A method, device and electronic equipment for interpreting a source program

Abstract

The application discloses a protection method, device and electronic equipment for an interpreted source program, and the method comprises the following steps: obtaining a source program image file; and performing decryption, decompression and running on the source program image file through a running application; the running application is a binary executable file comprising a memory loading application, a decryption application, a decompression application, an interpreter and a self-destruction application; the memory loading application is used for loading the source program image file into memory; the decryption application is used for decrypting the source program image file in the memory; the decompression application is used for decompressing the decrypted source program image file in the memory to obtain an interpreted source program; the interpreter is used for interpreting and running the interpreted source program obtained by decompressing in the memory; and the self-destruction application is used for continuously detecting whether the running application is externally intruded during the execution of the running application, and deleting the running application when the running application is externally intruded. The technical scheme provided by the application improves the security of the interpreted source program.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to a method, apparatus, and electronic device for protecting interpreted source programs. Background Technology

[0002] Interpreted language source code is a type of program that is not translated into binary machine language through a compilation process, but is directly read, interpreted, and executed by an interpreter. Commonly used interpreted language source code includes Python, JavaScript, Perl, and Shell. This means that the source code of interpreted languages ​​can be directly obtained, leading to leaks. Most existing protection mechanisms for interpreted language source code employ methods such as packaging, encrypting, or a combination of both. Specifically, the source code is compressed and symmetrically encrypted to generate ciphertext, which is then distributed and stored, and finally read and executed by the interpreter on the target system.

[0003] However, this method does not provide thorough protection for the source code. The ciphertext needs to be decrypted and decompressed on the target system, leaving plaintext or intermediate source code in the file system before being read and executed by the interpreter. Therefore, if the target system is compromised, the stored plaintext or intermediate source code will still be exposed and deciphered. Thus, a more robust method is needed to protect interpreted source code. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, apparatus, and electronic device for protecting interpreted source programs, thereby improving the security of interpreted source programs.

[0005] According to a first aspect, the present invention provides a method for protecting interpreted source code, the method comprising: obtaining a source code image file; decrypting, decompressing, and running the source code image file by running an application; the running application being installed on a current device and being a binary executable file including a memory-loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application; the memory-loading application being used to load the source code image file into memory; the decryption application being used to decrypt the source code image file in memory; the decompression application being used to decompress the decrypted source code image file in memory to obtain an interpreted source code; the interpreter being used to interpret and run the decompressed interpreted source code in memory; and the self-destructing application being used to continuously detect whether the running application has been externally intruded during the execution of the running application, and to delete the running application when the running application has been externally intruded.

[0006] Optionally, the source program image file is generated by compressing the interpreted source program into a compressed package, and then encrypting the compressed package. The steps of encrypting the compressed package include: encrypting the header bytes of the compressed package to obtain first ciphertext, and replacing the header bytes with the first ciphertext; encrypting the tail bytes of the compressed package to obtain second ciphertext, and replacing the tail bytes with the second ciphertext to obtain a first intermediate encrypted compressed package; selecting several random positions in the first intermediate encrypted compressed package, encrypting the bytes following the random positions, and replacing the bytes following the random positions with the obtained random position ciphertext to obtain a second intermediate encrypted compressed package; adding the coordinate information of the random positions to the end of the second intermediate encrypted compressed package to obtain a third intermediate encrypted compressed package; calculating the digest value of the third intermediate encrypted compressed package, and adding the digest value to the end of the third intermediate encrypted compressed package to obtain the source program image file.

[0007] Optionally, decrypting the source program image file in memory using the decryption application includes: extracting and deleting the tail digest value of the source program image file to obtain a first remaining part, and calculating the digest value of the first remaining part; comparing the digest value of the first remaining part with the tail digest value, and exiting the running application if they do not match; if they match, extracting and deleting the coordinate information of a random position at the tail of the first remaining part to obtain a second remaining part; decrypting the first ciphertext at the beginning of the second remaining part, the second ciphertext at the end, and the ciphertext at a random position after the coordinate information, and replacing the ciphertext at the corresponding position with the plaintext bytes obtained from the decryption to obtain a decrypted compressed package.

[0008] Optionally, the self-destructing application continuously detects whether the running application has been externally intruded during the execution of the running application, including: when the running application is running, calculating the current application digest value of the running application; obtaining the development application digest value stored inside the running application, the development application digest value being a digest value pre-calculated and stored when the running application is developed; comparing the current application digest value and the development application digest value, and if they are inconsistent, deleting the running application.

[0009] Optionally, the self-destructing application continuously detects whether the running application has been externally intruded during the execution of the running application, including: requesting authentication information from the operating system through the self-destructing application; receiving the authentication information returned by the operating system through the self-destructing application and determining whether the authentication information meets preset conditions; when the preset conditions are not met, deleting the running application through the self-destructing application and controlling the operating system to hibernate for 1 minute before shutting down.

[0010] Optionally, requesting authentication information from the operating system via a self-destructing application includes: encrypting the operating system's time string using a pre-built operating system key in the self-destructing application to obtain time ciphertext; generating an authentication request based on the time ciphertext using the self-destructing application and sending the authentication request to the operating system, so that the operating system uses the operating system key to decrypt the time ciphertext in the authentication request to obtain the time string, and comparing the time string with the system's current time, and then returning the comparison result as the authentication information to the self-destructing application.

[0011] Optionally, the self-destructing application continuously detects whether the running application has been externally intruded during the execution of the running application, including: checking whether a user has successfully logged into the operating system through the self-destructing application; if a user has successfully logged into the operating system, exiting the running application through the self-destructing application; checking the startup method of the running application through the self-destructing application; if the running application is not started by the init process, deleting the running application through the self-destructing application.

[0012] According to a second aspect, embodiments of the present invention provide a protection device for interpreted source programs. The device includes: a data acquisition module for acquiring a source program image file; and a running module for decrypting, decompressing, and running the source program image file through a running application. The running application is installed on the current device and is a binary executable file including a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory loading application loads the source program image file into memory. The decryption application decrypts the source program image file in memory. The decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program. The interpreter interprets and runs the decompressed interpreted source program in memory. The self-destructing application continuously detects whether the running application is externally intruded during the execution of the running application and deletes the running application when it is externally intruded.

[0013] According to a third aspect, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method described in the first aspect, or any optional embodiment of the first aspect.

[0014] According to a fourth aspect, embodiments of the present invention provide a computer-readable storage medium storing computer instructions for causing the computer to perform the method described in the first aspect, or any alternative embodiment of the first aspect.

[0015] The technical solution provided in this application has the following advantages:

[0016] The technical solution provided in this application decrypts, decompresses, and runs the acquired source program image file through a developed sealed-box runtime application. The runtime application, installed on the current device, is a binary executable file comprising a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory loading application loads the source program image file into memory; the decryption application decrypts the source program image file in memory; the decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program; and the interpreter interprets and runs the decompressed interpreted source program in memory. During the execution of the interpreted source program, all steps are implemented within the runtime application's memory on the current device, i.e., within the runtime application itself. The runtime application acts as a black box; the plaintext of the interpreted source program is not exposed to the device's persistent storage medium, and the contents of memory are protected by the device's operating system, preventing intruders from directly obtaining and analyzing them. Therefore, an intruder must compromise the running application to obtain the plaintext of the interpreted source program. However, in this embodiment of the invention, a self-destructing application within the running application continuously detects whether the running application has been compromised externally during its execution. If the running application is compromised externally, it is deleted, ensuring that the plaintext of the interpreted source program is not leaked and fully guaranteeing the security of the interpreted source program. Attached Figure Description

[0017] The features and advantages of the invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the invention in any way. In the drawings:

[0018] Figure 1 The diagram illustrates the steps of a method for protecting an interpreted source program according to one embodiment of the present invention.

[0019] Figure 2 A schematic diagram of the generator structure is shown in one embodiment of the present invention;

[0020] Figure 3 A schematic diagram of the structure of an application running in one embodiment of the present invention is shown;

[0021] Figure 4 A schematic diagram of the structure of a protection device for an interpreted source program is shown in one embodiment of the present invention;

[0022] Figure 5 A schematic diagram of an electronic device according to one embodiment of the present invention is shown. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see Figure 1 In one implementation, a method for protecting interpreted source code specifically includes the following steps:

[0025] Step S101: Obtain the source program image file;

[0026] Step S102: Decrypt, decompress, and run the source program image file by running the application; the running application is installed on the current device and is a binary executable file that includes a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application; the memory loading application is used to load the source program image file into memory; the decryption application is used to decrypt the source program image file in memory; the decompression application is used to decompress the decrypted source program image file in memory to obtain an interpreted source program; the interpreter is used to interpret and run the interpreted source program obtained by decompression in memory; the self-destructing application is used to continuously detect whether the running application has been externally intruded during the execution of the running application, and delete the running application when it has been externally intruded.

[0027] Specifically, the protection of interpreted language source programs in this embodiment of the invention is divided into four stages: generation, distribution, storage, and execution. The storage and execution stages are implemented within the operating system of the current device. This embodiment uses radar equipment and a Linux system as examples, but this is only an example and not a limitation.

[0028] The generation phase uses a generator. The generator does not need to be publicly disclosed and does not participate in subsequent distribution phases. For example... Figure 2As shown, the generator is developed and generated on a general-purpose computer (Windows or Linux system) and runs in-place. It consists of two parts: a compressor and an encryptor. The compressor compresses the interpreted source program Se to generate a compressed package Ze, and the encryptor then encrypts Ze into a source program image file Ie. Specifically, in this embodiment of the invention, the compressor is developed using Python and uses the zipfile and gzip libraries. The compressor first uses the DEFLATED algorithm to compress all folders and files in the interpreted source program directory into a single file ZIPe in zip format, and then uses the gzip algorithm to compress the ZIPe again into a single file in gz format, resulting in the compressed package Ze. The source program image file Ie can be distributed and transmitted to the current device via network, removable media, etc. For example, the source program image file Ie and the running application are burned (copied) to the current device. If the interpreted source program is modified, a new image file Ie' can be generated again during the generation stage and then distributed via network, USB flash drive, optical disc, etc. After an upgrade, the Ie in the device is replaced with Ie'. The device then saves the Ie file in the device's persistent storage medium (e.g., a hard drive), thus completing the step of obtaining the source program image file.

[0029] It is worth noting that the source code image file is a compressed and encrypted binary file during the distribution and storage stages. Due to the extremely limited number of samples and the fact that the key is not provided to the public, methods such as brute-force cracking and trial and error cannot effectively analyze the source code image file. Theoretically, there is no possibility that the source code image file can be cracked by the outside world, and it can be effectively protected during the distribution and storage stages.

[0030] The runtime phase of this invention is primarily implemented through a separately developed runtime application. This application is developed in C++ on a general-purpose computer (Windows or Linux system) and cross-compiled into a binary ELF executable file supported by the current device. Furthermore, to prevent unauthorized operations and online debugging of the runtime application within the device, all debugging information in the runtime application is removed during the generation phase. Unauthorized operations refer to the process of analyzing, cracking, or modifying the runtime application using methods prohibited by this solution. This involves analyzing and modifying the debugging information before running the application to achieve the desired purpose. For example, starting the runtime application not through the operating system but by writing user-level software is an unauthorized operation. Online debugging refers to manually starting the runtime application directly in the shell window after logging into the operating system. Its purpose is to debug and analyze the runtime application's execution process. Regarding the explanation of debugging information, the runtime application is a binary file generated by the GNU compiler. By default, runtime applications include debugging information, which provides clues that can be used to analyze and crack the runtime application. Online debugging also relies on the debugging information provided by the runtime application itself, used during the development phase to resolve software bugs. Applications in the development phase are owned by the manufacturer and contain debugging information. They do not block unauthorized operations or online debugging. However, the debugging information of applications officially released to the current device is deleted, and the blocking function is enabled.

[0031] like Figure 3 As shown, the running application comprises five parts: a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. First, the memory loading application loads the source program image file `le` stored in persistent storage into memory. Then, the decryption application decrypts the source program image file `le` in memory to obtain a compressed package `Ze`. Next, the decompression application decompresses the compressed package `Ze` in memory to obtain an interpreted source program `Se`. Finally, the interpreter interprets and runs the interpreted source program obtained from the decompression in memory. Thus, during the execution of the interpreted source program by the running application, all steps are implemented within the current device's memory, i.e., within the running application itself. The running application acts as a black box; the plaintext of the interpreted source program is not exposed to the device's persistent storage, and the contents in memory are protected by the device's operating system. Intruders cannot directly access or analyze it, significantly improving the security of the interpreted source program.

[0032] For an intruder to obtain the plaintext of an interpreted source program, they must compromise the running application. In this embodiment of the invention, the running application is also equipped with a self-destructing application. The self-destructing application continuously detects whether the running application has been compromised by external forces during its execution. If the running application is compromised by external forces, it deletes the running application, thus ensuring that the plaintext of the interpreted source program is not leaked and fully guaranteeing the security of the interpreted source program.

[0033] Specifically, in one embodiment, during the generation stage of the source program image file, the step of encrypting the compressed package obtained by compressing the interpreted source program includes:

[0034] Step 1: Encrypt the preset bytes in the header of the compressed package to obtain the first ciphertext, and replace the preset bytes in the header with the first ciphertext.

[0035] Step 2: Encrypt the preset bytes at the end of the compressed package to obtain the second ciphertext, and replace the preset bytes at the end with the second ciphertext to obtain the first intermediate encrypted compressed package.

[0036] Step 3: Select several random positions in the first intermediate encrypted compressed package, encrypt the preset bytes after the random positions, and replace the preset bytes after the random positions with the obtained ciphertext of the random positions to obtain the second intermediate encrypted compressed package.

[0037] Step 4: Add the coordinates of the random location to the end of the second intermediate encrypted compressed package to obtain the third intermediate encrypted compressed package.

[0038] Step 5: Calculate the digest value of the third intermediate encrypted compressed package and add the digest value to the end of the third intermediate encrypted compressed package to obtain the source program image file.

[0039] Specifically, common encryption algorithms for encrypting compressed files include, but are not limited to, DES, ASE, RSA, Base64, MD5, and SHA1. However, these existing algorithms are difficult to crack but also computationally intensive. This invention provides a method that does not encrypt the entire compressed file, but rather extracts and encrypts key parts of the compressed file. Taking MD5 and RSA algorithms as examples, the specific method is as follows:

[0040] 1. Use the import function to import the MD5 interface from the hashlib library, call the MD5.update interface, take the handle of the opened compressed file as input, and calculate the 128-bit MD5 digest value.

[0041] 2. Generate RSA key: From a pre-prepared table of large prime numbers, randomly select two distinct large prime numbers p and q to calculate their product n and φ. Then, arbitrarily select a large integer e and calculate d, satisfying:

[0042] n = p * q

[0043] φ(n)=(p-1)*(q-1)

[0044] gcd(e,φ(n))=1 indicates that e and φ(n) are coprime.

[0045] 1 <e<φ(n)

[0046] d*e=1modφ(n)

[0047] Where n and e are the public key, and d is the private key. It should be noted that the selection methods for p, q, and e, and the calculation method for d in this embodiment of the invention, are slightly different from those of traditional RSA.

[0048] 3. Generate encryption and decryption interfaces and compile them into a dynamic link library rsa.dll, specifically:

[0049] c = Enc(m) = m e mod n, m <n

[0050] In the formula, m represents plaintext, c represents ciphertext, and Enc represents the encryption interface.

[0051] m = Dec(c) = c d mod n

[0052] In the formula, Dec represents the decryption interface.

[0053] 4. After the above interface is created, call rsa.dll to read the header preset bytes (e.g., the first 128 bytes) of the compressed package containing the compressed index information, encrypt it using the Enc interface, generate the first ciphertext of the preset bytes, and then replace the original header preset bytes with the first ciphertext.

[0054] 5. Similarly, the overloaded version of the Enc interface is used to encrypt the preset bytes at the end of the compressed package (e.g., the last 128 bytes) and generate a second ciphertext of the preset bytes at the end. The second ciphertext is then used to replace the original preset bytes at the end to obtain the first intermediate encrypted compressed package.

[0055] 6. Then, select several random positions (e.g., 3 positions) in the first intermediate encrypted compressed package, and call the Enc interface to encrypt the preset bytes (e.g., 128 bytes) after the random positions. Similarly, replace the preset bytes after the random positions with the obtained ciphertext at the random positions to obtain the second intermediate encrypted compressed package.

[0056] 7. Record the random positions from step 6, such as coordinates rand1, rand2, and rand3. These coordinates can be offsets relative to the beginning or end of the file; this embodiment does not impose any special limitations. Then, append the random positions to the end of the file to obtain the third intermediate encrypted compressed package.

[0057] 8. Finally, add the digest value calculated in step 1 to the end of the third intermediate encrypted compressed package.

[0058] The encryption method provided by this invention can significantly reduce the amount of computation. For example, encrypting a 5MB file in segments takes about 1 minute, which reduces product performance. However, the above steps can control the encryption process (file size <500MB, embedded product source code is generally a few KB to tens of MB after compression) within 2 seconds, and the reduction in security is very small and negligible, which can significantly ensure the operating speed of embedded products such as radar.

[0059] Specifically, in one embodiment, the encryption algorithm based on the above steps, through the decryption application, includes the following specific steps for decrypting the source program image file in memory:

[0060] Step 6: Extract and delete the end digest value of the source program image file to obtain the first remaining part, and calculate the digest value of the first remaining part.

[0061] Step 7: Compare the summary value of the first remaining part with the tail summary value. If they do not match, exit the application.

[0062] Specifically, the decryption application first extracts the MD5 hash value Ms from the end of the source program image file and then removes this hash value from the end, obtaining the first remainder. Next, it calculates the MD5 hash value Mc of the first remainder. By comparing Mc and Ms, if they are not equal, it indicates that the source program image file has been corrupted or tampered with. To protect the interpreted source program from being stolen, the application exits, ending the decryption process. If they match, subsequent steps are performed.

[0063] Step 8: If they match, extract and delete the coordinates of the random position at the end of the first remaining part to obtain the second remaining part.

[0064] Step 9: Use the built-in key to decrypt the first ciphertext at the beginning, the second ciphertext at the end, and the ciphertext at random positions after the coordinate information in the second remaining part. Replace the ciphertext at the corresponding positions with the plaintext bytes obtained from the decryption to obtain the decrypted compressed package.

[0065] Specifically, if the comparison matches, the decryption application extracts the coordinates of random positions at the end of the first remainder (e.g., three), obtains the corresponding random position ciphertext (e.g., 128 bytes of ciphertext), and deletes the coordinates of the random positions at the end of the first remainder, resulting in the second remainder. Then, the decryption application uses a built-in key to sequentially decrypt the random position ciphertext, the first ciphertext at the beginning of the second remainder, and the second ciphertext at the end using the RSA algorithm. The obtained plaintext is then used to replace the corresponding ciphertext, resulting in the decrypted compressed package. Using this encryption and decryption method, the decryption process (file size < 500MB; embedded product source code compressed to a few KB to tens of MB) can also be controlled within 2 seconds, with very little reduction in security, which can be ignored, significantly ensuring the operating speed of embedded products such as radar.

[0066] Then, the compressed package is first restored to a ZIP file in memory by decompressing the application, and then the ZIPe is decompressed and restored to an interpreted source program, which can then be interpreted and run by the interpreter.

[0067] Self-destruct applications are used in official products to perform rigorous checks on the current device status. When an anomaly is detected, the application exits and is deleted, and memory is cleaned up to prevent intruders from copying and analyzing memory for hacking.

[0068] Specifically, in one embodiment, the self-destruct application performs the following specific steps:

[0069] Step 10: Check if any user has successfully logged into the operating system by using a self-destructing application.

[0070] Step 11: If a user successfully logs into the operating system, exit the running application by self-destructing the application.

[0071] Due to the confidentiality of the source code image file, the theoretical probability of cracking the source code image file alone is 0. A cracker needs to understand how the application running on the device works. Logging into the operating system is the first line of defense, which is extremely difficult without a username and password. However, usernames and passwords can still be leaked from after-sales personnel. Therefore, this solution's protection mechanism takes effect from the runtime phase. When the application is running, the self-destructing application checks if a user has successfully logged into the operating system. Whether it's a cracker's login or a legitimate login from the manufacturer, it will cause the application to exit, thus preventing intruders from gaining access to memory and significantly improving the security of interpreted source code.

[0072] Specifically, in one embodiment, the self-destruct application performs the following specific steps:

[0073] Step 12: When the application is running, calculate the current application summary value for the running application.

[0074] Step 13: Obtain the development application digest value stored inside the running application. The development application digest value is a digest value that is pre-calculated and saved when the running application is developed.

[0075] Step Fourteen: Compare the current application summary value with the development application summary value. If they do not match, delete the running application.

[0076] Specifically, when the application starts running, the self-destructing application obtains the development application digest value Ma, which is built into the application and generated during the build phase. This digest value belongs to the application's own software digest value. The self-destructing application also calculates the current application digest value Mb corresponding to the application after it has run. Then, the two digest values ​​are compared. If Ma is not equal to Mb, it indicates that the application has been tampered with. The interpreted source code, source code image file, and compressed package are deleted, and the application exits and is deleted, thereby blocking any attempts to crack the application after it has been tampered with, and improving the security of the interpreted source code.

[0077] Specifically, in one embodiment, the self-destruct application performs the following specific steps:

[0078] Step 15: Check the startup method of running applications by self-destructing the application.

[0079] Step 16: If the application is not started by the init process, then delete the application by self-destructing it.

[0080] Specifically, in this embodiment of the invention, starting the application via the init process is the only startup method supported by the device in this solution. After the operating system kernel starts, it will start an init process, which is the first process in user space. Other user processes are decomposed based on the init process. This method modifies the controlled operation mode of the operating system. If the self-destructing application detects that the running application itself is not started by the init process, it proves that an "unauthorized operation by an unauthorized user on the running application" has occurred, that is, the running application is manually started by other software, thereby triggering the self-destruct mechanism to terminate the unauthorized operation and delete the running application to ensure the security of the interpreted source program.

[0081] Specifically, in one embodiment, the self-destruct application performs the following specific steps:

[0082] Step 17: Request authentication information from the operating system through the self-destructing application.

[0083] Step 18: Receive the authentication information returned by the operating system through the self-destruct application, and determine whether the authentication information meets the preset conditions.

[0084] Step 19: When the preset conditions are not met, delete the running application by self-destructing the application, and control the operating system to hibernate for 1 minute before shutting down.

[0085] Specifically, if an intruder bypasses the running application and targets the operating system instead, indirectly intruding into the running application by cracking the operating system—for example, by intruding into and tampering with the current device's operating system, or by copying the running application to another device—this embodiment of the invention also uses a self-destructing application to request authentication information (e.g., the operating system's unique identifier, the machine's unique identifier, etc.) from the operating system. The self-destructing application receives the authentication information returned by the operating system and determines whether the authentication information meets preset conditions (e.g., the operating system's unique identifier, the machine's unique identifier, etc., do not meet expectations). If the operating system has been tampered with, or the running application has been copied to another device, the authentication information will not meet the preset conditions, thus deleting the running application through the self-destructing application, providing protection at the operating system level. Furthermore, controlling the operating system to hibernate for one minute before shutting down prevents intruders from making numerous attempts in a short period, rendering brute-force attacks theoretically unsupported. For an intruder to conduct cracking activities in a short time, they would need to purchase a large number (tens of thousands) of devices to attempt cracking, significantly increasing the difficulty. For example, a computer running at 2GHz can perform over a million cracking attempts per second, while this deletion, hibernation, and shutdown mechanism makes it impossible to crack even once per minute.

[0086] Specifically, in this embodiment of the invention, step seventeen includes the following steps:

[0087] Step 20: Encrypt the operating system's time string using the pre-built operating system key of the self-destructing application to obtain the time ciphertext.

[0088] Step 21: The self-destructing application generates an authentication request based on the time ciphertext and sends the authentication request to the operating system. The operating system then uses its operating system key to decrypt the time ciphertext in the authentication request to obtain a time string. The operating system compares the time string with the current system time and returns the comparison result as authentication information to the self-destructing application.

[0089] Specifically, in the development and operation of the application, this embodiment of the invention embeds the operating system key corresponding to the target operating system of the target device into the application. The source code and compilation process of the operating system are performed by the product manufacturer, without providing an installation package. The internal operating mechanism is opaque, comparable to a private key, resulting in very high security. The self-destructing application uses the embedded operating system key to encrypt the current system time string as plaintext using the aforementioned RSA algorithm, obtaining ciphertext. The self-destructing application sends an authentication request to the operating system, attaching the ciphertext. The operating system uses the embedded operating system key to decrypt the ciphertext, obtaining plaintext, and compares it with the current time. The comparison result is the difference between the two times. Two times are considered consistent if they do not exceed the time required for decryption, such as within the same second, the same minute, or a difference of no more than 10 seconds. Since the encryption and decryption speed of the aforementioned RSA algorithm is very fast, 5 seconds is selected as the preset condition in this embodiment of the invention. If the comparison result of the self-destructing application is within 5 seconds, the operating system authentication is successful, indicating that the current operating system has not been tampered with and the running application has not been copied to other devices. If the comparison result takes more than 5 seconds or the operating system cannot return a comparison result at all, it means that the current operating system is an unauthorized operating system. Both the operating system and the self-destructing application will execute the step of deleting the running application, and the operating system will shut down after hibernating for 1 minute.

[0090] Specifically, in one embodiment, if the self-destructing application detects any other anomaly in the current device, including abnormal reading of core files and the presence of abnormal processes, it will also exit the running application. Furthermore, before the running application exits, memory cleanup is performed, specifically including: forcibly flushing the system swap space, forcibly flushing the system buffer, forcibly cleaning the temporary area, and forcibly deleting the interpreted source program, source program image file, and compressed package, thereby further protecting the security of the interpreted source program.

[0091] In summary, the workflow for running the application is as follows:

[0092] (1) After the operating system starts, the first process of the operating system starts and runs the application and the self-destruct application. In the officially released product, the self-destruct application cannot be run in the interactive program, nor can it be run by other processes.

[0093] (2) The self-destruct application starts running and performs anomaly checks.

[0094] (3) When an anomaly occurs, the self-destruct application will be forced to exit the running application.

[0095] (4) When there are no abnormalities, the self-destruct application continues to run and sequentially runs the memory loading application, decryption application, decompression application, and interpreter. After the interpreter runs, it deletes the files related to the interpreted source program in the memory temporary area.

[0096] Through the above steps, the technical solution provided in this application decrypts, decompresses, and runs the acquired source program image file using a developed sealed-box runtime application. The runtime application, installed on the current device, is a binary executable file comprising a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory loading application loads the source program image file into memory; the decryption application decrypts the source program image file in memory; the decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program; and the interpreter interprets and runs the decompressed interpreted source program in memory. During the runtime of the interpreted source program, all steps are implemented within the memory of the current device through the runtime application, i.e., within the runtime application itself. The runtime application acts as a black box; the plaintext of the interpreted source program is not exposed to the device's persistent storage medium, and the contents of memory are protected by the device's operating system, preventing intruders from directly obtaining and analyzing them. Therefore, an intruder must compromise the running application to obtain the plaintext of the interpreted source program. However, in this embodiment of the invention, a self-destructing application within the running application continuously detects whether the running application has been compromised externally during its execution. If the running application is compromised externally, it is deleted, ensuring that the plaintext of the interpreted source program is not leaked and fully guaranteeing the security of the interpreted source program.

[0097] like Figure 4 As shown, this embodiment also provides a protection device for interpreted source code, including:

[0098] The data acquisition module 101 is used to acquire the source program image file. For details, please refer to the relevant description of step S101 in the above method embodiment, which will not be repeated here.

[0099] The execution module 102 is used to decrypt, decompress, and run the source program image file through the running application. The running application is installed on the current device and is a binary executable file including a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory loading application is used to load the source program image file into memory; the decryption application is used to decrypt the source program image file in memory; the decompression application is used to decompress the decrypted source program image file in memory to obtain an interpreted source program; the interpreter is used to interpret and run the interpreted source program obtained by decompression in memory; the self-destructing application is used to continuously detect whether the running application has been externally intruded during the execution of the running application, and delete the running application when it has been externally intruded. For details, please refer to the relevant description of step S102 in the above method embodiment, which will not be repeated here.

[0100] The protection device for interpreted source programs provided in this embodiment of the invention is used to execute the protection method for interpreted source programs provided in the above embodiment. Its implementation method and principle are the same. For details, please refer to the relevant description of the above method embodiment, which will not be repeated here.

[0101] Through the collaborative efforts of the aforementioned components, the technical solution provided in this application decrypts, decompresses, and runs the acquired source program image file using a developed sealed-box runtime application. The runtime application, installed on the current device, is a binary executable file comprising a memory loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory loading application loads the source program image file into memory; the decryption application decrypts the source program image file in memory; the decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program; and the interpreter interprets and runs the decompressed interpreted source program in memory. During the runtime application's execution of the interpreted source program, all steps are implemented within the runtime application's memory on the current device, i.e., within the runtime application itself. The runtime application acts as a black box; the plaintext of the interpreted source program is not exposed to the device's persistent storage medium, and the contents of memory are protected by the device's operating system, preventing intruders from directly obtaining and analyzing them. Therefore, an intruder must compromise the running application to obtain the plaintext of the interpreted source program. However, in this embodiment of the invention, a self-destructing application within the running application continuously detects whether the running application has been compromised externally during its execution. If the running application is compromised externally, it is deleted, ensuring that the plaintext of the interpreted source program is not leaked and fully guaranteeing the security of the interpreted source program.

[0102] Figure 5 An electronic device according to an embodiment of the present invention is shown. The device includes a processor 901 and a memory 902, which can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0103] Processor 901 can be a Central Processing Unit (CPU). Processor 901 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0104] The memory 902, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods in the above method embodiments. The processor 901 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 902, thereby implementing the methods in the above method embodiments.

[0105] The memory 902 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor 901, etc. Furthermore, the memory 902 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 902 may optionally include memory remotely located relative to the processor 901, and these remote memories may be connected to the processor 901 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0106] One or more modules are stored in memory 902, and when executed by processor 901, they perform the methods described in the above method embodiments.

[0107] The specific details of the aforementioned electronic device can be understood by referring to the relevant descriptions and effects in the above method embodiments, and will not be repeated here.

[0108] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The implemented program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0109] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for protecting interpreted source code, characterized in that, The method includes: Obtain the source program image file; The source program image file is decrypted, decompressed, and run by a running application. The running application, installed on the current device, is a binary executable file comprising a memory-loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory-loading application loads the source program image file into memory. The decryption application decrypts the source program image file in memory. The decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program. The interpreter interprets and runs the decompressed interpreted source program in memory. The self-destructing application continuously detects whether the running application has been externally intruded during execution and deletes the running application if it is. The self-destructing application continuously detects whether the running application has been externally intruded during its execution, and deletes the running application when it is found to have been externally intruded, including: When the running application is running, the current application summary value of the running application is calculated; the development application summary value stored inside the running application is obtained, which is a summary value pre-calculated and saved when the running application is developed; the current application summary value and the development application summary value are compared, and if they are inconsistent, the running application is deleted. The application requests authentication information from the operating system via a self-destructing application; the self-destructing application receives the authentication information returned by the operating system and determines whether the authentication information meets preset conditions. The authentication information includes at least one of the following: the unique identifier of the operating system, the unique identifier of the machine, or the comparison result of the operating system comparing a time string with the current system time; if the preset conditions are not met, the self-destructing application deletes the running application and controls the operating system to hibernate for 1 minute before shutting down. The self-destructing application checks whether a user has successfully logged into the operating system; if a user has successfully logged into the operating system, the self-destructing application exits the running application; the self-destructing application checks the startup method of the running application; if the running application is not started by the init process, the self-destructing application deletes the running application.

2. The method according to claim 1, characterized in that, The source program image file is generated by compressing the interpreted source program into a compressed package, and then encrypting the compressed package; wherein, the step of encrypting the compressed package includes: The header preset bytes of the compressed package are encrypted to obtain the first ciphertext, and the header preset bytes are replaced with the first ciphertext; The tail preset bytes of the compressed package are encrypted to obtain a second ciphertext, and the tail preset bytes are replaced with the second ciphertext to obtain a first intermediate encrypted compressed package; In the first intermediate encrypted compressed package, select several random positions, encrypt the preset bytes after the random positions, and replace the preset bytes after the random positions with the obtained random position ciphertext to obtain the second intermediate encrypted compressed package. The coordinate information of the random location is added to the end of the second intermediate encrypted compressed package to obtain the third intermediate encrypted compressed package; Calculate the digest value of the third intermediate encrypted compressed package, and add the digest value to the end of the third intermediate encrypted compressed package to obtain the source program image file.

3. The method according to claim 2, characterized in that, The decryption application is used to decrypt the source program image file in memory, including: Extract and delete the tail digest value of the source program image file to obtain the first remaining part, and calculate the digest value of the first remaining part; The summary value of the first remaining part is compared with the tail summary value. If they do not match, the running application is exited. If they match, the coordinate information of the random position at the end of the first remaining part is extracted and deleted to obtain the second remaining part; The first ciphertext at the beginning, the second ciphertext at the end, and the ciphertext at random positions after the coordinate information in the second remaining part are decrypted, and the plaintext bytes obtained from the decryption are used to replace the ciphertext at the corresponding positions to obtain the decrypted compressed package.

4. The method according to claim 1, characterized in that, The process of requesting authentication information from the operating system via a self-destructing application includes: The self-destruct application encrypts the operating system's time string using a pre-built operating system key to obtain time ciphertext. The self-destruct application generates an authentication request based on the time ciphertext and sends the authentication request to the operating system. The operating system then uses the operating system key to decrypt the time ciphertext in the authentication request to obtain the time string. The operating system compares the time string with the current system time and returns the comparison result as the authentication information to the self-destruct application.

5. A protection device for interpreted source code, characterized in that, The device includes: The data acquisition module is used to acquire the source program image file; The execution module is used to decrypt, decompress, and run the source program image file through the running application. The running application, installed on the current device, is a binary executable file comprising a memory-loading application, a decryption application, a decompression application, an interpreter, and a self-destructing application. The memory-loading application loads the source program image file into memory. The decryption application decrypts the source program image file in memory. The decompression application decompresses the decrypted source program image file in memory to obtain an interpreted source program. The interpreter interprets and runs the decompressed interpreted source program in memory. The self-destructing application continuously detects whether the running application has been externally intruded during execution and deletes the running application when it is. Continuously detecting whether the running application has been externally intruded during execution and deleting the running application when it is, via the self-destructing application, includes: When the running application is running, the current application summary value of the running application is calculated; the development application summary value stored inside the running application is obtained, which is a summary value pre-calculated and saved when the running application is developed; the current application summary value and the development application summary value are compared, and if they are inconsistent, the running application is deleted. The application requests authentication information from the operating system via a self-destructing application; the self-destructing application receives the authentication information returned by the operating system and determines whether the authentication information meets preset conditions. The authentication information includes at least one of the following: the unique identifier of the operating system, the unique identifier of the machine, or the comparison result of the operating system comparing a time string with the current system time; if the preset conditions are not met, the self-destructing application deletes the running application and controls the operating system to hibernate for 1 minute before shutting down. The self-destructing application checks whether a user has successfully logged into the operating system; if a user has successfully logged into the operating system, the self-destructing application exits the running application; the self-destructing application checks the startup method of the running application; if the running application is not started by the init process, the self-destructing application deletes the running application.

6. An electronic device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the method as described in any one of claims 1-4.

Images