some embodiments, after the first data is compared with the second data, if the comparison result of the first data is different from that of the second data, the device is marked as an abnormal device, the abnormal device is added to a preset abnormal device list, and a deployment failure message is returned.

It should be noted that the second data is also a bitmap corresponding to the deployment device generated by obtaining various hardware information of the current device to be deployed of the software package, and then calls a preset identification model, and obtains the unique identification of the deployment device based on timestamp calculation. And then calling a preset encryption engine according to the unique identifier to encrypt the software package.

As a specific embodiment, as shown in fig. 2, when the project is deployed and published on java web localization, the present invention prevents the project from being copied out and copied to external batch, and adopts technical means of encrypting the war packet and preventing decompilation. The war package is a packaging format of Java web engineering. In particular, the amount of the solvent to be used,

step S201, receiving a deployment instruction, and acquiring various hardware information of the current equipment to be deployed of the war package to obtain a field value of a preset target hardware attribute.

As another specific embodiment, before the step S201 is executed to obtain various types of hardware information of the device to be deployed of the war package, a reserved field in BIOS information of the device to be deployed of the war package may also be obtained, whether a value of the reserved field is a preset threshold (for example, the preset threshold is 1) is determined, if yes, the device is listed as an abnormal device list, a message indicating that deployment has failed is returned, and the process is exited. And if not, acquiring various hardware information of the current equipment to be deployed of the war package.

Step S202, generating a bitmap corresponding to the deployment device according to the field value of the target hardware attribute.

In an embodiment, the field value of the target hardware attribute is stored in the corresponding position in the deployment device bitmap according to the corresponding relationship between the bytes in the preset bitmap and the attributes. The bitmap is a dot matrix image or a grid image.

Preferably, the bitmap is expandable. That is, the bitmap may be 2 bytes, or 4 bytes, 8 bytes, etc., which is expandable within the range of the number of CPU bits.

Step S203, calculating the current timestamp based on a preset algorithm to generate an integer, determining a corresponding weight mode according to a preset mapping relation, further performing weight assignment on each byte in the bitmap, and calculating to obtain the unique identifier of the deployment device according to the field value of each byte in the bitmap.

Wherein the weighting patterns include equal weighting patterns, predefined assigned weighting patterns, random weighting patterns, and the like.

For example: calculating the current timestamp to generate an integer 1 based on a preset algorithm, performing weight assignment of an equal weight mode on each byte in the bitmap if the corresponding weight model is the equal weight mode, and then adding products of all byte field values and corresponding weight values to obtain the unique identifier of the deployment device. The byte field values are 1, 2, 3 and 4 respectively, the corresponding weight values are 5, 5 and 5 respectively, and the unique identifier of the deployment device is 1 × 5+2 × 5+3 × 5+4 × 5 ═ 50.

And step S204, calling a preset encryption engine according to the unique identifier, and encrypting the war packet by adopting an irreversible encryption algorithm MD 5.

And step S205, encrypting the result encrypted by the MD5 again by using the 128-bit AES algorithm to obtain the first data of the war packet after encryption.

And S206, acquiring second data corresponding to the war packet stored in the database file.

Step S207, comparing the first data with the second data, and determining whether the first data and the second data are the same, if yes, performing step S208, and if not, performing step S209.

Step S208, executing the deployment instruction.

Step S209, marking the equipment as abnormal equipment, adding the abnormal equipment into a preset abnormal equipment list, and returning a message of failed deployment.

Fig. 3 is a schematic diagram of main modules of a software deploying apparatus according to an embodiment of the present invention, and as shown in fig. 3, the software deploying apparatus includes an obtaining module 301 and a processing module 302. The obtaining module 301 receives the deployment instruction, obtains various hardware information of the current device to be deployed of the software package, generates a bitmap corresponding to the deployment device, and then obtains a unique identifier of the deployment device based on timestamp calculation; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package; the processing module 302 obtains second data corresponding to the software package stored in the database file to compare the first data with the second data, and if the first data and the second data are the same, executes the deployment instruction.

In some embodiments, the obtaining module 301 obtains various types of hardware information of a device to be currently deployed of a software package, and generates a bitmap corresponding to the deployed device, including:

In some embodiments, the obtaining module 301 obtains the unique identifier of the deployment device based on the timestamp calculation, including:

and calculating the current timestamp to generate an integer based on a preset algorithm, determining a corresponding weight mode according to a preset mapping relation, and further performing weight assignment on each byte in the bitmap to calculate the unique identifier of the deployment device according to the field value of each byte in the bitmap.

In some embodiments, the obtaining module 301 invokes a preset encryption engine according to the unique identifier to encrypt the software package, including:

In some embodiments, after the obtaining module 301 encrypts the war packet by using the irreversible encryption algorithm MD5, the method includes:

In some embodiments, after the processing module 302 compares the first data with the second data, the method includes:

In some embodiments, before the obtaining module 301 obtains various types of hardware information of the device to be currently deployed in the software package, the obtaining module includes:

It should be noted that, the software deployment method and the software deployment apparatus of the present invention have corresponding relation in the specific implementation content, so the repeated content is not described again.

Fig. 4 shows an exemplary system architecture 400 to which the software deployment method or the software deployment apparatus of the embodiments of the invention may be applied.

As shown in fig. 4, the system architecture 400 may include

terminal devices

401, 402, 403, a network 404, and a server 405. The network 404 serves as a medium for providing communication links between the

terminal devices

401, 402, 403 and the server 405. Network 404 may include various types of connections, such as wire, wireless communication links, or fiber optic cables, to name a few.

A user may use

terminal devices

401, 402, 403 to interact with a server 405 over a network 404 to receive or send messages or the like. The

terminal devices

401, 402, 403 may have installed thereon various communication client applications, such as shopping-like applications, web browser applications, search-like applications, instant messaging tools, mailbox clients, social platform software, etc. (by way of example only).

The

terminal devices

401, 402, 403 may be various electronic devices having software-deployed screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 405 may be a server providing various services, such as a background management server (for example only) providing support for shopping websites browsed by users using the

terminal devices

401, 402, 403. The backend management server may analyze and perform other processing on the received data such as the product information query request, and feed back a processing result (for example, target push information, product information — just an example) to the terminal device.

It should be noted that the software deployment method provided by the embodiment of the present invention is generally executed by the server 405, and accordingly, the computing device is generally disposed in the server 405.

It should be understood that the number of terminal devices, networks, and servers in fig. 4 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

Referring now to FIG. 5, shown is a block diagram of a computer system 500 suitable for use with a terminal device implementing an embodiment of the present invention. The terminal device shown in fig. 5 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present invention.

As shown in fig. 5, the computer system 500 includes a Central Processing Unit (CPU)501 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)502 or a program loaded from a storage section 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data necessary for the operation of the computer system 500 are also stored. The CPU501, ROM502, and RAM503 are connected to each other via a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, and the like; an output section 507 including a display such as a Cathode Ray Tube (CRT), a liquid crystal software deployer (LCD), and the like, and a speaker; a storage portion 508 including a hard disk and the like; and a communication section 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the internet. The driver 510 is also connected to the I/O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 510 as necessary, so that a computer program read out therefrom is mounted into the storage section 508 as necessary.

In particular, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 509, and/or installed from the removable medium 511. The computer program performs the above-described functions defined in the system of the present invention when executed by the Central Processing Unit (CPU) 501.

It should be noted that the computer readable medium shown in the present invention can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present invention, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules described in the embodiments of the present invention may be implemented by software or hardware. The described modules may also be provided in a processor, which may be described as: a processor includes an acquisition module and a processing module. Wherein the names of the modules do not in some cases constitute a limitation of the module itself.

As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs, and when the one or more programs are executed by one device, the device receives a deployment instruction, acquires various hardware information of the current device to be deployed of a software package, generates a bitmap corresponding to the deployment device, and then calculates and obtains a unique identifier of the deployment device based on a timestamp; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package; and acquiring second data corresponding to the software package stored in a database file to compare the first data with the second data, and executing the deployment instruction if the first data is the same as the second data.

According to the technical scheme of the embodiment of the invention, the problems of low source code security and poor user experience in the conventional software deployment can be solved.

The above-described embodiments should not be construed as limiting the scope of the invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions can occur, depending on design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for deploying software, comprising:

receiving a deployment instruction, acquiring various hardware information of the current equipment to be deployed of the software package, generating a bitmap corresponding to the deployment equipment, and calculating to obtain a unique identifier of the deployment equipment based on a timestamp;

calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package;

and acquiring second data corresponding to the software package stored in a database file to compare the first data with the second data, and executing the deployment instruction if the first data is the same as the second data.

2. The method of claim 1, wherein obtaining various types of hardware information of a device to be deployed of a software package at present, and generating a bitmap corresponding to the deployed device comprises:

3. The method of claim 2, wherein computing the unique identifier of the deployment device based on the timestamp comprises:

4. The method of claim 1, wherein invoking a preset encryption engine to encrypt the software package according to the unique identifier comprises:

5. The method according to claim 4, wherein after encrypting the software package by using the irreversible encryption algorithm MD5, the method comprises:

6. The method of claim 1, wherein comparing the first data to the second data comprises:

7. The method according to any one of claims 1 to 6, wherein before obtaining various types of hardware information of the device to be currently deployed in the software package, the method comprises:

8. A software deploying apparatus, comprising:

the acquisition module is used for receiving the deployment instruction, acquiring various hardware information of the current equipment to be deployed of the software package, generating a bitmap corresponding to the deployment equipment, and calculating to obtain a unique identifier of the deployment equipment based on a timestamp; calling a preset encryption engine according to the unique identifier, and encrypting the software package to obtain first data of the encrypted software package;

and the processing module is used for acquiring second data corresponding to the software package stored in a database file so as to compare the first data with the second data, and if the first data is the same as the second data, the deployment instruction is executed.

9. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-7.

10. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-7.