Method for generating and running executable files

Abstract

The present application relates to a file generation method and a file running method for an executable file. Based on the present application, the constant information of the source code can be set as the object topology form of the constant object, and the executable file of the source code can be generated by using the multi-layer nested ciphertext obtained by encrypting the constant object. Among them, the decryption and restoration method of the multi-layer nested ciphertext during the operation of the executable file is set as a local decryption and restoration controlled by the memory life cycle. Therefore, at any time during the operation of the executable file, only the local plaintext of the constant information may appear transiently in the memory, so as to avoid the constant information from appearing in the memory in the form of complete plaintext. The reliability of information security protection of the constant information of the source code is improved. In addition, the object ciphertext of the leaf node object of the object topology in the multi-layer nested ciphertext can be an encrypted ciphertext of the disguised information plaintext after obfuscation, thereby further improving the reliability of information security protection.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method for generating an executable file, a method for running an executable file, a device for generating an executable file, a device for running an executable file, an electronic device, a non-transitory computer-readable storage medium, and a computer program product. Background Art

[0002] In addition to the executable code for providing application services, the source code may also include constant information mixed in the source code with the executable code. The plain text content of the constant information can indirectly reflect some key technical information required to implement the application service, and these key technical information are not expected to be disclosed. Therefore, in order to prevent these key technical information from being maliciously obtained by profiling the constant information, the source code can be globally obfuscated to protect the information security of the constant information.

[0003] Global obfuscation of the source code can increase the difficulty of obtaining constant information. However, the constant information is still fully mixed in the source code in plain text form. Therefore, if reverse deobfuscation methods such as brute force enumeration are used, all the plain text content and contextual relationships of the constant information can still be restored from the globally obfuscated source code.

[0004] Therefore, how to improve the reliability of information security protection of constant information of source code has become a technical problem to be solved in the prior art. Summary of the invention

[0005] The embodiments of the present application provide a method for generating an executable file, a method for running an executable file, a device for generating an executable file, a device for running an executable file, an electronic device, a non-transitory computer-readable storage medium, and a computer program product, which help to improve the reliability of information security protection of constant information of source code.

[0006] In one embodiment of the present application, a method for generating an executable file is provided, comprising:

[0007] Performing encryption processing on constant objects; wherein the object topology of the constant objects is used to characterize constant information of the source code, and the encryption processing is used to hierarchically encrypt the object topology into multiple layers of nested ciphertexts, so that the nesting relationship of the object ciphertexts of the node objects in the object topology in the multiple layers of nested ciphertexts matches the topological relationship between the node objects in the object topology;

[0008] An executable file is generated using the source code and the multi-layer nested ciphertext; wherein the executable file is configured to: perform local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that matches the object call, the local decryption and restoration being used to decrypt and restore in memory the object ciphertext of the node object specified by the object call request in the object topology and other node objects passing through the topological path between the node object and the root node object in the object topology; and limit the memory lifecycle of the restored content obtained by the local decryption and restoration in memory to the call lifecycle of the object call.

[0009] In some examples, optionally, the node objects in the object topology are used to represent the plaintext content of the constant information; the hierarchical encryption is specifically configured to: encrypt the plaintext content of the information represented by the node objects in the object topology into the object ciphertext of the node object; according to the topological relationship, nest the object ciphertext of the node objects in the object topology layer by layer, so that the nesting relationship of the object ciphertext of the node objects in the object topology in the multi-layer nested ciphertext matches the topological relationship.

[0010] In some examples, optionally, the encryption processing is also used to perform obfuscation processing on the object topology before the hierarchical encryption; wherein the node objects in the object topology include root node objects, branch node objects, and leaf node objects, and the obfuscation processing is used to replace the plaintext content of the information represented by the leaf node objects in the object topology with pre-set disguised plaintext content.

[0011] In some examples, optionally, the plain text content of the information represented by the leaf node object is the smallest content element in the plain text content of the constant information.

[0012] In some examples, optionally, the node objects in the object topology also include branch node objects and leaf node objects; the hierarchical encryption is specifically configured to: encapsulate the object ciphertext of the leaf node objects and branch node objects in the object topology as the inner ciphertext of the multi-layer nested ciphertext, and the hierarchical encryption also encapsulates the object ciphertext of the root node object in the object topology as the outer ciphertext of the multi-layer nested ciphertext; the executable file is also configured to: decrypt and restore the outer ciphertext of the multi-layer nested ciphertext in memory in response to the execution of the executable file; the local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that performs a matching object call includes: performing the local decryption and restoration on the inner ciphertext in the multi-layer nested ciphertext.

[0013] In some examples, optionally, the encryption processing is also used to: perform obfuscation processing on leaf node objects in the object topology; wherein the hierarchical encryption is performed after the obfuscation processing, the plaintext content of the information represented by the leaf node object is the smallest content element in the plaintext content of the constant information, the obfuscation processing is used to replace the plaintext content of the information represented by the leaf node object with a pre-set disguised plaintext content, the object ciphertext of the leaf node object includes an encrypted ciphertext of the disguised plaintext content, and the object ciphertext of the leaf node object is located at the innermost layer of the multi-layer nested ciphertext.

[0014] In some examples, optionally, the encrypting the constant object includes: serializing the constant object; and encrypting serialized object information obtained by the serialization.

[0015] In some examples, optionally, the generating an executable file by using the source code and the multi-layer nested ciphertext includes: generating the executable file by compiling the source code and the multi-layer nested ciphertext.

[0016] In some examples, optionally, generating the executable file by compiling the source code and the multi-layer nested ciphertext includes: generating a header file using the multi-layer nested ciphertext; and compiling the source code and the header file to generate the executable file.

[0017] In another embodiment of the present application, a method for running an executable file is provided, comprising:

[0018] In response to an object call request received during the execution of an executable file, local decryption and restoration are performed on multi-layer nested ciphertexts; wherein the multi-layer nested ciphertexts are obtained by hierarchically encrypting an object topology of a constant object, the object topology is used to characterize constant information of a source code of the executable file, the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology, and the local decryption and restoration is used to decrypt and restore in memory the object ciphertexts of the node object specified by the object call request and other node objects passing through the topological path between the node object and the root node object in the object topology;

[0019] In response to completion of the calling of the object calling request, the memory life cycle of the restored content obtained by the local decryption and restoration in the memory is ended.

[0020] In some examples, optionally, the node objects in the object topology are used to represent the plain text content of the constant information, and the object ciphertext of each node object in the object topology is obtained by encrypting the plain text content of the information represented by the node object.

[0021] In some examples, optionally, the node objects in the object topology also include branch node objects and leaf node objects, the outer ciphertext of the multi-layer nested ciphertext is the object ciphertext of the root node object in the object topology, and the inner ciphertext of the multi-layer nested ciphertext includes the object ciphertext of the leaf node objects and branch node objects of the object topology; the running method also includes: in response to the start of the running of the executable file, decrypting and restoring the outer ciphertext of the multi-layer nested ciphertext in memory; the local decryption and restoration is specifically configured to perform decryption and restoration on the object ciphertext of the leaf node object or the branch node object specified by the object call request.

[0022] In some examples, optionally, the plain text content of the information represented by the leaf node object is the smallest content element in the plain text content of the constant information.

[0023] In some examples, optionally, the object ciphertext of the leaf node object is located in the innermost layer of the multi-layer nested ciphertext, and the restored content obtained by decrypting and restoring the object ciphertext of the leaf node object in memory is a disguised plaintext content that replaces the plaintext content of the information.

[0024] In some examples, optionally, the multi-layer nested ciphertext is obtained by encrypting serialized object information of the constant big data, and the decryption and restoration of the object ciphertext of any node object in memory also includes deserialization of the restored content.

[0025] In some examples, optionally, the completion of the call in response to the object call request ends the memory lifecycle of the restored content obtained by the local decryption and restoration in the memory, including: the destruction of the restored content restored by the local decryption and restoration in the memory in response to the completion of the call in response to the object call request.

[0026] In another embodiment of the present application, a device for generating an executable file is provided, comprising:

[0027] An object encryption module, used for performing encryption processing on constant objects; wherein the object topology of the constant objects is used to characterize the constant information of the source code, and the encryption processing is used to hierarchically encrypt the object topology into multi-layer nested ciphertexts, so that the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology;

[0028] Generate an execution module, which is used to generate an executable file using the source code and the multi-layer nested ciphertext; wherein the executable file is configured to: perform local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that matches the object call, the local decryption and restoration is used to decrypt and restore in memory the object ciphertext of the node object specified by the object call request in the object topology and other node objects passed through the topological path between the node object and the root node object in the object topology; and limit the memory life cycle of the restored content obtained by the local decryption and restoration in memory to the call life cycle of the object call.

[0029] In some examples, optionally, the node objects in the object topology are used to represent the plaintext content of the constant information; the hierarchical encryption is specifically configured to: encrypt the plaintext content of the information represented by the node objects in the object topology into the object ciphertext of the node object; nest the object ciphertexts of the node objects in the object topology layer by layer according to the topological relationship between the node objects in the object topology, and the nesting relationship of the object ciphertexts of the node objects in the object topology in the multiple layers of nested ciphertexts matches the topological relationship.

[0030] In some examples, optionally, the object encryption module is also used to perform obfuscation processing on the object topology before the hierarchical encryption; wherein, the node objects in the object topology include root node objects, branch node objects, and leaf node objects, and the obfuscation processing is used to replace the plaintext content of the information represented by the leaf node objects in the object topology with pre-set disguised plaintext content.

[0031] In some examples, optionally, the plain text content of the information represented by the leaf node object is the smallest content element in the plain text content of the constant information.

[0032] In some examples, optionally, the node objects in the object topology also include branch node objects and leaf node objects; the hierarchical encryption encapsulates the object ciphertexts of the leaf node objects and the branch node objects in the object topology as inner ciphertexts of the multi-layer nested ciphertexts, and the hierarchical encryption also encapsulates the object ciphertexts of the root node objects in the object topology as outer ciphertexts of the multi-layer nested ciphertexts, and the executable file is further configured to: decrypt and restore the outer ciphertexts of the multi-layer nested ciphertexts in memory in response to the execution of the executable file; the local decryption and restoration of the object ciphertexts in the multi-layer nested ciphertexts that matches the object calls includes: performing local decryption and restoration of the inner ciphertexts in the multi-layer nested ciphertexts that matches the object calls.

[0033] In some examples, optionally, the object encryption module is also used to perform obfuscation processing on leaf node objects in the object topology; wherein the hierarchical encryption is performed after the obfuscation processing, and the obfuscation processing is used to replace the information plaintext content of the leaf node object with a preset disguised plaintext content, the object ciphertext of the leaf node object includes an encrypted ciphertext of the disguised plaintext content, the information plaintext content represented by the leaf node object is the smallest content element in the information plaintext content of the constant information, and the object ciphertext of the leaf node object is located in the innermost layer of the multi-layer nested ciphertext.

[0034] In some examples, optionally, the encryption module is specifically configured to: serialize the constant object; and encrypt the serialized object information obtained by the serialization process.

[0035] In some examples, optionally, the generation execution module is specifically configured to generate the executable file by compiling the source code and the multi-layer nested ciphertext.

[0036] In some examples, optionally, the generation execution module is specifically configured to: generate a header file using the multi-layer nested ciphertext; and compile the source code and the header file to generate an executable file.

[0037] In another embodiment of the present application, a file running device for an executable file is provided, comprising:

[0038] A decryption and restoration module, for performing local decryption and restoration on multi-layer nested ciphertexts in response to an object call request received during the execution of an executable file; wherein the multi-layer nested ciphertexts are obtained by hierarchically encrypting an object topology of a constant object, the object topology is used to characterize constant information of the source code of the executable file, the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology, and the local decryption and restoration is used to decrypt and restore in memory the object ciphertexts of the node object specified by the object call request and other node objects passing through the topological path between the node object and the root node object in the object topology;

[0039] The cycle management module is used to terminate the memory life cycle of the restored content obtained by the partial decryption and restoration in the memory in response to the completion of the calling of the object calling request.

[0040] In some examples, optionally, the nesting relationship of the object ciphertext of the node object in the object topology in the multi-layer nested ciphertext matches the topological relationship, the node object in the object topology is used to represent the plaintext content of the constant information, and the object ciphertext of each node object in the object topology is obtained by encrypting the plaintext content of the information represented by the node object.

[0041] In some examples, optionally, the node objects in the object topology also include branch node objects and leaf node objects, the outer ciphertext of the multi-layer nested ciphertext is the object ciphertext of the root node object in the object topology, and the inner ciphertext of the multi-layer nested ciphertext includes the object ciphertext of the leaf node objects and branch node objects of the object topology; the decryption and restoration module is also used to: in response to the start of the execution of the executable file, decrypt and restore the outer ciphertext of the multi-layer nested ciphertext in memory; the local decryption and restoration is specifically configured to: perform decryption and restoration on the object ciphertext of the leaf node object or the branch node object specified by the object call request.

[0042] In some examples, optionally, the plaintext content of the information represented by the leaf node object is the smallest content element in the plaintext content of the constant information, the object ciphertext of the leaf node object is located in the innermost layer of the multi-layer nested ciphertext, and the restored content obtained by decrypting and restoring the object ciphertext of the leaf node object in memory is the disguised plaintext content that replaces the plaintext content of the information.

[0043] In some examples, optionally, the multi-layer nested ciphertext is obtained by encrypting the serialized object information of the constant big data, and the decryption and restoration module decrypts and restores the object ciphertext of any node object in memory and also includes deserialization of the restored content.

[0044] In some examples, optionally, the cycle management module is specifically configured to: in response to completion of the call of the object call request, destroy the restored content that is partially decrypted and restored to the memory.

[0045] In another embodiment of the present application, an electronic device is provided, comprising a processor, wherein the processor is used to execute at least one of the file generation method as described in the above embodiment and the file operation method as described in the above embodiment.

[0046] In another embodiment of the present application, a non-transitory computer-readable storage medium is provided, which stores instructions, and when the instructions are executed by a processor, the processor executes at least one of the file generation method described in the aforementioned embodiment and the file operation method described in the aforementioned embodiment.

[0047] In another embodiment of the present application, a computer program product is provided, comprising computer executable instructions, which, when executed by a processor, implement at least one of the file generation method described in the aforementioned embodiment and the file operation method described in the aforementioned embodiment.

[0048] Based on the above embodiments of the present application, the constant information of the source code can be set as the object topology form of the constant object, and the multi-layer nested ciphertext obtained by encrypting the constant object can be used to generate the executable file of the source code. Since the node objects in the object topology of the constant object are nested in the multi-layer nested ciphertext in the form of object ciphertext, the information plaintext content represented by the node objects in the object topology of the constant object will not appear normally in the memory during the operation of the executable file; and since the decryption and restoration method of the multi-layer nested ciphertext during the operation of the executable file is set as a local decryption and restoration controlled by the memory life cycle, even if the information plaintext content is allowed to be decrypted and restored in the memory, at any time during the operation of the executable file, only the local plaintext of the constant information may appear transiently in the memory, and the constant information will not appear normally in the memory in the form of complete plaintext. Thus, by avoiding the normal appearance of constant information in the memory in the form of complete plaintext, it can help to improve the reliability of information security protection of constant information of the source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The following drawings are only used to illustrate and explain the present application, and do not limit the scope of the present application:

[0050] Figure 1 This is a schematic diagram of an exemplary process of a method for generating an executable file in an embodiment of the present application;

[0051] Figure 2 A schematic diagram of a first encryption instance of encrypting a constant object by a file generation method for an executable file in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a second encryption example of encrypting a constant object by the file generation method of an executable file in an embodiment of the present application;

[0053] Figure 4 This is a schematic diagram of an example flow of a method for generating an executable file in an embodiment of the present application;

[0054] Figure 5 This is a schematic diagram of an exemplary flow chart of a method for running an executable file in an embodiment of the present application;

[0055] Figure 6A schematic diagram of a first restoration example of partially decrypting and restoring multi-layer nested ciphertexts by a file running method of an executable file in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of a second restoration example of partially decrypting and restoring multi-layer nested ciphertexts by the file running method of the executable file in the embodiment of the present application;

[0057] Figure 8 This is a schematic diagram of an exemplary structure of a file generating device for an executable file in an embodiment of the present application;

[0058] Fig. 9 The present invention is a schematic diagram of an exemplary structure of a file running device for an executable file in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below with reference to the accompanying drawings and examples.

[0060] In an embodiment of the present application, constant information in the source code can be stripped from the source code, and the constant information stripped from the source code can be set as the object topology form of the constant object. Thus, by encrypting the constant object, the constant information is in a ciphertext state in the generated executable file, and at any time during the running of the executable file, only part of the constant information is allowed to appear in the memory in plaintext form, that is, the constant information is prevented from appearing in the memory in a complete plaintext form. Furthermore, by preventing the constant information from appearing in the memory in a complete plaintext form, the reliability of the information security protection of the constant information of the source code is improved.

[0061] Figure 1 FIG. 1 is a schematic diagram of an exemplary process of a method for generating an executable file in an embodiment of the present application. Figure 1 The method for generating an executable file shown is suitable for being executed by a developer of the executable file.

[0062] See also Figure 1 In an embodiment of the present application, a method for generating an executable file may include:

[0063] S110: encrypting the constant object; wherein the object topology of the constant object is used to represent the constant information of the source code, and the encryption processing of the constant object is used to hierarchically encrypt the object topology of the constant object into multiple layers of nested ciphertext.

[0064] Exemplarily, in an embodiment of the present application, the constant information represented by the object topology of the constant object encrypted in S110 may be constant information stripped from the source code. For example, the node objects in the object topology of the constant object may have information plaintext content for representing the constant information of the source code, and the topological relationship between the node objects in the object topology of the constant object is used to represent the contextual relationship of the information plaintext content of the constant information of the source code.

[0065] Exemplarily, in an embodiment of the present application, in the encryption processing performed in S110, the hierarchical encryption implemented for the object topology of the constant object can be specifically configured as: encrypting the plaintext content of the information represented by the node objects in the object topology of the constant object into the object ciphertext of the node object, that is, the object ciphertext of each node object in the object topology of the constant object in the multi-layer nested ciphertext is obtained by encrypting the plaintext content of the information represented by the node object; and, according to the topological relationship between the node objects in the object topology of the constant object, the object ciphertext of the node objects in the object topology of the constant object is nested layer by layer, so that the nesting relationship of the object ciphertext of the node objects in the object topology of the constant object in the multi-layer nested ciphertext matches the topological relationship between the node objects in the object topology of the constant object.

[0066] Exemplarily, in an embodiment of the present application, in the multi-layer nested ciphertext obtained by encryption processing in S110, the object ciphertext of any pair of node objects in the topological relationship of the object topology that are in a parent-child relationship can adopt a nested relationship in which the object ciphertext of the child node object is embedded in the object ciphertext of the parent node object. For example, the object topology of the constant object can be a tree topology, and the node objects in the object topology of the constant object can include a root node object, a branch node object, and a leaf node object. In this case: the root node object and the branch node object of the next level are a pair of node objects with a parent-child relationship, the root node object is the parent node object, and the branch node object of the next level is the child node object; similarly, each branch node and the branch node or leaf node of the next level are a pair of node objects with a parent-child relationship, and the branch node is the parent node object, and the branch node or leaf node of the next level is the child node object; the leaf node can only be used as a child node object in a pair of node objects with a parent-child relationship formed with any branch node of the previous level.

[0067] Figure 2 This is a schematic diagram of a first encryption example of encrypting a constant object in the method for generating an executable file in an embodiment of the present application. Figure 2In an embodiment of the present application, the object topology of the constant object 20 may be a tree topology, which may include multiple leaf node objects Obj_end_1 to Obj_end_M, where M is a positive integer greater than 1, and there is a corresponding topological path between each leaf node object Obj_end_i and the root node Obj_root of the object topology, which passes through several branch node objects Obj_brc_j, i is a positive integer greater than 1 and less than or equal to M, j is a natural number used to distinguish different branch node objects, and the numerical order of i and j is independent of the position of the node object in the object topology. In this case, hierarchical encryption of the object topology of the constant object 20 may include encrypting layer by layer from each leaf node object Obj_end_i along the corresponding topological path to the root node Obj_root, and in the topological path corresponding to each leaf node object Obj_end_i, the encrypted ciphertext of each node object is embedded in the parent node object of the node object. Among them, the parent node object described here refers to the explanation in the previous text, and, Figure 2 In the above, "Enc()" is used to represent the object ciphertext, that is, each node object in the object topology of the constant object is represented by "Enc()" as the object ciphertext, which can be obtained by encrypting the plaintext content of the information represented by the node object.

[0068] Thus, the nested relationship of the object ciphertext of the node object in the object topology of the constant object in the multi-layer nested ciphertext matches the topological relationship between the node objects in the object topology of the constant object. Furthermore, the hierarchical encryption of the object topology of the constant object at S110 can be specifically configured as follows: encapsulating the object ciphertext of the leaf node object and the branch node object in the object topology of the constant object as the inner ciphertext of the multi-layer nested ciphertext, and encapsulating the object ciphertext of the root node object in the object topology of the constant object as the outer ciphertext of the multi-layer nested ciphertext. Among them, the object ciphertext of the leaf node object in the object topology of the constant object is located in the innermost layer of the multi-layer nested ciphertext.

[0069] Still see Figure 1 In an embodiment of the present application, the method for generating an executable file may further include:

[0070] S130: Generate an executable file using source code and multi-layer nested ciphertexts; wherein the executable file is configured to: perform local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that matches the object call, and limit the memory lifecycle of the restored content obtained by the local decryption and restoration in the memory to the call lifecycle of the object call.

[0071] Exemplarily, in an embodiment of the present application, the above configuration of the executable file may be implemented through code settings of the source code.

[0072] Exemplarily, if in S110 the object ciphertexts of leaf node objects and branch node objects in the object topology of the constant object are encapsulated as inner ciphertexts of multi-layer nested ciphertexts, and the object ciphertexts of the root node objects in the object topology of the constant object are encapsulated as outer ciphertexts of multi-layer nested ciphertexts, then the executable file generated by S130 may also be configured to: decrypt and restore the outer ciphertexts of the multi-layer nested ciphertexts in memory in response to the execution start of the executable file; and the executable file generated by S130 performs local decryption and restoration of matching object calls on the object ciphertexts in the multi-layer nested ciphertexts, which may include: performing local decryption and restoration of matching object calls on the inner ciphertexts in the multi-layer nested ciphertexts.

[0073] Exemplarily, in an embodiment of the present application, an object call to an executable file may be initiated by an application service, and local decryption and restoration of a matching object call may refer to: only decrypting and restoring the called node object and other node objects along the topological path between the node object and the root node object. Therefore, the restored content of the local decryption and restoration of each execution of the matching object call is limited to a portion of the plaintext content of the constant information.

[0074] Exemplarily, in an embodiment of the present application, limiting the memory lifecycle of the restored content obtained by partial decryption and restoration in memory to the call lifecycle of the object call may mean that the start of the memory lifecycle of the restored content is no earlier than the start of the call lifecycle, and the end of the memory lifecycle of the restored content is no later than the end of the call lifecycle, and the end of the memory lifecycle of the restored content means that the restored content disappears in the memory. That is, in order to limit the memory lifecycle of the restored content obtained by partial decryption and restoration in memory, the restored content in memory may be destroyed in response to the end of the call lifecycle of the object call.

[0075] Based on the file generation method of the executable file in the embodiment of the present application, the constant information of the source code can be set as the object topology form of the constant object, and the multi-layer nested ciphertext obtained by encrypting the constant object can be used to generate the executable file of the source code. Since the node objects in the object topology of the constant object are nested in the multi-layer nested ciphertext in the form of object ciphertext, during the operation of the executable file, the information plaintext content represented by the node objects in the object topology of the constant object will not appear normally in the memory; and since the decryption and restoration method of the multi-layer nested ciphertext during the operation of the executable file is set as a local decryption and restoration controlled by the memory life cycle, even if the information plaintext content is decrypted and restored in the memory, at any time during the operation of the executable file, only the local plaintext of the constant information may appear transiently in the memory, and the constant information will not appear normally in the memory in the form of complete plaintext. Thus, by avoiding the normal appearance of constant information in the memory in the form of complete plaintext, it can help to improve the reliability of information security protection of constant information of the source code.

[0076] Figure 3 This is a schematic diagram of a second encryption example of encrypting a constant object in the method for generating an executable file in an embodiment of the present application. Figure 3 In an embodiment of the present application, the encryption processing of the constant object at S110 can also be used to: before the constant object 20 image topology is hierarchically encrypted, the object topology of the constant object 20 is obfuscated. Among them, the obfuscation processing of the object topology of the constant object 20 is used to: replace the information plaintext content represented by any selected leaf node object Obj_end_i in the object topology of the constant object 20 with the preset disguised plaintext content Cont_cfu. Thus, the leaf node object Obj_end_i of the object topology of the constant object 20 in the multi-layer nested ciphertext 30 object ciphertext can be the encrypted ciphertext of the disguised information plaintext Cont_cfu after obfuscation processing. That is, the encryption processing of the constant object in S110 can also be used for: obfuscation processing of any selected leaf node object Obj_end_i in the object topology of the constant object 20, the hierarchical encryption of the object topology of the constant object 20 is performed after the obfuscation processing, and the encrypted ciphertext (i.e., the innermost ciphertext) of any selected leaf node object Obj_end_i in the object topology of the constant object 20 in the multi-layer nested ciphertext 30 includes the encrypted ciphertext of the disguised plaintext content Cont_cfu.

[0077] Exemplarily, in an embodiment of the present application, the information plain text content represented by the leaf node object Obj_end_i in the object topology of the constant object can be the minimum content element in the information plain text content of the constant information, and the minimum content element does not affect the normal operation of the executable file. That is, the minimum content element can be an annotation information content that does not affect the normal operation of the executable file, rather than the operation information content on which the normal operation of the executable file depends.

[0078] Assume that the constant information represented by the object topology of the constant object may include text, the plain text of the information content represented by the root node Obj_root in the object topology of the constant object may be the title of the text, the plain text of the information content represented by the branch node objects at each level downward may correspond to the "chapter", "section", "paragraph" and "sentence" of the text respectively, and the plain text of the information represented by the leaf node object Obj_end_i may correspond to the "word" in the "sentence". In this case, if it is predicted that key technical information that is not desired to be disclosed can be maliciously obtained by analyzing certain "words", then the plain text of the information content of the leaf node object Obj_end_i representing these "words" may be replaced with the disguised information plain text Cont_cfu. Therefore, even if the local plain text of the transient constant information is obtained multiple times by maliciously monitoring the memory in an attempt to obtain the restored content of the leaf node object Obj_end_i, the restored content obtained may only be the disguised information plain text Cont_cfu, rather than the "word" of the information content plain text (i.e., the smallest content element).

[0079] Assume again that the service application can realize the chip's soft-hard collaborative software stack function, and the constant information represented by the object topology of the constant object can also include configuration information. The information content represented by the root node Obj_root in the object topology of the constant object can be the attribute category of the configuration information, such as hardware configuration. The information content represented by the branch node objects at each level can correspond to the "device-level configuration information of the electronic device", "board-level configuration information of the circuit board in the electronic device", "on-chip resource configuration information of the chip of the circuit board" of the configuration information, and the information content represented by the leaf node object Obj_end_i can correspond to the "resource name" in the "on-chip resource configuration information", such as a specific register name. In this case, if it is predicted that key technical information that is not desired to be disclosed can be maliciously obtained by analyzing certain "resource names", then the information content of the leaf node object Obj_end_i representing these "resource names" can be replaced with the disguised information plaintext Cont_cfu. Therefore, even if the local plaintext of transient constant information is obtained multiple times by maliciously monitoring the memory in an attempt to obtain the restored content of the leaf node object Obj_end_i, the restored content obtained can only be the disguised information plaintext Cont_cfu, rather than the "resource name" of the information content plaintext (that is, the smallest content element).

[0080] Therefore, if the plain text content represented by any selected leaf node object Obj_end_i in the object topology of the constant object is replaced with the pre-set disguised plain text content Cont_cfu, the plain text content of the constant information can be protected by local information hiding with the smallest content unit as the granularity, that is, based on the combination of layered encryption and obfuscation processing, the local decryption and restoration of the constant information during the execution of the executable file and the local information hiding protection are ensured. Furthermore, on the basis of ensuring the local decryption and restoration of the constant information during the execution of the executable file, through the local information hiding protection of the constant information, it is possible to prevent the key technical information that is not desired to be disclosed from being analyzed and obtained through malicious monitoring of the memory without affecting the execution of the executable file, so as to further improve the reliability of information security protection.

[0081] Figure 4 The present invention is a flowchart of an example of a method for generating an executable file in an embodiment of the present application.

[0082] See also Figure 4 In the embodiments of the present application, Figure 1 The illustrated S110 may include:

[0083] S111: Serializing the constant object; wherein the object topology of the constant object is used to represent the constant information of the source code.

[0084] For example, the node objects in the object topology of the constant objects can be used to represent the plain text content of the constant information of the source code, and the topological relationship between the node objects in the object topology of the constant objects is used to represent the contextual relationship of the plain text content of the constant information of the source code.

[0085] S113: Encrypting the serialized object information obtained by the serialization process; wherein the encryption process of the constant object is used to hierarchically encrypt the object topology of the constant object into multiple layers of nested ciphertext.

[0086] For example, the nesting relationship of the object ciphertext of the node object in the object topology of the constant object in the multi-layer nested ciphertext matches the topological relationship between the node objects in the object topology of the constant object.

[0087] In the embodiments of the present application, by introducing serialization processing, constant objects in various object formats can be supported to enhance the scope of application of the solutions of the embodiments of the present application.

[0088] Please see again Figure 4 In the embodiments of the present application, Figure 1 The S130 shown can generate an executable file by compiling the source code and the multi-layer nested ciphertext, that is, the executable file is generated by compilation, such as AOT (Ahead-of-Time, before running), and Figure 1 The S130 shown may specifically include:

[0089] S131: Generate a header file using multi-layer nested ciphertexts. For example, the header file may be generated through a GODEGEN (Gode Generation, code generation) process.

[0090] S133: Compile the source code and header file to generate an executable file; wherein the executable file is configured to: perform local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that matches the object call, and limit the memory life cycle of the restored content obtained by the local decryption and restoration in the memory to the call life cycle of the object call.

[0091] In an embodiment of the present application, a header file generated by multi-layer nested ciphertexts can be used to support compilation to generate an executable file, that is, the source code can be a code in a programming language such as C, C++, etc.

[0092] Figure 5 FIG. 1 is an exemplary flow chart of a method for running an executable file in an embodiment of the present application. Figure 5 The file running method of the executable file shown is suitable for being executed by a user of the executable file.

[0093] See also Figure 5 In an embodiment of the present application, the file running method of the executable file may include:

[0094] S510: In response to an object call request received during the execution of the executable file, local decryption and restoration are performed on the multi-layer nested ciphertext; wherein the multi-layer nested ciphertext is obtained by hierarchically encrypting the object topology of the constant object, and the object topology of the constant object is used to characterize the constant information of the source code of the executable file, and the local decryption and restoration is used to decrypt and restore the object ciphertext of the node object specified by the object call request in the memory.

[0095] Exemplarily, as described above, the node objects in the object topology can be used to represent the plaintext content of the constant information of the source code, the topological relationship between the node objects in the object topology can be used to represent the contextual relationship of the plaintext content of the constant information of the source code, and the nested relationship of the object ciphertext of the node objects in the object topology of the constant object in the multi-layer nested ciphertext can match the topological relationship of the object topology of the constant object.

[0096] Exemplarily, similar to the explanation of partial decryption and restoration of matching object calls in the previous text, in an embodiment of the present application, decrypting and restoring the object ciphertext of the node object specified by the object call request in the memory may refer to: decrypting and restoring only the node object specified by the object call request and other node objects passed by the topological path between the node object and the root node object. That is, the restored content of the partial decryption and restoration performed by S510 each time is limited to a part of the information plaintext content in the constant information.

[0097] Exemplarily, in an embodiment of the present application, the object call request received by the executable file may be sent by the application service through an API (Application Programming Interface).

[0098] S530: In response to the completion of the object calling request, the memory life cycle of the restored content obtained by the partial decryption and restoration in the memory is ended.

[0099] Exemplarily, in an embodiment of the present application, returning a successful response to an object call request can be considered as completion of the call, and the process from receiving the object call request to returning a successful response can be considered as the call lifecycle of the object call. For example, a successful response can be returned to the API that sent the object call request; and, S530 ends the memory lifecycle of the restored content in response to the call completion of the object call request, which can be considered as limiting the memory lifecycle of the restored content obtained by local decryption and restoration in the memory to the call lifecycle of the object call.

[0100] Exemplarily, in an embodiment of the present application, S530 may specifically include, in response to completion of the object call request (eg, return of a successful response), destroying the restored content that is partially decrypted and restored to the memory.

[0101] Based on the file running method of the executable file in the embodiment of the present application, the multi-layer nested ciphertext can be partially decrypted and restored with a controlled memory life cycle during the running of the executable file. Among them, since the node objects in the object topology of the constant object are nested in the multi-layer nested ciphertext in the form of object ciphertext, the information plaintext content represented by the node objects in the object topology of the constant object will not appear normally in the memory during the running of the executable file; and the decryption and restoration of the information plaintext of the constant information in the memory is a local decryption and restoration, and the memory life cycle is controlled. Therefore, at any time during the running of the executable file, only the local plaintext of the constant information may appear transiently in the memory, and the constant information will not appear normally in the memory in the form of complete plaintext. Therefore, by avoiding the constant information from appearing normally in the memory in the form of complete plaintext, it can help to improve the reliability of information security protection of the constant information of the source code.

[0102] As described above, the outer ciphertext of the multi-layer nested ciphertext may be the object ciphertext of the root node object in the object topology of the constant object, and the inner ciphertext of the multi-layer nested ciphertext may include the object ciphertext of the leaf node object and the branch node object in the object topology of the constant object, and the object ciphertext of the leaf node object in the object topology of the constant object is located in the innermost layer of the multi-layer nested ciphertext. In order to facilitate the rapid execution of local decryption and restoration of the multi-layer nested ciphertext to improve the response speed to the object call request, in an embodiment of the present application, the file running method of the executable file may be as follows: Figure 5 Before S510 shown, including:

[0103] In response to the execution start of the executable file, the outer ciphertext of the multi-layer nested ciphertext is decrypted and restored in the memory.

[0104] In this case, if Figure 5 The illustrated S510 may be specifically configured to: perform decryption and restoration on the object ciphertext of the leaf node object or the branch node object specified by the object call request.

[0105] Figure 6 This is a schematic diagram of a first restoration example of partially decrypting and restoring multi-layer nested ciphertexts by the file running method of the executable file in the embodiment of the present application. Figure 6 , in the embodiments of the present application:

[0106] When the executable file 60 is started, the multi-layer nested ciphertext 30 is decrypted and restored as the outer ciphertext, that is, the root node object Obj_root is in the plaintext state in the memory 70, and other node objects are still in the inner ciphertext state in the memory 70;

[0107] Assuming that the node object specified by the object call request Req(Obj_brc_7) received by the executable file 60 from the API is the branch node object Obj_brc_7, then the restored content of the local decryption and restoration of the multi-layer nested ciphertext 30 to the memory 70 includes the plain text content of the branch node object Obj_brc_7 and the branch node object Obj_brc_6 along the topological path between the branch node object Obj_brc_7 and the root node object Obj_root, and other branch node objects and leaf node objects still maintain the state of inner ciphertext; that is, if the constant information represented by the object topology of the constant object includes the text illustrated in the previous example, then the restored content of the local decryption and restoration of the multi-layer nested ciphertext 30 to the memory 70 only includes the plain text content of the branch node object Obj_brc_7 and the branch node object Obj_brc_6 along the topological path between the branch node object Obj_brc_7 and the root node object Obj_root. The branch node object Obj_brc_7, and the branch node object Obj_brc_6 through which the topological path between the branch node object Obj_brc_7 and the root node object Obj_root passes, respectively represent a part of the plain text content of the information in the text corresponding to the part of the “chapter”, “section”, “paragraph”, and “sentence” respectively; if the constant information represented by the object topology of the constant object includes the configuration information illustrated in the above text, then the restored content restored to the memory 70 by the local decryption of the multi-layer nested ciphertext 30 only includes the branch node object Obj_brc_7, and the branch node object Obj_brc_6 through which the topological path between the branch node object Obj_brc_7 and the root node object Obj_root passes, respectively, corresponding to the part of the plain text content in the configuration information;

[0108] In response to the successful response Rspn (Obj_brc_7) returned by the executable file 60 to the API, the above-mentioned restored content in the memory may be destroyed.

[0109] Figure 7 This is a schematic diagram of a second restoration example of partially decrypting and restoring multi-layer nested ciphertexts by the file running method of the executable file in the embodiment of the present application. Figure 7 , if the multi-layer nested ciphertext 30 is adopted as follows Figure 3The object ciphertext of the leaf node object Obj_end_i is decrypted and restored in the memory 70 to obtain the restored content, which is the disguised plaintext content that replaces the information plaintext content. Assuming that the node object specified by the object call request Req(Obj_end_1) received by the executable file 60 from the API is the leaf node object Obj_end_1, the restored content of the multi-layer nested ciphertext 30 partially decrypted and restored to the memory 70 includes the disguised plaintext content Cont_cfu obtained by replacing the leaf node object Obj_end_1 after the obfuscation process, and the information plaintext content represented by the branch node objects Obj_brc_1 to Obj_brc_3 of the topological path between the leaf node object Obj_end_1 and the root node object Obj_root. That is, if the constant information of the object topology representation of the constant object includes the text as exemplified above, then, even if the restored content includes the "word" corresponding to the leaf node object Obj_end_1 in the text, the "word" appearing in the memory 70 is only the disguised word of the disguised plaintext content Cont_cfu, not the original word in the text; if the constant information of the object topology representation of the constant object includes the configuration information as exemplified above, then the "resource name" corresponding to the leaf node object Obj_end_1 in the configuration information is only the disguised name of the disguised plaintext content Cont_cfu in the memory 70. Thereafter, in response to the successful response Rspn(Obj_end_1) returned by the executable file 60 to the API, the above-mentioned restored content including the disguised plaintext content Cont_cfu in the memory can be destroyed.

[0110] In an embodiment of the present application, if the constant object is encrypted in the form of serialized object information, that is, the multi-layer nested ciphertext is obtained by encrypting the serialized object information of the constant big data, then, in the file running method of the executable file, the decryption and restoration of the object ciphertext of any node object in the memory (that is, the decryption and restoration of the outer ciphertext of the multi-layer nested ciphertext, and the partial decryption and restoration of the inner ciphertext in the multi-layer nested ciphertext) also includes deserialization of the restored content.

[0111] Figure 8 This is an exemplary structural diagram of the file generation device of the executable file in the embodiment of the present application. Figure 8 In an embodiment of the present application, a file generation device for an executable file is also provided, including an object encryption module 810 and a generation execution module 830.

[0112] The object encryption module 810 is used to encrypt constant objects; wherein the object topology of the constant object is used to characterize the constant information of the source code, and the encryption processing of the constant object is used to hierarchically encrypt the object topology of the constant object into multiple layers of nested ciphertext.

[0113] Exemplarily, in an embodiment of the present application, the constant information represented by the object topology of the constant object encrypted by the object encryption module 810 may be constant information stripped from the source code. For example, the node objects in the object topology of the constant object may have information plaintext content for representing the constant information of the source code, and the topological relationship between the node objects in the object topology of the constant object is used to represent the contextual relationship of the information plaintext content of the constant information of the source code.

[0114] Exemplarily, in an embodiment of the present application, in the encryption processing performed by the object encryption module 810, the hierarchical encryption implemented for the object topology of the constant object can be specifically configured as: encrypting the plaintext content of the information represented by the node objects in the object topology of the constant object into the object ciphertext of the node object, that is, the object ciphertext of each node object in the object topology of the constant object in the multi-layer nested ciphertext is obtained by encrypting the plaintext content of the information represented by the node object; and, according to the topological relationship between the node objects in the object topology of the constant object, the object ciphertext of the node objects in the object topology of the constant object is nested layer by layer, so that the nesting relationship of the object ciphertext of the node objects in the object topology of the constant object in the multi-layer nested ciphertext matches the topological relationship between the node objects in the object topology of the constant object.

[0115] Exemplarily, in the embodiment of the present application, in the multi-layer nested ciphertext obtained by the object encryption module 810 through encryption processing, the object ciphertext of any pair of node objects in the parent-child relationship in the topological relationship of the object topology can adopt the nested relationship in which the object ciphertext of the child node object is embedded in the object ciphertext of the parent node object. For the parent-child relationship between node objects, please refer to the examples in the previous text, which will not be repeated here.

[0116] Generate an execution module 830, which is used to generate an executable file using source code and multi-layer nested ciphertexts; wherein the executable file is configured to: perform local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext that matches the object call, and limit the memory life cycle of the restored content obtained by the local decryption and restoration in the memory to the call life cycle of the object call.

[0117] Exemplarily, in an embodiment of the present application, the above configuration of the executable file may be implemented through code settings of the source code.

[0118] Exemplarily, the node objects in the object topology of the constant object may include a root node object, a branch node object, and a leaf node object. In this case, if the object encryption module 810 encapsulates the object ciphertext of the leaf node objects and the branch node objects in the object topology of the constant object as the inner ciphertext of the multi-layer nested ciphertext, and encapsulates the object ciphertext of the root node object in the object topology of the constant object as the outer ciphertext of the multi-layer nested ciphertext, then the executable file generated by the generation execution module 830 may also be configured to: decrypt and restore the outer ciphertext of the multi-layer nested ciphertext in the memory in response to the execution of the executable file; and the executable file generated by the generation execution module 830 performs local decryption and restoration of matching object calls on the object ciphertext in the multi-layer nested ciphertext, which may include: performing local decryption and restoration of matching object calls on the inner ciphertext in the multi-layer nested ciphertext.

[0119] Exemplarily, in an embodiment of the present application, an object call to an executable file may be initiated by an application service, and local decryption and restoration of a matching object call may refer to: only decrypting and restoring the called node object and other node objects along the topological path between the node object and the root node object. Therefore, the restored content of the local decryption and restoration of each execution of the matching object call is limited to a portion of the plaintext content of the constant information.

[0120] Exemplarily, in an embodiment of the present application, limiting the memory lifecycle of the restored content obtained by partial decryption and restoration in memory to the call lifecycle of the object call may mean that the start of the memory lifecycle of the restored content is no earlier than the start of the call lifecycle, and the end of the memory lifecycle of the restored content is no later than the end of the call lifecycle, and the end of the memory lifecycle of the restored content means that the restored content disappears in the memory. That is, in order to limit the memory lifecycle of the restored content obtained by partial decryption and restoration in memory, the restored content in memory may be destroyed in response to the end of the call lifecycle of the object call.

[0121] Based on the file generation device of the executable file in the embodiment of the present application, the constant information of the source code can be set as the object topology form of the constant object, and the executable file of the source code can be generated by using the multi-layer nested ciphertext obtained by encrypting the constant object. Since the node objects in the object topology of the constant object are nested in the multi-layer nested ciphertext in the form of object ciphertext, during the operation of the executable file, the information plaintext content represented by the node objects in the object topology of the constant object will not appear normally in the memory; and since the decryption and restoration method of the multi-layer nested ciphertext during the operation of the executable file is set as a local decryption and restoration controlled by the memory life cycle, even if the information plaintext content is decrypted and restored in the memory, at any time during the operation of the executable file, only the local plaintext of the constant information may appear transiently in the memory, and the constant information will not appear normally in the memory in the form of complete plaintext. Therefore, by avoiding the constant information from appearing normally in the memory in the form of complete plaintext, it can help to improve the reliability of information security protection of the constant information of the source code.

[0122] In an embodiment of the present application, the encryption processing of constant objects by the object encryption module 810 can also be used for: before the constant object image topology is hierarchically encrypted, the object topology of the constant object is obfuscated. Among them, the obfuscation processing of the object topology of the constant object by the object encryption module 810 is used for: replacing the information plaintext content represented by any selected leaf node object in the object topology of the constant object with a pre-set disguised plaintext content. Thus, the ciphertext of the leaf node object of the object topology of the constant object in the multi-layer nested ciphertext object can be the encrypted ciphertext of the disguised information plaintext after obfuscation. That is, the encryption processing of the constant object by the object encryption module 810 can also be used for: obfuscation processing of any selected leaf node object in the object topology of the constant object, the hierarchical encryption of the object topology of the constant object is performed after the obfuscation, and the encrypted ciphertext (i.e., the innermost ciphertext) of any selected leaf node object in the object topology of the constant object includes the encrypted ciphertext of the disguised plaintext content in the multi-layer nested ciphertext.

[0123] Therefore, if the plain text content represented by any selected leaf node object in the object topology of the constant object is replaced with the pre-set disguised plain text content, the plain text content of the constant information can be protected by local information hiding with the smallest content unit as the granularity, that is, based on the combination of layered encryption and obfuscation processing, the local decryption and restoration of the constant information during the execution of the executable file and the local information hiding protection are ensured. Furthermore, on the basis of ensuring the local decryption and restoration of the constant information during the execution of the executable file, the local information hiding protection of the constant information can prevent the key technical information that is not desired to be disclosed from being analyzed and obtained through malicious monitoring of the memory without affecting the execution of the executable file, so as to further improve the reliability of information security protection.

[0124] Exemplarily, in an embodiment of the present application, the object encryption module 810 may be specifically configured to: perform serialization processing on constant objects; and perform encryption processing on serialized object information obtained by serialization processing. In this case, by introducing serialization processing, constant objects of various object formats can be supported to improve the scope of application of the solution of the embodiment of the present application.

[0125] Exemplarily, in an embodiment of the present application, the generation execution module 830 may be specifically configured to: generate a header file using multi-layer nested ciphertext; and compile the source code and the header file to generate an executable file. In this case, it may support the generation of an executable file by compilation, that is, the source code may be a code in a programming language such as C, C++, etc.

[0126] Fig. 9 This is an exemplary structural diagram of the file running device of the executable file in the embodiment of the present application. Fig. 9 In an embodiment of the present application, a file running device for an executable file is also provided, including a decryption and restoration module 910 and a cycle management module 930.

[0127] The decryption and restoration module 910 is used to perform local decryption and restoration on multi-layer nested ciphertexts in response to object call requests received during the execution of the executable file; wherein the multi-layer nested ciphertexts are obtained by hierarchically encrypting the object topology of constant objects, and the object topology of constant objects is used to characterize the constant information of the source code of the executable file, and the local decryption and restoration is used to decrypt and restore the object ciphertext of the node object specified by the object call request in the memory.

[0128] Exemplarily, as described above, the node objects in the object topology can be used to represent the plaintext content of the constant information of the source code, the topological relationship between the node objects in the object topology can be used to represent the contextual relationship of the plaintext content of the constant information of the source code, and the nested relationship of the object ciphertext of the node objects in the object topology of the constant object in the multi-layer nested ciphertext can match the topological relationship of the object topology of the constant object.

[0129] Exemplarily, similar to the explanation of partial decryption and restoration of matching object calls in the previous text, in an embodiment of the present application, decrypting and restoring the object ciphertext of the node object specified by the object call request in the memory may mean: decrypting and restoring only the node object specified by the object call request and other node objects that the topological path between the node object and the root node object passes through. That is, the restoration content of the partial decryption and restoration performed by the decryption and restoration module 910 each time is limited to a part of the information plaintext content in the constant information.

[0130] Exemplarily, in an embodiment of the present application, the object call request received by the executable file may be sent by the application service through an API.

[0131] The cycle management module 930 is used to terminate the memory life cycle of the restored content obtained by partial decryption and restoration in the memory in response to the completion of the call of the object call request.

[0132] Exemplarily, in an embodiment of the present application, returning a successful response to an object call request can be considered as completion of the call, and the process from receiving the object call request to returning a successful response can be considered as the call lifecycle of the object call. For example, a successful response can be returned to the API that sent the object call request; and, the cycle management module 930 ends the memory lifecycle of the restored content in response to the call completion of the object call request, which can be considered as limiting the memory lifecycle of the restored content obtained by local decryption and restoration in the memory to the call lifecycle of the object call.

[0133] Exemplarily, in an embodiment of the present application, the cycle management module 930 may be specifically configured to: in response to completion of the object call request (eg, return of a successful response), destroy the restored content that is partially decrypted and restored to the memory.

[0134] Based on the file running device of the executable file in the embodiment of the present application, the multi-layer nested ciphertext can be partially decrypted and restored with a controlled memory life cycle during the running of the executable file. Among them, since the node objects in the object topology of the constant object are nested in the multi-layer nested ciphertext in the form of object ciphertext, the information plaintext content represented by the node objects in the object topology of the constant object will not appear normally in the memory during the running of the executable file; and the decryption and restoration of the information plaintext of the constant information in the memory is a local decryption and restoration, and the memory life cycle is controlled. Therefore, at any time during the running of the executable file, only the local plaintext of the constant information may appear transiently in the memory, and the constant information will not appear normally in the memory in the form of complete plaintext. Therefore, by avoiding the constant information from appearing normally in the memory in the form of complete plaintext, it can help to improve the reliability of information security protection of the constant information of the source code.

[0135] Exemplarily, in an embodiment of the present application, the outer ciphertext of the multi-layer nested ciphertext may be the object ciphertext of the root node object in the object topology of the constant object, the inner ciphertext of the multi-layer nested ciphertext may include the object ciphertext of the leaf node object and the branch node object in the object topology of the constant object, and the object ciphertext of the leaf node object in the object topology of the constant object is located in the innermost layer of the multi-layer nested ciphertext. In order to facilitate the rapid execution of local decryption and restoration of the multi-layer nested ciphertext to improve the response speed to the object call request, in an embodiment of the present application, the decryption and restoration module 910 may also be used to: in response to the execution start of the executable file, decrypt and restore the outer ciphertext of the multi-layer nested ciphertext in the memory. In this case, the decryption and restoration module 910 may be specifically configured to: perform decryption and restoration on the object ciphertext of the leaf node object or the branch node object specified by the object call request, wherein, if the multi-layer nested ciphertext is obtained by encryption processing including obfuscation processing of the leaf node object, then the object ciphertext of the leaf node object is decrypted and restored in the memory to obtain the restored content as the disguised plaintext content of the substitute information plaintext content.

[0136] In an embodiment of the present application, if the constant object is encrypted in the form of serialized object information, that is, the multi-layer nested ciphertext is obtained by encrypting the serialized object information of the constant big data, then the decryption and restoration module 910 also includes deserialization of the restored content for the decryption and restoration of the object ciphertext of any node object in the memory (that is, the decryption and restoration of the outer ciphertext of the multi-layer nested ciphertext, and the partial decryption and restoration of the inner ciphertext in the multi-layer nested ciphertext).

[0137] In an embodiment of the present application, an electronic device is further provided, comprising a processor, the processor being used to execute at least one of the file generation method of the executable file as described in the aforementioned embodiment and the file running method of the executable file as described in the aforementioned embodiment.

[0138] In an embodiment of the present application, a non-transitory computer-readable storage medium is also provided, which stores instructions, which, when executed by a processor, enable the processor to execute at least one of the file generation method of the executable file described in the aforementioned embodiment and the file running method of the executable file described in the aforementioned embodiment.

[0139] In an embodiment of the present application, a computer program product is also provided, comprising computer executable instructions, which, when executed by a processor, implement at least one of the file generation method of the executable file as described in the aforementioned embodiment and the file running method of the executable file as described in the aforementioned embodiment.

[0140] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating an executable file, characterized in that: include: Performing encryption processing on constant objects; wherein the object topology of the constant objects is used to characterize constant information of the source code, and the encryption processing is used to hierarchically encrypt the object topology into multiple layers of nested ciphertexts, so that the nesting relationship of the object ciphertexts of the node objects in the object topology in the multiple layers of nested ciphertexts matches the topological relationship between the node objects in the object topology; Generate an executable file using the source code and the multi-layer nested ciphertext; wherein the executable file is configured as follows: Performing local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext for matching the object call, the local decryption and restoration is used to decrypt and restore in memory the object ciphertext of the node object specified by the object call request in the object topology and other node objects passing through the topological path between the node object and the root node object in the object topology; and The memory life cycle of the restored content obtained by the partial decryption and restoration in the memory is limited to the call life cycle of the object call.

2. The file generation method according to claim 1, characterized in that: The node object in the object topology is used to represent the plain text content of the constant information; The layered encryption is specifically configured as follows: Encrypting the plain text content of the information represented by the node object in the object topology into the object ciphertext of the node object; According to the topological relationship, the object ciphertexts of the node objects in the object topology are nested layer by layer, so that the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship.

3. The file generation method according to claim 1, characterized in that: The node objects in the object topology also include branch node objects and leaf node objects; The hierarchical encryption is specifically configured to: encapsulate the object ciphertexts of the leaf node objects and the branch node objects in the object topology as the inner ciphertexts of the multi-layer nested ciphertexts, and encapsulate the object ciphertexts of the root node objects in the object topology as the outer ciphertexts of the multi-layer nested ciphertexts; The executable file is further configured to: in response to the execution of the executable file, decrypt and restore the outer ciphertext of the multi-layer nested ciphertext in the memory; The performing of local decryption and restoration of the matching object call on the object ciphertext in the multi-layer nested ciphertext includes: performing the local decryption and restoration on the inner ciphertext in the multi-layer nested ciphertext.

4. The file generation method according to claim 3, characterized in that: The encryption process is also used to: perform obfuscation processing on leaf node objects in the object topology; Among them, the layered encryption is performed after the obfuscation processing, and the obfuscation processing is used to replace the plaintext content of the information represented by the leaf node object with a preset disguised plaintext content. The object ciphertext of the leaf node object includes the encrypted ciphertext of the disguised plaintext content, and the object ciphertext of the leaf node object is located in the innermost layer of the multi-layer nested ciphertext.

5. A method for running an executable file, characterized in that: include: In response to an object call request received during the execution of an executable file, local decryption and restoration are performed on multi-layer nested ciphertexts; wherein the multi-layer nested ciphertexts are obtained by hierarchically encrypting an object topology of a constant object, the object topology is used to characterize constant information of a source code of the executable file, the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology, and the local decryption and restoration is used to decrypt and restore in memory the object ciphertexts of the node object specified by the object call request and other node objects passing through the topological path between the node object and the root node object in the object topology; In response to completion of the calling of the object calling request, the memory life cycle of the restored content obtained by the local decryption and restoration in the memory is ended.

6. The file operation method according to claim 5, characterized in that: The node objects in the object topology are used to represent the plain text content of the constant information, and the object ciphertext of each node object in the object topology is obtained by encrypting the plain text content of the information represented by the node object.

7. The file operation method according to claim 5, characterized in that: The node objects in the object topology also include branch node objects and leaf node objects, the outer ciphertext of the multi-layer nested ciphertext is the object ciphertext of the root node object in the object topology, and the inner ciphertext of the multi-layer nested ciphertext includes the object ciphertext of the leaf node objects and branch node objects of the object topology; The file running method further comprises: in response to the execution start of the executable file, decrypting and restoring the outer ciphertext of the multi-layer nested ciphertext in the memory; The local decryption and restoration is specifically configured as: performing decryption and restoration on the object ciphertext of the leaf node object or the branch node object specified by the object call request, wherein the restored content obtained by decrypting and restoring the object ciphertext of the leaf node object in the memory is a disguised plaintext content that replaces the plaintext content of the information.

8. A device for generating an executable file, characterized in that: include: An object encryption module, used for performing encryption processing on constant objects; wherein the object topology of the constant objects is used to characterize the constant information of the source code, and the encryption processing is used to hierarchically encrypt the object topology into multi-layer nested ciphertexts, so that the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology; Generate an execution module, used to generate an executable file using the source code and the multi-layer nested ciphertext; wherein the executable file is configured as follows: Performing local decryption and restoration of the object ciphertext in the multi-layer nested ciphertext for matching the object call, the local decryption and restoration is used to decrypt and restore in memory the object ciphertext of the node object specified by the object call request in the object topology and other node objects passing through the topological path between the node object and the root node object in the object topology; and The memory life cycle of the restored content obtained by the partial decryption and restoration in the memory is limited to the call life cycle of the object call.

9. A file running device for an executable file, characterized in that: include: A decryption and restoration module, for performing local decryption and restoration on multi-layer nested ciphertexts in response to an object call request received during the execution of an executable file; wherein the multi-layer nested ciphertexts are obtained by hierarchically encrypting an object topology of a constant object, the object topology is used to characterize constant information of the source code of the executable file, the nesting relationship of the object ciphertexts of the node objects in the object topology in the multi-layer nested ciphertexts matches the topological relationship between the node objects in the object topology, and the local decryption and restoration is used to decrypt and restore in memory the object ciphertexts of the node object specified by the object call request and other node objects passing through the topological path between the node object and the root node object in the object topology; The cycle management module is used to terminate the memory life cycle of the restored content obtained by the partial decryption and restoration in the memory in response to the completion of the calling of the object calling request.

10. An electronic device, characterized in that: The method comprises a processor, wherein the processor is used to execute at least one of the file generation method according to any one of claims 1 to 4 and the file operation method according to any one of claims 5 to 7.

11. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores instructions which, when executed by a processor, cause the processor to perform at least one of the file generation method according to any one of claims 1 to 4 and the file execution method according to any one of claims 5 to 7.

12. A computer program product, characterized in that The invention comprises computer executable instructions, which, when executed by a processor, implement at least one of the file generation method according to any one of claims 1 to 4 and the file operation method according to any one of claims 5 to 7.

Images