Method and system for encrypted deployment of application software

Abstract

The application provides an application software encryption deployment method and system. The method comprises the following steps: a server can use a git tool to establish a data warehouse. When a programmer finishes writing source code, the source code can be uploaded by logging in the git tool. The server can obtain obfuscated configuration information from a configuration center. After the server obtains the obfuscated configuration information, the server can use the obfuscated configuration information to obfuscate the source code to obtain obfuscated code. After the server obtains the obfuscated code, the server can use maven to compile and package the obfuscated code to obtain an application software package. After the server obtains the application software package, the server uses a docker tool to generate an image container of the application software package. In addition to the application software package, the image container can also include an application server and a dynamic library. The method of the application improves the security of the application software package and avoids the problem of source code leakage caused by reverse analysis of the application software package.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer, in particular to an application software encryption deployment method and system. BACKGROUND

[0002] In the software industry, some customers may require to deploy application software on the customer's internal server or private cloud. When the application software is JAVA application software, the program code of the JAVA application software deployed on the customer's internal server or private cloud is usually easy to be reverse parsed to obtain the source code. Further, code leakage and other problems are easy to occur.

[0003] To solve this problem, the prior art usually uses a JAVA obfuscator to realize the obfuscation of the source code. At present, the commonly used JAVA obfuscators include ProGuard, Allatori, Obfuscate4e, etc. Programmers can use short meaningless names to rename the existing classes, fields, methods and properties, thereby realizing the obfuscation of the source code. The programmers can package and upload the obfuscated source code. Reverse parsing the obfuscated source code will not be able to obtain the correct source code.

[0004] However, the JAVA obfuscator usually requires the programmer to manually obfuscate the source code locally before uploading the source code. This source code obfuscation method has the problems of low automation degree and inconvenient operation. SUMMARY

[0005] The present application provides an application software encryption deployment method and system to solve the problem of low automation degree and inconvenient operation caused by the need to manually obfuscate the source code in the prior art.

[0006] In a first aspect, the present application provides an application software encryption deployment method, comprising:

[0007] obtaining source code to be obfuscated;

[0008] obfuscating the source code according to configuration information to obtain obfuscated code, the obfuscated code having the same logical content as the source code, the obfuscated code being used to prevent the source code from being leaked after the application software package is reverse parsed;

[0009] packaging the obfuscated code to obtain an application software package, the application software package including a first file, a digest file and the obfuscated code, the first file including an archive file of classes or a Web application;

[0010] generating an image container according to the application software package, the image container including the application software package, an application server and a dynamic library, the application server being used to run the application software package in the image container.

[0011] Optionally, the obfuscating the source code according to the configuration information to obtain the obfuscated code comprises at least one of the following:

[0012] replacing a target word in a class, a function or a field in the source code with a preset word;

[0013] replacing a target word in a class, a function or a field in the source code with a random character;

[0014] replacing a target word in a class, a function or a field in the source code with a random arrangement combination of preset characters, wherein the preset characters include multiple similar characters.

[0015] Optionally, the method further comprises:

[0016] generating a key pair according to a preset encryption rule, wherein the key pair includes a public key and a private key;

[0017] encrypting the first file according to the private key to obtain first ciphertext.

[0018] Optionally, before the obfuscating the source code according to the configuration information, the method further comprises:

[0019] obtaining user information, wherein the user information includes client information of uploading the source code and account information logged in the client;

[0020] judging whether the source code needs to be obfuscated according to the user information and a first white list.

[0021] Optionally, when the application server is running in the image container, the method further comprises:

[0022] judging whether an interface of the application server is legal according to an IP address of the application server and a second white list;

[0023] calling a verification interface of the dynamic library to verify whether the application software package is legal;

[0024] when the interface of the application server and the application software package are both legal, executing the application software package through the application server in the image container.

[0025] Optionally, the calling the verification interface of the dynamic library to verify whether the application software package is legal further comprises:

[0026] obtaining the public key, first ciphertext, the first file and the digest file;

[0027] verifying whether the first file is correct according to the public key and the first ciphertext;

[0028] determine whether the classes in the application package are the latest versions according to the summary file;

[0029] determine that the application package is legal when the first file is correct and the classes in the application package are the latest versions.

[0030] In a second aspect, the application provides an application encryption deployment system, comprising:

[0031] The data warehouse is configured to obtain and store source code.

[0032] The obfuscation service module is configured to obfuscate the source code in the data warehouse to obtain obfuscated code.

[0033] The packaging service module is configured to package the obfuscated code to obtain an application package.

[0034] The image service module is configured to generate an image container of the application package, wherein the image container further comprises an application server and a dynamic library, and the application package is to be started and executed in the image container through the application server.

[0035] Optionally, the obfuscation service module further comprises a configuration center, a background service module, a front-end service module, and a database.

[0036] The configuration center is configured to configure obfuscation rules.

[0037] The background service module is configured to obfuscate the source code according to the obfuscation rules to obtain obfuscated code.

[0038] The front-end service module is configured to visualize the obfuscation process.

[0039] The database is configured to store the source code, the obfuscated code, and version information.

[0040] In a third aspect, the application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when at least one processor of an application encryption deployment system executes the computer program, the application encryption deployment system executes the application encryption deployment method in the first aspect and any possible design of the first aspect.

[0041] In a fourth aspect, the application provides a computer program product, wherein the computer program product comprises a computer program, and when at least one processor of an application encryption deployment system executes the computer program, the application encryption deployment system executes the application encryption deployment method in the first aspect and any possible design of the first aspect.

[0042] The application provides an application software encryption deployment method and system. A server can use a git tool to establish a data warehouse. When a programmer completes the writing of source code, the source code can be uploaded by logging in the git tool. The server can obtain obfuscated configuration information from a configuration center. When the server obtains the obfuscated configuration information, the server can use the obfuscated configuration information to obfuscate the source code to obtain obfuscated code. After the server obtains the obfuscated code, the server can use maven to compile and package the obfuscated code to obtain an application software package. After the server obtains the application software package, the server uses a docker tool to generate an image container of the application software package. In addition to the application software package, the image container can also include application servers and dynamic libraries, so as to improve the security of the application software package and avoid the problem of source code leakage caused by reverse analysis of the application software package. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0044] Figure 1 A scene schematic diagram of an application software encryption deployment provided by an embodiment of the application;

[0045] Figure 2 A flowchart of an application software encryption deployment method provided by an embodiment of the application;

[0046] Figure 3 A flowchart of another application software encryption deployment method provided by an embodiment of the application;

[0047] Figure 4 A flowchart of still another application software encryption deployment method provided by an embodiment of the application;

[0048] Figure 5 A structure schematic diagram of an application software encryption deployment provided by an embodiment of the application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the application more clear, the technical solutions in the application will be described clearly and completely in the following with reference to the drawings in the application. Obviously, the described embodiments are some embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the application.

[0050] The terms "first", "second", "third", "fourth", and the like in the description and in the claims of the present application, as well as above-mentioned drawings, are used to distinguish similar objects and are not necessarily used to describe a specific sequential or chronological order. It is to be understood that the use of the terms so used herein is merely intended to distinguish the various embodiments of the application from each other and that similar objects can be described using different and interchangeable terms and that the terms thus have no appreciated meaning other than that which is intended to be given to them herein.

[0051] In addition, the terms "comprising" and "having" and any variations thereof are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or apparatus that includes a list of steps or units not necessarily limited to those clearly identified as such and can include other steps or units not clearly identified or inherent to such processes, methods, products or apparatus.

[0052] In the B2B market of the software industry, the proposal of SAAS service greatly reduces the hardware cost of the software deployment process for customers. The SAAS service provider is a third party besides the software service provider and the enterprise customer. The software service provider can use the network infrastructure and software and hardware operation platform of the SAAS platform to complete a series of operations such as deployment, debugging, maintenance and upgrading of application software. Customers can realize the calling of the application software through the interface or interactive interface provided by the software service provider. In this process, the source code of the application software is mastered by the software service provider.

[0053] However, for some customers, the application software must be deployed on the customer's internal server or private cloud separately. At this time, after the software service provider deploys the application software on the customer's internal server or private cloud, the software service provider will lose the monitoring of the source code of the application software. Customers can parse the application software through reverse engineering to obtain the source code of the application software. Especially for the application software written in JAVA language, the file compiled by the JAVA application software is a bytecode file. Compared with the binary file generated by the C / C++ language and the like, the bytecode file is more easily parsed to obtain the source code.

[0054] Therefore, for JAVA application software, if not prevented, it is easy to cause code leakage and security problems caused by malicious modification.

[0055] In the prior art, to solve the problem, a JAVA obfuscator is usually used to realize the obfuscation of the source code. Currently, the commonly used JAVA obfuscators include ProGuard, Allatori, Obfuscate4e, etc. Taking ProGuard as an example, the ProGuard can delete useless classes, fields, methods and attributes, can delete useless comments, and can use short meaningless names to rename the existing classes, fields, methods and attributes. The programmer can use the ProGuard to locally obfuscate the source code to obtain the obfuscated code. The programmer can upload the obfuscated code after the obfuscation is completed, and then realize the packaging and use of the obfuscated code. However, the ProGurad needs the program to be obfuscated locally. The obfuscation manner does not have complete code version management, and it is easy to cause that after multiple people upload, the code version of a certain class cannot be determined. Moreover, in the obfuscation manner, the programmer needs to manually perform the obfuscation operation each time the source code is obfuscated, and the automatic obfuscation cannot be realized, and there is the problem of inconvenient operation and low automation degree.

[0056] To solve the above problem, the application provides an application software encryption deployment method. The programmer can upload the source code to a git repository. An obfuscation server obtains the source code from the git repository, and obfuscates the source code according to preset configuration information to obtain obfuscated code. The obfuscated code is the source code after the target words in the classes, functions or fields in the source code are replaced by other strings. A packaging server obtains the obfuscated code, and compiles and packages the obfuscated code using a maven tool to obtain an application software package. An image server generates an image container of the application software package. The image server also includes an application server tomcat. The application software package can be run in the image container through the tomcat. The application arranges the obfuscation server in the pipeline process of jenkins, so that the automatic process has the source code obfuscation function, and realizes automatic obfuscation.

[0057] The technical solutions of the application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in detail in some embodiments.

[0058] Figure 1A scenario diagram of application software encryption deployment provided by an embodiment of the present application is shown. As shown, it is a flow diagram of continuous integration (CI). The CI flow mainly uses the pipeline of jenkins for flow arrangement. The arranged flow mainly includes four nodes. The workflow framework of the pipeline connects the four nodes to realize the process of the application software encryption deployment. In the process, the workflow framework first calls the git tool to obtain the source code. The git tool can be a data warehouse established for a project. The source code data of the project is stored in the data warehouse. When the programmer uploads the source code to the data warehouse of the git tool, the second node in the workflow framework is triggered. The source code in the data warehouse is sent to the node of the obfuscation service. In the obfuscation service node, the source code is obfuscated using the obfuscation service. At the same time, the obfuscation service node also records the code versions before and after obfuscation and persists. The obfuscation service can include four parts of web service, background service, configuration center and database. When the source code is obfuscated in the obfuscation service node, the obfuscated code is sent to the packaging node. The packaging node includes the maven tool. The obfuscated code is compiled and packaged by the maven tool. Finally, the packaged application software package is sent to the image node. The image node uses docker to generate an image container, and the packaged application software package, customized tomcat and so dynamic library are all put into the image container. Finally, the image container is deployed to the K8S cluster and realizes continuous delivery (CD). The so file in the so dynamic library is a binary file. The so file will undertake the work of decryption and verification in the use process of the application software.

[0059] In the present application, an electronic device is taken as an execution subject to execute the application software encryption deployment method of the embodiments. Specifically, the execution subject can be composed of one or more servers. The following Figures 2 to 4 In the embodiments shown, one server will be taken as an example to describe the application software encryption deployment method in detail.

[0060] Figure 2 A flowchart of the application software encryption deployment method provided by an embodiment of the present application is shown. In the Figure 1 On the basis of the embodiments shown, as Figure 2 Taking the server as the execution subject, the method of the present embodiment can include the following steps:

[0061] S101, obtaining the source code to be obfuscated.

[0062] In this embodiment, the server can use the git tool to establish a data warehouse. The data warehouse can run in the server. The programmers can complete the writing of the source code in respective clients. When the programmers complete the writing of the source code, the source code can be uploaded by logging in the git tool. Each programmer can have a git account. When the programmers upload the source code, the client of the programmer can also upload the terminal information and the git account information of the programmer. Alternatively, after the programmers complete the writing of the source code in respective clients, the source code can be uploaded by logging in the jenkins account. One or more programmers can have a jenkins account. When the programmers log in the pipeline of jenkins by using the jenkins account, the source code can be uploaded in the process node of the pipeline. The process node can include the git tool to establish a data warehouse.

[0063] In an example, the server can also obtain version information of the source code. The version information is used to indicate an updated version of the source code.

[0064] In S102, the source code is obfuscated according to the configuration information to obtain obfuscated code. The obfuscated code has the same logical content as the source code, and the obfuscated code is used to prevent the application software package from being reverse parsed to cause the source code to be leaked.

[0065] In this embodiment, the server can obtain the obfuscated configuration information from a configuration center. The configuration center can be a visual interface. The programmers can set the configuration information by setting configuration rules in the configuration center. The basic settings can include replacement rules of classes, functions, and variables. For example, part of the characters are replaced. According to the recognizability after the obfuscation, the obfuscation difficulty can be divided into three levels.

[0066] In an example, the server can replace target words in classes, functions, or fields in the source code with preset words. The word replacement belongs to a low-difficulty obfuscation.

[0067] In another example, the server can replace target words in classes, functions, or fields in the source code with random characters. The replacement of the random characters belongs to a medium-difficulty obfuscation. When the source code is obfuscated by using the medium-difficulty obfuscation, the source code cannot be read even if it is reverse parsed. The obfuscation can better protect the security of the source code and avoid code leakage.

[0068] In another example, the server can replace the target word in the class, function or field in the source code with a random arrangement of preset characters, which include multiple similar characters. The replacement by random arrangement of preset characters is a high-difficulty obfuscation. The preset characters can be "O", "o", "0", and other characters with high similarity and difficult to distinguish. After obfuscation by using the high-difficulty obfuscation, the source code cannot be distinguished even if it is reverse analyzed. This obfuscation can maximize the difficulty of understanding and can well protect the security of the source code to avoid code leakage.

[0069] After the server obtains the obfuscation configuration information, the server can use the obfuscation configuration information to obfuscate the source code to obtain obfuscated code. The obfuscated code has the same logical content as the source code. The logical content can include functional logic, interaction logic, etc. And the application software package obtained by packaging the obfuscated code cannot be correctly interpreted even if it is reverse analyzed.

[0070] S103, package the obfuscated code to obtain an application software package, the application software package including a first file, a digest file and the obfuscated code, the first file including an archive file of classes or a Web application.

[0071] In this embodiment, after obtaining the obfuscated code, the server can use maven to compile and package the obfuscated code to obtain an application software package. The application software package can include a first file, a digest file and the obfuscated code. The first file includes an archive file (jar package) of classes or a Web application (war package). The use of the jar package or the war package is determined according to the project in which the source code is located. The digest file includes the digest information of the obfuscated class file. The digest information includes the class name and the version information of the class. The obfuscated code is the compiled obfuscated code.

[0072] In one example, the digest file is obtained by using a digest algorithm to calculate the digest of each class file. The digest algorithm can be configured in a configuration file. At the same time, in order to avoid tampering of the digest algorithm at runtime, the server can also use the MD5 algorithm to encrypt the digest algorithm. The use of the MD5 algorithm can ensure the secure generation of the digest file, thereby improving the effectiveness of the digest file.

[0073] S104, generate an image container according to the application software package, the image container including the application software package, an application server and a dynamic library, the application server being configured to run the application software package in the image container.

[0074] In this embodiment, after obtaining the application software package, the server generates an image container of the application software package using the docker tool. The image container can include the application software package, an application server and a dynamic library. The application server is a customized tomcat. The tomcat is used to run the application software package. The customized tomcat has a customized LifecycleListener interface. When the tomcat starts, the LifecycleListener interface starts its listener and enters the observer mode. The dynamic library is a so dynamic library. Since the memory address of the so dynamic library is random when it is loaded, the security of the application software package can be greatly improved, and the source code can be avoided from being reverse parsed.

[0075] The application software encryption deployment method provided in the application uses a git tool to establish a data warehouse, logs in the git tool to upload source code, obtains obfuscated configuration information from a configuration center, obfuscates the source code using the obfuscated configuration information to obtain obfuscated code, compiles and packages the obfuscated code using a maven to obtain an application software package, and generates an image container of the application software package using a docker tool. The image container includes the application software package, an application and a dynamic library. In the application, the obfuscation step is added to the pipeline process of jenkins, the source code is obfuscated in the source code management process, the security of the application software package is improved, and the source code leakage problem caused by reverse parsing of the application software package is avoided.

[0076] Figure 3 A flowchart of an application software encryption deployment method provided in an embodiment of the application is shown. In Figure 1 and Figure 2 the embodiment shown, as Figure 3 shown, for an execution subject, the method of the embodiment can include the following steps:

[0077] S201, obtaining source code to be obfuscated.

[0078] The step S201 is similar to the implementation of the step S101 in the Figure 2 embodiment, and will not be described here.

[0079] S202, obtaining user information, the user information including client information for uploading source code and account information logged in the client.

[0080] In this embodiment, the programmer can upload the source code to the server through the application program of the client. The server can obtain the user information when obtaining the source code uploaded by the client. The user information can include the client information and the account information of the user logged in the application program of the client.

[0081] In an example, the application program of the client can be bound to the client. That is, when the programmer uploads the source code using the client, the server can determine the corresponding programmer according to the client information. In this way, the permission can be bound to the client, and irrelevant personnel cannot log in the data warehouse through other clients to obtain the project-related information.

[0082] In another example, the programmer needs to log in the application program of the client to upload the source code. The server can determine the programmer corresponding to the source code according to the account information logged in the application program of the client. In this way, the permission can be bound to the programmer, and irrelevant personnel cannot log in the data warehouse using the account to obtain the project-related information.

[0083] In another example, the programmer can log in the client using a jenkins account. The jenkins account can be jointly held by one or more programmers. When the programmer needs to upload the source code in the client, the programmer needs to log in the application program using the jenkins account to upload the source code. The server can obtain the client information and the account information of the client. In this way, the permission can be bound to the jenkins account, and irrelevant personnel cannot obtain the jenkins account, thereby avoiding the possibility that irrelevant personnel logs in the data warehouse to obtain the project-related information.

[0084] S203, determining whether the source code needs to be obfuscated according to the user information and the first white list.

[0085] In this embodiment, the server can include a first white list. The first white list includes the client information and / or the account information. The server determines whether the client information and / or the account information in the user information is in the first white list. When the user information is in the first white list, the server determines that the source code needs to be obfuscated. When the user information is not in the first white list, the server determines that the source code does not need to be obfuscated.

[0086] In the above process, the server realizes authentication by the first whitelist. That is, when the user information is in the first whitelist, the authentication is successful. Otherwise, the authentication fails. The use of the authentication in the pipeline process can prevent personnel unrelated to the project from obtaining relevant information of the project. Meanwhile, the use of the authentication can also manage the permissions of programmers, which can effectively avoid misoperation in the production process of the project.

[0087] S204, according to the configuration information, the source code is obfuscated to obtain obfuscated code, and the obfuscated code has the same logical content as the source code. The obfuscated code is used to prevent the source code from being leaked after the application software package is reverse parsed.

[0088] S205, packing the obfuscated code to obtain an application software package, the application software package including a first file, a digest file and the obfuscated code, the first file including an archive file of a class or a Web application.

[0089] Among them, steps S204 and S205 are similar to Figure 2 The implementation of steps S102 and S103 in the embodiment is similar, and will not be repeated here.

[0090] S206, generating a key pair according to a preset encryption rule, the key pair including a public key and a private key.

[0091] In the embodiment, the server can generate a key pair according to a preset encryption rule. The preset encryption rule can be configured in the configuration heart of the server. The default preset encryption algorithm can be RSA1024 asymmetric encryption algorithm. The key pair can include a private key and a public key. Among them, the selection of RSA algorithm key length is the result of the balance between security and program performance. The longer the key length, the better the security, and the longer the encryption and decryption time. Among them, RSA1024 means that the public key and the private key are 1024bit (128byte). The key of 1024bit can encrypt the content length of 117byte at a time.

[0092] After the server generates the key pair, the public key in it will be saved to the dynamic library of the image container of S208. When decryption is needed, the image container will use the public key to decrypt the first ciphertext through the dynamic library.

[0093] S207, encrypting the first file according to the private key to obtain first ciphertext.

[0094] In this embodiment, after obtaining the key pair, the server uses the private key in the key pair to encrypt the first file. The first file includes the jar package or war package of the application software. The server encrypts the jar package or war package using the private key to obtain the first ciphertext. The first ciphertext will be saved to the image container generated in S208.

[0095] S208, generating an image container according to the application software package, the image container including the application software package, an application server and a dynamic library, the application server being used to run the application software package in the image container.

[0096] In this embodiment, the step S208 is similar to the step S208 of the above embodiment, and will not be described here. Figure 2 The step S104 in the embodiment is implemented in a similar manner, and will not be described here.

[0097] The application provides an application software encryption deployment method. The server obtains source code to be obfuscated. When the server obtains the source code uploaded by the client, the server can also obtain user information. The user information can include client information and account information of the user logged in the application program on the client. The server can include a first white list. The server judges whether the client information and / or the account information in the user information is in the first white list, thereby realizing authentication. The server obfuscates the source code according to configuration information to obtain obfuscated code. The server packages the obfuscated code to obtain an application software package. The server can generate a key pair according to a preset encryption rule. After obtaining the key pair, the server uses the private key in the key pair to encrypt the first file. The server generates an image container according to the application software package. In this application, through authentication and encryption, the security management of the obfuscation process is realized, and the security of the pipeline process is increased.

[0098] On the basis of the above embodiments, the source code can be obfuscated, and the source code, the obfuscated code and the version information can be saved to realize version management of the obfuscated code. The application provides an application software encryption deployment method. By obtaining and saving the source code, the obfuscated code and the version information, the historical information of each version can be retrieved, and the version management of the source code and the obfuscated code is realized.

[0099] Figure 4 A flowchart of an application software encryption deployment method provided by an embodiment of the application is shown. In the Figures 1 to 3 On the basis of the above embodiments, the source code can be obfuscated, and the source code, the obfuscated code and the version information can be saved to realize version management of the obfuscated code. The application provides an application software encryption deployment method. By obtaining and saving the source code, the obfuscated code and the version information, the historical information of each version can be retrieved, and the version management of the source code and the obfuscated code is realized. Figure 4 When the server generates an image container and deploys the image container to a K8S cluster, a server in the K8S cluster is taken as an execution subject, and the running process of the application software package in the image container can include the following steps:

[0100] S301, judging whether the interface of the application server is legal according to the IP address of the application server and the second white list.

[0101] In this embodiment, the application server is a Web application server in the image container. The application server can be tomcat. The tomcat is used to run the application software package in the image container. The tomcat has a customized LifecycleListener interface. When the tomcat starts, the tomcat can call the JAVA Native Interface (JNI) of the dynamic library for authentication.

[0102] After the authentication process is started, the dynamic library obtains the pre-stored second white list. The second white list includes one or more IP addresses. The customized tomcat is configured with a fixed IP address. The dynamic library can obtain the IP address of the tomcat. The dynamic library compares the IP address with the IP addresses in the second white list. When the IP address is within the range of the second white list, the dynamic library determines that the tomcat is a legal application server. Otherwise, the dynamic library determines that the application server is not legal. At this time, the dynamic library can end the start of the tomcat. The use of the authentication process can effectively avoid the application software package in the image container from being extracted and running in other tomcats, thereby reducing the possibility of being reverse analyzed.

[0103] In an example, the dynamic library can also store a third white list. The third white list includes one or more image container identifiers. When the application server is started, the dynamic library can obtain the image container identifier of the image container. The dynamic library compares the image container identifier with the image container identifiers in the third white list. When the application server runs in the image container allowed by the third white list, the authentication is successful. Otherwise, the authentication fails. When the authentication fails, the dynamic library can end the start of the tomcat. The use of the authentication process can effectively avoid the application software package in the image container from being copied and used in other environments. The authentication process can also effectively avoid the image container from being copied unreasonably.

[0104] S302, calling a verification interface of the dynamic library to verify whether the application software package is legal.

[0105] In this embodiment, the dynamic library can also call a verification interface to verify the information in the application software package, thereby ensuring the security of the information in the application software package.

[0106] In an example, the verification process specifically includes:

[0107] Step 1, obtaining a public key, a first ciphertext, a first file, and a digest file.

[0108] In this step, the dynamic library can obtain the public key, the first ciphertext, the first file and the digest file from the mirror container or the dynamic library.

[0109] Step 2, verify whether the first file is correct according to the public key and the first ciphertext.

[0110] In this step, the dynamic library encrypts the first file using the public key to obtain a second ciphertext. The dynamic library compares the first ciphertext and the second ciphertext. When the first ciphertext and the second ciphertext are consistent, the dynamic library determines that the first file is a correct first file. Otherwise, the dynamic library determines that the first file is incorrect.

[0111] Step 3, judge whether the classes in the application software package are the latest version according to the digest file.

[0112] In this step, after the dynamic library obtains the digest file, it verifies the class files in the digest file. The dynamic library judges whether each class file is the latest version. When each class file in the digest file is the latest version, the dynamic library determines that the application software package is the latest version. Otherwise, the dynamic library determines that the application software package is not the latest version.

[0113] Step 4, when the first file is correct and the classes in the application software package are the latest version, determine that the application software package is legal.

[0114] In this step, when the dynamic library determines that the first file is a correct first file and the application software package is the latest version, the dynamic library determines that the application software package is a legal application software package. When the application software package is an illegal application software package, the dynamic library can end the startup of the tomcat.

[0115] S303, when the interface of the application server and the application software package are both legal, execute the application software package in the mirror container.

[0116] In this embodiment, when the dynamic library determines that the interface of the application server and the application software package are both legal, the application server loads the class files in the dynamic library and executes the application software package.

[0117] The application provides an application software encryption deployment method. An application server is a web application server in the mirror container. The application server can be tomcat. When the tomcat is started, the tomcat can call the JNI of the dynamic library to perform authentication. When the IP address is within the second whitelist range, the dynamic library determines that the tomcat is a legal application server. Otherwise, the dynamic library determines that the application server is illegal. The dynamic library can also verify the information in the application software package. When the dynamic library determines that the interface of the application server and the application software package are both legal, the application server loads the class file in the dynamic library and executes the application software package. In the application, authentication and verification are performed when the application server is running, which further improves the security of the application software package, can effectively prevent the application software package from being replaced, and can also effectively prevent the application software package from running in an unsafe environment.

[0118] Figure 5 A structural diagram of an application software encryption deployment system provided by an embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the application software encryption deployment system 10 is used to implement the operations corresponding to the electronic device in any of the method embodiments described above. The application software encryption deployment system 10 includes a data warehouse 11, an obfuscation service module 12, a packaging service module 13, and a mirror service module 14. Figure 5

[0119] The data warehouse 11 is used to obtain and store source code. The data warehouse can run in a first server. Programmers log in to the data warehouse through a client to upload the source code.

[0120] The obfuscation service module 12 is used to obfuscate the source code in the data warehouse to obtain obfuscated code.

[0121] In an example, the obfuscation service module 12 can specifically include a configuration center 121, a background service module 122, a front-end service module 123, and a database 124.

[0122] The configuration center 121 is used to configure obfuscation rules. The configuration center can include a front-end interface. Programmers can select or input the obfuscation rules through the front-end interface. The configuration center can also be used to configure a digest algorithm and a preset encryption algorithm.

[0123] The background service module is used to obfuscate the source code according to the obfuscation rules to obtain the obfuscated code. The background service module can also be used for authentication.

[0124] The front-end service module is used to visualize the obfuscation process. For example, the front-end service module can visualize the configuration of the obfuscation rules, present the information before and after the code obfuscation of different versions, and compare the code before and after the obfuscation.​

[0125] The database is used to store the source code, the obfuscated code and the version information. The database can also calculate a digest file for the obfuscated code after each obfuscation using a digest algorithm. The database can also save the public and private keys of the RSA1024 algorithm for randomly generated jar or war packages.

[0126] The packaging service module is used to package the obfuscated code to obtain an application package. The packaging service module mainly uses the maven tool to realize the packaging of the obfuscated code.

[0127] The image service module is used to generate an image container of the application package. The image container also includes an application server and a dynamic library. The application package will be started and executed in the image container through the application server. The image service module mainly uses docker to realize the generation of the image container.

[0128] In the embodiment, the modules can be physically separated, for example, installed in different positions of a device, or installed on different devices, or distributed on multiple network elements, or distributed on multiple processors. Alternatively, the modules can be integrated, for example, installed in the same device, or integrated in a set of codes. The modules can exist in the form of hardware, or in the form of software, or in the form of software plus hardware.

[0129] The application also provides a computer readable storage medium. When the modules are integrated in the form of software function modules, the function modules can be stored in the computer readable storage medium. The software function modules include a computer program for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of the steps of the method of the embodiments.

[0130] The computer readable storage medium can be a computer readable storage medium or a communication medium. The communication medium includes any medium that facilitates transfer of a computer program from one place to another. A storage medium can be any available medium that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, computer readable storage media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired computer program code means in the form of computer readable instructions or data structures and that can be accessed by a general purpose or special purpose computer. Combinations of the above should also be included within the scope of the computer readable media.

[0131] In particular, the computer readable storage medium can be realized by any type of volatile or non-volatile storage devices, or a combination thereof, such as static random access memory (SRAM), electrically-erasable programmable read-only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic or optical disks. The storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

[0132] The present application also provides a computer program product, which includes a computer program stored in a computer readable storage medium. At least one processor of a device can read the computer program from the computer readable storage medium, and the at least one processor executes the computer program to enable the device to implement the method provided by the various embodiments described above.

[0133] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other manners. For example, the apparatus embodiments described above are only illustrative, for example, the division of the modules is only a logical function division, and actual implementation can have another division manner, for example, a plurality of modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interfaces, apparatuses or modules, which can be electrical, mechanical or other forms.

[0134] It should be understood that, although each step in the flowchart in the above embodiments is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps has no strict sequence limitation, and they can be executed in other orders. Moreover, at least part of the steps in the figure can include a plurality of sub-steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order is not necessarily sequential, but can be executed in rotation or alternation with other steps or sub-steps or stages of other steps.

[0135] Finally, it should be pointed out that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for encrypted deployment of application software, characterized in that, The method includes: Obtain the source code to be obfuscated; The source code is obfuscated based on the configuration information to obtain obfuscated code; The obfuscated code is packaged to obtain an application package, which includes a first file, a digest file, and the obfuscated code. The first file includes a web application. Based on the application software package, an image container is generated. The image container includes the application software package, an application server, and a dynamic library. The application server is used to run the application software package in the image container, and the dynamic library has a random memory address when loaded. The obfuscation of source code based on configuration information to obtain obfuscated code includes at least one of the following: Replace target words in classes, functions, or fields in the source code with preset words; Replace target words in classes, functions, or fields in the source code with random characters; Replace target words in classes, functions, or fields in the source code with random combinations of preset characters, where the preset characters include multiple similar characters; When the application server is running in the image container, the validity of the application server's interface is determined based on the application server's IP address and the second whitelist. Obtain the public key, the first ciphertext, the first file, and the digest file; Based on the public key and the first ciphertext, verify whether the first file is correct; Based on the summary file, determine whether the classes in the application software package are the latest versions; If the first file is correct and all classes in the application software package are the latest versions, the application software package is determined to be valid. When both the application server interface and the application package are valid, the application package is executed in the image container through the application server.

2. The application software encryption deployment method according to claim 1, characterized in that, The method further includes: A key pair is generated according to a preset encryption rule, the key pair including a public key and a private key; The first file is encrypted using the private key to obtain the first ciphertext.

3. The application software encryption deployment method according to claim 1, characterized in that, Before obfuscating the source code according to the configuration information, the method further includes: Obtain user information, which includes client information for uploading the source code and account information logged in on the client; Based on the user information and the first whitelist, determine whether the source code needs to be obfuscated.

4. An application software encryption deployment system, characterized in that, The system includes: a data warehouse, an obfuscation service module, a packaging service module, and an image service module; The data warehouse is used to acquire and store source code; The obfuscation service module is used to obfuscate the source code in the data warehouse to obtain obfuscated code; The packaging service module is used to package the obfuscated code to obtain an application package; the application package includes a first file, a digest file and the obfuscated code, and the first file includes a web application; The image service module is used to generate an image container for the application software package. The image container also includes an application server and a dynamic library. The application software package will be started and executed in the image container through the application server. The dynamic library has a random memory address when loaded. The obfuscation service module is specifically used for at least one of the following: Replace target words in classes, functions, or fields in the source code with preset words; Replace target words in classes, functions, or fields in the source code with random characters; Replace target words in classes, functions, or fields in the source code with random combinations of preset characters, where the preset characters include multiple similar characters; The image service module is further configured to, when running the application server in the image container, determine whether the interface of the application server is legitimate based on the IP address of the application server and a second whitelist; obtain a public key, a first ciphertext, a first file, and a digest file; verify whether the first file is correct based on the public key and the first ciphertext; determine whether the classes in the application package are the latest versions based on the digest file; determine that the application package is legitimate when the first file is correct and all classes in the application package are the latest versions; and execute the application package in the image container through the application server when both the interface of the application server and the application package are legitimate.

5. The application software encryption deployment system according to claim 4, characterized in that, The obfuscation service module also includes: a configuration center, a backend service module, a frontend service module, and a database; The configuration center is used to configure obfuscation rules; The background service module is used to obfuscate the source code according to the obfuscation rules to obtain obfuscated code; The front-end service module is used to visualize the obfuscation process; The database is used to store the source code, the obfuscated code, and version information.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, is used to implement the application software encryption deployment method as described in any one of claims 1 to 3.

7. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the application software encryption deployment method according to any one of claims 1 to 3.

Images