Micro-front-end confusion method and sub-application operation method
By dividing the source code of the micro front-end into multiple code blocks and generating a jump table, parsing it into AST node for obfuscation, the problem of difficulty in taking into account both independence and security of the micro front-end application is solved, efficient code obfuscation and dynamic loading are achieved, and the overall security of the micro front-end is improved.
Patent Information
- Application Number
- CN202411578761.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-03-07
AI Technical Summary
The prior art is difficult to take into account the independence of micro front-end applications and the security of code obfuscation, which leads to the obfuscated code being easily cracked and has low security.
By dividing the source code into multiple code blocks, generating jump tables, and parsing the source code into AST nodes for code obfuscation, generating obfuscated code. Load the jump table, obfuscated code and configuration files into the sub-app, so that they can redirect code based on the configuration file and jump table, and load code dynamically based on the configuration file and obfuscated code.
It improves the security of the micro front-end, makes the code flow difficult to predict, protects sensitive data and communication content within and across applications, and increases the difficulty of attackers to crack.
Smart Images
Figure CN119577705A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a micro-front-end obfuscation method and a sub-application operation method. Background Art
[0002] The micro-frontend architecture decouples a single complex application into different independent sub-applications. Each sub-application usually uses a different technology stack and can be independently developed, tested, and deployed, reducing the dependencies between different teams. Each sub-application may contain sensitive business logic or algorithms. Once the code is reverse engineered, attackers may use this information to perform malicious operations.
[0003] In the prior art, a unified obfuscation algorithm is used to obfuscate codes, thereby improving code security and preventing malicious attacks and code leaks.
[0004] However, due to the uniqueness of micro frontends, the above method is difficult to take into account the independence of sub-applications, and the obfuscated code is easy to crack, so the security is low. Summary of the invention
[0005] The embodiments of the present application provide a micro-frontend obfuscation method and a sub-application running method to improve the security of the micro-frontend.
[0006] In a first aspect, an embodiment of the present application provides a micro-front-end obfuscation method, which is applied to an electronic device, and the method includes:
[0007] For any sub-application of the micro front-end, divide the source code corresponding to the sub-application into multiple code blocks, generate a jump table corresponding to each code block and a jump table between code blocks;
[0008] Parsing the source code into Abstract Syntax Tree (AST) nodes, performing code obfuscation based on the AST nodes, and converting the obfuscated AST nodes into obfuscated codes;
[0009] The jump table, the obfuscated code and the configuration file are loaded into the sub-application, so that the sub-application performs code jump based on the configuration file and the jump table, and performs code dynamic loading based on the configuration file and the obfuscated code.
[0010] In some optional implementations, the source code includes running code and debugging and detection code.
[0011] Some optional implementations of code obfuscation based on AST nodes include:
[0012] Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
[0013] In some optional implementations, code obfuscation based on AST nodes also includes:
[0014] Insert a redundant code block at the AST node.
[0015] In some optional implementations, the configuration file is generated in the following manner:
[0016] Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0017] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0018] Some optional implementations also include:
[0019] In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
[0020] In a second aspect, an embodiment of the present application provides a micro-frontend obfuscation method, the method comprising:
[0021] Obtaining a jump table, obfuscated code, and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes;
[0022] Perform code jump based on the configuration file and the jump table;
[0023] The code is dynamically loaded based on the configuration file and the obfuscated code.
[0024] In some optional implementations, the configuration file is generated by:
[0025] The electronic device encrypts the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0026] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0027] Some optional implementations also include:
[0028] When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
[0029] In a third aspect, an embodiment of the present application provides a micro-front-end obfuscation device, which includes:
[0030] The structural obfuscation module is used to divide the source code corresponding to any sub-application of the micro front-end into multiple code blocks, generate a jump table corresponding to each code block and a jump table between code blocks;
[0031] A code obfuscation module, used to parse the source code into AST nodes, perform code obfuscation based on the AST nodes, and convert the obfuscated AST nodes into obfuscated code;
[0032] A loading module is used to load the jump table, the obfuscated code and the configuration file into the sub-application, so that the sub-application performs code jumps based on the configuration file and the jump table, and performs dynamic code loading based on the configuration file and the obfuscated code.
[0033] In some optional implementations, the source code includes running code and debugging and detection code.
[0034] In some optional implementations, the code obfuscation module is specifically used to:
[0035] Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
[0036] In some optional implementations, the code obfuscation module is further used to:
[0037] Insert a redundant code block at the AST node.
[0038] Some optional implementations further include a configuration module, which is used to generate the configuration file in the following manner:
[0039] Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0040] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0041] In some optional implementation manners, the configuration module is further used to:
[0042] In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
[0043] In a fourth aspect, an embodiment of the present application provides a sub-application running device, the device comprising:
[0044] An acquisition module, used to acquire a jump table, obfuscated code and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes;
[0045] An operation module, used for performing code jump based on the configuration file and the jump table;
[0046] The running module is also used to dynamically load code based on the configuration file and the obfuscated code.
[0047] In some optional implementations, the configuration file is generated by:
[0048] The electronic device encrypts the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0049] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0050] Some optional implementations further include a monitoring module for:
[0051] When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
[0052] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the micro-front-end obfuscation method described in any one of the first aspects above.
[0053] In the sixth aspect, an embodiment of the present application provides a front-end device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any sub-application running method described in the second aspect above.
[0054] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes any method described in the first aspect or the second aspect above.
[0055] In the embodiment of the present application, each sub-application is independently obfuscated, and structural obfuscation is achieved by forming a code flow table, making the code flow difficult to predict, protecting sensitive data and communication content within and across applications, and reducing attacks through intercepting or tampering with communications; by converting source code into AST nodes, the code obfuscation of each independent sub-application is efficiently performed, and the independence of obfuscation is improved. Even if one sub-application is cracked, other sub-applications cannot be directly cracked; through the diversity of obfuscation between sub-applications and the multi-level obfuscation architecture, the difficulty of cracking by attackers is increased, and the situation of malicious analysis and tampering of front-end code through reverse engineering is reduced, and the micro-front-end architecture is made more intelligent and efficient. BRIEF DESCRIPTION OF THE DRAWINGS
[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0057] Figure 1 A schematic diagram of a micro front-end provided for an embodiment of the present application;
[0058] Figure 2 A schematic diagram of a flow chart of a micro-front-end obfuscation method provided in an embodiment of the present application;
[0059] Figure 3 A schematic diagram of code conversion provided in an embodiment of the present application;
[0060] Figure 4 A flowchart of a sub-application operation method provided in an embodiment of the present application;
[0061] Figure 5 A schematic diagram of the structure of a micro-front-end obfuscation device provided in an embodiment of the present application;
[0062] Figure 6 A schematic diagram of the structure of a sub-application running device provided in an embodiment of the present application;
[0063] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0064] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.
[0065] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.
[0066] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.
[0067] See also Figure 1 As shown, the micro front-end architecture decouples a single complex application into different independent sub-applications ( Figure 1 Take sub-application 1 to sub-application n as an example). Each sub-application usually uses a different technology stack and can be independently developed, tested, and deployed, reducing the dependencies between different teams. A micro-frontend application looks like a complete application to users, but from a technical perspective, it is composed of independent sub-applications combined in some way.
[0068] Each sub-application may contain sensitive business logic or algorithms. Once the code is reverse engineered, attackers may use this information to perform malicious operations, such as stealing intellectual property, bypassing security checks, or tampering with application behavior.
[0069] In the prior art, a unified obfuscation algorithm is used to obfuscate codes, thereby improving code security and preventing malicious attacks and code leaks.
[0070] However, due to the uniqueness of micro frontends, the above approach is difficult to take into account the independence of sub-applications and has low security.
[0071] For example, the code is obfuscated, but the dependencies between different sub-applications are usually exposed in network requests. Reverse engineers can locate key code snippets and weaken the obfuscation effect.
[0072] In view of this, an embodiment of the present application proposes a micro-frontend obfuscation method and a sub-application running method to improve the security of the micro-frontend.
[0073] The following will be combined with the accompanying drawings and specific embodiments to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.
[0074] Figure 2 A schematic diagram of the process of the first micro-frontend obfuscation method provided in the embodiment of the present application is as follows: Figure 2 As shown, the following steps are included:
[0075] Step S201: For any sub-application of the micro front-end, divide the source code corresponding to the sub-application into multiple code blocks, and generate a jump table corresponding to each code block and a jump table between code blocks.
[0076] In this embodiment, each sub-application is obfuscated independently, and structural obfuscation is achieved by forming a code flow table, making the code flow difficult to predict, protecting sensitive data and communication content within and across applications, and reducing attacks by intercepting or tampering with communications.
[0077] Exemplarily, one sub-application corresponds to multiple source codes, and each source code is divided into multiple code blocks. A jump table is created for each code block, which is implemented through a large switch (selection judgment statement) or an overall jump table. The control flow is driven by a state variable, and complex operations are performed on the value of the state, making the transition between each state difficult to predict.
[0078] The source code may be a JavaScript (JS) code.
[0079] Step S202: Parse the source code into AST nodes, perform code obfuscation based on the AST nodes, and convert the obfuscated AST nodes into obfuscated codes.
[0080] In practice, directly obfuscating the source code is inefficient and difficult. Based on this, this embodiment converts the source code into AST nodes to efficiently obfuscate the code of each independent sub-application, thereby improving the independence of the obfuscation. Even if one sub-application is cracked, other sub-applications cannot be directly cracked.
[0081] See also Figure 3 As shown, you can use @babel / parser (JavaScript parser) to parse the source code into original AST nodes, traverse the AST nodes, find the identifiers that need to be obfuscated, get the obfuscated AST nodes, and use generator (code generator) to regenerate obfuscated code from the obfuscated AST.
[0082] For example, during the obfuscation process, closures or immediately-invoked function expressions (IIFEs) may be used to encapsulate the variables and functions of each sub-application to prevent conflicts in global variables between different sub-applications.
[0083] During implementation, code obfuscation can also be combined with code compression to reduce code size while increasing the complexity of obfuscation and improving loading and execution performance.
[0084] Step S203: Load the jump table, the obfuscated code and the configuration file into the sub-application, so that the sub-application performs code jumps based on the configuration file and the jump table, and performs dynamic code loading based on the configuration file and the obfuscated code.
[0085] The configuration file contains the obfuscation strategy and parameters specific to the corresponding sub-application. Therefore, the jump table, obfuscated code and configuration file are loaded into the sub-application. At runtime, code jumps are performed based on the configuration file and jump table, and code is dynamically loaded based on the configuration file and obfuscated code.
[0086] Configuration options are provided through configuration files, allowing developers to adjust the intensity and strategy of obfuscation and encryption according to project requirements, making the obfuscation process more flexible and adaptable to the needs of different scenarios.
[0087] The above solution confuses each sub-application independently and implements structural obfuscation by forming a code flow table, making the code flow unpredictable, protecting sensitive data and communication content within and across applications, and reducing attacks through intercepting or tampering with communications; by converting source code into AST nodes, the code of each independent sub-application is efficiently obfuscated, and the obfuscation independence is improved. Even if one sub-application is cracked, other sub-applications cannot be directly cracked; through the obfuscation diversity between sub-applications and the multi-level obfuscation architecture, the difficulty of cracking is increased for attackers, reducing the situation of malicious analysis and tampering of front-end code through reverse engineering, and making the micro-front-end architecture more intelligent and efficient.
[0088] In some optional implementations, the source code includes running code and debugging and detection code.
[0089] During implementation, debugging detection code is added to detect debugging tools (such as determining whether the debugging tool of the browser is turned on), thereby realizing an anti-debugging mechanism.
[0090] In some optional implementations, the above step S202 performs code obfuscation based on AST nodes, which can be implemented by but not limited to the following methods:
[0091] Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
[0092] In implementation, sub-applications have more codes, and different codes have different importance. Some codes do not need to be obfuscated, and the codes that need to be obfuscated also have different importance.
[0093] Based on this, this embodiment divides the codes to be obfuscated into first codes with lower security requirements and second codes with higher security requirements according to different importance levels;
[0094] Basic obfuscation is performed on the AST nodes corresponding to the first code with lower security requirements, and logical obfuscation is performed on the AST nodes corresponding to the second code with higher security requirements.
[0095] This embodiment does not make any specific limitations on basic obfuscation, such as variable replacement, etc.; this embodiment does not make any specific limitations on logical obfuscation, such as function encryption, etc.
[0096] The above scheme, through a progressive obfuscation strategy, performs basic obfuscation on the AST nodes corresponding to the first code with lower security requirements, and performs logical obfuscation on the AST nodes corresponding to the second code with higher security requirements, so as to balance security and performance.
[0097] In some optional implementation manners, the above step S202 further performs the following steps:
[0098] Insert a redundant code block at the AST node.
[0099] By randomly generating and inserting different redundant code blocks each time the obfuscation is performed, the randomness of the obfuscation is increased, making it more difficult to attack and crack.
[0100] In some optional implementations, the above configuration file may be implemented by, but not limited to, the following methods:
[0101] Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0102] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0103] During implementation, independent keys and configurations are generated based on the relevant information of the sub-application. The keys are generated based on information such as the sub-application's identification, timestamp, and random salt value (Salt), ensuring that the keys are difficult to predict. Different keys are used for encryption and decryption when loading different sub-applications, increasing the difficulty of cracking.
[0104] Exemplarily, for each sub-application-specific obfuscation configuration information (obfuscation strategy and parameters), a hash calculation is performed based on a key to obtain an encrypted configuration file.
[0105] In some optional implementations, the following steps are further performed:
[0106] In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
[0107] In this embodiment, abnormal behavior detection is performed during the operation of the sub-application. Once abnormal behavior is detected, a key adjustment request is triggered; the electronic device generates a new key based on the key adjustment request.
[0108] During implementation, a new key may be generated based on information such as the sub-application identifier, a new timestamp, and a new random salt value.
[0109] Figure 4 A flowchart of a sub-application operation method provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the following steps are included:
[0110] Step S401: Obtain a jump table, obfuscated code, and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes;
[0111] Step S402: performing code jump based on the configuration file and the jump table;
[0112] Step S403: dynamically loading code based on the configuration file and the obfuscated code.
[0113] The generation of the configuration file, jump table and obfuscated code may refer to the above embodiment and will not be described in detail here.
[0114] Since the configuration file contains the obfuscation strategy and parameters specific to the corresponding sub-application, after the jump table, obfuscated code and configuration file are loaded into the sub-application, during the running process of the sub-application, code jumps are performed based on the configuration file and jump table, and code is dynamically loaded based on the configuration file and obfuscated code.
[0115] In some optional implementation manners, after the above step 403, the following steps are further performed:
[0116] When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
[0117] During implementation, abnormal behavior detection will be performed during the running process of the sub-application, such as detecting debugging behavior by measuring the execution time of the code, detecting window size abnormalities (such as the width outside the browser window - the width inside the browser window > 100), inserting trigger AntiDebugActions to check the trigger behavior of the debugger (a kind of debugging software), etc.; once abnormal behavior is detected, a key adjustment request will be triggered. In addition, the sub-application can destroy the current key and stop code decryption; the electronic device generates a new key based on the key adjustment request.
[0118] In some optional implementations, when abnormal behavior is detected, an abnormal recheck may be performed, such as tracking mouse behavior, etc. If the recheck confirms the abnormality, the code may be self-destructed and the electronic device may be requested to regenerate the configuration file, jump table and obfuscated code.
[0119] like Figure 5 As shown, based on the same inventive concept as the above-mentioned micro-frontend obfuscation method, an embodiment of the present application provides a micro-frontend obfuscation device 500, which includes:
[0120] The structure obfuscation module 501 is used to divide the source code corresponding to any sub-application of the micro front-end into multiple code blocks, and generate a jump table corresponding to each code block and a jump table between code blocks;
[0121] A code obfuscation module 502 is used to parse the source code into AST nodes, perform code obfuscation based on the AST nodes, and convert the obfuscated AST nodes into obfuscated codes;
[0122] The loading module 503 is used to load the jump table, the obfuscated code and the configuration file into the sub-application, so that the sub-application performs code jumps based on the configuration file and the jump table, and performs dynamic code loading based on the configuration file and the obfuscated code.
[0123] In some optional implementations, the source code includes running code and debugging and detection code.
[0124] In some optional implementations, the code obfuscation module 502 is specifically used to:
[0125] Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
[0126] In some optional implementations, the code obfuscation module 502 is further used to:
[0127] Insert a redundant code block at the AST node.
[0128] Some optional implementations further include a configuration module 504, which is used to generate the configuration file in the following manner:
[0129] Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0130] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0131] In some optional implementations, the configuration module 504 is further configured to:
[0132] In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
[0133] like Figure 6 As shown, based on the same inventive concept as the above-mentioned sub-application running method, the embodiment of the present application provides a sub-application running device 600, which includes:
[0134] The acquisition module 601 is used to acquire a jump table, obfuscated code and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes;
[0135] An operation module 602 is used to perform code jump based on the configuration file and the jump table;
[0136] The running module 602 is also used to dynamically load code based on the configuration file and the obfuscated code.
[0137] In some optional implementations, the configuration file is generated by:
[0138] The electronic device encrypts the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0139] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0140] Some optional implementations further include a monitoring module 603, which is used to:
[0141] When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
[0142] Figure 5-6 The specific implementation of the embodiment can refer to the implementation of the corresponding method above, and the repeated parts will not be repeated.
[0143] Based on the same technical concept, the embodiment of the present application also provides an electronic device 700, such as Figure 7 As shown, it includes at least one processor 701 and a memory 702 connected to the at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. Figure 7 For example, the processor 701 and the memory 702 are connected via a bus 703. The bus can be divided into a path bus, a data bus, a control bus, etc. For convenience of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0144] Among them, the processor 701 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 702 and calling data stored in the memory 702. Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.
[0145] Processor 701 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the micro-front-end obfuscation method can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.
[0146] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0147] In an embodiment of the present application, the memory 702 stores a computer program, and when the program is executed by the processor 701, the processor 701 executes the micro-front-end obfuscation method corresponding to the above-mentioned electronic device side.
[0148] Based on the same technical concept, an embodiment of the present application further provides a front-end device, including at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor 701 executes:
[0149] For any sub-application of the micro front-end, divide the source code corresponding to the sub-application into multiple code blocks, generate a jump table corresponding to each code block and a jump table between code blocks;
[0150] Parsing the source code into AST nodes, performing code obfuscation based on the AST nodes, and converting the obfuscated AST nodes into obfuscated code;
[0151] The jump table, the obfuscated code and the configuration file are loaded into the sub-application, so that the sub-application performs code jump based on the configuration file and the jump table, and performs code dynamic loading based on the configuration file and the obfuscated code.
[0152] In some optional implementations, the source code includes running code and debugging and detection code.
[0153] In some optional implementation manners, the processor 701 specifically performs:
[0154] Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
[0155] In some optional implementations, the processor 701 further executes:
[0156] Insert a redundant code block at the AST node.
[0157] In some optional implementations, the processor 701 further executes:
[0158] Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0159] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0160] In some optional implementations, the processor 701 further executes:
[0161] In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
[0162] Based on the same technical concept, an embodiment of the present application further provides a front-end device, including at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes:
[0163] Obtaining a jump table, obfuscated code, and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes;
[0164] Perform code jump based on the configuration file and the jump table;
[0165] The code is dynamically loaded based on the configuration file and the obfuscated code.
[0166] In some optional implementations, the configuration file is generated by:
[0167] The electronic device encrypts the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file;
[0168] The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
[0169] In some optional implementations, the processor further executes:
[0170] When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
[0171] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned micro-front-end obfuscation method or sub-application running method.
[0172] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0173] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0176] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.
[0177] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A micro-frontend obfuscation method, characterized in that: Applied to electronic equipment, the method comprises: For any sub-application of the micro front-end, divide the source code corresponding to the sub-application into multiple code blocks, generate a jump table corresponding to each code block and a jump table between code blocks; Parsing the source code into AST nodes, performing code obfuscation based on the AST nodes, and converting the obfuscated AST nodes into obfuscated code; The jump table, the obfuscated code and the configuration file are loaded into the sub-application, so that the sub-application performs code jump based on the configuration file and the jump table, and performs code dynamic loading based on the configuration file and the obfuscated code.
2. The method according to claim 1, characterized in that The source code includes running code and debugging and detection code.
3. The method according to claim 1, characterized in that Code obfuscation based on AST nodes, including: Basic obfuscation is performed on the AST nodes corresponding to the first code, and logical obfuscation is performed on the AST nodes corresponding to the second code.
4. The method according to claim 1, characterized in that Code obfuscation based on AST nodes also includes: Insert a redundant code block at the AST node.
5. The method according to claim 1, characterized in that Generate the configuration file in the following way: Encrypting the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file; The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
6. The method according to claim 5, characterized in that Also includes: In response to a key adjustment request sent by the sub-application, a new key is generated; wherein the key adjustment request is triggered by the sub-application when abnormal behavior is detected.
7. A sub-application running method, characterized in that: include: Obtaining a jump table, obfuscated code, and configuration file corresponding to the sub-application; wherein the jump table includes a jump table corresponding to each code block and a jump table between code blocks generated after the electronic device divides the source code corresponding to the sub-application into multiple code blocks; the obfuscated code is obtained by the electronic device parsing the source code into AST nodes, performing code obfuscation, and converting the obfuscated AST nodes; Perform code jump based on the configuration file and the jump table; The code is dynamically loaded based on the configuration file and the obfuscated code.
8. The method according to claim 7, characterized in that The configuration file is generated in the following way: The electronic device encrypts the obfuscated configuration information of the sub-application based on the key corresponding to the sub-application to obtain the configuration file; The key is generated based on part or all of the information in the identifier, timestamp and random salt value of the sub-application.
9. The method according to claim 8, characterized in that Also includes: When abnormal behavior is detected, the key is destroyed, and a key adjustment request is sent to the electronic device so that the electronic device generates a new key.
10. An electronic device, characterized in that: It includes at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the micro-frontend obfuscation method as described in any one of claims 1 to 6.
11. A front-end device, characterized in that: It comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the sub-application running method according to any one of claims 7 to 9.