Client security protection method, device, computer equipment and storage medium

Abstract

The present invention discloses a client security protection method, device, computer equipment and storage medium. The method includes: obtaining the current access request file and the current startup entry address corresponding to the client access request, and jumping to the current target space in the client; if it is determined that the current access request file is a normal access request, then obtaining the target interface data; if it is determined that there is a target interface as an encrypted interface, then obtaining the target interface to-be-decrypted data and the decryption model from the client encrypted data and decrypting them to obtain the target interface decrypted data and the target interface restored data; sending the current access request file to the current target interface corresponding to the target interface restored data to obtain the target processing result. In the embodiment of the present invention, the encryption security protection of the client can be completed in advance before receiving the client access request, and the client is decrypted and responded to the request when this request occurs, thereby improving the security of the client's original data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a client security protection method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of the software industry, information security has become an important issue. At present, many protections in the software industry are based on the server and network transmission, and there is very little protection for the client program itself.

[0003] Moreover, the current client self-protection often adopts the following methods:

[0004] A1) Network transmission security, where the transport layer uses the HTTPS protocol (HTTPS stands for Hypertext Transfer Protocol Secure) or custom protocols, such as RSA encryption algorithm keys (RSA encryption algorithm is an asymmetric encryption algorithm);

[0005] A2) Software packing, that is, using third-party packing software to process the client program itself;

[0006] A3) Built-in simple scrambling, that is, adding some simple scrambling functions to the internal code of the client to increase the cracking time.

[0007] However, when the client uses the above method to improve its own protection performance, the following problems exist:

[0008] B1) The scrambling method is simple, because the scrambling logic is mostly fixed, and it is easy to be cracked by adding some fancy instructions;

[0009] B2) Network communication is easily intercepted, that is, the specific network communication methods at the bottom of the client, such as Socket communication transmission (Socket is essentially a communication endpoint, which identifies the two ends of a communication link on the network and provides the interfaces and functions required by both parties of the communication) are fixed communication functions, which are very easy to be intercepted and debugged to obtain the corresponding network transmission packets, and obtain the array packets corresponding to the network transmission packets, resulting in the client being cracked through network communication;

[0010] B3) The program code is easy to read. This is because no matter what preprocessing is done to the client program, the program code is intact locally. As long as the protection layer of the preprocessed code is bypassed, plain text analysis can be performed, which cannot achieve better security protection. Summary of the invention

[0011] The embodiments of the present invention provide a client security protection method, apparatus, computer equipment and storage medium, aiming to solve the problem that the client's own security protection in the prior art adopts software shell processing or a simple scrambling code, which makes the scrambling code and the shell added by the software easy to be cracked, thereby reducing the client's own protection performance.

[0012] In a first aspect, an embodiment of the present invention provides a client security protection method, which includes:

[0013] In response to a client access request, obtaining a current access request file corresponding to the client access request;

[0014] Obtaining the current startup entry address corresponding to the current access request file, obtaining the current adjustment entry address corresponding to the current startup entry address based on a preset interface protection policy, and jumping to the current target space in the client corresponding to the current adjustment entry address; wherein the client is obtained by installing an application program using client encrypted data;

[0015] If it is determined that the current access request file corresponds to a normal access request, acquiring target interface data corresponding to the current access request file in the current target space;

[0016] If it is determined that the target interface in the target interface data is an encrypted interface, the target interface to-be-decrypted data and the decryption model corresponding to the target interface are extracted from the client encrypted data, and the target interface to-be-decrypted data are decrypted based on the decryption model to obtain the target interface decrypted data and the target interface restored data corresponding to the target interface data;

[0017] In the current target space, the current adjustment entry address is adjusted to the current startup entry address based on the interface protection policy, and the current access request file is sent to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

[0018] In a second aspect, an embodiment of the present invention further provides a client security protection device, which includes:

[0019] A client access request interception unit, configured to obtain, in response to a client access request, a current access request file corresponding to the client access request;

[0020] A target space jump unit, used to obtain the current startup entry address corresponding to the current access request file, obtain the current adjustment entry address corresponding to the current startup entry address based on a preset interface protection policy, and jump to the current target space in the client corresponding to the current adjustment entry address; wherein the client is obtained by installing an application program using client encrypted data;

[0021] a target interface data acquisition unit, configured to acquire target interface data corresponding to the current access request file in the current target space if it is determined that the current access request file corresponds to a normal access request;

[0022] A target interface data decryption unit is used for extracting target interface to-be-decrypted data and a decryption model corresponding to the target interface from the client encrypted data if it is determined that the target interface in the target interface data is an encrypted interface, and decrypting the target interface to-be-decrypted data based on the decryption model to obtain target interface decrypted data and target interface restored data corresponding to the target interface data;

[0023] A target processing result acquisition unit is used to adjust the current adjustment entry address to the current startup entry address in the current target space based on the interface protection policy, and send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

[0024] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0025] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method described in the first aspect above can be implemented.

[0026] The embodiment of the present invention provides a client security protection method, device, computer equipment and storage medium, the method comprising: in response to a client access request, obtaining a current access request file corresponding to the client access request; obtaining a current startup entry address corresponding to the current access request file, obtaining a current adjustment entry address corresponding to the current startup entry address based on a preset interface protection strategy, and jumping to a current target space in the client corresponding to the current adjustment entry address; wherein the client is encrypted data for the client to install an application; if it is determined that the current access request file corresponds to a normal access request, then obtaining target interface data corresponding to the current access request file in the current target space; if it is determined that the target interface in the target interface data is an encrypted interface, extracting and obtaining target interface to-be-decrypted data and a decryption model corresponding to the target interface from the client encrypted data, and decrypting the target interface to-be-decrypted data based on the decryption model to obtain target interface decrypted data, and target interface decrypted data corresponding to the target interface data; adjusting the current adjustment entry address to the current startup entry address based on the interface protection strategy in the current target space, and sending the current access request file to the current target interface corresponding to the current startup entry address and the target interface decrypted data, so as to obtain the corresponding target processing result from the current target interface. In the embodiment of the present invention, encryption security protection of the client can be completed in advance before receiving the client access request, and the client is decrypted and responded to accordingly when the request occurs, thereby improving the security of the client's original data. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0028] Figure 1 A schematic diagram of an application scenario of the client security protection method provided by an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of a process flow of a client security protection method provided by an embodiment of the present invention;

[0030] Figure 3 Another schematic diagram of the process of the client security protection method provided by the embodiment of the present invention;

[0031] Figure 4A A schematic diagram of a scenario of client encryption protection in a client security protection method provided by an embodiment of the present invention;

[0032] Figure 4BA schematic diagram of a scenario in which an object to be encrypted is encrypted in a client security protection method provided by an embodiment of the present invention;

[0033] Figure 5 A schematic diagram of a sub-process of a client security protection method provided by an embodiment of the present invention;

[0034] Figure 6 A schematic diagram of another sub-process of the client security protection method provided by an embodiment of the present invention;

[0035] Figure 7 A schematic diagram of a scenario in which data to be decrypted on a target interface is decrypted in a client security protection method provided by an embodiment of the present invention;

[0036] Figure 8 A schematic block diagram of a client security protection device provided by an embodiment of the present invention;

[0037] Fig. 9 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0040] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0041] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0042] Please also see Figure 1 and Figure 2 , Figure 1The following is a schematic diagram of a scenario of a client security protection method according to an embodiment of the present invention. Figure 2 1 is a flow chart of a client security protection method provided by an embodiment of the present invention. The method is applied to a user terminal or a server 10, and the user terminal or the server 10 can be connected to other terminals 20 for communication. Figure 2 As shown, the method includes the following steps S110-S150.

[0043] S110. In response to a client access request, obtain a current access request file corresponding to the client access request.

[0044] In this embodiment, the user terminal or server is used as the execution subject, and the application to be protected is deployed on the user terminal or server (for example, the user terminal or server is equipped with a Windows operating system, and the application to be protected is installed in the user terminal or server). During the operation of the application, it may receive local access requests initiated by other local applications, and may also receive third-party access requests sent by other user terminals or other servers (other user terminals or other servers can be regarded as other terminals). If both local access requests and third-party access requests are regarded as client access requests, what is different from the prior art at this time is that the client access request is not directly parsed and then jumps to the target interface, but first parses to obtain its current access request file and temporarily jumps to another security space for subsequent processing.

[0045] In one embodiment, as a first embodiment of encrypting and protecting an application to be protected, Figure 3 As shown, before step S110, it also includes:

[0046] S101, obtaining original data from the client;

[0047] S102, obtaining a plurality of objects to be encrypted in the original data of the client, and encrypting the data of the plurality of objects to be encrypted based on the obtained encryption model to obtain corresponding encrypted data of the encrypted objects;

[0048] S103: Replace the data of the plurality of objects to be encrypted in the client original data according to the corresponding encrypted object encrypted data to update the plurality of objects to be encrypted and obtain client encrypted data.

[0049] In this embodiment, the corresponding application scenario is that the application developer deploys client encrypted data on its local user terminal or server, that is, the application developer can directly obtain the original data of the client. Figure 4A, when the client original data (developed by the developer of the application) can be obtained first, in order to improve the data security of the application (for example, to prevent it from being cracked or maliciously accessed to obtain data, etc.), at least one object to be encrypted in the client original data (the object to be encrypted can be understood as an executable file or dynamic link library file in the application) can be encrypted based on the encryption model to obtain the encrypted object encrypted data corresponding to the object to be encrypted; then all the objects to be encrypted in the client original data are updated and replaced with the corresponding encrypted object encrypted data to obtain the client encrypted data. Afterwards, the client encrypted data can be used in the user terminal or server used by the developer to install and deploy the application and use it in the future. It can be seen that the above process makes the application to be protected no longer deployed in all plain text, but encrypts several objects to be encrypted and then deploys them in the form of client encrypted data, thereby improving the data security of the application.

[0050] In one embodiment, reference may also be made to Figure 4B and Figure 5 , step S102 includes:

[0051] S1021. Obtain a locally pre-stored encryption model;

[0052] S1022. For each of the plurality of objects to be encrypted in the client original data, obtain the plaintext data of a plurality of encryption points in the object to be encrypted and encrypt them based on the encryption model to obtain ciphertext data corresponding to the plaintext data of the plurality of encryption points, and compose encrypted data of the encrypted object corresponding to the object to be encrypted;

[0053] Step S103 includes:

[0054] S1031, for each of the multiple objects to be encrypted in the client original data, write the decryption model calling data corresponding to the encryption model and the encrypted object encryption data corresponding to the object to be encrypted into the object to be encrypted, so as to update the object to be encrypted;

[0055] S1032. Delete the plaintext data corresponding to several encryption points in the object to be encrypted, and write the decryption model calling code of each encryption point into the object to be encrypted to update the object to be encrypted and obtain the client encrypted data; wherein the decryption model calling code is used to obtain the decryption model calling data when being executed.

[0056] In this embodiment, when encrypting the original data of the client, it is not necessary to encrypt all the data, but first determine a number of objects to be encrypted, and also determine a number of encryption points in each object to be encrypted (encryption points can be understood as important functions or important codes in the object to be encrypted, and the required security protection level is high, and it is necessary to avoid its being obtained in plain text). For example Figure 4B The whole process of encrypting the client original data into the client encrypted data is described by taking an object to be encrypted with two encryption points as an example, as follows:

[0057] 1) Obtain the plaintext data 1 of encryption point 1 and the plaintext data 2 of encryption point 2 in the object to be encrypted;

[0058] 2) Encrypt the plaintext data of each encryption point based on the encryption model to obtain ciphertext data 1 of encryption point 1 and ciphertext data 2 of encryption point 2, obtain the decryption model calling data corresponding to the encryption model, and write the decryption model calling data, ciphertext data 1 of encryption point 1 and ciphertext data 2 of encryption point 2 to the end position of the object to be encrypted;

[0059] 3) Delete the ciphertext data 1 of encryption point 1 and the ciphertext data 2 of encryption point 2 in the object to be encrypted;

[0060] 4) The decryption model calling code 1 is stored in the original storage area 1 of the ciphertext data 1 of the encryption point 1, and the decryption model calling code 2 is stored in the original storage area 2 of the ciphertext data 2 of the encryption point 2.

[0061] After the encryption processing of each encryption point in the object to be encrypted is completed, the object to be encrypted can be updated. And when all the encrypted objects in the client original data are encrypted according to the above process, the client encrypted data can be obtained.

[0062] Among them, in the above step 4), while storing the decryption model calling code 1 in the original storage area 1 of the ciphertext data 1 of the encryption point 1, a reserved area 1 can also be added after the original storage area 1; and while storing the decryption model calling code 1 in the original storage area 2 of the ciphertext data 2 of the encryption point 2, a reserved area 2 can also be added after the original storage area 2. The newly added reserved area 1 is used as an extension area of ​​the storage area 1, so that after receiving the plaintext data 1 corresponding to the decryption restoration of the ciphertext data 1 after the storage area 1, and in the case of insufficient storage space, the plaintext data 1 is stored together with the storage area 1; similarly, the newly added reserved area 2 is used as an extension area of ​​the storage area 2, and its function is similar to that of the newly added reserved area 1.

[0063] Specifically, the decryption model corresponding to the decryption model call data (which can also be understood as the decryption model corresponding to the encryption model) can be stored in the storage space specified in the application, or stored in other servers such as cloud servers. If the decryption model is stored in the storage space specified in the application, the decryption model call data is the local storage address of the decryption model; if the decryption model is stored in the cloud server, the decryption model call data is the cloud communication address, and when the application needs to use the decryption model during execution, it can communicate with the cloud based on the cloud communication address and obtain the decryption model from the cloud.

[0064] In specific implementation, step S1031 can also be replaced by executing: for each object to be encrypted among several objects to be encrypted in the original data of the client, obtain the encrypted data of the encrypted object and the corresponding encrypted data call data, write the decryption model call data corresponding to the encryption model and the encrypted data call data into the object to be encrypted to update the object to be encrypted. In the above embodiment, instead of storing the encrypted data of the encrypted object of the object to be encrypted locally, the encrypted data of the encrypted object of the object to be encrypted is stored in the cloud, and the storage address of the encrypted data of the encrypted object in the cloud can be used as the corresponding encrypted data call data. It can be seen that based on the above encryption of several encryption points in the object to be encrypted in the application to be protected, the data security of the object to be encrypted can be effectively improved, and the security of the entire application can be improved.

[0065] In one embodiment, as a second embodiment of performing encryption protection on the application to be protected, before step S110, the following is further included:

[0066] Client encrypted data is obtained, and application installation is performed based on the client encrypted data.

[0067] In this embodiment, the corresponding application scenario is that the developer of the application completes the encryption processing of the client original data to obtain the client encrypted data and provides it to other users to deploy the client encrypted data, that is, the scenario where other users other than the developer cannot directly obtain the client original data. At this time, after receiving the client encrypted data provided by the developer, the user terminal or server of other users directly installs the application on their user terminal or server. Among them, the client encrypted data is also obtained by encrypting several objects to be encrypted in the client original data based on the encryption model.

[0068] S120. Obtain the current startup entry address corresponding to the current access request file, obtain the current adjustment entry address corresponding to the current startup entry address based on the preset interface protection strategy, and jump to the current target space in the client corresponding to the current adjustment entry address; wherein, the client is obtained by installing the application program by encrypting the client data.

[0069] In this embodiment, after the current access request file is obtained, the current startup entry address can be parsed and obtained from it. At this time, the target interface is not jumped based on the current startup entry address, but it is temporarily jumped to another security space for subsequent processing. Specifically, the current adjustment entry address corresponding to the current startup entry address is first obtained based on the preset interface protection policy. For example, the current startup entry address is XX1, and the current adjustment entry address after the interface address is adjusted by the interface protection policy is XX2; then, it is adjusted to the current target space according to the current adjustment entry address being XX2.

[0070] Among them, the current target space can be regarded as a secure isolation space and can be used as an interception and processing area for all client access requests. All client access requests cannot directly access the target interface data, and the current target space needs to obtain the corresponding target interface data and decrypt and restore it before subsequent normal access processing can be performed.

[0071] In one embodiment, after step S120 and before step S130, the method further includes:

[0072] Obtaining multiple process loading judgment results of the current access request file;

[0073] If it is determined that the multiple process loading judgment result is that the process is not loaded multiple times, obtaining the process running cache reading judgment result of the current access request file;

[0074] If it is determined that the process running cache reading judgment result is that the process running cache is not read, it is determined that the current access request file corresponds to a normal access request.

[0075] In this embodiment, when judging whether the current access request corresponding to the current access request file is a normal access request in the current target space, the two main judgment indicators are whether it is loaded multiple times (for example, if the process is loaded more than once, it can be regarded as multiple loading of the process) and whether the running cache is read. If the current access request corresponding to the current access request file satisfies the condition that the process is not loaded multiple times and the process running cache is not read, it can be judged that the current access request file corresponds to a normal access request, and the current access request file can be released for subsequent access processing to the client.

[0076] In one embodiment, after the step of obtaining the multiple process loading judgment results of the current access request file, the method further includes:

[0077] If it is determined that the multiple process loading judgment result is a multiple loading process, a pre-configured condition is obtained; wherein the pre-configured condition at least includes the name of the callable and the number of processes allowed to be called beyond the limit;

[0078] Based on the pre-configured conditions, obtaining configuration condition judgment results corresponding to the multiple loading process data of the current access request file;

[0079] If it is determined that the configuration condition judgment result satisfies the pre-configured condition, the step of obtaining the process running cache reading judgment result of the current access request file is executed;

[0080] If it is determined that the configuration condition judgment result is that the pre-configured condition is not met, then the current access request file is determined to correspond to an illegal access request, and corresponding access alarm information is generated;

[0081] After the step of obtaining the process running cache read judgment result of the current access request file, the method further includes:

[0082] If it is determined that the process running cache reading judgment result is that the process running cache has been read, obtaining the third-party program call judgment result of the current access request file;

[0083] If it is determined that the third-party program call judgment result is not a third-party program call, determining that the current access request file corresponds to a normal access request;

[0084] If it is determined that the third-party program call judgment result is a third-party program call, obtaining a judgment result of an allowed access list corresponding to the current access request file;

[0085] If it is determined that the access allowed list judgment result is that the third-party program call is in the access allowed list, then determining that the current access request file corresponds to a normal access request;

[0086] If it is determined that the allowed access list judgment result is that the third-party program call is not in the allowed access list, then it is determined that the current access request file corresponds to an illegal access request, and corresponding access alarm information is generated.

[0087] In this embodiment, when judging whether the current access request corresponding to the current access request file is a normal access request in the current target space, the previous embodiment lists the situation that the current access request satisfies the situation that the process is not loaded multiple times and the process running cache is not read. In the specific implementation, there will also be a situation that at least one of the situations of the current access request satisfies the situation that the process is loaded multiple times and the process running cache is read. In order to more clearly understand the judgment of whether the current access request file is a normal access request in the current target space in this application, the following is a specific description in combination with more situations:

[0088] 11) If it is determined that the multiple process loading judgment result is multiple loading processes, and the configuration condition judgment result is that the pre-configured condition is met, then jump to the step of obtaining the process running cache reading judgment result of the current access request file; and, influenced by the judgment result of the step of obtaining the process running cache reading judgment result of the current access request file, only when it is continued to be determined that the process running cache reading judgment result is that the process running cache is not read, then it is determined that the current access request file corresponds to a normal access request;

[0089] 12) If it is determined that the multiple process loading judgment result is a multiple loading process, and the configuration condition judgment result is that the pre-configured condition is not met, then it is determined that the current access request file corresponds to an illegal access request, and a corresponding access alarm information is generated;

[0090] 13) In any of the previous cases, as long as the step of obtaining the process cache reading judgment result of the current access request file is jumped to, and the third-party program call judgment result is further determined to be not a third-party program call, the current access request file is determined to correspond to a normal access request;

[0091] 14) In any of the previous cases, as long as the step of obtaining the process cache reading judgment result of the current access request file is jumped to, and the third-party program call judgment result is further determined to be a third-party program call, the access permission list judgment result corresponding to the current access request file is obtained;

[0092] 15) If it is determined that the access permission list judgment result is that the third-party program call is in the access permission list, then determining that the current access request file corresponds to a normal access request;

[0093] 16) If it is determined that the access permission list judgment result is that the third-party program call is not in the access permission list, then the current access request file is determined to correspond to an illegal access request, and corresponding access alarm information is generated.

[0094] It can be seen that only when it is determined in the current access space that the current access request file corresponds to a normal access request and the current access request file can be released for subsequent access processing by the client, when other situations occur and it is determined that the current access request file corresponds to an illegal access request, corresponding access alarm information is generated.

[0095] S130: If it is determined that the current access request file corresponds to a normal access request, then obtaining target interface data corresponding to the current access request file in the current target space.

[0096] In this embodiment, after it has been determined that the current access request file corresponds to a normal access request, it means that subsequent processing can continue in the current target space. Specifically, the target interface data corresponding to the current access request file is first obtained. For example, if the API protection module has been loaded in the current target space, the API protection module can parse the data of the current access request file to obtain the target interface data therein. Because the target interface data corresponds to several API interfaces among the client encrypted data, if there is an API interface among the several API interfaces that is an object to be encrypted in the client encrypted data, it is impossible to obtain a response when directly accessing the encrypted type of API interface at this time. Therefore, it is also necessary to decrypt the encrypted type of API interface based on the API protection module in order to obtain a timely response. Moreover, the above-mentioned method of adding an API protection module to the application to be protected realizes API hook processing, which improves the security of the application itself.

[0097] S140. If it is determined that the target interface in the target interface data is an encrypted interface, the target interface data to be decrypted and the decryption model corresponding to the target interface are extracted from the client encrypted data, and the target interface data to be decrypted are decrypted based on the decryption model to obtain the target interface decrypted data and the target interface restoration data corresponding to the target interface data.

[0098] In this embodiment, the API protection module still determines in the current target space whether there is a target interface as an encrypted interface in the target interface data. If the API protection module determines that there is a target interface as an encrypted interface in the target interface data, the code extraction module in the current target space continues to extract the target interface to-be-decrypted data and the decryption model corresponding to the target interface from the client encrypted data. The specific process of obtaining the client encrypted data refers to the first embodiment or the second embodiment for encrypting and protecting the application to be protected. After obtaining the target interface decrypted data corresponding to the target interface, the corresponding target interface is restored to a decrypted interface and can respond promptly to the current access request file.

[0099] At this time, after the code extraction module in the current target space obtains the target interface to-be-decrypted data and the decryption model corresponding to the target interface, the encryption and decryption module in the current target space decrypts the target interface to-be-decrypted data based on the decryption model to obtain the target interface decrypted data. It should be noted that in the above example, when there is a target interface as an encrypted interface in the target interface data, there is at least one target interface as an encrypted interface. If the above example uses one target interface as an encrypted interface and decrypts and restores it to the original interface to illustrate the processing process, when more target interfaces are also encrypted interfaces, the processing process also refers to the case where one target interface is an encrypted interface and is decrypted and restored to the original interface.

[0100] In one embodiment, if decryption and restoration are performed on a target interface of an encrypted interface type in the target interface data, for example, Figure 6 and Figure 7 As shown, step S140 includes:

[0101] S141, obtaining the current decryption model calling data in the target interface data to be decrypted;

[0102] S142, calling data based on the current decryption model to obtain the decryption model from a local computer or the cloud;

[0103] S143, obtaining ciphertext data of several encryption points in the target interface data to be decrypted from the target interface data to be decrypted or the cloud, and decrypting the ciphertext data of the several encryption points in sequence based on the decryption model to obtain the plaintext data of the several encryption points;

[0104] S144, deleting the ciphertext data of several encryption points in the target interface data to be decrypted and the current decryption model calling data, and adding the plaintext data of the several encryption points accordingly, to obtain the target interface decrypted data.

[0105] In this embodiment, the decryption and restoration of a target interface of an encrypted interface type in the target interface data is taken as an example (more specifically, the target interface may be Figure 4B The specific process is as follows:

[0106] 21) First, the current decryption model calling data is obtained from the target interface to-be-decrypted data. Since the current decryption model calling data is the local storage address or cloud communication address of the decryption model, the decryption model can be obtained from the local or cloud based on the current decryption model calling data;

[0107] 22) Then, when the ciphertext data of the several encryption points in the target interface data to be decrypted are stored locally, the ciphertext data of the several encryption points in the target interface data to be decrypted are obtained from the ciphertext data of the several encryption points in the target interface data to be decrypted, or when the ciphertext data of the several encryption points in the target interface data to be decrypted are stored in the cloud, the ciphertext data of the several encryption points in the target interface data to be decrypted are obtained from the corresponding storage location in the cloud;

[0108] 23) Afterwards, the ciphertext data of several encryption points in the data to be decrypted of the target interface are sequentially decrypted based on the decryption model to obtain the plaintext data of the several encryption points;

[0109] 24) Finally, the ciphertext data of several encryption points in the target interface data to be decrypted and the current decryption model calling data are deleted, and the plaintext data of the several encryption points are added accordingly to obtain the target interface decrypted data.

[0110] Through the above process, the target interface of an encrypted interface type in the target interface data is decrypted and restored. The decryption and restoration process of other target interfaces in the target interface data also refers to the above process. After the target interfaces of all encrypted interface types in the target interface data are decrypted and restored, the target interface restoration data corresponding to the target interface data can be obtained. The obtained target interface restoration data can be used to respond to the client access request in a timely manner.

[0111] S150. Adjust the current adjustment entry address to the current startup entry address in the current target space based on the interface protection policy, and send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

[0112] In this embodiment, the current adjustment entry address can also be adjusted to the current startup entry address in the current target space based on the interface protection policy to restore the original access entry address of the client access request, and then a jump is added to send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data. Because each encrypted point in the interface data corresponding to the current target interface has been restored to plain text data, the current access request file of the client access request can be responded to normally. Therefore, after the current target interface responds to the current access request file and obtains the target processing result, the target processing result can be sent to the requester corresponding to the client access request.

[0113] It can be seen that the implementation example of this method can complete the encryption security protection of the client in advance before receiving the client access request, and decrypt the client accordingly and respond to the request when the request occurs, thereby improving the security of the client's original data.

[0114] Figure 8 is a schematic block diagram of a client security protection device provided by an embodiment of the present invention. Figure 8 As shown, corresponding to the above client security protection method, the present invention also provides a client security protection device 100. The client security protection device 100 includes: a client access request interception unit 110, a target space jump unit 120, a target interface data acquisition unit 130, a target interface data decryption unit 140 and a target processing result acquisition unit 150.

[0115] The client access request intercepting unit 110 is used to obtain a current access request file corresponding to the client access request in response to the client access request.

[0116] In this embodiment, the user terminal or server is used as the execution subject, and the application to be protected is deployed on the user terminal or server (for example, the user terminal or server is equipped with a Windows operating system, and the application to be protected is installed in the user terminal or server). During the operation of the application, it may receive local access requests initiated by other local applications, and may also receive third-party access requests sent by other user terminals or other servers (other user terminals or other servers can be regarded as other terminals). If both local access requests and third-party access requests are regarded as client access requests, what is different from the prior art at this time is that the client access request is not directly parsed and then jumps to the target interface, but first parses to obtain its current access request file and temporarily jumps to another security space for subsequent processing.

[0117] In one embodiment, as a first embodiment of performing encryption protection on an application to be protected, the client security protection device 100 further includes:

[0118] A client original data acquisition unit, used to acquire client original data;

[0119] The object encryption unit to be encrypted is used to obtain a plurality of objects to be encrypted in the original data of the client, and encrypt the data of the plurality of objects to be encrypted based on the obtained encryption model to obtain corresponding encrypted object encrypted data;

[0120] The client encrypted data acquisition unit is used to replace the data of the several objects to be encrypted in the client original data according to the corresponding encrypted object encrypted data to update the several objects to be encrypted and obtain the client encrypted data.

[0121] In this embodiment, the corresponding application scenario is that the application developer deploys client encrypted data on its local user terminal or server, that is, the application developer can directly obtain the original data of the client. Figure 4A , when the client original data (developed by the developer of the application) can be obtained first, in order to improve the data security of the application (for example, to prevent it from being cracked or maliciously accessed to obtain data, etc.), at least one object to be encrypted in the client original data (the object to be encrypted can be understood as an executable file or dynamic link library file in the application) can be encrypted based on the encryption model to obtain the encrypted object encrypted data corresponding to the object to be encrypted; then all the objects to be encrypted in the client original data are updated and replaced with the corresponding encrypted object encrypted data to obtain the client encrypted data. Afterwards, the client encrypted data can be used in the user terminal or server used by the developer to install and deploy the application and use it in the future. It can be seen that the above process makes the application to be protected no longer deployed in all plain text, but encrypts several objects to be encrypted and then deploys them in the form of client encrypted data, thereby improving the data security of the application.

[0122] In one embodiment, reference may also be made to Figure 4B , the object encryption unit to be encrypted is specifically used for:

[0123] Obtain the locally pre-stored encryption model;

[0124] For each of the plurality of objects to be encrypted in the client original data, obtaining the plaintext data of a plurality of encryption points in the object to be encrypted and encrypting them based on the encryption model, obtaining ciphertext data corresponding to the plaintext data of the plurality of encryption points, and forming encrypted data of the encrypted object corresponding to the object to be encrypted;

[0125] The client encrypted data acquisition unit is specifically used for:

[0126] For each of the plurality of objects to be encrypted in the client original data, writing the decryption model calling data corresponding to the encryption model and the encrypted object encryption data corresponding to the object to be encrypted into the object to be encrypted, so as to update the object to be encrypted;

[0127] The plaintext data corresponding to several encryption points in the object to be encrypted are deleted, and the decryption model calling code of each encryption point is written into the object to be encrypted to update the object to be encrypted and obtain the client encrypted data; wherein the decryption model calling code is used to obtain the decryption model calling data when being executed.

[0128] In this embodiment, when encrypting the original data of the client, it is not necessary to encrypt all the data, but first determine a number of objects to be encrypted, and also determine a number of encryption points in each object to be encrypted (encryption points can be understood as important functions or important codes in the object to be encrypted, and the required security protection level is high, and it is necessary to avoid its being obtained in plain text). For example Figure 4B The whole process of encrypting the client original data into the client encrypted data is described by taking an object to be encrypted with two encryption points as an example, as follows:

[0129] 31) Obtain the plaintext data 1 of encryption point 1 and the plaintext data 2 of encryption point 2 in the object to be encrypted;

[0130] 32) Encrypt the plaintext data of each encryption point based on the encryption model, obtain the ciphertext data 1 of encryption point 1 and the ciphertext data 2 of encryption point 2, obtain the decryption model calling data corresponding to the encryption model, and write the decryption model calling data, the ciphertext data 1 of encryption point 1 and the ciphertext data 2 of encryption point 2 to the end position of the object to be encrypted;

[0131] 33) Delete the ciphertext data 1 of encryption point 1 and the ciphertext data 2 of encryption point 2 in the object to be encrypted;

[0132] 34) The decryption model calling code 1 is stored in the original storage area 1 of the ciphertext data 1 of the encryption point 1, and the decryption model calling code 2 is stored in the original storage area 2 of the ciphertext data 2 of the encryption point 2.

[0133] After the encryption processing of each encryption point in the object to be encrypted is completed, the object to be encrypted can be updated. And when all the encrypted objects in the client original data are encrypted according to the above process, the client encrypted data can be obtained.

[0134] Among them, in the above step 34), while storing the decryption model calling code 1 in the original storage area 1 of the ciphertext data 1 of the encryption point 1, a reserved area 1 can also be added after the original storage area 1; and while storing the decryption model calling code 1 in the original storage area 2 of the ciphertext data 2 of the encryption point 2, a reserved area 2 can also be added after the original storage area 2. The newly added reserved area 1 is used as an extension area of ​​the storage area 1, so that after receiving the plaintext data 1 corresponding to the decryption restoration of the ciphertext data 1 after the storage area 1, and in the case of insufficient storage space, the plaintext data 1 is stored together with the storage area 1; similarly, the newly added reserved area 2 is used as an extension area of ​​the storage area 2, and its function is similar to that of the newly added reserved area 1.

[0135] Specifically, the decryption model corresponding to the decryption model call data (which can also be understood as the decryption model corresponding to the encryption model) can be stored in the storage space specified in the application, or stored in other servers such as cloud servers. If the decryption model is stored in the storage space specified in the application, the decryption model call data is the local storage address of the decryption model; if the decryption model is stored in the cloud server, the decryption model call data is the cloud communication address, and when the application needs to use the decryption model during execution, it can communicate with the cloud based on the cloud communication address and obtain the decryption model from the cloud.

[0136] In specific implementation, for each of the several objects to be encrypted in the original data of the client, the decryption model call data corresponding to the encryption model and the encrypted object encrypted data corresponding to the object to be encrypted are written into the object to be encrypted to update the object to be encrypted. It can also be replaced by executing: for each of the several objects to be encrypted in the original data of the client, the encrypted data of the encrypted object and the corresponding encrypted data call data are obtained, and the decryption model call data corresponding to the encryption model and the encrypted data call data are written into the object to be encrypted to update the object to be encrypted. In the above embodiment, the encrypted object encrypted data of the object to be encrypted is not stored locally, but the encrypted object encrypted data of the object to be encrypted is stored in the cloud, and the storage address of the encrypted object encrypted data stored in the cloud can be used as the corresponding encrypted data call data. It can be seen that based on the above encryption of several encryption points in the object to be encrypted in the application to be protected, the data security of the object to be encrypted can be effectively improved, and the security of the entire application can be improved.

[0137] In one embodiment, as a second embodiment of performing encryption protection on the application to be protected, the client security protection device 100 further includes:

[0138] The client encrypted data installation unit is used to obtain the client encrypted data and install the application based on the client encrypted data.

[0139] In this embodiment, the corresponding application scenario is that the developer of the application completes the encryption processing of the client original data to obtain the client encrypted data and provides it to other users to deploy the client encrypted data, that is, the scenario where other users other than the developer cannot directly obtain the client original data. At this time, after receiving the client encrypted data provided by the developer, the user terminal or server of other users directly installs the application on their user terminal or server. Among them, the client encrypted data is also obtained by encrypting several objects to be encrypted in the client original data based on the encryption model.

[0140] The target space jump unit 120 is used to obtain the current startup entry address corresponding to the current access request file, obtain the current adjustment entry address corresponding to the current startup entry address based on the preset interface protection strategy, and jump to the current target space in the client corresponding to the current adjustment entry address; wherein, the client is obtained by installing an application program for client encrypted data.

[0141] In this embodiment, after the current access request file is obtained, the current startup entry address can be parsed and obtained from it. At this time, the target interface is not jumped based on the current startup entry address, but it is temporarily jumped to another security space for subsequent processing. Specifically, the current adjustment entry address corresponding to the current startup entry address is first obtained based on the preset interface protection policy. For example, the current startup entry address is XX1, and the current adjustment entry address after the interface address is adjusted by the interface protection policy is XX2; then, it is adjusted to the current target space according to the current adjustment entry address being XX2.

[0142] Among them, the current target space can be regarded as a secure isolation space and can be used as an interception and processing area for all client access requests. All client access requests cannot directly access the target interface data, and the current target space needs to obtain the corresponding target interface data and decrypt and restore it before subsequent normal access processing can be performed.

[0143] In one embodiment, the client security protection device 100 further includes:

[0144] A first judgment unit, used to obtain the judgment results of multiple process loading of the current access request file;

[0145] A second judgment unit is used to obtain a process execution cache reading judgment result of the current access request file if it is determined that the multiple process loading judgment result is that the process is not loaded multiple times;

[0146] The third judgment unit is used to determine that the current access request file corresponds to a normal access request if it is determined that the process running cache read judgment result is that the process running cache is not read.

[0147] In this embodiment, when judging whether the current access request corresponding to the current access request file is a normal access request in the current target space, the two main judgment indicators are whether it is loaded multiple times (for example, if the process is loaded more than once, it can be regarded as multiple loading of the process) and whether the running cache is read. If the current access request corresponding to the current access request file satisfies the condition that the process is not loaded multiple times and the process running cache is not read, it can be judged that the current access request file corresponds to a normal access request, and the current access request file can be released for subsequent access processing to the client.

[0148] In one embodiment, the client security protection device 100 further includes:

[0149] The fourth judgment unit is used to obtain a pre-configured condition if it is determined that the result of the multiple process loading judgment is a multiple loading process; wherein the pre-configured condition at least includes the name of the callable and the number of processes allowed to be called beyond the limit;

[0150] A fifth judgment unit, configured to obtain, based on the pre-configured condition, a configuration condition judgment result corresponding to the multiple loading process data of the current access request file;

[0151] A sixth judgment unit, configured to execute the step of obtaining the process running cache reading judgment result of the current access request file if it is determined that the configuration condition judgment result satisfies the pre-configured condition;

[0152] a seventh judgment unit, configured to judge that the current access request file corresponds to an illegal access request and generate corresponding access alarm information if it is determined that the configuration condition judgment result does not meet the pre-configured condition;

[0153] The client security protection device 100 also includes:

[0154] An eighth judgment unit is configured to obtain a third-party program call judgment result of the current access request file if it is determined that the process running cache read judgment result is that the process running cache has been read;

[0155] a ninth judgment unit, configured to judge that the current access request file corresponds to a normal access request if it is determined that the third-party program call judgment result is not a third-party program call;

[0156] a tenth judgment unit, configured to obtain a judgment result of an allowed access list corresponding to the current access request file if it is determined that the judgment result of the third-party program call is a third-party program call;

[0157] an eleventh judgment unit, configured to judge that the current access request file corresponds to a normal access request if it is determined that the access allowed list judgment result is that the third-party program call is in the access allowed list;

[0158] The twelfth judgment unit is used to determine that the current access request file corresponds to an illegal access request and generate corresponding access alarm information if it is determined that the access allowed list judgment result is that the third-party program call is not in the access allowed list.

[0159] In this embodiment, when judging whether the current access request corresponding to the current access request file is a normal access request in the current target space, the previous embodiment lists the situation that the current access request satisfies the situation that the process is not loaded multiple times and the process running cache is not read. In the specific implementation, there will also be a situation that at least one of the situations of the current access request satisfies the situation that the process is loaded multiple times and the process running cache is read. In order to more clearly understand the judgment of whether the current access request file is a normal access request in the current target space in this application, the following is a specific description in combination with more situations:

[0160] 41) If it is determined that the multiple process loading judgment result is multiple loading processes, and the configuration condition judgment result is that the pre-configured condition is met, then jump to the step of obtaining the process running cache reading judgment result of the current access request file; and, affected by the judgment result of the step of obtaining the process running cache reading judgment result of the current access request file, only when it is continued to be determined that the process running cache reading judgment result is that the process running cache is not read, then it is determined that the current access request file corresponds to a normal access request;

[0161] 42) If it is determined that the multiple process loading judgment result is a multiple loading process, and the configuration condition judgment result is that the pre-configured condition is not met, then it is determined that the current access request file corresponds to an illegal access request, and a corresponding access alarm information is generated;

[0162] 43) In any of the previous cases, as long as the step of obtaining the process cache read judgment result of the current access request file is jumped to, and the third-party program call judgment result is further determined to be not a third-party program call, then the current access request file is determined to correspond to a normal access request;

[0163] 44) In any of the previous cases, as long as the step of obtaining the process cache read judgment result of the current access request file is jumped to, and the third-party program call judgment result is further determined to be a third-party program call, the access permission list judgment result corresponding to the current access request file is obtained;

[0164] 45) If it is determined that the access permission list judgment result is that the third-party program call is in the access permission list, then determining that the current access request file corresponds to a normal access request;

[0165] 46) If it is determined that the allowed access list judgment result is that the third-party program call is not in the allowed access list, then the current access request file is determined to correspond to an illegal access request, and a corresponding access alarm message is generated.

[0166] It can be seen that only when it is determined in the current access space that the current access request file corresponds to a normal access request and the current access request file can be released for subsequent access processing by the client, when other situations occur and it is determined that the current access request file corresponds to an illegal access request, corresponding access alarm information is generated.

[0167] The target interface data acquisition unit 130 is configured to acquire target interface data corresponding to the current access request file in the current target space if it is determined that the current access request file corresponds to a normal access request.

[0168] In this embodiment, after it has been determined that the current access request file corresponds to a normal access request, it means that subsequent processing can continue in the current target space. Specifically, the target interface data corresponding to the current access request file is first obtained. For example, if the API protection module has been loaded in the current target space, the API protection module can parse the data of the current access request file to obtain the target interface data therein. Because the target interface data corresponds to several API interfaces among the client encrypted data, if there is an API interface among the several API interfaces that is an object to be encrypted in the client encrypted data, it is impossible to obtain a response when directly accessing the encrypted type of API interface at this time. Therefore, it is also necessary to decrypt the encrypted type of API interface based on the API protection module in order to obtain a timely response. Moreover, the above-mentioned method of adding an API protection module to the application to be protected realizes API hook processing, which improves the security of the application itself.

[0169] The target interface data decryption unit 140 is used to extract the target interface data to be decrypted and the decryption model corresponding to the target interface from the client encrypted data if it is determined that the target interface in the target interface data is an encrypted interface, and decrypt the target interface data to be decrypted based on the decryption model to obtain the target interface decrypted data and the target interface restoration data corresponding to the target interface data.

[0170] In this embodiment, the API protection module still determines in the current target space whether there is a target interface as an encrypted interface in the target interface data. If the API protection module determines that there is a target interface as an encrypted interface in the target interface data, the code extraction module in the current target space continues to extract the target interface to-be-decrypted data and the decryption model corresponding to the target interface from the client encrypted data. The specific process of obtaining the client encrypted data refers to the first embodiment or the second embodiment for encrypting and protecting the application to be protected. After obtaining the target interface decrypted data corresponding to the target interface, the corresponding target interface is restored to a decrypted interface and can respond promptly to the current access request file.

[0171] At this time, after the code extraction module in the current target space obtains the target interface to-be-decrypted data and the decryption model corresponding to the target interface, the encryption and decryption module in the current target space decrypts the target interface to-be-decrypted data based on the decryption model to obtain the target interface decrypted data. It should be noted that in the above example, when there is a target interface as an encrypted interface in the target interface data, there is at least one target interface as an encrypted interface. If the above example uses one target interface as an encrypted interface and decrypts and restores it to the original interface to illustrate the processing process, when more target interfaces are also encrypted interfaces, the processing process also refers to the case where one target interface is an encrypted interface and is decrypted and restored to the original interface.

[0172] In one embodiment, if decryption and restoration of a target interface of an encrypted interface type in the target interface data is taken as an example, the target interface data decryption unit 140 is specifically used for:

[0173] Obtaining the current decryption model calling data in the target interface data to be decrypted;

[0174] Calling data based on the current decryption model to obtain the decryption model from a local computer or a cloud server;

[0175] Obtaining ciphertext data of several encryption points in the target interface data to be decrypted from the target interface data to be decrypted or the cloud, and decrypting the ciphertext data of the several encryption points in sequence based on the decryption model to obtain the plaintext data of the several encryption points;

[0176] The ciphertext data of several encryption points in the target interface data to be decrypted and the current decryption model calling data are deleted, and the plaintext data of the several encryption points are added accordingly to obtain the target interface decrypted data.

[0177] In this embodiment, the decryption and restoration of a target interface of an encrypted interface type in the target interface data is taken as an example (more specifically, the target interface may be Figure 4B For the specific process, refer to Figure 7 as follows:

[0178] 51) First, the current decryption model calling data is obtained from the target interface to-be-decrypted data. Since the current decryption model calling data is the local storage address or cloud communication address of the decryption model, the decryption model can be obtained from the local or cloud based on the current decryption model calling data;

[0179] 52) Then, when the ciphertext data of several encryption points in the target interface data to be decrypted are stored locally, the ciphertext data of several encryption points in the target interface data to be decrypted are obtained from the ciphertext data of several encryption points in the target interface data to be decrypted, or when the ciphertext data of several encryption points in the target interface data to be decrypted are stored in the cloud, the ciphertext data of several encryption points in the target interface data to be decrypted are obtained from the corresponding storage location in the cloud;

[0180] 53) Afterwards, the ciphertext data of several encryption points in the target interface data to be decrypted are sequentially decrypted based on the decryption model to obtain the plaintext data of the several encryption points;

[0181] 54) Finally, the ciphertext data of several encryption points in the target interface data to be decrypted and the current decryption model calling data are deleted, and the plaintext data of the several encryption points are added accordingly to obtain the target interface decrypted data.

[0182] Through the above process, the target interface of an encrypted interface type in the target interface data is decrypted and restored. The decryption and restoration process of other target interfaces in the target interface data also refers to the above process. After the target interfaces of all encrypted interface types in the target interface data are decrypted and restored, the target interface restoration data corresponding to the target interface data can be obtained. The obtained target interface restoration data can be used to respond to the client access request in a timely manner.

[0183] The target processing result acquisition unit 150 is used to adjust the current adjustment entry address to the current startup entry address in the current target space based on the interface protection policy, and send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

[0184] In this embodiment, the current adjustment entry address can also be adjusted to the current startup entry address in the current target space based on the interface protection policy to restore the original access entry address of the client access request, and then a jump is added to send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data. Because each encrypted point in the interface data corresponding to the current target interface has been restored to plain text data, the current access request file of the client access request can be responded to normally. Therefore, after the current target interface responds to the current access request file and obtains the target processing result, the target processing result can be sent to the requester corresponding to the client access request.

[0185] It can be seen that the implementation of the device can complete the client's encryption security protection in advance before receiving the client's access request, and decrypt the client accordingly and respond to the request when the request occurs, thereby improving the security of the client's original data.

[0186] The client security protection device can be implemented in the form of a computer program. Fig. 9 Runs on the computer device shown.

[0187] See also Fig. 9 , Fig. 9 The present invention provides a schematic block diagram of a computer device provided in an embodiment of the present invention. The computer device integrates any client security protection device provided in an embodiment of the present invention.

[0188] See also Fig. 9 The computer device 400 includes a processor 402 , a memory and a network interface 405 connected via a system bus 401 , wherein the memory may include a storage medium 403 and an internal memory 404 .

[0189] The storage medium 403 can store an operating system 4031 and a computer program 4032. The computer program 4032 includes program instructions, and when the program instructions are executed, the processor 402 can execute the above-mentioned client security protection method.

[0190] The processor 402 is used to provide computing and control capabilities to support the operation of the entire computer device.

[0191] The internal memory 404 provides an environment for the operation of the computer program 4032 in the storage medium 403. When the computer program 4032 is executed by the processor 402, the processor 402 can execute the above-mentioned client security protection method.

[0192] The network interface 405 is used to communicate with other devices over the network. Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0193] The processor 402 is used to run a computer program 4032 stored in the memory to implement the client security protection method as described above.

[0194] It should be understood that in the embodiment of the present invention, the processor 402 may be a central processing unit (CPU), and the processor 402 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0195] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0196] Therefore, the present invention also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the client security protection method as described above.

[0197] The computer-readable storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0198] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0199] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0200] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0201] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0202] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A client security protection method, characterized in that: include: In response to a client access request, obtaining a current access request file corresponding to the client access request; Obtaining the current startup entry address corresponding to the current access request file, obtaining the current adjustment entry address corresponding to the current startup entry address based on a preset interface protection policy, and jumping to the current target space in the client corresponding to the current adjustment entry address; wherein the client is obtained by installing an application program using client encrypted data; If it is determined that the current access request file corresponds to a normal access request, acquiring target interface data corresponding to the current access request file in the current target space; If it is determined that the target interface in the target interface data is an encrypted interface, the target interface to-be-decrypted data and the decryption model corresponding to the target interface are extracted from the client encrypted data, and the target interface to-be-decrypted data are decrypted based on the decryption model to obtain the target interface decrypted data and the target interface restored data corresponding to the target interface data; In the current target space, the current adjustment entry address is adjusted to the current startup entry address based on the interface protection policy, and the current access request file is sent to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

2. The method according to claim 1, characterized in that Before the step of acquiring, in response to the client access request, a current access request file corresponding to the client access request, the method further includes: Get the original data of the client; Acquire several objects to be encrypted in the original data of the client, and encrypt the data of the several objects to be encrypted based on the acquired encryption model to obtain corresponding encrypted data of the encrypted objects; The data of the plurality of objects to be encrypted in the client original data are replaced according to the corresponding encrypted object encrypted data to update the plurality of objects to be encrypted and obtain the client encrypted data.

3. The method according to claim 2, characterized in that The step of encrypting the data of the plurality of objects to be encrypted based on the obtained encryption model to obtain corresponding encrypted object encrypted data includes: Obtain the locally pre-stored encryption model; For each of the plurality of objects to be encrypted in the client original data, obtaining the plaintext data of a plurality of encryption points in the object to be encrypted and encrypting them based on the encryption model, obtaining ciphertext data corresponding to the plaintext data of the plurality of encryption points, and forming encrypted data of the encrypted object corresponding to the object to be encrypted; The step of replacing the data of the plurality of objects to be encrypted in the original data of the client according to the encrypted data of the corresponding encrypted objects to update the plurality of objects to be encrypted and obtain the client encrypted data includes: For each of the plurality of objects to be encrypted in the client original data, writing the decryption model calling data corresponding to the encryption model and the encrypted object encryption data corresponding to the object to be encrypted into the object to be encrypted, so as to update the object to be encrypted; The plaintext data corresponding to several encryption points in the object to be encrypted are deleted, and the decryption model calling code of each encryption point is written into the object to be encrypted to update the object to be encrypted and obtain the client encrypted data; wherein the decryption model calling code is used to obtain the decryption model calling data when being executed.

4. The method according to claim 1, characterized in that Before the step of acquiring, in response to the client access request, a current access request file corresponding to the client access request, the method further includes: Client encrypted data is obtained, and application installation is performed based on the client encrypted data.

5. The method according to claim 1, characterized in that Before the step of acquiring target interface data corresponding to the current access request file in the current target space if it is determined that the current access request file corresponds to a normal access request, the method further includes: Obtaining multiple process loading judgment results of the current access request file; If it is determined that the multiple process loading judgment result is that the process is not loaded multiple times, obtaining the process running cache reading judgment result of the current access request file; If it is determined that the process running cache reading judgment result is that the process running cache is not read, it is determined that the current access request file corresponds to a normal access request.

6. The method according to claim 5, characterized in that After the step of obtaining the multiple process loading judgment results of the current access request file, the method further includes: If it is determined that the multiple process loading judgment result is a multiple loading process, a pre-configured condition is obtained; wherein the pre-configured condition at least includes the name of the callable and the number of processes allowed to be called beyond the limit; Based on the pre-configured conditions, obtaining configuration condition judgment results corresponding to the multiple loading process data of the current access request file; If it is determined that the configuration condition judgment result satisfies the pre-configured condition, the step of obtaining the process running cache reading judgment result of the current access request file is executed; If it is determined that the configuration condition judgment result is that the pre-configured condition is not met, then the current access request file is determined to correspond to an illegal access request, and corresponding access alarm information is generated; After the step of obtaining the process running cache read judgment result of the current access request file, the method further includes: If it is determined that the process running cache reading judgment result is that the process running cache has been read, obtaining the third-party program call judgment result of the current access request file; If it is determined that the third-party program call judgment result is not a third-party program call, determining that the current access request file corresponds to a normal access request; If it is determined that the third-party program call judgment result is a third-party program call, obtaining a judgment result of an allowed access list corresponding to the current access request file; If it is determined that the access allowed list judgment result is that the third-party program call is in the access allowed list, then determining that the current access request file corresponds to a normal access request; If it is determined that the allowed access list judgment result is that the third-party program call is not in the allowed access list, then it is determined that the current access request file corresponds to an illegal access request, and corresponding access alarm information is generated.

7. The method according to claim 1, characterized in that The step of extracting the target interface to-be-decrypted data and the decryption model corresponding to the target interface from the client encrypted data, and decrypting the target interface to-be-decrypted data based on the decryption model to obtain the target interface decrypted data includes: Obtaining the current decryption model calling data in the target interface data to be decrypted; Calling data based on the current decryption model to obtain the decryption model from a local computer or a cloud server; Obtaining ciphertext data of several encryption points in the target interface data to be decrypted from the target interface data to be decrypted or the cloud, and decrypting the ciphertext data of the several encryption points in sequence based on the decryption model to obtain the plaintext data of the several encryption points; The ciphertext data of several encryption points in the target interface data to be decrypted and the current decryption model calling data are deleted, and the plaintext data of the several encryption points are added accordingly to obtain the target interface decrypted data.

8. A client security protection device, characterized in that: include: A client access request interception unit, configured to obtain, in response to a client access request, a current access request file corresponding to the client access request; A target space jump unit, used to obtain the current startup entry address corresponding to the current access request file, obtain the current adjustment entry address corresponding to the current startup entry address based on a preset interface protection policy, and jump to the current target space in the client corresponding to the current adjustment entry address; wherein the client is obtained by installing an application program using client encrypted data; a target interface data acquisition unit, configured to acquire target interface data corresponding to the current access request file in the current target space if it is determined that the current access request file corresponds to a normal access request; A target interface data decryption unit is used for extracting target interface to-be-decrypted data and a decryption model corresponding to the target interface from the client encrypted data if it is determined that the target interface in the target interface data is an encrypted interface, and decrypting the target interface to-be-decrypted data based on the decryption model to obtain target interface decrypted data and target interface restored data corresponding to the target interface data; A target processing result acquisition unit is used to adjust the current adjustment entry address to the current startup entry address in the current target space based on the interface protection policy, and send the current access request file to the current target interface corresponding to the current startup entry address and the target interface restoration data, so as to obtain the corresponding target processing result from the current target interface.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the client security protection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the client security protection method according to any one of claims 1 to 7 can be implemented.

Images