File processing method and device, storage medium and server
By encapsulating the rendering logic in the JS file and using UUID to generate a real public key for obfuscation, the problem of new user discount activities being easily cracked is solved, the difficulty of automation by black market operators is increased, and the fairness of the activities is protected.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HUNAN HAPPLY SUNSHINE INTERACTIVE ENTERTAINMENT MEDIA CO LTD
- Filing Date
- 2022-09-02
- Publication Date
- 2026-07-31
AI Technical Summary
In existing technologies, new user discount programs are easily cracked by third parties, threatening the fairness of the program. The threshold for black market operators to automatically crack encrypted source files is low.
The rendering logic is encapsulated in the JS file requested by the client, and a real public key is generated based on the client's UUID. This public key is written into a backup of the JS file, and the backup file is obfuscated to generate an obfuscated JS file. The client loads and runs the encryption logic in the obfuscated JS file to encrypt the information.
This significantly increases the difficulty for cybercriminals to crack obfuscated JS files, raises the cost of their automation, makes it harder for them to successfully simulate user actions, and protects the fairness of the activity.
Smart Images
Figure CN115952475B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security, and more particularly to a file processing method, apparatus, storage medium, and server. Background Technology
[0002] With the development of the internet, businesses frequently hold client-side promotions (such as new user discounts) to attract new customers. Internet users can participate in these promotions by registering on the client-side. However, because these promotions are conducted online, they are more susceptible to disruption by third parties (e.g., simulating internet users registering on the client-side to participate, thus undermining the fairness of the promotion).
[0003] Currently, to prevent third parties from undermining the fairness of events, obfuscation is typically used to encrypt the event's source files (usually JavaScript files). However, this encryption method is still relatively easy to crack by automated hacking techniques.
[0004] Therefore, how to increase the difficulty of automated black market operations (i.e., the threshold for automated cracking of encrypted source files) to increase the cost of third-party sabotage activities and thus force third parties to abandon sabotage activities has become an urgent problem to be solved in this field. Summary of the Invention
[0005] This application provides a file processing method, apparatus, storage medium, and server, with the aim of increasing the difficulty of automating black market activities.
[0006] To achieve the above objectives, this application provides the following technical solution:
[0007] A file processing method, comprising:
[0008] The JavaScript file requested by the client is copied to obtain a backup of the JavaScript file; the JavaScript file includes encryption logic and rendering logic; the encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; the rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag;
[0009] Based on the client's UUID, obtain the real public key;
[0010] Write the real public key into the backup of the js file to obtain the candidate js file;
[0011] The candidate JS files are obfuscated to obtain obfuscated JS files;
[0012] The obfuscated JS file is sent to the client, causing the client to load the rendering logic in the obfuscated JS file, obtain the interactive page, and run the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, thereby obtaining encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
[0013] Optionally, copying the JS file requested by the client to obtain a backup of the JS file includes:
[0014] Receive a page loading request sent by the client; the page loading request includes a page tab selected by the user;
[0015] Retrieve the JS file corresponding to the page tag selected by the user from the preset database;
[0016] The obtained js file is copied to obtain a backup of the js file.
[0017] Optionally, obtaining the real public key based on the client's UUID includes:
[0018] Receive a page loading request sent by the client, which carries the UUID of the device to which the client belongs;
[0019] The UUID is sent to a preset key service, which then generates a key pair set based on the UUID. The key pair set includes a set of real key pairs and multiple phishing key pairs. The real key pairs include a real public key and a real private key. The phishing key pairs include a phishing public key and a phishing private key.
[0020] Receive the set of key pairs sent by the preset key service.
[0021] Optionally, writing the real public key into the js file backup to obtain the candidate js file includes:
[0022] The real public key and each of the phishing public keys are written into the js file backup to obtain the candidate js file.
[0023] Optionally, obfuscating the candidate JS file to obtain an obfuscated JS file includes:
[0024] The pre-defined phishing code is injected into the candidate js file to obtain the target js file;
[0025] The target JS file is obfuscated to obtain an obfuscated JS file.
[0026] A document processing apparatus, comprising:
[0027] The file copying unit is used to copy the JS file requested by the client to obtain a backup of the JS file; the JS file includes encryption logic and rendering logic; the encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; the rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag;
[0028] The public key acquisition unit is used to obtain the real public key based on the client's UUID;
[0029] The public key writing unit is used to write the real public key into the js file backup to obtain the candidate js file;
[0030] A public key obfuscation unit is used to obfuscate the candidate JS file to obtain an obfuscated JS file;
[0031] The file sending unit is used to send the obfuscated JS file to the client, so that the client loads the rendering logic in the obfuscated JS file, obtains the interactive page, and runs the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, so as to obtain encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
[0032] Optionally, the file copying unit is specifically used for:
[0033] Receive a page loading request sent by the client; the page loading request includes a page tab selected by the user;
[0034] Retrieve the JS file corresponding to the page tag selected by the user from the preset database;
[0035] The obtained js file is copied to obtain a backup of the js file.
[0036] Optionally, the public key acquisition unit is specifically used for:
[0037] Receive a page loading request sent by the client, which carries the UUID of the device to which the client belongs;
[0038] The UUID is sent to a preset key service, which then generates a key pair set based on the UUID. The key pair set includes a set of real key pairs and multiple phishing key pairs. The real key pairs include a real public key and a real private key. The phishing key pairs include a phishing public key and a phishing private key.
[0039] Receive the set of key pairs sent by the preset key service.
[0040] A computer-readable storage medium includes a stored program, wherein the program executes the file processing method described above.
[0041] A server includes: a processor, a memory, and a bus; the processor and the memory are connected via the bus.
[0042] The memory is used to store programs, and the processor is used to run programs, wherein the program executes the file processing method when it runs.
[0043] The technical solution provided in this application copies the JavaScript file requested by the client to obtain a JavaScript file backup. Based on the client's UUID, the real public key is obtained. The real public key is written into the JavaScript file backup to obtain a candidate JavaScript file. The candidate JavaScript file is obfuscated to obtain an obfuscated JavaScript file. The obfuscated JavaScript file is sent to the client, causing the client to load the rendering logic in the obfuscated JavaScript file, obtain an interactive page, and run the encryption logic in the obfuscated JavaScript file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, obtaining encrypted interactive information. This embodiment encapsulates the rendering logic in a JavaScript file. When the client requests the JavaScript file, the real public key is written into the JavaScript file backup, and the JavaScript file backup is obfuscated to obtain an obfuscated JavaScript file. This significantly increases the difficulty for malicious actors to crack the obfuscated JavaScript file, thereby significantly increasing the difficulty of automated malicious operations. Attached Figure Description
[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0045] Figure 1a This application provides a schematic diagram of the architecture of a file processing system.
[0046] Figure 1b A flowchart illustrating a document processing method provided in an embodiment of this application;
[0047] Figure 1c A flowchart illustrating a document processing method provided in an embodiment of this application;
[0048] Figure 2 A flowchart illustrating another document processing method provided in this application embodiment;
[0049] Figure 3 This is a schematic diagram of the architecture of a file processing device provided in an embodiment of this application. Detailed Implementation
[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0051] The technical terms used in the embodiments of this application are as follows.
[0052] JS file: JS is short for JavaScript, which is a scripting language. Generally, web page source files are composed of HTML and JavaScript. JS scripting language can control the display and modification of HTML markup language, and can also put all the icons and components on the page into JS files for rendering.
[0053] Cybercrime Automated Operations: Cybercriminals analyze the HTML source code of web pages (web source code cannot be hidden) to decipher the encryption methods of login, order placement, and other interfaces. They then write automated programs to simulate a normal user logging in and placing orders. E-commerce platforms often offer preferential policies for new users. Cybercriminals borrow phone numbers from [website name] and automate the login, order placement, and other actions of new users, ultimately obtaining the new user rewards offered by the marketing campaign.
[0054] Haoshan: A black market service that maintains a large number of SIM cards. These cards are specifically used to exploit various new user rewards. For example, black market company A maintains 200,000 SIM cards and then sells them. After receiving a text message, the SIM card then forwards the message content to the black market.
[0055] A Universally Unique Identifier (UUID) is a number generated on a machine that is guaranteed to be unique across all machines in the same time and space.
[0056] like Figure 1a The diagram shown is an architectural schematic of a file processing system provided in an embodiment of this application, including the following modules.
[0057] Client 100 and server 200.
[0058] The flowchart illustrating the file processing method of the file processing system is shown below. Figure 1b and Figure 1c As shown, it includes the following steps.
[0059] S101: The client sends a page loading request to the server, carrying the UUID of the client's device.
[0060] The page load request includes the page tab selected by the user.
[0061] It's important to note that whenever a client needs to execute a business function, it must send a page loading request containing the UUID of the client's device to the server. Specifically, when a client applies for a new user coupon, it needs to log in to the new user coupon page, which means sending a page loading request for the new user coupon page to the server. Furthermore, the new user coupon page includes two tabs: an "Order" button and a "New User Coupon" button. If the user selects the "Order" button on the new user coupon page, the page loading request for the new user coupon page will include the "Order" button.
[0062] S102: The server retrieves the JS file corresponding to the page tag selected by the user from the preset database.
[0063] The preset database includes JS files corresponding to multiple page tags.
[0064] In this embodiment, the JS file includes encryption logic and rendering logic. The encryption logic is used to encrypt the interactive information to obtain encrypted interactive information. Assuming the recharge page includes two page tags: a phone number input box and a recharge button, taking the recharge page (the interactive page corresponding to the recharge button) as an example, the interaction flow of the recharge page is as follows: the user enters their phone number and selects the amount, clicks "recharge," and the recharge page runs the encryption logic in the JS file to obtain the user's entered phone number and recharge amount (i.e., interactive information). Then, it encrypts the phone number and recharge amount to obtain encrypted interactive information and sends it to the business server to complete the recharge. The JS files mentioned in the prior art only contain encryption logic (the rendering logic is implemented using other interfaces). Therefore, automation by black market operators is very easy; they only need to find the encryption logic corresponding to the recharge button and directly pass in the desired phone number and amount. The encryption logic automatically performs the encryption calculation for the black market operators and requests the business server to perform the recharge.
[0065] However, the JS file shown in this application embodiment contains not only encryption logic but also rendering logic. The rendering logic is used to render the page tags selected by the user, resulting in an interactive page corresponding to those tags. Since the rendering logic is encapsulated in a JS file, and the interactive page contains an interactive flow that guides the user to input interactive information, malicious actors only know that the encryption logic exists but do not know the specific interactive information. Therefore, for malicious actors to automate their operations, they also need to crack the rendering logic to obtain the interactive flow. Cracking the rendering logic will consume time and resources, thus increasing the difficulty of malicious actors' automation.
[0066] S103: The server copies the obtained JS file to obtain a backup of the JS file.
[0067] In this process, the JS file is copied to obtain a backup. This is to ensure that the original JS file is not corrupted. Since the server needs to perform the following processing operations on the JS file every time the client sends a page load request (such as writing key pairs, injecting phishing code, obfuscation, etc.), the backup JS file is used instead of the original JS file for processing.
[0068] S104: The server sends a UUID to the preset key service so that the preset key service can generate a key pair set based on the UUID.
[0069] The key pair set includes one set of genuine key pairs and multiple phishing key pairs. The genuine key pairs include a genuine public key and a genuine private key, while the phishing key pairs include a phishing convention and a phishing private key.
[0070] S105: After receiving the key pair set from the preset key service, the server writes the real public key and each phishing public key into the js file backup to obtain the candidate js file.
[0071] By writing the real public key and various phishing public keys into a backup of a JS file to obtain a candidate JS file, it is ensured that only real users can obtain the real public key by following the interaction process shown in the candidate JS file. If the black market automates to run the candidate JS file, since the black market automates lack user operation steps and the real public key is not obtained through the interface in the current technology, the black market automates can only obtain the phishing public key, ensuring that the black market automates cannot successfully execute the correct encryption operation, thereby effectively increasing the difficulty of black market automates.
[0072] Furthermore, compared to existing encryption methods (i.e., calling an interface to obtain a real key to encrypt information), this embodiment writes the real key into a js file. Black market automation requires cracking the js file to obtain the real key, thus increasing the difficulty of black market automation.
[0073] S106: The server injects the pre-set phishing code into the candidate js file to obtain the target js file.
[0074] The method involves embedding pre-set phishing code into candidate JavaScript files. By modifying the definitions of various variable names in these candidate JavaScript files, the target JavaScript file can be obtained. Each time the client sends a page load request, the definitions of various variable names in the target JavaScript file are changed, meaning that the JavaScript file obtained by the client is different each time. This necessitates that automated phishing attacks target a massive number of JavaScript files, significantly increasing the time cost of cracking and thus raising the difficulty of such attacks.
[0075] Specifically, the phishing code contained in the target JS file can be as follows:
[0076] Line 100: Varuis = "real public key";
[0077] Line 501: Varxsa = "Phishing public key 1";
[0078] Line xxx: Var s1a = "Phishing Public Key 2";
[0079] Line xxx: Varx01 = "Phishing Public Key 3".
[0080] S107: The server obfuscates the target JS file to obtain an obfuscated JS file.
[0081] Obfuscating the target JavaScript file involves changing variable names within it, resulting in an obfuscated JavaScript file. Each time a client sends a page load request, the variable names in the obfuscated JavaScript file change, meaning the JavaScript file received by the client is different each time. This necessitates hacking a massive number of JavaScript files, significantly increasing the time and effort required for automated hacking operations, thus further complicating the process.
[0082] S108: The server sends the obfuscated JS file to the client.
[0083] S109: The client loads the rendering logic in the obfuscated JS file to obtain the interactive page corresponding to the page tag selected by the user.
[0084] The interactive page includes an interactive process that guides users to input interactive information.
[0085] It should be noted that, assuming the client is a client simulated by the black market automation, the black market automation is unmanned. Since the interactive page needs to load the rendering logic in the obfuscated JS file, the black market automation is unaware of the interactive information. It needs to crack the rendering logic to find out what specific interactive information is needed, thus increasing the difficulty of the black market automation.
[0086] S110: The client runs the encryption logic in the obfuscated JS file to call the real public key and encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, thus obtaining encrypted interactive information.
[0087] If the client is not a real user's client, i.e., a client simulated by the black market automation, then the black market automation cannot easily obtain the real public key by loading the encryption logic in the obfuscated JS file. Therefore, the black market automation will most likely obtain the phishing public key, effectively increasing the difficulty of the black market automation.
[0088] S111: The client calls the preset business interface to send the encrypted interaction information to the business server, so that the business server can verify the encrypted interaction information and obtain the verification result.
[0089] The specific implementation process of the business server verifying the encrypted interaction information can be as follows: The business server sends the encrypted interaction information to a preset key service. The preset key service uses the real private key to decrypt the encrypted interaction information. If the decryption result of the encrypted interaction information is successful, the verification result is determined to be that the encrypted interaction information has passed verification. If the decryption result of the encrypted interaction information fails, the encrypted interaction information is decrypted a second time using a phishing private key. If the second decryption result of the encrypted interaction information is successful, the client is determined to be a client impersonated by black market automation. The business server adds the client to a preset blacklist and prohibits receiving any requests sent by the client. If the second decryption result of the encrypted interaction information fails, the verification result is determined to be that the encrypted interaction information has failed verification.
[0090] In this embodiment, if the verification result indicates that the encrypted interaction information has passed verification, the service server will execute the service request shown in the encrypted interaction information, obtain the service execution result, and send the service execution result back to the client. If the verification result indicates that the encrypted interaction information has failed verification, the service server will not execute the service request shown in the encrypted interaction information, but will only send a request failure message back to the client.
[0091] It should be noted that if the client is identified as a fake client created by automated black market operations, the business server will add the client to a preset blacklist to prevent the automated black market operations from impersonating the client to exploit loopholes, thus increasing the difficulty of such operations.
[0092] S112: If the verification result indicates that the encrypted interaction information has passed verification, the client receives the business execution result from the business server.
[0093] In summary, this embodiment encapsulates the rendering logic in a JS file. When the client requests the JS file, the real public key is written to the JS file backup, and the JS file backup is obfuscated to obtain an obfuscated JS file. This greatly increases the difficulty for black market operators to crack the obfuscated JS file, thereby significantly increasing the difficulty of black market automation.
[0094] It should be noted that the file processing method of the file processing system mentioned in the above embodiments can be summarized as follows: Figure 2 The method shown.
[0095] like Figure 2 The diagram shown is a flowchart of another file processing method provided in this application embodiment, including the following steps.
[0096] S201: Copy the JS file requested by the client to obtain a backup of the JS file.
[0097] The JS file includes encryption logic and rendering logic. The encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information. The rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag.
[0098] Optionally, the specific implementation process of S201 can be as follows: receiving a page loading request sent by the client; the page loading request includes the page tag selected by the user; retrieving the js file corresponding to the page tag selected by the user from a preset database; copying the obtained js file to obtain a backup of the js file.
[0099] S202: Obtain the real public key based on the client's UUID.
[0100] Optionally, the specific implementation process of S202 can be as follows: receiving a page loading request sent by the client carrying the UUID of the device to which the client belongs; sending the UUID to the preset key service so that the preset key service generates a key pair set based on the UUID; the key pair set includes a set of real key pairs and multiple sets of phishing key pairs; the real key pairs include a real public key and a real private key; the phishing key pairs include a phishing public key and a phishing private key; and receiving the key pair set sent by the preset key service.
[0101] S203: Write the real public key into the backup of the js file to obtain the candidate js file.
[0102] Optionally, the specific implementation process of S203 can be as follows: write the real public key and each phishing public key into the js file backup to obtain the candidate js file.
[0103] S204: Obfuscate the candidate JS file to obtain an obfuscated JS file.
[0104] Optionally, the specific implementation process of S204 can be as follows: inject the preset phishing code into the candidate js file to obtain the target js file; obfuscate the target js file to obtain the obfuscated js file.
[0105] S205: Send the obfuscated JS file to the client so that the client loads the rendering logic in the obfuscated JS file, obtains the interactive page, and runs the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, and obtains encrypted interactive information.
[0106] The encrypted interaction information is used to request the business server to obtain the business execution result.
[0107] In summary, this embodiment encapsulates the rendering logic in a JS file. When the client requests the JS file, the real public key is written to the JS file backup, and the JS file backup is obfuscated to obtain an obfuscated JS file. This greatly increases the difficulty for black market operators to crack the obfuscated JS file, thereby significantly increasing the difficulty of black market automation.
[0108] Corresponding to the document processing provided in the above embodiments of this application, the embodiments of this application also provide a document processing apparatus.
[0109] like Figure 3 The diagram shown is an architectural schematic of a file processing device provided in an embodiment of this application, including the following units.
[0110] File copy unit 301 is used to copy the JS file requested by the client to obtain a backup of the JS file; the JS file includes encryption logic and rendering logic; the encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; the rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag.
[0111] Optionally, the file copy unit 301 is specifically used for: receiving a page loading request sent by the client; the page loading request includes a page tag selected by the user; retrieving the js file corresponding to the page tag selected by the user from a preset database; and copying the obtained js file to obtain a backup of the js file.
[0112] The public key acquisition unit 302 is used to obtain the real public key based on the client's UUID.
[0113] Optionally, the public key acquisition unit 302 is specifically used for: receiving a page loading request sent by the client carrying the UUID of the device to which the client belongs; sending the UUID to the preset key service so that the preset key service generates a key pair set based on the UUID; the key pair set includes a set of real key pairs and multiple sets of phishing key pairs; the real key pairs include a real public key and a real private key; the phishing key pairs include a phishing public key and a phishing private key; and receiving the key pair set sent by the preset key service.
[0114] Public key writing unit 303 is used to write the real public key into the js file backup to obtain the candidate js file.
[0115] Optionally, the public key writing unit 303 is specifically used to: write the real public key and each phishing public key into the js file backup to obtain the candidate js file.
[0116] Public key obfuscation unit 304 is used to obfuscate candidate JS files to obtain obfuscated JS files.
[0117] Optionally, the public key obfuscation unit 304 is specifically used for: injecting preset phishing code into a candidate js file to obtain a target js file; and obfuscating the target js file to obtain an obfuscated js file.
[0118] The file sending unit 305 is used to send an obfuscated JS file to the client, so that the client loads the rendering logic in the obfuscated JS file, obtains the interactive page, and runs the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, and obtains encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
[0119] In summary, this embodiment encapsulates the rendering logic in a JS file. When the client requests the JS file, the real public key is written to the JS file backup, and the JS file backup is obfuscated to obtain an obfuscated JS file. This greatly increases the difficulty for black market operators to crack the obfuscated JS file, thereby significantly increasing the difficulty of black market automation.
[0120] This application also provides a computer-readable storage medium including a stored program, wherein the program executes the file processing method provided in this application.
[0121] This application also provides a server, including a processor, a memory, and a bus. The processor and the memory are connected via the bus. The memory is used to store programs, and the processor is used to run the programs. When the program runs, it executes the file processing method provided in this application, including the following steps:
[0122] The JavaScript file requested by the client is copied to obtain a backup of the JavaScript file; the JavaScript file includes encryption logic and rendering logic; the encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; the rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag;
[0123] Based on the client's UUID, obtain the real public key;
[0124] Write the real public key into the backup of the js file to obtain the candidate js file;
[0125] The candidate JS files are obfuscated to obtain obfuscated JS files;
[0126] The obfuscated JS file is sent to the client, causing the client to load the rendering logic in the obfuscated JS file, obtain the interactive page, and run the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, thereby obtaining encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
[0127] Specifically, based on the above embodiments, the step of copying the JS file requested by the client to obtain a JS file backup includes:
[0128] Receive a page loading request sent by the client; the page loading request includes a page tab selected by the user;
[0129] Retrieve the JS file corresponding to the page tag selected by the user from the preset database;
[0130] The obtained js file is copied to obtain a backup of the js file.
[0131] Specifically, based on the above embodiments, obtaining the real public key based on the client's UUID includes:
[0132] Receive a page loading request sent by the client, which carries the UUID of the device to which the client belongs;
[0133] The UUID is sent to a preset key service, which then generates a key pair set based on the UUID. The key pair set includes a set of real key pairs and multiple phishing key pairs. The real key pairs include a real public key and a real private key. The phishing key pairs include a phishing public key and a phishing private key.
[0134] Receive the set of key pairs sent by the preset key service.
[0135] Specifically, based on the above embodiments, the step of writing the real public key into the js file backup to obtain the candidate js file includes:
[0136] The real public key and each of the phishing public keys are written into the js file backup to obtain the candidate js file.
[0137] Specifically, based on the above embodiments, the obfuscation process of the candidate JS file to obtain an obfuscated JS file includes:
[0138] The pre-defined phishing code is injected into the candidate js file to obtain the target js file;
[0139] The target JS file is obfuscated to obtain an obfuscated JS file.
[0140] If the functions described in the embodiments of this application are implemented as software functional units and sold or used as independent products, they can be stored in a computing device readable storage medium. Based on this understanding, the parts of the embodiments of this application that contribute to the prior art or the technical solutions can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computer, server, mobile computing device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.
[0141] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0142] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A file processing method, characterized in that, include: Copy the JS file requested by the client to obtain a backup of the JS file; The JS file includes encryption logic and rendering logic; The encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; The rendering logic is used to render the page tag selected by the user to obtain an interactive page corresponding to the page tag; Receive a page loading request sent by the client, which carries the UUID of the device to which the client belongs; Send the UUID to the preset key service so that the preset key service generates a key pair set based on the UUID; Receive the set of key pairs sent by the preset key service; Write the real public key and each phishing public key in the key pair set into the js file backup to obtain the candidate js file; The candidate JS files are obfuscated to obtain obfuscated JS files; The obfuscated JS file is sent to the client, causing the client to load the rendering logic in the obfuscated JS file, obtain the interactive page, and run the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information entered by the user according to the interactive process shown on the interactive page, thereby obtaining encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
2. The method according to claim 1, characterized in that, The step of copying the JS file requested by the client to obtain a backup of the JS file includes: Receive a page loading request sent by the client; the page loading request includes a page tab selected by the user; Retrieve the JS file corresponding to the page tag selected by the user from the preset database; The obtained js file is copied to obtain a backup of the js file.
3. The method according to claim 1, characterized in that, The obfuscation process for the candidate JS files to obtain obfuscated JS files includes: The pre-defined phishing code is injected into the candidate js file to obtain the target js file; The target JS file is obfuscated to obtain an obfuscated JS file.
4. A document processing device, characterized in that, include: The file copy unit is used to copy the js file requested by the client to obtain a backup of the js file; The JS file includes encryption logic and rendering logic; The encryption logic is used to encrypt the interactive information input by the user to obtain encrypted interactive information; the rendering logic is used to render the page tag selected by the user to obtain the interactive page corresponding to the page tag. The public key acquisition unit is used to: receive a page loading request sent by the client, which carries the UUID of the device to which the client belongs; Send the UUID to the preset key service so that the preset key service generates a key pair set based on the UUID; Receive the set of key pairs sent by the preset key service; The public key writing unit is used to write the real public key and each phishing public key in the key pair set into the js file backup to obtain the candidate js file; A public key obfuscation unit is used to obfuscate the candidate JS file to obtain an obfuscated JS file; The file sending unit is used to send the obfuscated JS file to the client, so that the client loads the rendering logic in the obfuscated JS file, obtains the interactive page, and runs the encryption logic in the obfuscated JS file to call the real public key to encrypt the interactive information input by the user according to the interactive process shown on the interactive page, so as to obtain encrypted interactive information; the encrypted interactive information is used to request the business server to obtain the business execution result.
5. The apparatus according to claim 4, characterized in that, The file copying unit is specifically used for: Receive a page loading request sent by the client; the page loading request includes a page tab selected by the user; Retrieve the JS file corresponding to the page tag selected by the user from the preset database; The obtained js file is copied to obtain a backup of the js file.
6. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program performs the file processing method according to any one of claims 1-3.
7. A server, characterized in that, include: Processor, memory, and bus; The processor and the memory are connected via the bus; The memory is used to store a program, and the processor is used to run the program, wherein the program executes the file processing method according to any one of claims 1-3 when it runs.