A bytecode encryption and decryption method and device

Abstract

The present invention discloses a bytecode encryption and decryption method and device, wherein the bytecode encryption method is: determining each function with encryption annotations in a source code file; determining each bytecode segment of each function in the bytecode file according to the offset and length of each part in the bytecode data structure; the bytecode file is obtained after compiling the source code file; determining the bytecode segment to be encrypted from the bytecode segments of each function; encrypting the bytecode segment to be encrypted. When the above method is applied to financial technology (Fintech), only the bytecode segments to be encrypted are encrypted, thereby shortening the encryption time of the source code file.

Description

Technical Field

[0001] The present invention relates to the field of computer software in the field of financial technology (Fintech), and in particular to a bytecode encryption and decryption method and device. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. Developers of financial institutions can develop various functions based on their own programming software. Different developers may borrow developed functions from each other. For example, developer A develops function a, and developer B also wants to use function a after learning about it. Developer A can compile the corresponding source code of function a into bytecode and give it to developer B for direct linking and running. However, the original developer A of the source code does not want the user B of the source code to know the specific implementation logic of the function. In this way, in order to prevent the user from decompiling the source code, the developer has the need to encrypt the bytecode.

[0003] At present, software development is generally based on the concept of object-oriented programming. Object-oriented programming is encapsulated, and the properties of each object and the program code for its operation on the object are assembled together and encapsulated in a "module", that is, a class. Generally, a complete class is written in a separate file. In the current bytecode encryption method, whether it is through custom ClassLoader, calling the local library through JNI, or encrypting the bytecode content through shell protection, developers directly encrypt the compiled bytecode content of the entire source code file after compiling the source code of the corresponding function. This will cause some larger source code files, such as source code files of larger classes, to take too long to encrypt, which is a problem that needs to be solved urgently. Summary of the invention

[0004] The present invention provides a bytecode encryption and decryption method and device, which solves the problem of too long encryption time of source code files in the prior art.

[0005] In a first aspect, the present invention provides a bytecode encryption method, comprising: determining each function with encryption annotations in a source code file; determining each bytecode segment of each function in the bytecode file based on the offset and length of each part in the bytecode data structure; the bytecode file is obtained after compiling the source code file; determining the bytecode segment to be encrypted from the bytecode segments of the functions; and encrypting the bytecode segment to be encrypted.

[0006] In the above method, not all functions in the source code file need to be encrypted. In the above method, first, the functions with encryption annotations added to the source code file are determined. Each function can be a partial function in the source code file. Then, it is only necessary to determine the bytecode segments corresponding to the functions in the bytecode file obtained after compiling the source code file based on the offset and length of each part in the bytecode data structure, and determine the bytecode segments to be encrypted in the bytecode segments. Therefore, when encrypting, only the bytecode segments to be encrypted can be encrypted, thereby shortening the encryption time of the source code file.

[0007] Optionally, the bytecode file includes a constant pool and a method set; the method set includes a method name index and a description name index for each function; determining the bytecode segment to be encrypted from the bytecode segments of each function includes: for any function, using the constant attributes corresponding to the method name index and the description name index of the function in the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; if the method name and the description name in the constant attributes of the bytecode segment of the function correspond to the method name and the description name in the function, then determining the bytecode segment of the function as the bytecode segment to be encrypted.

[0008] In the above method, if the method name and description name in the constant attributes of the bytecode segment of the function correspond to the method name and description name in the function, the bytecode segment of the function is determined as the bytecode segment to be encrypted; thereby, the function is verified through the constant pool and method set, thereby increasing the accuracy of determining the bytecode segment to be encrypted.

[0009] Optionally, the effective version number of the configuration file is specified in the encryption annotation of each function; determining the bytecode segment to be encrypted from the bytecode segment of each function includes: loading at least one configuration file; wherein each configuration file is uniquely mapped to an effective version number, and each configuration file specifies the function to be encrypted; for any function, if the configuration file corresponding to the effective version number in the encryption annotation of the function specifies that the function is the function to be encrypted, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0010] In the above method, both the configuration file and the encryption annotation of the function have specified version numbers. The matching of the two version numbers can be used to determine whether the function is the function to be encrypted. Therefore, the function to be encrypted can be flexibly determined through the configuration file and the encryption annotation of the function, and the flexibility of determining the bytecode segment to be encrypted can be further improved.

[0011] Optionally, after encrypting the bytecode segment to be encrypted, the method further includes: generating position information of the encrypted bytecode segment after the bytecode segment to be encrypted according to the offset and length of each part in the data structure of the bytecode; the position information indicates the offset and length of the encrypted bytecode segment.

[0012] In the above manner, after the byte code segment to be encrypted is encrypted, location information indicating the offset and length of the encrypted byte code segment is generated, thereby directly recording the offset and length of the encrypted byte code segment.

[0013] Optionally, the encryption of the bytecode segment to be encrypted includes: encrypting the bytecode segment to be encrypted based on a method key externally referenced by programming software; after encrypting the bytecode segment to be encrypted, it also includes: encrypting the method key by an embedded key of the programming software to obtain an encryption certificate; the encryption certificate is used for a decryptor to obtain the method key according to the embedded key in the programming software when using the programming software.

[0014] In the above manner, the bytecode segment to be encrypted is encrypted based on the method key externally referenced by the programming software. In addition, an encryption certificate is generated. If the decryptor also uses the same programming software, the method key can be obtained based on the embedded key in the programming software, thereby further increasing the encryption security of the bytecode segment to be encrypted.

[0015] Optionally, the source code file is a Java source code file; and the bytecode file is a Java bytecode file.

[0016] In a second aspect, the present invention provides a bytecode decryption method, comprising: obtaining a bytecode file to be decrypted; the bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file; determining the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted; and decrypting the encrypted bytecode segment.

[0017] Under the above method, the bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file, wherein the encrypted part only includes the encrypted bytecode segment corresponding to the bytecode segment to be encrypted. Therefore, only the encrypted bytecode segment needs to be decrypted, thereby reducing the decryption time of the bytecode file to be decrypted.

[0018] Optionally, the bytecode file to be decrypted also includes position information of the encrypted bytecode segment, wherein the position information indicates the offset and length of the encrypted bytecode segment, and determining the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted includes: determining the encrypted bytecode segment in the bytecode file to be decrypted according to the offset and length of the encrypted bytecode segment.

[0019] In the above manner, the bytecode file to be decrypted also includes the position information of the encrypted bytecode segment, which can directly indicate the offset and length of the encrypted bytecode segment. Therefore, the encrypted bytecode segment in the bytecode file to be decrypted can be directly determined based on the offset and length of the encrypted bytecode segment, thereby shortening the time for determining the encrypted bytecode segment.

[0020] Optionally, the encrypted bytecode segment is encrypted based on a method key externally referenced by programming software; before decrypting the encrypted bytecode segment, it also includes: obtaining an encryption certificate; the encryption certificate is obtained by encrypting the method key with an embedded key of the programming software; obtaining the method key based on the embedded key and the encryption certificate; decrypting the encrypted bytecode segment includes: decrypting the encrypted bytecode segment using the method key.

[0021] In the above manner, the encrypted bytecode segment is encrypted based on the method key externally referenced by the programming software, and is not encrypted based on the embedded key of the programming software. It is not directly visible to the user of the programming software, and the encrypted bytecode segment can only be decrypted by the method key after indirectly obtaining the method key by obtaining the encryption certificate, thereby increasing the decryption security.

[0022] In a third aspect, the present invention provides a bytecode encryption device, comprising: a determination module, used to determine each function with encryption annotations in a source code file; determine each bytecode segment of each function in the bytecode file according to the offset and length of each part in the bytecode data structure; the bytecode file is obtained after compiling the source code file; determine the bytecode segment to be encrypted from the bytecode segments of each function; and an encryption module, encrypting the bytecode segment to be encrypted.

[0023] Optionally, the bytecode file includes a constant pool and a method set; the method set includes a method name index and a description name index for each function; the determination module is specifically used to: for any function, use the constant attributes corresponding to the method name index and the description name index of the function in the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; if the method name and the description name in the constant attributes of the bytecode segment of the function correspond to the method name and the description name in the function, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0024] Optionally, the effective version number of the configuration file is specified in the encryption annotation of each function; the determination module is specifically used to: load at least one configuration file; wherein each configuration file is uniquely mapped to an effective version number, and each configuration file specifies the function to be encrypted; for any function, if the configuration file corresponding to the effective version number in the encryption annotation of the function specifies that the function is the function to be encrypted, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0025] Optionally, the encryption module is also used to: generate position information of the encrypted bytecode segment after the bytecode segment to be encrypted is encrypted according to the offset and length of each part in the bytecode data structure; the position information indicates the offset and length of the encrypted bytecode segment.

[0026] Optionally, the encryption module is specifically used to: encrypt the bytecode segment to be encrypted based on a method key externally referenced by the programming software; the encryption module is also used to: encrypt the method key by means of an embedded key in the programming software to obtain an encryption certificate; the encryption certificate is used for the decryptor to obtain the method key according to the embedded key in the programming software when using the programming software.

[0027] Optionally, the source code file is a Java source code file; and the bytecode file is a Java bytecode file.

[0028] The beneficial effects of the third aspect and each optional device of the third aspect can be referred to the beneficial effects of the first aspect and each optional method of the first aspect, and will not be repeated here.

[0029] In a fourth aspect, the present invention provides a bytecode encryption device, comprising: an acquisition module, used to acquire a bytecode file to be decrypted; the bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file; a decryption module, used to determine the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted; and decrypting the encrypted bytecode segment.

[0030] Optionally, the bytecode file to be decrypted also includes the position information of the encrypted bytecode segment, and the position information indicates the offset and length of the encrypted bytecode segment. The decryption module is specifically used to determine the encrypted bytecode segment in the bytecode file to be decrypted based on the offset and length of the encrypted bytecode segment.

[0031] Optionally, the encrypted bytecode segment is encrypted based on a method key externally referenced by the programming software; the acquisition module is also used to: obtain an encryption certificate; the encryption certificate is obtained by encrypting the method key with an embedded key of the programming software; the method key is obtained based on the embedded key and the encryption certificate; the decryption module is specifically used to: decrypt the encrypted bytecode segment using the method key.

[0032] The beneficial effects of the fourth aspect and each optional device of the fourth aspect can refer to the beneficial effects of the second aspect and each optional method of the second aspect, which will not be repeated here.

[0033] In a fifth aspect, the present invention provides a computer device, including a program or an instruction, which, when executed, is used to execute each optional method of the first aspect or the second aspect.

[0034] In a sixth aspect, the present invention provides a storage medium, including a program or an instruction, which, when executed, is used to execute each optional method of the first aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of the steps of a bytecode encryption method provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of the location of a bytecode segment provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of specific steps of a bytecode encryption method provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of specific steps of a bytecode decryption method provided in an embodiment of the present application;

[0039] Figure 5 A schematic diagram of the structure of a bytecode encryption device provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of the structure of a bytecode decryption device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to better understand the above-mentioned technical scheme, the above-mentioned technical scheme will be described in detail below in combination with the accompanying drawings and specific implementation methods of the specification. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0042] The following first lists the definitions of abbreviations appearing in this application.

[0043] JVM: Java Virtual Machine, Java virtual machine;

[0044] JVMTI: JVM Tool Interface, a local programming interface provided by JVM;

[0045] JVMTIAgent: Local loading client implemented using JVMTI;

[0046] ClassLoader: class loader, responsible for loading class objects;

[0047] JNI: Java Native Interface Java native method interface;

[0048] Bytecode: A binary file consisting of a sequence of code or data pairs that contains an executable program.

[0049] Decompilation: The process of converting bytecode into source code.

[0050] In the process of financial institutions (banking institutions, insurance institutions or securities institutions) conducting business (such as bank loan business, deposit business, etc.), developers of financial institutions can develop various functions based on their own programming software. Different developers may borrow developed functions from each other. Developers can compile the corresponding source code of the function into bytecode and give it to other developers to directly link and run. However, in order to protect their own software copyrights and to prevent users from decompiling the source code, each developer has a need for bytecode encryption. In the current bytecode encryption method, developers directly encrypt the compiled bytecode content of the entire source code file after compiling the source code of the corresponding function, resulting in some larger source code files. The encryption time is too long. This situation does not meet the needs of banks and other financial institutions, and cannot guarantee the efficient operation of various businesses of financial institutions. For this reason, if Figure 1 As shown, the present application provides a bytecode encryption method.

[0051] Step 101: Determine each function in a source code file that has an encrypted annotation.

[0052] Step 102: Determine each bytecode segment of each function in the bytecode file according to the offset and length of each part in the bytecode data structure.

[0053] The bytecode file is obtained by compiling the source code file.

[0054] Step 103: Determine the bytecode segment to be encrypted from the bytecode segments of each function.

[0055] Step 104: Encrypt the bytecode segment to be encrypted.

[0056] The source code file in step 101 to step 104 does not limit the specific programming language and programming software. For example, the source code file can be a Java source code file, and accordingly, the compiled bytecode file is a Java bytecode file. In addition, the specific content in the source code file is not limited. For example, the source code file is a complete class, and it can also include multiple classes. It is worth mentioning that the bytecode segments of each function with encryption annotations in steps 101 to 104 are not necessarily the bytecode segments to be encrypted in the end. The bytecode segments of each function with encryption annotations in the source code file can be directly used as the bytecode segments to be encrypted, or the bytecode segments to be encrypted can be selected from the bytecode segments of each function with encryption annotations according to certain conditions. The method can determine the specific bytecode segments that need to be protected and encrypt them for protection, so that fine-grained encryption functions can be achieved that are subdivided into the bytecode segments of each function. For example, the source code file is specifically:

[0057]

[0058]

[0059] Among them, @WeEncrypt is an encryption annotation.

[0060] It should be noted that the data structure of the bytecode is a unified standard. The bytecode compiled from each source code file follows this standard. Specifically, the data structure of the bytecode is shown in Table 1:

[0061] name illustrate length magic magic number 4 minor_version Minor version number 2 major_version Major version number 2 constant_pool_count Constant Pool Calculator 2 constant_pool Constant Pool n access_flags Access Flag 2 this_class Class Index 2 super_class Parent Class Index 2 interfaces_count Interface Counters 2 interfaces Interface Index Collection n fields_count Number of fields 2 fields Field Collection n methods_count Method Counter 2 methods Method Collection n attributes_count Additional attribute counters 2 attributes Additional properties collection n

[0062] Table 1 Bytecode data structure

[0063] Table 1 shows the data structure of the bytecode. Through the offset and length of each part, the specific data segment (such as each bytecode segment of each function) can be located from the bytecode file. Among them, the constant pool contains all the variables, constants, methods and other information declared in the class, and each subscript in the constant pool has a corresponding constant attribute. For example, the parameters in the "method collection" can all reference the constants declared in the "constant pool" by referencing the subscript. In the application scenario of the Java source code file, the JVM associates the two in this way, generates bytecode and executes it. Specifically, the data structure of the method collection is shown in Table 2:

[0064] name meaning length access_flags Access Flag 1 name_index Method Name Index 1 descriptor_index Descriptor Index 1 attributes_count Attribute Counters 1 attributes Property Collection n

[0065] Table 2 Data structure of method set

[0066] More specifically, the attribute set includes the parameters in the method set, as shown in Table 3, and the bytecode segment in the code attribute can be obtained.

[0067] name meaning length attribute_name_index Attribute Name Index 2 attribute_length Attribute length 4 max_stack Maximum stack depth 2 max_locals The space required for the local variable table to persist 2 code_length Bytecode instruction length 4 code Bytecode code_length exception_table_length Abnormal table length 2 exception_table Exception table exception_table_length attributes_count Attribute collection counter 2 attributes Property Collection n

[0068] Table 3 Data structure of attribute set

[0069] Examples of specific bytecode segments are Figure 2 shown.

[0070] It should be noted that, in an optional implementation of step 103, the bytecode file includes a constant pool and a method set; the method set includes a method name index and a description name index of each function; and step 103 can be specifically performed according to the following implementation (hereinafter referred to as implementation 1 of step 103):

[0071] For any function, the method name index and description name index of the function are used as the constant attributes corresponding to the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; if the method name and description name in the constant attributes of the bytecode segment of the function correspond to the method name and description name in the function, the bytecode segment of the function is determined to be the bytecode segment to be encrypted.

[0072] That is, the encryption condition in the first implementation mode of step 103 is that the method name and the description name in the constant attribute of the bytecode segment of the function correspond to the method name and the description name in the function.

[0073] Specifically, the method name in the constant attribute of the bytecode segment of the function is public int getI(), and the description name is return i. The method name in the function is also public int getI(), and the description name is also return i. At this time, it is proved that there is no problem with the bytecode compilation and it can be determined as the bytecode segment to be encrypted.

[0074] In another optional implementation of step 103, the encryption annotation of each function specifies the effective version number of the configuration file; specifically, step 103 can be performed according to the following implementation (hereinafter referred to as implementation method 2 of step 103):

[0075] Load at least one configuration file; wherein each configuration file is uniquely mapped to an effective version number, and each configuration file specifies a function to be encrypted; for any function, if the configuration file corresponding to the effective version number in the encryption annotation of the function specifies that the function is a function to be encrypted, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0076] That is, the encryption condition in the second implementation mode of step 103 is that the configuration file corresponding to the effective version number in the encryption annotation specifies that the function is the function to be encrypted. For example, the source code file is specifically:

[0077]

[0078]

[0079] In the above example, the effective version number is added to the encryption annotation, such as @WeEncrypt(version="2"), and the effective version number is 2.

[0080] You can add the function to be encrypted in the configuration files with different effective version numbers, and specify the bytecode segment to be encrypted together with the effective version number in the decryption annotation of the function.

[0081] Specifically, at least one configuration file can be read, and functions with encryption annotations in each configuration file can be searched to obtain the names, signatures, and version information of these functions. The corresponding function encryption configuration table is generated and can be stored in the form of key-value pairs, where the key stores the version number and the value stores the corresponding function encryption configuration table, as shown in the following table;

[0082] key value 1 [{"METHOD":"getValue","SIG":"(I)I;()I"}] 2 [{"METHOD":"getI","SIG":"()I"},{"METHOD":"getJ","SIG":"()I"}]

[0083] Table 4 Function encryption configuration table

[0084] For example, the functions with encryption annotations in the source code file are function 1, function 2, and function 3. The effective version number in function 1 is 1, the effective version number in function 2 is 2, and the effective version number in function 3 is 1. There are two configuration files with effective version numbers. The configuration file of effective version 1 specifies function 1 and function 2 as functions to be encrypted, so the bytecode segment of function 1 is determined to be the bytecode segment to be encrypted. The configuration file of effective version 2 specifies function 2 and function 3 as functions to be encrypted, so the bytecode segment of function 2 is determined to be the bytecode segment to be encrypted. However, the effective version number specified in function 3 is 1, so the bytecode segment of function 3 is not determined to be the bytecode segment to be encrypted.

[0085] It should be noted that the various implementations of the above-mentioned step 103 can be combined with each other. For example, a byte code segment that satisfies both the encryption conditions in implementation mode 1 of step 103 and the encryption conditions in implementation mode 2 of step 103 can be used as the byte code segment to be encrypted.

[0086] An optional implementation of step 104 is as follows:

[0087] The bytecode segment to be encrypted is encrypted based on a method key externally referenced by programming software.

[0088] It should be noted that the programming software has its own embedded key. The embedded key is not used directly to encrypt the bytecode segment to be encrypted here. Instead, the method key referenced externally by the programming software is used to encrypt the bytecode segment to be encrypted.

[0089] Based on the above optional implementation manner, the following steps may be further performed after step 104:

[0090] The method key is encrypted by the embedded key of the programming software to obtain an encryption certificate; the encryption certificate is used for the decryptor to obtain the method key according to the embedded key in the programming software when using the programming software.

[0091] In another optional implementation of step 104, the bytecode file path to be encrypted, the offset of the bytecode to be encrypted, the length information of the bytecode to be encrypted, and the method key B can be serialized in JSON format and encrypted using the embedded key A to obtain the certificate C.

[0092] It should be noted that the encryption algorithm is not limited. For example, the encryption can be performed using the Data Encryption Standard (DES). If the length is not an integer multiple of 8, it is padded with 0x00, and the encrypted byte code segment replaces the original byte code segment to be encrypted.

[0093] For example, the embedded key is A and the method key is B, then A encrypts B to obtain encryption certificate C.

[0094] After step 104, an optional implementation is as follows:

[0095] According to the offset and length of each part in the bytecode data structure, the position information of the encrypted bytecode segment after the bytecode segment to be encrypted is generated; the position information indicates the offset and length of the encrypted bytecode segment.

[0096] For example, as shown in Table 5, the location information of the encrypted bytecode segment is added to the file header of the bytecode according to the following encoding rules.

[0097] Hierarchical relationship meaning length content 1 Identifies encrypted file header 4 be be cf cf 2 Number of encryption configurations 2 2.1 Offset 4 2.2 length 4

[0098] Table 5 Location information of the encrypted bytecode segment

[0099] It should be noted that the content in the encrypted file header (hereinafter referred to as the file header of the bytecode file) is used to mark the bytecode file as a bytecode file that needs to be decrypted, the offset is the byte offset of the starting position of the encrypted bytecode segment in Table 5 from the file header, and the length is the byte length of the original bytecode segment, which is written into the position information from small to large according to the offset. Due to the above operation, during the decryption process, the encrypted bytecode segment can be directly read by reading the above position information, and there is no need to re-position it according to the bytecode encoding specification, which improves the decryption speed.

[0100] In summary, in combination with the above implementation methods, taking a Java source code file as an example, a specific flow chart of a bytecode encryption method provided by this application can be as follows: Figure 3 .in, Figure 3 The steps of using embedded key A to encrypt method key B and obtaining certificate C can be replaced by: serializing the bytecode file path to be encrypted, the offset of the bytecode to be encrypted, the length information of the bytecode to be encrypted, and method key B in JSON format, and encrypting them with embedded key A to obtain certificate C.

[0101] Correspondingly, the present application also provides a bytecode decryption method.

[0102] Step (1): Obtain the bytecode file to be decrypted.

[0103] The bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file.

[0104] Step (2): Determine the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted.

[0105] Step (3): Decrypt the encrypted bytecode segment.

[0106] In an optional implementation manner, the bytecode file to be decrypted also includes the location information of the encrypted bytecode segment, and the location information indicates the offset and length of the encrypted bytecode segment. Step (2) can be specifically performed in the following manner:

[0107] The encrypted bytecode segment in the bytecode file to be decrypted is determined according to the offset and length of the encrypted bytecode segment.

[0108] In an optional implementation, the encrypted bytecode segment is encrypted based on a method key externally referenced by the programming software; before step (3), the following steps may be performed:

[0109] Obtain an encryption certificate; the encryption certificate is obtained by encrypting the method key through the embedded key of the programming software; obtain the method key according to the embedded key and the encryption certificate.

[0110] Based on the above steps, step (3) may specifically be:

[0111] The encrypted bytecode segment is decrypted using the method key.

[0112] Step (3) can also be specifically as follows: after decrypting certificate C through embedded key A, method key B and the complete path information of the encrypted source code file are obtained, which is used to determine whether the source code file needs to be decrypted during the loading process. The offset and length data of the relevant bytecode segment are also obtained through the decrypted certificate C. There is no need to parse the location information of the bytecode file, nor is there any need to delete this part of the location information.

[0113] The specific implementation of the above decryption process can refer to the specific implementation of the encryption process, which will not be repeated here. In summary, taking the Java source code file as an example, the specific process of bytecode decryption can be as follows: Figure 4 shown.

[0114] Step (4-1): Obtain the bytecode file to be decrypted, load the client locally, and the encryption certificate C.

[0115] Step (4-2): Store the certificate C in a specified directory, and declare to start the corresponding local loading client (such as jvmti agent) according to the platform when the JVM is started.

[0116] Step (4-3): Use the embedded key A to decrypt certificate C through the jvmti agent to obtain the method key B.

[0117] Step (4-4): Before loading the bytecode file, the jvmti agent checks whether the header of the bytecode file is a custom header code, i.e., 0xbe be cf cf. If it matches, it is determined to be an encrypted bytecode file and needs to be decrypted.

[0118] Step (4-5): Read the number of encryption functions, obtain the corresponding encrypted byte code segment according to each function offset in turn, decrypt it using method key B to obtain the source byte code segment padded with 8 bits in length, remove the padded 0x00 data according to the length in the configuration, obtain the source byte segment, and write it back to the byte code segment.

[0119] Step (4-6): Delete the header of the bytecode file.

[0120] Step (4-7): Load the decrypted bytecode file into memory.

[0121] like Figure 5 As shown, the present invention provides a bytecode encryption device, including: a determination module 501, used to determine each function with encryption annotations in a source code file; determine each bytecode segment of each function in the bytecode file according to the offset and length of each part in the bytecode data structure; the bytecode file is obtained after compiling the source code file; determine the bytecode segment to be encrypted from the bytecode segments of each function; and an encryption module 502, encrypting the bytecode segment to be encrypted.

[0122] Optionally, the bytecode file includes a constant pool and a method set; the method set includes a method name index and a description name index for each function; the determination module 501 is specifically used to: for any function, use the constant attributes corresponding to the method name index and the description name index of the function in the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; if the method name and the description name in the constant attributes of the bytecode segment of the function correspond to the method name and the description name in the function, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0123] Optionally, the effective version number of the configuration file is specified in the encryption annotation of each function; the determination module 501 is specifically used to: load at least one configuration file; wherein each configuration file is uniquely mapped to an effective version number, and each configuration file specifies the function to be encrypted; for any function, if the configuration file corresponding to the effective version number in the encryption annotation of the function specifies that the function is the function to be encrypted, then the bytecode segment of the function is determined as the bytecode segment to be encrypted.

[0124] Optionally, the encryption module 502 is also used to: generate the position information of the encrypted bytecode segment after the bytecode segment to be encrypted is encrypted according to the offset and length of each part in the bytecode data structure; the position information indicates the offset and length of the encrypted bytecode segment.

[0125] Optionally, the encryption module 502 is specifically used to: encrypt the bytecode segment to be encrypted based on the method key externally referenced by the programming software; the encryption module 502 is also used to: encrypt the method key by means of the embedded key of the programming software to obtain an encryption certificate; the encryption certificate is used for the decryptor to obtain the method key according to the embedded key in the programming software when using the programming software.

[0126] Optionally, the source code file is a Java source code file; and the bytecode file is a Java bytecode file.

[0127] like Figure 6 As shown, the present invention provides a bytecode encryption device, including: an acquisition module 601, used to acquire a bytecode file to be decrypted; the bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file; a decryption module 602, used to determine the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted; and decrypt the encrypted bytecode segment.

[0128] Optionally, the bytecode file to be decrypted also includes the position information of the encrypted bytecode segment, and the position information indicates the offset and length of the encrypted bytecode segment. The decryption module 602 is specifically used to determine the encrypted bytecode segment in the bytecode file to be decrypted according to the offset and length of the encrypted bytecode segment.

[0129] Optionally, the encrypted bytecode segment is encrypted based on a method key externally referenced by the programming software; the acquisition module 601 is also used to: obtain an encryption certificate; the encryption certificate is obtained by encrypting the method key with an embedded key of the programming software; the method key is obtained based on the embedded key and the encryption certificate; the decryption module 602 is specifically used to: decrypt the encrypted bytecode segment using the method key.

[0130] An embodiment of the present application provides a computer device, including a program or instruction, which, when executed, is used to execute a bytecode encryption and decryption method and any optional method provided in an embodiment of the present application.

[0131] An embodiment of the present application provides a storage medium, including a program or instruction, which, when executed, is used to execute a bytecode encryption and decryption method and any optional method provided in an embodiment of the present application.

[0132] Finally, it should be noted that: those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program code.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A bytecode encryption method, characterized in that: include: Identify each function in the source code file that has an encrypted annotation; Determine, according to the offset and length of each part in the bytecode data structure, each bytecode segment of each function in the bytecode file; the bytecode file is obtained by compiling the source code file; Determining the bytecode segment to be encrypted from the bytecode segments of each function; Encrypting the bytecode segment to be encrypted; The bytecode file includes a constant pool and a method set; the constant pool includes all variables, constants, and methods declared in the class, each subscript in the constant pool has a corresponding constant attribute, and the method set includes a method name index and a description name index for each function. The bytecode segment to be encrypted from the bytecode segments of each function includes: For any function, the method name index and the description name index of the function are used as the constant attributes corresponding to the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; If the method name and the description name in the constant attribute of the bytecode segment of the function correspond to the method name and the description name in the function, the bytecode segment of the function is determined as the bytecode segment to be encrypted.

2. The method according to claim 1, characterized in that The encryption annotation of each function specifies the effective version number of the configuration file; the step of determining the bytecode segment to be encrypted from the bytecode segment of each function includes: Load at least one configuration file; wherein each configuration file is uniquely mapped to an effective version number, and each configuration file specifies a function to be encrypted; For any function, if the configuration file corresponding to the effective version number in the encryption annotation of the function specifies that the function is a function to be encrypted, the bytecode segment of the function is determined as the bytecode segment to be encrypted.

3. The method according to claim 1, characterized in that After encrypting the bytecode segment to be encrypted, the method further includes: According to the offset and length of each part in the bytecode data structure, the position information of the encrypted bytecode segment after the bytecode segment to be encrypted is generated; the position information indicates the offset and length of the encrypted bytecode segment.

4. The method according to any one of claims 1 to 3, characterized in that The encrypting the bytecode segment to be encrypted comprises: Encrypting the bytecode segment to be encrypted based on a method key externally referenced by the programming software; After encrypting the bytecode segment to be encrypted, the method further includes: The method key is encrypted by the embedded key of the programming software to obtain an encryption certificate; the encryption certificate is used for the decryptor to obtain the method key according to the embedded key in the programming software when using the programming software.

5. The method according to any one of claims 1 to 3, characterized in that: The source code file is a Java source code file; the bytecode file is a Java bytecode file.

6. A bytecode decryption method, characterized in that: include: Obtain a bytecode file to be decrypted; the bytecode file to be decrypted is obtained by encrypting the bytecode segment to be encrypted in the bytecode file compiled from the source code file, and the encryption of the bytecode segment to be encrypted is performed by the bytecode encryption method of claim 1; Determine the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted; decrypting the encrypted bytecode segment; The bytecode file includes a constant pool and a method set; the constant pool contains all variables, constants, and methods declared in the class, each subscript in the constant pool has a corresponding constant attribute, and the method set includes a method name index and a description name index for each function.

7. The method according to claim 6, characterized in that The bytecode file to be decrypted also includes the position information of the encrypted bytecode segment, the position information indicates the offset and length of the encrypted bytecode segment, and the step of determining the encrypted bytecode segment corresponding to the bytecode segment to be encrypted in the bytecode file to be decrypted includes: The encrypted bytecode segment in the bytecode file to be decrypted is determined according to the offset and length of the encrypted bytecode segment.

8. The method according to claim 6 or 7, characterized in that The encrypted bytecode segment is encrypted based on a method key externally referenced by the programming software; before decrypting the encrypted bytecode segment; further comprising: Obtaining an encryption certificate; the encryption certificate is obtained by encrypting the method key with the embedded key of the programming software; Obtaining the method key according to the embedded key and the encryption certificate; The decrypting of the encrypted bytecode segment comprises: The encrypted bytecode segment is decrypted using the method key.

9. A bytecode encryption device, characterized in that: include: A determination module, used for determining each function having an encrypted annotation in a source code file; Determine, according to the offset and length of each part in the bytecode data structure, each bytecode segment of each function in the bytecode file; the bytecode file is obtained by compiling the source code file; determine the bytecode segment to be encrypted from the bytecode segments of each function; An encryption module, encrypting the byte code segment to be encrypted; The bytecode file includes a constant pool and a method set; the constant pool includes all variables, constants, and methods declared in the class, each subscript in the constant pool has a corresponding constant attribute, and the method set includes a method name index and a description name index for each function. The bytecode segment to be encrypted from the bytecode segments of each function includes: For any function, the method name index and the description name index of the function are used as the constant attributes corresponding to the constant pool of the bytecode file as the constant attributes of the bytecode segment of the function; If the method name and the description name in the constant attribute of the bytecode segment of the function correspond to the method name and the description name in the function, the bytecode segment of the function is determined as the bytecode segment to be encrypted.

10. A computer device, characterized in that: The method comprises a program or an instruction. When the program or the instruction is executed, the method according to any one of claims 1 to 5 or 6 to 8 is performed.

11. A storage medium, characterized in that: The method comprises a program or an instruction. When the program or the instruction is executed, the method according to any one of claims 1 to 5 or 6 to 8 is performed.

Images