Source code protection method of SpringBoot JAR package

Abstract

The present invention relates to the field of information security technology, and provides a source code protection method for a SpringBoot JAR package, the method comprising: a builder generates an XJAR package and a launcher program file according to a building material; a launcher verifies the legitimacy of the XJAR package to be started and the JVM tracking program file and then starts them one after another; the JVM tracking process and the JVM process of the JVM running protector complete the startup authentication based on a dynamic startup password and a dynamic key, and after the authentication is successful, the CLASS file is decrypted and loaded in a custom class loader, and the JVM process monitors the running state of the JVM tracking process. The present invention can not only prevent the static file of the JAR package from being decompiled and reverse engineered to export the source code through dynamic startup passwords, dynamic authentication keys, process control and inter-process communication technologies, but also can restrict the decompilation tool from accessing the JVM process memory during the startup and operation process, thereby realizing all-round protection of the JAR package source code.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a source code protection method for a SpringBoot JAR package. Background Art

[0002] Spring Boot is a framework for building independent, production-level Java applications. It enables rapid development of Spring applications by providing automatic configuration and the principle of convention over configuration. Spring Boot embeds containers such as Tomcat and Jetty, which can be started directly through Java commands without the need for separate installation. Spring Boot is widely used in microservice distributed systems such as Spring Cloud (an ordered collection of a series of frameworks).

[0003] The CLASS file in the JAR (a software package file format) package developed based on Spring Boot is bytecode, which is easy to be decompiled and the intellectual property rights are easily infringed. Therefore, it is particularly important to protect the intellectual property rights of software developers. Summary of the invention

[0004] In order to solve the technical problem that the above-mentioned intellectual property rights are easily infringed, the purpose of the present invention is to propose a source code protection method for a SpringBoot JAR package.

[0005] The technical solution adopted by the present invention is as follows:

[0006] The embodiment of the present invention proposes a source code protection method for a SpringBoot JAR package, comprising: a builder generates an XJAR package and a launcher program file according to construction materials, wherein the construction materials include: a JAR package, an encryption key, CLASS file information to be encrypted, a launcher script template and a JVM (Java Virtual Machine, an abstract computer) tracking program file; a launcher runs according to the launcher program file, verifies an XJAR package to be started (a JAR package in which a CLASS file is encrypted and a SpringBoot JAR package launcher and a class loader are redefined, and is directly started using a Java command) and a JVM tracking program file, and starts a JVM running protector after the verification passes, and creates a pipeline connection with the JVM running protector; a JVM tracking process of the JVM running protector and a JVM process complete startup authentication based on a dynamic startup password and a dynamic key, after the startup authentication succeeds, the JVM process decrypts and loads the CLASS file in a custom class loader, and the JVM process monitors the running state of the JVM tracking process, and the JVM tracking process monitors the client connection state at a SOCKET server, and terminates the operation when an abnormality is monitored.

[0007] The source code protection method of the SpringBoot JAR package proposed in the present invention may also have the following additional technical features:

[0008] According to one embodiment of the present invention, the builder generates an XJAR package and a launcher program file based on the construction materials, specifically including: encrypting part of the key CLASS source code in the JAR package according to the construction parameters using the AES (Advanced Encryption Standard, symmetric encryption algorithm) encryption algorithm to obtain the XJAR package; rewriting the SpringBoot JAR package launcher and class loader to obtain the XJAR package to be started; using MD5 (a hash function) and SHA-1 (a hash function) algorithms to generate file verification codes for the XJAR package to be started and the JVM running protector file, respectively, and instantiating the startup parameter template in the launcher script according to the file verification code, and compiling it into a launcher program file.

[0009] According to one embodiment of the present invention, the launcher runs according to the launcher program file, verifies the XJAR package and JVM tracking program file to be started, and starts the JVM running protector after the verification is passed, and creates a pipe connection with the JVM running protector, specifically including: verifying the MD5 and SHA-1 values ​​of the XJAR package and JVM tracking program file to be started; after the verification is passed, generating a UUID (Universally Unique Identifier) ​​as a dynamic startup password, starting the JVM process, and creating a pipe connection with the JVM process, through which the JVM process running parameters are passed, the JVM process running parameters include: a CLASS file decryption key, a dynamic startup password and a JAVA command parameter; starting the JVM tracking subprocess, and creating a pipe connection with the JVM tracking subprocess, and passing the JVM subprocess PID (ProcessIdentifier) ​​in the startup command line parameters; after completing the startup of the JVM process and the JVM tracking process, waiting to receive the startup authentication result on the tracking process pipeline, if the startup authentication is successful, the launcher completes the startup task and exits, otherwise the JVM process is forcibly stopped.

[0010] According to an embodiment of the present invention, the JVM tracking process of the JVM running protector and the JVM process complete the startup authentication based on the dynamic startup password and the dynamic key. After the startup authentication is successful, the JVM process decrypts and loads the CLASS file in the custom class loader, and the JVM process monitors the running status of the JVM tracking process. The JVM tracking process monitors the client connection status on the SOCKET (socket, the endpoint of the communication connection between two networks) server and terminates the operation when an abnormality is detected. Specifically, in the custom SpringBoot JAR package launcher, the JVM process is connected through JNI (Java NativeInterface, Java local interface) calls the startup authentication function of the dynamic library, creates a SOCKET communication connection with the JVM tracking process in the function, and completes the startup authentication process based on the dynamic startup password and dynamic key; if JNI calls the dynamic library startup authentication function and returns that the startup authentication is successful, the CLASS file is decrypted by the AES decryption algorithm in the custom class loader and loaded and run, the launcher process as the parent process exits, the JVM tracking process ATTACHs to the JVM process, and the decompilation tool is checked and restricted from accessing the JVM process memory at runtime. The JVM process sends a heartbeat packet to the JVM tracking process as a SOCKET client to monitor the running status of the JVM tracking process. If the JVM tracking process is monitored to be running abnormally, the JVM process terminates and exits; if JNI calls the dynamic library startup authentication function and returns that the startup authentication fails, the JVM process disconnects the SOCKET connection with the JVM tracking process, and the JVM process terminates; the JVM tracking process monitors the client connection status on the SOCKET server, and if the monitored client connection is disconnected, the JVM tracking process terminates.

[0011] According to one embodiment of the present invention, the calculation of the dynamic key is independently calculated using the same function FUC in the launcher process, JVM process and JVM tracking process, and the function parameters uniformly use the launcher process PID. In the tracking process and JVM process, the launcher process PID is obtained by obtaining the parent process PID.

[0012] According to one embodiment of the present invention, a startup authentication process is completed based on a dynamic startup password and a dynamic key, specifically including: after the JVM tracking process is started, a SOCKET service is created, and the maximum number of client connections is set to 1, and client connections are listened. Once a client connection request is received, other client connection requests are no longer received; the JVM process calls the startup authentication function of the dynamic library in the custom SpringBoot JAR package launcher through JNI, and passes the dynamic startup password to the JVM tracking process. The startup authentication function execution process includes: obtaining the PID of the parent process launcher, generating a dynamic authentication key, creating a SOCKET client, and attempting to connect to the JVM tracking process server multiple times within the timeout period. If the connection fails within the timeout period, the dynamic library startup authentication function returns a startup authentication failure. If the connection is successful, a plaintext dynamic startup password is sent to the JVM tracking process, and the encrypted dynamic startup password is waited for to be returned; in the JVM tracking process, the PID of the parent process launcher is obtained, a dynamic authentication key is generated, and after the plaintext dynamic startup password is received at the SOCKET server, the dynamic startup password is encrypted using the dynamic authentication key to generate a ciphertext dynamic startup password. Password, returns the encrypted dynamic startup password to the JVM process, and forwards it to the launcher process through the process pipeline; the client of the JVM process receives the encrypted dynamic startup password, decrypts it with the dynamic authentication key, compares the decrypted data with the plaintext dynamic startup password sent before, and if the comparison results are consistent, a heartbeat thread is created, and the startup authentication library function returns a successful startup authentication, otherwise the client connection is disconnected, and the startup authentication function returns a failed startup authentication; after the launcher process receives the encrypted dynamic startup password sent by the JVM tracking process on the process pipeline, it obtains the process PID, generates a dynamic authentication key for decryption, and compares the decrypted result with the dynamic startup password sent to the JVM process before. If the comparison results are consistent, the startup authentication is successful, if they are inconsistent or not received within a timeout, the startup authentication fails.

[0013] Beneficial effects of the present invention:

[0014] The present invention adopts AES encryption technology to encrypt some key CLASS files in the JAR package as an XJAR package that can be published and run, so as to prevent static files from being hard decrypted. Before decrypting and loading the CLASS file, the startup authentication must also be completed. The startup authentication adopts a unique method based on dynamic keys and dynamic startup passwords, so that only the JVM tracking child process started by the launcher as the parent process can ATTACH to the JVM process, preventing the JVM running protector from being taken over by an illegal process during the startup process, and ensuring the startup process is safe and reliable.

[0015] The present invention uses dynamic startup passwords, dynamic authentication keys, process control and inter-process communication technologies to not only prevent JAR package static files from being decompiled and reverse engineered to export source code, but also restrict decompilation tools from accessing JVM process memory during startup and operation, thereby achieving all-round protection of JAR package codes. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of a source code protection method for a SpringBoot JAR package according to an embodiment of the present invention;

[0017] Figure 2 It is a block diagram of a source code protection method of a SpringBoot JAR package according to an embodiment of the present invention;

[0018] Figure 3 The figure is a schematic diagram of the working principle of the source code protection method of the SpringBoot JAR package according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Figure 1 : is a flow chart of a source code protection method for a SpringBoot JAR package according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0021] S1, the builder generates an XJAR package and a launcher program file according to the building materials, wherein the building materials include: a JAR package, an encryption key, CLASS file information to be encrypted, a launcher script template and a JVM tracking program file.

[0022] S2, the launcher runs according to the launcher program file, verifies the XJAR package and JVM tracking program file to be started, and starts the JVM running protector after the verification passes, and creates a pipeline connection with the JVM running protector.

[0023] S3, the JVM tracking process and JVM process of the JVM running protector complete the startup authentication based on the dynamic startup password and dynamic key. After the startup authentication is successful, the JVM process decrypts and loads the CLASS file in the custom class loader, and the JVM process monitors the running status of the JVM tracking process. The JVM tracking process monitors the client connection status on the SOCKET server and terminates the operation when an exception is detected.

[0024] Specifically, the process of the source code protection method of the SpringBoot JAR package can be found in Figure 2 As shown, the present invention adopts encryption of some key CLASS files in the JAR package as an XJAR package that can be published and run, so as to prevent static files from being hard decrypted. Before decrypting and loading the CLASS file, the startup authentication must also be completed. The startup authentication adopts a unique method based on dynamic keys and dynamic startup passwords, so that only the JVM tracking process started by the launcher as the parent process can ATTACH to the JVM process, preventing the JVM running protector from being taken over by illegal processes during the startup process, ensuring that the startup process is safe and reliable. After the startup is successful, the parent process launcher stops running, and the JVM process is handed over to the system INIT process (the first process in the user space) for hosting. Therefore, through dynamic startup passwords, dynamic authentication keys, process control and inter-process communication technology, not only can the static files of the JAR package be prevented from being decompiled and reverse engineered to export source code, but also the decompilation tool can be restricted from accessing the JVM process memory during the startup process, so as to achieve all-round protection of the JAR package code.

[0025] In one embodiment of the present invention, the builder generates an XJAR package and a launcher program file based on the construction materials, specifically including: encrypting part of the key CLASS source code in the JAR package using the AES encryption algorithm according to the construction parameters to obtain the XJAR package; rewriting the SpringBoot JAR package launcher and class loader to obtain the XJAR package to be started; using MD5 and SHA-1 algorithms to generate file verification codes for the XJAR package and JVM program file to be started, respectively, instantiating the startup parameter template in the launcher script according to the file verification code, and compiling it into a launcher program file.

[0026] Specifically, the startup parameter template is as follows:

[0027] var xTrace = XTrace{

[0028] md5: []byte{#{xTrace.md5}},

[0029] sha1: []byte{#{xTrace.sha1}},

[0030] }

[0031] var xJar = XJar{

[0032] md5: []byte{#{xJar.md5}},

[0033] sha1: []byte{#{xJar.sha1}},

[0034] }

[0035] var xKey = XKey{

[0036] algorithm: []byte{#{xKey.algorithm}},

[0037] keysize: []byte{#{xKey.keysize}},

[0038] ivsize: []byte{#{xKey.ivsize}},

[0039] password: []byte{#{xKey.password}},

[0040] }

[0041] var RequiredOptions = []string{#{RequiredOptions}}

[0042] var InsecureOptions = []string{#{InsecureOptions}}

[0043] To instantiate the startup parameter template in the launcher script, follow these steps:

[0044] var xTrace = XTrace {

[0045] md5:[]byte{143,32,73,8,238,175,72,238,56,241,165,40,212,47,134, 170},

[0046] sha1:[]byte{13,92,235,115,63,199,161,54,70,81,62,135,30,156,114,40,166,159,83,97},

[0047] }

[0048] var xJar = XJar{

[0049] md5:[]byte{186,95,41,72,37,91,122,117,47,102,37,158,41,188,92,31},

[0050] sha1:byte{235,130,175,156,61,94,90,39,210,151,186,95,207,93,49,149,32,14,240,139},

[0051] }

[0052] var xKey=XKey{

[0053] algorithm:[]byte65,69,83,47,67,66,67,47,80,75,67,83,53,80,97,100,100,105,110,103},

[0054] keysize:[]byte{49,50,56},

[0055] ivsize:[]byte{49, 50, 56},

[0056] password:[]byte{54,48,52,51,50,51},

[0057] }

[0058] Var RequiredOptions=[]stringf"-XX:+DisableAttachMechanism},

[0059] Var InsecureOptions=

[0060] []stringf{"-Djava.rmi.server.hostname","-Dcom.sun.management.jmxremote","-Xdebug","-Xrunjdwp","-agentlib"}.

[0061] RequiredOptions is the required parameter of the JAVA startup command, such as "-XX:+DisableAttachMechanism", and InsecureOptions is the disabled parameter, such as "-Xdebug", "-agentlib".

[0062] In one embodiment of the present invention, Figure 3As shown, the launcher runs according to the launcher program file, verifies the XJAR package and JVM tracking program file to be started, and starts the JVM running protector after the verification is passed, and creates a pipeline connection with the JVM running protector, specifically including: verifying the MD5 and SHA-1 values ​​of the XJAR package and JVM program file to be started; after the verification is passed, a UUID is generated as a dynamic startup password, the JVM process is started, and a pipeline connection with the JVM process is created, and the JVM process running parameters are passed through the pipeline. The JVM process running parameters include: CLASS file decryption key, dynamic startup password and JAVA command parameters, wherein the JAVA command parameters are disabled parameters according to the configuration. and the parameters after the required parameters are adjusted, such as the required parameter "-XX:+DisableAttachMechanism" must be used as a JAVA command parameter, and the disabled parameter "-Xdebug" cannot appear in the JAVA command line; start the JVM tracking subprocess, and create a pipe connection with the JVM tracking subprocess, pass the JVM process PID as the target process of the JVM tracking subprocess ATTACH in the startup command line parameters; after completing the startup of the JVM process and the JVM tracking process, use a non-blocking method to wait for receiving the startup authentication result on the tracking process pipeline. If the startup authentication is successful, the launcher completes the startup task and exits, otherwise the JVM process is forcibly stopped.

[0063] Among them, if the startup authentication result is received within the timeout period, the launcher generates a dynamic authentication key and uses the DES algorithm to decrypt it. The decryption result is compared with the UUID dynamic startup password previously generated by the launcher. If they are consistent, the startup authentication is successful, the launcher exits, and the JVM process and JVM tracking process are handed over to the system daemon process. Otherwise, the startup authentication fails, and the launcher checks and forcibly stops the JVM process and then exits.

[0064] In one embodiment of the present invention, Figure 3As shown in the figure, the JVM tracking process and JVM process of the JVM running protector complete the startup authentication based on the dynamic startup password and dynamic key. After the startup authentication is successful, the JVM process decrypts and loads the CLASS file in the custom class loader, and the JVM process monitors the running status of the JVM tracking process. The JVM tracking process monitors the client connection status on the SOCKET server and terminates the operation when an exception is detected. Specifically, in the custom SpringBoot In the JAR package launcher, the JVM process calls the startup authentication function of the dynamic library through JNI, creates a SOCKET communication connection with the JVM tracking process in the function, and completes the startup authentication process based on the dynamic startup password and dynamic key; if JNI calls the dynamic library startup authentication function and returns that the startup authentication is successful, the CLASS file is decrypted by the AES decryption algorithm in the custom class loader and loaded and run, the launcher process as the parent process exits, the JVM tracking process ATTACHs to the JVM process, and the decompilation tool is checked and restricted from accessing the JVM process memory at runtime. The JVM process sends a heartbeat packet to the JVM tracking process as a SOCKET client to monitor the running status of the JVM tracking process. If the JVM tracking process is monitored to be running abnormally, the JVM process terminates and exits; if JNI calls the dynamic library startup authentication function and returns that the startup authentication fails, the JVM process disconnects the SOCKET connection with the JVM tracking process, and the JVM process terminates; the JVM tracking process monitors the client connection status on the SOCKET server, and if the monitored client connection is disconnected, the JVM tracking process terminates.

[0065] Furthermore, a custom SpringBootJAR package launcher is created by inheriting JarLauncher: XJarLauncher, the startup authentication dynamic library is statically imported in the XJarLauncher class, and the parameters related to starting the XJAR package are obtained from the process pipeline in the constructor, including: CLASS file decryption parameters (xKey), startup dynamic password; a custom class loader is created by inheriting LaunchedURLClassLoader: XBootClassLoader, and xKey is used as the XBootClassLoader class constructor parameter, and then the CLASS file is decrypted in the class.

[0066] When the JVM tracking child process is started, it obtains the command line parameters (JVM process PID), and the JVM tracking process ATTACHs to the JVM process according to the PID parameters. During runtime, it checks and restricts the decompilation tool from accessing the JVM process memory. In the JVM tracking process, a local socket (UNIX SOCKET) is used to create a server, and the number of client connections is set to 1. It waits for the client connection request of the JVM process, and completes the interactive process of startup authentication after the connection is successful. After the startup authentication is successful, it continues to receive the heartbeat packets sent regularly by the JVM process on the connection, and monitors the connection status of the JVM process (client). Once a timeout occurs and the heartbeat packet is not received or the client connection is disconnected, the JVM tracking process checks and stops the JVM process and then exits.

[0067] In an embodiment of the present invention, the startup authentication key is a dynamic key. The dynamic key is calculated independently in the launcher process, JVM process and JVM tracking process using the same function FUC (launcher PID). The function parameter uses the launcher process PID. In the JVM tracking process and the JVM process, the launcher process PID is obtained by obtaining the parent process PID, ensuring that the same dynamic key can only be calculated by using this function method in the parent process and its child processes.

[0068] In a specific embodiment of the present invention, Figure 3 As shown, the process of the JVM process and the JVM tracking process completing the startup authentication based on the dynamic startup password and the dynamic key is as follows: Steps A1-A5:

[0069] Step A1, after the JVM tracking process is started, a SOCKET service is created, and the maximum number of client connections is set to 1, and the client connection is listened. Once a client connection request is received, other client connection requests are no longer received.

[0070] In step A2, the JVM process calls the startup authentication function of the dynamic library in the custom SpringBoot JAR package launcher (XJarLauncher) through JNI, and passes the dynamic startup password to the JVM tracking process. The execution process of the startup authentication function includes: obtaining the PID of the parent process launcher, generating a dynamic authentication key, creating a SOCKET client, and trying to connect to the JVM tracking process server multiple times within the timeout period. If the connection fails within the timeout period, the dynamic library startup authentication function returns a startup authentication failure. If the connection is successful, the plain text dynamic startup password is sent to the JVM tracking process, and the encrypted dynamic startup password is waited for to be returned.

[0071] Step A3, in the JVM tracking process, obtain the PID of the parent process launcher, generate a dynamic authentication key, and after receiving the plaintext dynamic startup password on the SOCKET server, use the dynamic authentication key to encrypt the dynamic startup password to generate a ciphertext dynamic startup password, return the ciphertext dynamic startup password to the JVM process, and forward it to the launcher process through the process pipeline.

[0072] Step A4, the client of the JVM process receives the dynamic startup password in ciphertext, decrypts it using the dynamic authentication key, and compares the decrypted data with the plaintext dynamic startup password sent previously. If the comparison results are consistent, a heartbeat thread is created, and the startup authentication library function returns a successful startup authentication. Otherwise, the client connection is disconnected, and the startup authentication library function returns a failed startup authentication.

[0073] Step A5, after the launcher process receives the dynamic startup password in ciphertext sent by the JVM tracking process on the process pipeline, it obtains the process PID, generates a dynamic authentication key for decryption, and compares the decryption result with the dynamic startup password previously sent to the JVM process. If the comparison results are consistent, the startup authentication is successful. If they are inconsistent or not received after timeout, the startup authentication fails.

[0074] It can be understood that inter-process communication is not limited to Unix SOCKET and pipes, and encryption algorithms are not limited to AES. Any technician familiar with the technical field can make equivalent replacements or changes based on the technical solutions and concepts of the present invention within the scope disclosed by the present invention, which fall within the protection scope of the present invention.

[0075] In summary, according to the source code protection method of the SpringBoot JAR package of the embodiment of the present invention, the AES encryption technology is used to encrypt some key CLASS files in the JAR package as an XJAR package that can be published and run, so as to prevent the static files from being hard decrypted. Before decrypting and loading the CLASS file, the startup authentication must also be completed. The startup authentication adopts a unique method based on dynamic keys and dynamic startup passwords, so that only the JVM tracking process started by the launcher as the parent process can ATTACH to the JVM process, preventing the JVM running protector from being taken over by illegal processes during the startup process, and ensuring that the startup process is safe and reliable. Therefore, through dynamic startup passwords, dynamic authentication keys, process control and inter-process communication technology, not only can the static files of the JAR package be prevented from being decompiled and reverse engineered to export source code, but also the decompilation tool can be restricted from accessing the JVM process memory during the startup process, so as to achieve all-round protection of the JAR package code.

[0076] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0077] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0078] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0079] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0080] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0081] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0082] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0083] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A source code protection method for a SpringBoot JAR package, characterized in that: The steps include: The builder generates an XJAR package and a launcher program file according to the building materials, wherein the building materials include: a JAR package, an encryption key, CLASS file information to be encrypted, a launcher script template, and a JVM tracking program file; The launcher runs according to the launcher program file, verifies the XJAR package and JVM tracking program file to be started, and starts the JVM run protector after the verification passes, and creates a pipeline connection with the JVM run protector; The JVM tracking process and JVM process of the JVM running protector complete the startup authentication based on the dynamic startup password and dynamic key. After the startup authentication is successful, the JVM process decrypts and loads the CLASS file in the custom class loader, and the JVM process monitors the running status of the JVM tracking process. The JVM tracking process monitors the client connection status on the SOCKET server and terminates the operation when an exception is detected; Among them, the JVM tracking process of the JVM running protector and the JVM process complete the startup authentication based on the dynamic startup password and dynamic key. After the startup authentication is successful, the JVM process decrypts and loads the CLASS file in the custom class loader, and the JVM process monitors the running status of the JVM tracking process. The JVM tracking process monitors the client connection status on the SOCKET server and terminates the operation when an exception is detected. Specifically, in the custom SpringBoot In the JAR package launcher, the JVM process calls the startup authentication function of the dynamic library through JNI, creates a SOCKET communication connection with the JVM tracking process in the function, and completes the startup authentication process based on the dynamic startup password and dynamic key; if JNI calls the dynamic library startup authentication function and returns that the startup authentication is successful, the CLASS file is decrypted by the AES decryption algorithm in the custom class loader and loaded and run, the launcher process as the parent process exits, the JVM tracking process ATTACHs to the JVM process, and the decompilation tool is checked and restricted from accessing the JVM process memory at runtime. The JVM process sends a heartbeat packet to the JVM tracking process as a SOCKET client to monitor the running status of the JVM tracking process. If the JVM tracking process is monitored to be abnormal, the JVM process terminates and exits; if JNI calls the dynamic library startup authentication function and returns that the startup authentication fails, the JVM process disconnects the SOCKET connection with the JVM tracking process, and the JVM process terminates; the JVM tracking process monitors the client connection status on the SOCKET server, and if the monitored client connection is disconnected, the JVM tracking process terminates; The startup authentication process is completed based on the dynamic startup password and dynamic key, specifically including: after the JVM tracking process is started, a SOCKET service is created, and the maximum number of client connections is set to 1, and the client connection is listened. Once a client connection request is received, no other client connection requests are received; the JVM process calls the startup authentication function of the dynamic library in the custom SpringBoot JAR package launcher through JNI, and passes the dynamic startup password to the JVM tracking process. The execution process of the startup authentication function includes: obtaining the PID of the parent process launcher, generating a dynamic authentication key, creating a SOCKET client, and trying to connect to the JVM tracking process server multiple times within the timeout period. If the connection fails within the timeout period, the dynamic library startup authentication function returns a startup authentication failure. If the connection is successful, the plaintext dynamic startup password is sent to the JVM tracking process, and the encrypted dynamic startup password is waited for. In the JVM tracking process, the PID of the parent process launcher is obtained, and a dynamic authentication key is generated. After the plaintext dynamic startup password is received on the SOCKET server, the dynamic startup password is encrypted using the dynamic authentication key to generate a ciphertext dynamic startup password. Password, returns the encrypted dynamic startup password to the JVM process, and forwards it to the launcher process through the process pipeline; the client of the JVM process receives the encrypted dynamic startup password, decrypts it with the dynamic authentication key, compares the decrypted data with the plaintext dynamic startup password sent before, and if the comparison results are consistent, a heartbeat thread is created, and the startup authentication library function returns a successful startup authentication, otherwise the client connection is disconnected, and the startup authentication function returns a failed startup authentication; after the launcher process receives the encrypted dynamic startup password sent by the JVM tracking process on the process pipeline, it obtains the process PID, generates a dynamic authentication key for decryption, and compares the decrypted result with the dynamic startup password sent to the JVM process before. If the comparison results are consistent, the startup authentication is successful, if they are inconsistent or not received within a timeout, the startup authentication fails.

2. The source code protection method of the SpringBoot JAR package according to claim 1 is characterized in that: The builder generates XJAR packages and launcher program files based on the build materials, including: According to the construction parameters, the AES encryption algorithm is used to encrypt some key CLASS source codes in the JAR package to obtain the XJAR package; Rewrite the SpringBoot JAR package launcher and class loader to get the XJAR package to be started; The MD5 and SHA-1 algorithms are used to generate file verification codes for the XJAR package and JVM tracking program file to be started respectively, and the startup parameter template in the launcher script is instantiated according to the file verification code and compiled into a launcher program file.

3. The source code protection method of the SpringBoot JAR package according to claim 1 is characterized in that: The launcher runs according to the launcher program file, verifies the XJAR package and JVM tracking program file to be started, and starts the JVM run protector after the verification passes, and creates a pipeline connection with the JVM run protector, including: Verify the MD5 and SHA-1 values ​​of the XJAR package and JVM tracer file to be started; After the verification is passed, a UUID is generated as a dynamic startup password, the JVM process is started, and a pipeline connection is created between the JVM process, and the JVM process running parameters are passed through the pipeline. The JVM process running parameters include: CLASS file decryption key, dynamic startup password and JAVA command parameters; Start the JVM tracking process and create a pipe connection with the JVM tracking process, passing the JVM process PID in the startup command line parameters; After the JVM process and the JVM tracking process are started, the startup authentication result is waited for on the tracking process pipeline. If the startup authentication is successful, the launcher completes the startup task and exits, otherwise the JVM process is forcibly stopped.

4. The source code protection method of the SpringBoot JAR package according to claim 1 is characterized in that: The dynamic key is calculated independently in the launcher process, JVM process and JVM tracking process using the same function FUC. The function parameters uniformly use the launcher process PID. The launcher process PID is obtained by obtaining the parent process PID in the tracking process and JVM process.

Images