Software service code reverse prevention method and system for Linux system

Abstract

The invention provides a software business code anti-reverse method and system for a Li nux system, and the method comprises the steps: dividing a to-be-operated software code into a basic service code and a core business code according to the importance degree of a code function; wherein the core service code is in an encrypted state; in the software code running process, the following running strategies are executed: basic service codes are executed based on a created process in a first namespace pre-created in a system; creating a second namespace by executing a related process of the basic service code, and decrypting the core service code in the second namespace; and creating a third namespace based on the decrypted core service code, and executing a core service process in the third namespace.

Description

Technical Field

[0001] The present invention belongs to the technical field of code anti-reversal, and in particular relates to a method and system for software business code anti-reversal for Linux system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In Linux systems, there are two main solutions for code anti-reverse engineering: one is code obfuscation, and the other is code encryption. The inventors found that code obfuscation does not hide the real code, and it cannot really prevent reverse engineering, but can only increase the difficulty. For scenarios with high security requirements, using code obfuscation alone cannot guarantee the security of the original code; and for code encryption, it refers to encrypting the core code, and when the business is launched, the core code is decrypted and loaded. However, for most software, the core module files will be dropped to the disk during the middle process of its operation. In this case, it may still be captured and reversed. Summary of the invention

[0004] In order to solve the above problems, the present invention provides a software business code anti-reversing method and system for Linux system, so as to solve the problem that the traditional code anti-reversing scheme cannot truly realize code hiding and the code is captured and reversed due to the core business code being dropped to the disk during operation.

[0005] According to a first aspect of an embodiment of the present invention, there is provided a software service code anti-reversing method for a Linux system, comprising:

[0006] The software codes to be run are divided into basic service codes and core business codes according to the importance of the code functions; among them, the core business codes are in an encrypted state;

[0007] During the software code running process, the following running strategies are executed:

[0008] Executing the basic service code based on the created process in a first namespace pre-created in the system;

[0009] Creating a second namespace by executing a process related to the basic service code, and decrypting the core business code in the second namespace;

[0010] A third namespace is created based on the decrypted core business code, and the core business process is executed in the third namespace.

[0011] Furthermore, the first namespace, the second namespace, the third namespace and the namespace where the Linux system is located are independent of each other and are all different namespaces.

[0012] Furthermore, the decryption of the core business code in the second namespace is specifically: decryption of the core business code is performed in the second namespace through a pre-created expansion process, wherein the expansion process performs corresponding decryption processing based on the encryption algorithm adopted by the core business code to obtain the decrypted core business code.

[0013] Furthermore, the second namespace selects a temporary storage device for creation and starts encryption and hiding functions, wherein the temporary storage device is a memory file system or a cache.

[0014] Furthermore, the namespace is created by using a clone command or a setns command, and the type of the namespace is an mnt namespace.

[0015] Furthermore, the importance of the code function is pre-set by software developers according to the business implemented by the code.

[0016] Furthermore, the encryption method used for encrypting the core business code may adopt a symmetric encryption algorithm or an asymmetric encryption algorithm.

[0017] According to a second aspect of an embodiment of the present invention, there is provided a software service code anti-reversal system for a Linux system, comprising:

[0018] A software code division unit, which is used to divide the software code to be run into a basic service code and a core business code according to the importance of the code function; wherein the core business code is in an encrypted state;

[0019] A software running unit is used to execute the following running strategies during the running of the software code: executing the corresponding process of the basic service code in the first namespace pre-created by the system; creating a second namespace by executing the related process of the basic service code, and decrypting the core business code in the second namespace; creating a third namespace based on the decrypted core business code, and executing the core business process in the third namespace.

[0020] According to a third aspect of an embodiment of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored and running on the memory, wherein when the processor executes the program, the method for preventing software business code from being reverse engineered in a Linux system is implemented.

[0021] According to a fourth aspect of an embodiment of the present invention, there is provided a computer storage medium on which a computer program is stored, and when the program is executed by a processor, the method for preventing software service code from being reverse engineered in a Linux system is implemented.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] The present invention provides a method and system for preventing software business code from being reverse engineered in a Linux system. The scheme is implemented based on multiple namespaces. The basic services of the software are run in a first namespace. A second namespace is created, and an expansion process is started in the second namespace, and the expansion process expands a core business module. A third namespace is created through the core business module, and the core business is loaded in the third namespace. Due to the file isolation of multiple namespaces, the first and third namespaces that are truly displayed to the outside are unaware of the core business module files in the second namespace, thereby achieving the purpose of preventing software business code from being reverse engineered.

[0024] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0026] Figure 1 This is a flow chart of a method for preventing software service code from being reverse engineered in a Linux system according to an embodiment of the present invention;

[0027] Figure 2 The figure is a structural diagram of a software service code anti-reverse system for a Linux system described in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0029] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0030] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0031] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0032] Terminology explanation:

[0033] Basic service code: that is, the implementation code of the more basic functional modules in the software business, which needs to be determined by technical personnel based on the actual situation of the software.

[0034] Core business code: that is, the implementation code of relatively important functional modules in the software business, which needs to be determined by technical personnel based on the actual situation of the software.

[0035] Namespace: Namespaces under Linux is a virtualization mechanism provided by the kernel to isolate system resources. The most common namespaces include mount, UTS, IPC, network, and PID.

[0036] Clone command: It is a Linux system call used to create a new process or thread;

[0037] setns command: It is a Linux system call used to reassociate threads to different namespaces;

[0038] mnt namespace: mnt namespace is a mechanism in the Linux kernel to achieve isolation of file system environments.

[0039] Expand process: that is, the decryption process, which is responsible for decrypting the encrypted core files and is also an executable program itself.

[0040] In order to solve the problems existing in the prior art, this embodiment provides a method for preventing software service code from being reverse engineered in a Linux system, which mainly adopts the following technical concepts:

[0041] Based on the implementation of multiple namespaces, the basic services of the software are run in the first namespace; a second namespace is created, and the expansion process is started in the second namespace, and the expansion process expands the core business module; a third namespace is created through the core business module, and the core business is loaded in the third namespace. Due to the file isolation of multiple namespaces, the first and third namespaces that are truly displayed to the outside world are unaware of the core business module files in the second namespace, thereby achieving the purpose of preventing software business code from being reversed.

[0042] Specifically, Figure 1 As shown, the method specifically includes the following processing steps:

[0043] Step 1: The software code to be run is divided into basic service code and core business code according to the importance of the code function; the core business code is in an encrypted state;

[0044] Step 2: During the software code execution, execute the following operation strategy:

[0045] Step 201: Execute the basic service code based on the created process in the first namespace pre-created in the system;

[0046] Specifically, the creation of the first namespace uses the clone or setns command to specify the switching of the mnt command space, and ensures that it is not in the same file namespace as the host (ie, the Linux system).

[0047] Step 202: Create a second namespace by executing a process related to the basic service code, and decrypt the core service code in the second namespace;

[0048] Specifically, the creation of the second namespace is consistent with the creation of the first namespace, and both require the creation of a separate mnt namespace.

[0049] The reason for the above setting is that since the core business code will be written to the disk in this namespace, an independent namespace is created (it should be noted that the creation of the namespace here requires the selection of a temporary storage device for creation, and the encryption and hiding functions are enabled, wherein the temporary storage device is a memory file system or a cache), and the encryption and hiding functions are enabled. In this way, even if the file is written to the disk, no trace will be left on the physical disk, and the user will not be aware of the core file.

[0050] In a specific implementation, the decryption of the core business code in the second namespace is specifically: decrypting the core business code in the second namespace through a pre-created expansion process, wherein the expansion process performs corresponding decryption processing based on the encryption algorithm adopted by the core business code to obtain the decrypted core business code.

[0051] Step 203: Create a third namespace based on the decrypted core business code, and execute the core business process in the third namespace.

[0052] In one or more implementations, the third namespace may also be encrypted and protected, and the files written to the disk may be deleted after the core business is successfully run.

[0053] In one or more implementations, the first namespace, the second namespace, the third namespace, and the namespace where the Linux system is located are independent of each other and are all different namespaces.

[0054] In a specific implementation, the importance of the code function is pre-set by software developers based on the business implemented by the code.

[0055] Exemplary:

[0056] Taking WPS (Word Processing System) under Linux system as an example, its basic services and core businesses can be divided as follows:

[0057] The basic services and core services of WPS mainly include the following aspects:

[0058] (1) Basic services:

[0059] 1) Document creation and editing: Users can use WPS to create new documents, including text documents, presentations, spreadsheets, etc., and can edit existing documents, such as text input, modification, format setting, table data entry, formula calculation, presentation slide production, animation setting, etc. This is the most basic function of WPS, which meets the basic creation needs of users for various documents in daily office work.

[0060] 2) File management: helps users manage local and cloud files. Users can create, save, save as, open, close, and other operations in WPS. They can also classify, search, and sort files to help users quickly find the files they need. In addition, WPS supports multiple file formats, such as .docx, .xlsx, .pptx, .pdf, etc., to ensure compatibility with other office software.

[0061] 3) Cloud storage and synchronization: Cloud storage space is provided. After logging into the account, users can upload local files to the cloud for storage, so that they can access and edit them anytime and anywhere on different devices. The cloud synchronization function ensures that the user's changes to files on different devices can be synchronized in real time, avoiding the problem of inconsistent file versions1.

[0062] 4) Template service: Provide users with a variety of templates, including various types of document templates, presentation templates, table templates, etc. These templates cover multiple fields such as daily office, study, business, etc. Users can choose appropriate templates according to their needs, quickly create professional documents, and improve work efficiency1.

[0063] (2) Core Services:

[0064] 1) Collaborative office: Supports multiple people to edit documents online. Multiple users can edit a document at the same time, view other users' modifications in real time, and communicate and discuss in real time. This is very useful for team projects, which can improve team collaboration efficiency and reduce communication costs1.

[0065] 2) Intelligent office assistance: AI technology is used to provide intelligent office assistance functions, such as intelligent typesetting, intelligent error correction, and intelligent translation. Intelligent typesetting can automatically adjust the format and layout of the document according to the user's content to make the document more beautiful; intelligent error correction can detect typos and grammatical errors in the document and give modification suggestions; the intelligent translation function allows users to quickly translate document content.

[0066] 3) Data processing and analysis: The spreadsheet function provides powerful data processing and analysis capabilities. Users can use various functions and formulas to calculate, count, filter, sort, and other operations on data. They can also use tools such as pivot tables and charts to perform visual analysis on data, helping users extract valuable information from large amounts of data.

[0067] 4) Security and privacy protection: We attach great importance to the security and privacy protection of user files and adopt various security measures, such as file encryption and access control. Users can set file passwords to limit other users' access and editing permissions to files, ensuring the security and privacy of files.

[0068] According to the above division, for the WPS software under Linux, the implementation code of its document creation and editing, file management, cloud storage and synchronization, and template service related functions corresponds to the basic service code in the scheme described in this embodiment; and the implementation code of the related functions of collaborative office, intelligent office assistance, data processing and analysis, and security and privacy protection corresponds to the core business code in the scheme described in this embodiment.

[0069] It is understandable that the confirmation of the basic service code and core business code of a specific software needs to be determined based on the specific circumstances.

[0070] In a specific implementation, the encryption method used for encrypting the core business code may adopt a symmetric encryption algorithm or an asymmetric encryption algorithm, wherein:

[0071] Symmetric encryption algorithm

[0072] Principle: The code is encrypted using a key. At runtime, the program uses the same key to decrypt. For example, Advanced Encryption Standard (AES) is a commonly used symmetric encryption algorithm. The encrypting and decrypting parties need to know the same key.

[0073] Asymmetric encryption algorithm

[0074] Principle: Use a pair of keys, namely a public key and a private key. The public key is used for encryption and the private key is used for decryption. For example, the RSA algorithm.

[0075] In one or more embodiments, Figure 2 As shown, corresponding to the above method, a software service code anti-reversal system for Linux system is provided, including:

[0076] A software code division unit, which is used to divide the software code to be run into a basic service code and a core business code according to the importance of the code function; wherein the core business code is in an encrypted state;

[0077] A software running unit is used to execute the following running strategies during the running of the software code: executing the corresponding process of the basic service code in the first namespace pre-created by the system; creating a second namespace by executing the related process of the basic service code, and decrypting the core business code in the second namespace; creating a third namespace based on the decrypted core business code, and executing the core business process in the third namespace.

[0078] It should be noted here that the system described in this embodiment corresponds to the method described in Example 1, and its technical details have been described in detail in the method embodiment, so they will not be repeated here.

[0079] In further embodiments, there is also provided:

[0080] An electronic device includes a memory and a processor and computer instructions stored in the memory and executed on the processor, wherein when the computer instructions are executed by the processor, the above-mentioned software service code anti-reversal method for Linux system is completed. For the sake of brevity, it will not be described here.

[0081] It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, off-the-shelf programmable gate arrays FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0082] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0083] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the above-mentioned software business code anti-reversing method for a Linux system is completed.

[0084] The method in the above embodiment can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0085] Those skilled in the art will appreciate that the units, i.e., algorithm steps, of the various examples described in the present embodiment can be implemented in electronic hardware or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A method for preventing software service code from being reverse engineered in a Linux system, characterized in that: include: The software codes to be run are divided into basic service codes and core business codes according to the importance of the code functions; among them, the core business codes are in an encrypted state; During the software code running process, the following running strategies are executed: Executing the basic service code based on the created process in a first namespace pre-created in the system; Creating a second namespace by executing a process related to the basic service code, and decrypting the core business code in the second namespace; A third namespace is created based on the decrypted core business code, and the core business process is executed in the third namespace.

2. A software service code anti-reversing method for Linux system as claimed in claim 1, characterized in that: The first namespace, the second namespace, the third namespace and the namespace where the Linux system is located are independent of each other and are all different namespaces.

3. A method for preventing software service code from being reverse engineered in a Linux system as claimed in claim 1, characterized in that: The decryption of the core business code in the second namespace is specifically: decrypting the core business code in the second namespace through a pre-created expansion process, wherein the expansion process performs corresponding decryption processing based on the encryption algorithm adopted by the core business code to obtain the decrypted core business code.

4. A software service code anti-reversing method for Linux system as claimed in claim 1, characterized in that: The second namespace selects a temporary storage device for creation and starts encryption and hiding functions, wherein the temporary storage device is a memory file system or a cache.

5. A software service code anti-reversing method for Linux system as claimed in claim 1, characterized in that: The namespace is created by using the clone command or the setns command, and the type of the namespace is the mnt namespace.

6. A method for preventing software service code from being reverse engineered in a Linux system as claimed in claim 1, characterized in that: The importance of the code function is pre-set by the software developer according to the business implemented by the code.

7. A method for preventing software service code from being reverse engineered in a Linux system as claimed in claim 1, characterized in that: The encryption method used for encrypting the core business code may be a symmetric encryption algorithm or an asymmetric encryption algorithm.

8. A software business code anti-reversal system for Linux system, characterized in that: include: A software code division unit, which is used to divide the software code to be run into a basic service code and a core business code according to the importance of the code function; wherein the core business code is in an encrypted state; A software running unit is used to execute the following running strategies during the running of the software code: executing the corresponding process of the basic service code in the first namespace pre-created by the system; creating a second namespace by executing the related process of the basic service code, and decrypting the core business code in the second namespace; creating a third namespace based on the decrypted core business code, and executing the core business process in the third namespace.

9. An electronic device comprising a memory, a processor and a computer program stored and running on the memory, characterized in that: When the processor executes the program, the method for preventing software business code from being reverse engineered for a Linux system as described in any one of claims 1 to 7 is implemented.

10. A computer storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a software service code anti-reversing method for a Linux system as described in any one of claims 1 to 7 is implemented.

Images