A Java bytecode encryption method based on secure password module

Abstract

The present invention relates to the technical field of code encryption, and in particular to a Java bytecode encryption method based on a secure password module, comprising: a key management module pre-stores a one-to-one correspondence between an encrypted service operating environment, a key, and a key identifier; a code encryption module receives a source code package of a current encrypted service operating environment, determines a key identifier, and sends the source code package and the key identifier to the key management module; the key management module retrieves a corresponding key to encrypt the source code package, and returns the encrypted code package to the code encryption module; the code encryption module deploys the encrypted code package to a corresponding terminal; when the terminal encrypted code package needs to be started, the code decryption module sends the encrypted code package to the key management module after passing a trusted authentication; the key management module uses an internal key to decrypt the encrypted code package, and returns the decryption result to the code decryption module. The present invention can improve the security of the code encryption and decryption process.

Description

Technical Field

[0001] The present invention relates to the technical field of code encryption, and more specifically to a Java bytecode encryption method based on a security password module. Background Art

[0002] With the rapid development of Internet technology and the increasing popularization of informatization in all walks of life, Java language services have been applied to all walks of life. With the large-scale popularization of Java service applications and the characteristics of Java code being easily decompiled, how to protect the company's core code technology from being leaked without affecting the deployment and operation of the original code has become an urgent problem to be solved.

[0003] Currently, common Java bytecode protection schemes include code obfuscation, code virtualization, and code encryption. Among them, the code obfuscation scheme modifies the class name, method name, variable name, etc. in the bytecode file to make the code difficult to read and understand, but keep the original logic unchanged. The obfuscated code only increases the difficulty of reading, but still retains the real code running logic, so the original code logic can still be parsed through reverse engineering. Secondly, the obfuscated code class name, method name, and variable name are all changed to meaningless identifiers, making code debugging and operation and maintenance difficult. In addition, code obfuscation will change the code logic and keep the code running as expected as possible, which may cause more compatibility issues and performance degradation, which is not conducive to maintenance.

[0004] Code virtualization is the process of converting part or all of the bytecode into an intermediate language or bytecode that can only be executed in a specific virtual machine environment. Code virtualization essentially modifies the logic of the virtual machine to parse and run binary bytecodes, making it different from the standard JVM, and the parsing logic needs to be kept confidential. Once the virtualized logic has vulnerabilities or is cracked, it may still lead to code leakage. Virtualized code usually needs to be run in a customized virtual machine environment, which may increase additional performance overhead. At the same time, it cannot be run on the standard JVM, which makes the program have portability and compatibility issues.

[0005] The code encryption scheme is to encrypt and store the bytecode file, and then decrypt and load it into the memory at runtime. Conventional encryption schemes usually put the encryption key together with the encrypted service, and hide the key in the deployment package of the encrypted service through different key hiding methods. During the startup process, the key is reverse parsed through a fixed process, and the parsed key is used to decrypt the encrypted bytecode file.

[0006] The above code encryption scheme, although it is almost impossible to crack without a key or it will take a very long time to crack using the computing power of existing conventional computers when a high-security encryption algorithm is selected. However, the encryption key is placed together with the encrypted service. Although the key can be hidden through logical confidentiality, the cracking of the key has become one of the weaknesses of the current code encryption scheme; secondly, after the encrypted service is started, the encrypted bytecode will be decrypted into the memory due to the basic logical requirements of service startup. Therefore, in the running state, it is still possible to obtain the memory information of the encrypted service through memory snooping tools, and then parse the logic of the source code through reverse engineering.

[0007] Therefore, how to prevent malicious behavior of stealing the core code logic of the application program through conventional decompilation means of the Java bytecode in the deployment package is still a problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0008] In view of this, the present invention provides a Java bytecode encryption method based on a security password module, which can prevent malicious acts of stealing the core code logic of the application program through conventional decompilation means of the Java bytecode in the deployment package; prevent the behavior of dynamically analyzing the code logic during the running process through dynamic debugging and remote attachment means when the program is running, and realize the full life cycle protection of Java service code.

[0009] In order to achieve the above object, the present invention adopts the following technical solution:

[0010] A Java bytecode encryption method based on a secure password module, the encryption method runs on an encryption system, the encryption system includes: an encryption side and a decryption side; the encryption side includes a code encryption module and a key management module; the decryption side includes a code decryption module; the encryption method includes:

[0011] The key management module pre-stores a one-to-one correspondence between the encrypted service operating environment and the key, and each encrypted service operating environment corresponds to a unique key identifier;

[0012] When encrypting a source code package of a certain encrypted service operating environment, the code encryption module receives the source code package of the current encrypted service operating environment, determines the key identifier associated with the current encrypted service operating environment, and sends the source code package and the key identifier to the key management module;

[0013] The key management module retrieves the corresponding key according to the received key identifier to encrypt the source code package, and returns the encrypted code package to the code encryption module;

[0014] The code encryption module deploys the encrypted code package to the corresponding terminal;

[0015] When the terminal encrypted code package needs to be started, the terminal applies for decryption to the code decryption module, and after the code decryption module passes the trusted authentication, the encrypted code package is sent to the key management module;

[0016] The key management module decrypts the encrypted code package using the internal key and returns the decryption result to the code decryption module.

[0017] Furthermore, the key management module performs operations of generating keys, destroying keys and cryptographic operations under the scheduling of the code encryption module; the code encryption module does not have the authority to view and edit the actual content of the keys in the key management module.

[0018] Furthermore, when the source code package of an encrypted service operating environment is encrypted, if the code encryption module determines that the current encrypted service operating environment has not yet been associated with a unique key identifier, the key management module is scheduled to generate a key and a corresponding key identifier for the current encrypted service operating environment, and the key identifier is returned to the code encryption module, and the code encryption module associates the current encrypted service operating environment with the returned key identifier.

[0019] Furthermore, the code encryption module is connected to an external code compiler, receives the source code package and encryption configuration information issued by the external code compiler, and schedules the key management module to perform corresponding encryption operations on the source code package according to the encryption configuration information; the encryption configuration information at least includes encryption class range settings, code package file format, encryption key configuration and encryption algorithm.

[0020] Furthermore, before the code encryption module deploys the encrypted code package to the corresponding terminal, a terminal registration process is also included; the terminal registration process includes:

[0021] Scan the current environment baseline based on the trusted scanner, generate the trusted environment root based on the current environment baseline content, and implant the trusted environment root into the trusted node;

[0022] Entering the terminal unique identifier and program package information into the code decryption module for subsequent dynamic checking of whether the actual operating environment of the terminal matches the registered environment information; the terminal unique identifier is a unique serial number generated based on the trusted environment root;

[0023] After the terminal registration is completed, the configuration information of the corresponding terminal is exported from the code decryption module, and the terminal configuration information is stored in a designated path of the terminal.

[0024] Furthermore, the trusted scanning program is used to scan the environmental information of the encrypted service and the program package information of the encrypted service, and generate a trusted root; the environmental information includes at least: an environmental feature code and an environmental process information list; the program package information includes at least: startup terminal information, program package path and signature information.

[0025] Furthermore, the process of starting the terminal encryption code package also includes: terminal environment trusted authentication; the terminal environment trusted authentication includes:

[0026] Scan the environment information and program package information of the currently encrypted service, and upload the environment information and program package information to the code decryption module;

[0027] The code decryption module performs trustworthy verification on the current environment information and program package information according to the trusted environment root of the terminal. If they do not match the registered environment information, it is deemed that the verification has failed and countermeasures are taken; if they match the registered environment information, it is deemed that the verification has passed and subsequent encrypted code package decryption operations are performed.

[0028] The startup process of the terminal program also includes process startup event monitoring and periodic environmental security checks, including:

[0029] After decrypting the encrypted code package, the current environment code data and terminal identity credentials are periodically checked based on the trusted environment root. If an intrusion is found and the processing conditions are met, the intrusion will be resolved. If the processing conditions are not met, the startup process of the terminal program will be stopped.

[0030] The content of periodic detection includes environment information, program package information and process startup events.

[0031] Furthermore, the key management module is any one of a cryptographic card, a cryptographic machine, a key management system or a white box key.

[0032] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0033] 1. When encrypting the source code package, the present invention uses the key management module to be responsible for the key full life cycle management and code package encryption operation. The code encryption module interacts with the key management module through the unique identifier of the code package, and does not have the authority to view and edit the actual content of the key. By separately deploying the code encryption module and the key management module, the "separation of management and use" of the key is achieved, and the security of the key in the service production environment is further guaranteed based on system isolation.

[0034] 2. After encrypting the source code package of a certain encrypted service running environment, the present invention distributes the key offline to the cryptographic module for storage, so that the server where the encrypted program is deployed does not contain the decryption key. Compared with the prior art in which the key is hidden in the encrypted service and the key is not separated from the startup program, the security of the key in the service usage environment is ensured.

[0035] 3. Without affecting the original development, deployment and startup process, the present invention separates the key management and use to prevent malicious acts of stealing the core code logic of the application program through conventional decompilation methods of the Java bytecode in the deployment package, and prevents the acts of dynamically analyzing the code logic during the program operation by means of dynamic debugging and remote attachment. The purpose of protecting the Java service code throughout its life cycle is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a Java bytecode encryption method based on a secure password module provided by the present invention;

[0038] Figure 2 The present invention provides a startup flow chart of the terminal encryption code package. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] like Figure 1 As shown, the embodiment of the present invention discloses a Java bytecode encryption method based on a security password module, the encryption method runs on an encryption system, the encryption system includes: an encryption side and a decryption side; the encryption side includes a code encryption module and a key management module; the decryption side includes a code decryption module; the encryption method includes:

[0041] The key management module pre-stores a one-to-one correspondence between the encrypted service operating environment and the key, and each encrypted service operating environment corresponds to a unique key identifier;

[0042] When encrypting a source code package of a certain encrypted service operating environment, the code encryption module receives the source code package of the current encrypted service operating environment, determines the key identifier associated with the current encrypted service operating environment, and sends the source code package and the key identifier to the key management module;

[0043] The key management module retrieves the corresponding key according to the received key identifier to encrypt the source code package, and returns the encrypted code package to the code encryption module;

[0044] The code encryption module deploys the encrypted code package to the corresponding terminal;

[0045] When the terminal encrypted code package needs to be started, it applies for decryption to the code decryption module. After the code decryption module passes the trusted authentication, it sends the encrypted code package to the key management module;

[0046] The key management module uses the internal key to decrypt the encrypted code package and returns the decryption result to the code decryption module.

[0047] In general, the present invention includes two stages: a Java source code package encryption process and a terminal encryption code package startup process, both of which involve key management processes. The following further describes these two stages.

[0048] (1) Java source code package encryption process:

[0049] The Java source code package encryption process includes two processes: compilation and packaging and package encryption. Package encryption is to encrypt the packaged inner class files to ensure that they cannot be decompiled in the static environment of the package. The encryption algorithm can choose to use domestic cryptographic algorithms or international algorithms.

[0050] The code encryption module connects to the external code compiler, receives the source code package and encryption configuration information issued by the external code compiler, which can be passed to the code encryption module through the client interface, API interface, command line, etc., through network transmission, shared file path, etc. The code encryption module schedules the key management module to perform corresponding encryption operations on the source code package according to the encryption configuration information. The encryption configuration information includes at least the encryption class range setting, code package file format, encryption key configuration and encryption algorithm. Among them, the encryption class range setting is to limit the class. The encryption key is used to tell the code encryption module the key to use when encrypting the class. The encryption algorithm is used to tell the code encryption device the specific encryption algorithm used in the encryption process. The encryption key configuration can be a key identifier specially set for the key, and the creation and destruction life cycle of the key is managed by the code encryption device.

[0051] When the source code package of an encrypted service operating environment is encrypted for the first time, the code encryption module determines that the current encrypted service operating environment has not yet been associated with a unique key identifier, so the key management module is scheduled to generate a key and a corresponding key identifier for the current encrypted service operating environment, and return the key identifier to the code encryption module. The code encryption module associates the current encrypted service operating environment with the returned key identifier. Afterwards, when the source code package of the encrypted service operating environment is encrypted again, the code encryption module can directly obtain the key identifier associated with the source code package, and the scheduling key management module can use the corresponding key to perform encryption operations on the source code package.

[0052] During the code encryption phase, the key management module pre-stores a one-to-one correspondence between the encrypted service operating environment and the key, and each encrypted service operating environment corresponds to a unique key identifier.

[0053] The keys used by the code encryption module are securely generated, stored, and managed by the key management module. The code encryption module and the key management module are deployed separately to achieve the "separation of management and use" of the keys, and further ensure the security of the keys in the service production environment based on system isolation.

[0054] The specific key management process in the encryption phase is as follows: the key management module is responsible for the management of the entire life cycle of the secret key, and performs key generation, key destruction and cryptographic operations under the scheduling of the code encryption module; cryptographic operations include encryption or decryption through specified algorithms, and the key generation and key destruction processes are both performed by the code encryption module through the key unique identifier.

[0055] The code encryption module only has the management and use permissions for the key management module, but does not have the permission to view and edit the actual content of the key in the key management module, ensuring the security of the key in the service production environment.

[0056] The code encryption module uses a specific key to encrypt the source code package according to the specific business scenario. The encryption process interacts with the key management module only through the key unique identifier. The key management module or the specific cryptographic module implements the encryption operation process and returns the operation result to the code encryption module. The specific cryptographic module refers to any cryptographic software or hardware module with key generation, key storage, and cryptographic operation capabilities, such as cryptographic cards, cryptographic machines, key management systems, and white box keys.

[0057] (2) The terminal encryption code package startup process is as follows Figure 2 As shown:

[0058] 1) Terminal registration process:

[0059] The terminal encryption code package startup process includes the terminal registration process and the program startup process. The terminal registration process is before the code encryption module deploys the encrypted code package to the corresponding terminal. The specific process includes:

[0060] The current environment baseline is scanned based on the trusted scanner, and the trusted environment root is generated based on the current environment baseline content, and the trusted environment root is implanted into the trusted node; the trusted scanner is used to scan the environment information of the encrypted service and the package information of the encrypted service, and generate a trusted root; the environment information includes at least: the environment feature code and the environment process information list; the package information includes at least: the startup terminal information, the package path and the signature information.

[0061] Import the trusted root file through the operation page / CLI tool / interface of the code decryption module to complete the terminal registration. Specifically, enter the terminal unique identifier and program package information into the code decryption module for subsequent dynamic checking of whether the actual operating environment of the terminal matches the registered environment information; the terminal unique identifier is a unique serial number generated based on the trusted environment root;

[0062] After the terminal registration is completed, the configuration information of the corresponding terminal is exported from the operation page / CLI tool / interface of the code decryption module, and the terminal configuration information is stored in the specified path of the terminal to complete the distribution operation of the configuration terminal information.

[0063] 2) Program startup process:

[0064] The program startup process includes terminal environment trusted authentication, bytecode-like file decryption and loading, process startup event monitoring after startup, and periodic environment security checks.

[0065] Among them, the terminal environment trusted authentication includes:

[0066] Scan the environment information and package information of the currently encrypted service, and upload the environment information and package information to the code decryption module;

[0067] The code decryption module performs trusted verification on the current environment information and program package information based on the terminal's trusted environment root. If it does not match the registered environment information, it is considered a verification failure and countermeasures are taken, such as terminating program startup, issuing alarms, and logging. If it matches the registered environment information, it is considered a verification success and subsequent encrypted code package decryption operations are performed.

[0068] Uploading environment information and program package information to the code decryption module includes: trusted identity authentication of the encrypted program and the code decryption module and information reporting process. The terminal is assigned a unique trusted identity through a trusted authentication root, and the SM series of domestic cryptographic algorithms or international algorithms such as RSA are used to ensure the security of encrypted programs and the terminal authentication based on digital certificate authentication, exclude the influence of unauthorized users on the Java operating environment, and ensure the legitimacy of internal running programs.

[0069] The prerequisite for decrypting and loading a bytecode-like file is that the previous terminal environment has passed the trusted authentication. The specific process includes: the program pulls the encrypted bytecode, passes the trusted authentication to the decryption machine and applies for decryption, obtains the decrypted bytecode, and loads the program.

[0070] Process startup event monitoring and periodic environment security checks include:

[0071] After decrypting the encrypted code package, the current environment code data and terminal identity credentials are periodically checked based on the trusted environment root. If an intrusion is found and the processing conditions are met, the intrusion will be resolved. If the processing conditions are not met, the startup process of the terminal program will be stopped.

[0072] The content of periodic detection includes environmental information, package information and process start events. The detection of environmental information and package information is realized through periodic detection, and the implementation of process start events includes but is not limited to any method that can monitor process start, such as the process start event monitoring mechanism of the operating system. If unknown and untrusted process start events, package information tampering, etc. are detected in the terminal environment, countermeasures are taken, such as terminating the program, issuing an alarm, and logging.

[0073] During the program startup phase, the key management process includes: the key of the code decryption module is stored by the key management module (which can also be a password module) to ensure the security of the key in the service usage environment. The password module includes but is not limited to a password card, a password machine, a hardware password module, a software password module, etc.

[0074] The code decryption module needs to cooperate with the key management module to decrypt the encrypted code package bytecode. During the startup of the terminal encryption program, the code decryption module is requested for decryption. After the code decryption module passes the trusted authentication, it gives the ciphertext data to the key management module. The key management module uses its internal key data to decrypt the ciphertext data and returns the decryption result to the code decryption module to complete the entire decryption process. During the entire process, the key is only stored in the password module to ensure the security of the key.

[0075] In addition, the key of the code encryption process is implemented through the key management module. In view of the use and management of a large number of keys involved, the key management module in the present invention specifically refers to hardware / software cryptographic modules that tend to manage the key life cycle, such as key management; the key of the code decryption process is stored and used by the key management module. Here, more hardware / software cryptographic modules that tend to have cryptographic computing capabilities, such as cryptographic cards and cryptographic machines, are used.

[0076] In particular, the code encryption module can still cooperate with cryptographic modules such as cryptographic cards or cryptographic machines to provide cryptographic operations, and the key management module provides key lifecycle management. During the encryption process, the key management module sends the key to the cryptographic module, and the code encryption module sends the source code package to the cryptographic module for encryption operations; during the decryption process, the key management module sends the corresponding key to the cryptographic module offline, and the code decryption module transmits the encrypted code package to the cryptographic module for decryption operations.

[0077] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0078] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A Java bytecode encryption method based on a secure password module, characterized in that: The encryption method is run on an encryption system, the encryption system comprising: an encryption side and a decryption side; the encryption side comprises a code encryption module and a key management module; the decryption side comprises a code decryption module; the encryption method comprises: The key management module pre-stores a one-to-one correspondence between the encrypted service operating environment and the key, and each encrypted service operating environment corresponds to a unique key identifier; When encrypting a source code package of a certain encrypted service operating environment, the code encryption module receives the source code package of the current encrypted service operating environment, determines the key identifier associated with the current encrypted service operating environment, and sends the source code package and the key identifier to the key management module; The key management module retrieves the corresponding key according to the received key identifier to encrypt the source code package, and returns the encrypted code package to the code encryption module; The code encryption module deploys the encrypted code package to the corresponding terminal; When the terminal encrypted code package needs to be started, the terminal applies for decryption to the code decryption module, and after the code decryption module passes the trusted authentication, the encrypted code package is sent to the key management module; The key management module decrypts the encrypted code package using the internal key and returns the decryption result to the code decryption module; The key management module performs the operations of generating keys, destroying keys and cryptographic operations under the scheduling of the code encryption module; the code encryption module does not have the authority to view and edit the actual contents of the keys in the key management module; The code encryption module is connected to an external code compiler, receives a source code package and encryption configuration information issued by the external code compiler, and schedules the key management module to perform corresponding encryption operations on the source code package according to the encryption configuration information.

2. The Java bytecode encryption method based on the security password module according to claim 1 is characterized in that: When encrypting the source code package of a certain encrypted service operating environment, if the code encryption module determines that the current encrypted service operating environment has not yet been associated with a unique key identifier, the key management module is scheduled to generate a key and a corresponding key identifier for the current encrypted service operating environment, and return the key identifier to the code encryption module. The code encryption module associates the current encrypted service operating environment with the returned key identifier.

3. The Java bytecode encryption method based on the security password module according to claim 1 is characterized in that: The encryption configuration information includes at least encryption class range settings, code package file format, encryption key configuration and encryption algorithm.

4. The Java bytecode encryption method based on the security password module according to claim 1 is characterized in that: Before the code encryption module deploys the encrypted code package to the corresponding terminal, it also includes a terminal registration process; The terminal registration process includes: Scan the current environment baseline based on the trusted scanner, generate the trusted environment root based on the current environment baseline content, and implant the trusted environment root into the trusted node; Entering the terminal unique identifier and program package information into the code decryption module for subsequent dynamic checking of whether the actual operating environment of the terminal matches the registered environment information; the terminal unique identifier is a unique serial number generated based on the trusted environment root; After the terminal registration is completed, the configuration information of the corresponding terminal is exported from the code decryption module, and the terminal configuration information is stored in a designated path of the terminal.

5. The Java bytecode encryption method based on the security password module according to claim 4 is characterized in that: The trusted scanning program is used to scan the environment information of the encrypted service and the program package information of the encrypted service, and generate a trusted root; The environment information at least includes: an environment feature code and an environment process information list; the program package information at least includes: startup terminal information, program package path and signature information.

6. The Java bytecode encryption method based on the security password module according to claim 4 is characterized in that: The process of starting the terminal encryption code package also includes: terminal environment trust authentication; the terminal environment trust authentication includes: Scan the environment information and program package information of the currently encrypted service, and upload the environment information and program package information to the code decryption module; The code decryption module performs trustworthy verification on the current environment information and program package information according to the trusted environment root of the terminal. If they do not match the registered environment information, it is deemed that the verification has failed and countermeasures are taken; if they match the registered environment information, it is deemed that the verification has passed and subsequent encrypted code package decryption operations are performed.

7. The Java bytecode encryption method based on the security password module according to claim 6 is characterized in that: The startup process of the terminal program also includes process startup event monitoring and periodic environmental security checks, including: After decrypting the encrypted code package, the current environment code data and terminal identity credentials are periodically checked based on the trusted environment root. If an intrusion is found and the processing conditions are met, the intrusion will be resolved. If the processing conditions are not met, the startup process of the terminal program will be stopped. The content of periodic detection includes environment information, program package information and process startup events.

8. The Java bytecode encryption method based on the security password module according to claim 1 is characterized in that: The key management module is any one of a cryptographic card, a cryptographic machine, a key management system or a white box key.

Images