Webpage script code protection method and device

Abstract

The invention discloses a webpage script code protection method and device, relates to the technical field of computer security, and aims to enhance the protection of webpage script codes and effectively eliminate malicious code analysis behaviors. The method comprises the following steps of: analyzing a webpage script code through a code analysis tool to obtain a tree code structure consisting ofa plurality of nodes; traversing the to-be-encrypted nodes in the tree code structure, and sequentially executing encryption conversion on the to-be-encrypted nodes from bottom to top based on the offset parameters until the to-be-encrypted node on the topmost layer is completely converted to generate an encrypted byte code; configuring a virtual machine interpreter for constructing and executingthe encrypted byte code according to the offset parameter; and packaging and storing the virtual machine interpreter and the encrypted byte code in a webpage script code file for executing calling. The device applies the method provided by the scheme.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method and device for protecting web page script codes. Background technique [0002] The webpage script code is an interpretive language. The operation of this language does not need to be compiled into binary machine code in advance. After the browser opens the page, it directly loads the source code of the webpage script and runs it. Therefore, the source code of the webpage script is open and there is no confidentiality at all. It is very convenient to perform breakpoint debugging in the browser, which brings great harm to the key front-end business logic. In fact, the first step of a hacker attack often starts with analyzing the front-end web page script code. [0003] In order to improve this problem, the current common practice is to use obfuscation or encryption methods to protect webpage script codes, but neither of these two methods is very good against mali...

AI Technical Summary

Problems solved by technology

[0003] In order to improve this problem, the current common practice is to use obfuscation or encryption methods to protect webpage script codes, but neither of these two methods is very good against malicious code analysis; first, obfuscating webpage script codes is essentially streamlining code and simplifying variable naming , to remove comments and simplify statements, but the code logic has not changed, it just increases the reading cost. For example, the UglifyJS library is a commonly used web page script code obfuscation tool, and the code generated by it can still be achieved by some code beautification tools. It is similar to the readability of the source code; secondly, the encrypted webpage script code is not safe, because the decryption method or private key can only be provided through the webpage script code, there are also ways for professionals in this field to find out, such as the encryption of strings, Just call the same encryption function to encrypt any string

[0004] To sum up, ordinary obfuscation and encryption methods cannot resist professional malicious code analysis, and professional code crackers can directly obtain the business logic in the code, thereby forging web page requests

Images