Application encryption method, device and system and storage medium

Abstract

The invention discloses an application encryption method, device and system and a storage medium, which are used for saving the labor cost in the application encryption process and improving the encryption effect. The method comprises the following steps: extracting a preset feature vector of each module in a to-be-encrypted application from a feature matrix; substituting the preset feature vector of each module into a first preset formula to obtain a calculation result of the first preset formula; according to a calculation result of a first preset formula, an encryption strategy corresponding to each module is determined, the first preset formula is used for calculating scores of each module under different encryption strategies, and the encryption strategy with the highest score is selected for each module; and performing encryption operation on each module according to the encryption strategy corresponding to each module. By adopting the scheme provided by the invention, the labor cost in the application encryption process is saved, and the encryption effect is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an application encryption method, device, system and storage medium. Background Art

[0002] Application encryption is a measure to protect the security of application data and files. Specifically, it can protect applications from unauthorized access and potential threats. Due to the different characteristics and security requirements of various applications, different encryption methods are suitable for different applications. Some are suitable for encryption through strong encryption strategies, such as encryption through AES (Advanced Encryption Standard). Some do not need to be encrypted through strong encryption strategies, and can be encrypted through some other encryption strategies, such as encryption through RSA or lightweight obfuscation encryption. These encryption strategies can ensure that even if the data is intercepted during transmission or storage, attackers cannot easily decrypt it.

[0003] In the prior art, the same encryption strategy is usually used for the same application, and the encryption strategy is pre-set by the staff by analyzing the application characteristics. Therefore, the existing encryption strategy requires a lot of manpower costs to analyze the application characteristics and set the encryption method. In addition, usually, the same application is composed of multiple different modules, and the encryption methods suitable for different modules may actually be different. In the existing encryption method, the same application uses the same encryption strategy, and the encryption effect is not ideal.

[0004] Therefore, how to save labor costs in the application encryption process and improve the encryption effect is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides an application encryption method, device, system and storage medium to save manpower costs in the application encryption process and improve the encryption effect.

[0006] The present application provides an application encryption method, including:

[0007] Extracting a preset feature vector of each module in the application to be encrypted from the feature matrix;

[0008] Substituting the preset feature vector of each module into the first preset formula to obtain a calculation result of the first preset formula;

[0009] Determine the encryption strategy corresponding to each module according to the calculation result of the first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module;

[0010] Perform encryption operations for each module according to the encryption strategy corresponding to each module.

[0011] The beneficial effect of the present application is that it can automatically analyze the preset feature vectors of each module to obtain the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module, and then perform encryption operations on each module according to the encryption strategy corresponding to each module, thereby eliminating the need for staff to pre-set encryption algorithms by analyzing application characteristics, saving labor costs in the application encryption process. In addition, in the present application, each module of the application can be encrypted through different encryption strategies, thereby improving the encryption effect.

[0012] In one embodiment, the method further comprises:

[0013] The application to be encrypted is identified to extract preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features:

[0014] Functional features, security features, and dependency features;

[0015] The preset features of each module in the application to be encrypted are stored in the feature matrix in the form of feature vectors, wherein, when the program to be encrypted includes multiple modules, each row of the feature matrix corresponds to the preset feature vector of one of the modules in the program to be encrypted.

[0016] In one embodiment, when the preset feature is a functional feature, the identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted includes:

[0017] Parsing the code of each module into an abstract syntax tree to parse the code structure of the module;

[0018] Extracting keywords of the module by analyzing the word frequency-inverse document frequency of the module code, so as to determine the code category by the keywords of the module;

[0019] The functional characteristics of the module are extracted according to the structure of the code and the code category.

[0020] In one embodiment, when the preset feature is a security feature, the identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted includes:

[0021] When the module is running, the module's pattern, behavior, and sensitive information are identified and used as the module's security features.

[0022] In one embodiment, when the preset feature is a dependent feature, the application to be encrypted is identified to extract the preset feature of each module in the application to be encrypted, including:

[0023] Parse the module code to obtain dependency information;

[0024] Constructing a dependency graph according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and an edge represents a dependency relationship of each element;

[0025] The dependency graph is analyzed to obtain dependency characteristics of each module.

[0026] In one embodiment, substituting the preset feature vector of each module into the first preset formula to obtain the calculation result of the first preset formula includes:

[0027] Substitute the characteristic vector of each module into the following first preset formula to obtain the calculation result of the first preset formula:

[0028]

[0029] Among them, S n is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

[0030] In one embodiment, the encryption requirement value corresponding to a specific encryption strategy in the encryption strategy is calculated as follows:

[0031] E(T n )=αf n +βs n +γd n ;

[0032] Among them, E(T n ) is the encryption requirement value; α, β and γ are weight parameters, indicating the weights of functional features, security features and dependency features in the encryption requirement, f n is the functional characteristic, s n is a safety feature, d n Dependent features.

[0033] The present application also provides an application encryption device, comprising:

[0034] An extraction module, used for extracting a preset feature vector of each module in the application to be encrypted from the feature matrix;

[0035] A substitution module, used for substituting the preset feature vector of each module into the first preset formula to obtain a calculation result of the first preset formula;

[0036] A determination module, configured to determine the encryption strategy corresponding to each module according to a calculation result of a first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module;

[0037] The encryption module is used to perform encryption operations for each module according to the encryption strategy corresponding to each module.

[0038] In one embodiment, the apparatus further comprises:

[0039] The identification module is used to identify the application to be encrypted so as to extract the preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features:

[0040] Functional features, security features, and dependency features;

[0041] A storage module is used to store the preset features of each module in the application to be encrypted into a feature matrix in the form of feature vectors, wherein, when the program to be encrypted contains multiple modules, each row of the feature matrix corresponds to a preset feature vector of one of the modules in the program to be encrypted.

[0042] In one embodiment, when the preset feature is a functional feature, the identification module includes:

[0043] A first parsing submodule, used for parsing the code of each module into an abstract syntax tree to parse the code structure of the module;

[0044] A first extraction submodule, configured to extract keywords of the module by analyzing the word frequency-inverse document frequency of the module code, so as to determine the code category by the keywords of the module;

[0045] The second extraction submodule is used to extract the functional characteristics of the module according to the structure of the code and the code category.

[0046] In one embodiment, when the preset feature is a security feature, the recognition module includes:

[0047] The identification submodule is used to identify the module's mode, behavior and sensitive information when the module is running, and use the module's mode, behavior and sensitive information as the module's security features.

[0048] In one embodiment, when the preset feature is a dependent feature, the recognition module includes:

[0049] The second parsing submodule is used to parse the module code to obtain dependency information;

[0050] A construction submodule, used to construct a dependency graph according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and an edge represents a dependency relationship of each element;

[0051] The analysis submodule is used to analyze the dependency graph to obtain the dependency characteristics of each module.

[0052] In one embodiment, the substitution module includes:

[0053] The substitution submodule is used to substitute the feature vector of each module into the following first preset formula to obtain the calculation result of the first preset formula:

[0054]

[0055] Among them, S n is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

[0056] In one embodiment, the encryption requirement value corresponding to a specific encryption strategy in the encryption strategy is calculated as follows:

[0057] E(T n )=αf n +βs n +γd n ;

[0058] Among them, E(T n ) is the encryption requirement value; α, β and γ are weight parameters, indicating the weights of functional features, security features and dependency features in the encryption requirement, f n is the functional characteristic, s n is a safety feature, d n Dependent features.

[0059] The present application also provides an application encryption system, comprising:

[0060] at least one processor; and,

[0061] a memory communicatively connected to the at least one processor; wherein,

[0062] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to implement the application encryption method recorded in any one of the above embodiments.

[0063] The present application also provides a computer-readable storage medium, characterized in that when the instructions in the storage medium are executed by a processor corresponding to the application encryption system, the application encryption system can implement the application encryption method recorded in any one of the above embodiments.

[0064] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

[0065] The technical solution of the present application is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The accompanying drawings are used to provide a further understanding of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings:

[0067] Figure 1 This is a flow chart of an application encryption method in one embodiment of the present application;

[0068] Figure 2 This is a block diagram of an application encryption device in one embodiment of the present application;

[0069] Figure 3 This is a schematic diagram of the hardware structure of an application encryption system in one embodiment of the present application. DETAILED DESCRIPTION

[0070] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application.

[0071] Figure 1 Flow chart of an application encryption method in one embodiment of the present application. Figure 1 As shown, the method can be implemented as the following steps S101-S104:

[0072] In step S101, a preset feature vector of each module in the application to be encrypted is extracted from the feature matrix;

[0073] In step S102, the preset feature vector of each module is substituted into the first preset formula to obtain a calculation result of the first preset formula;

[0074] In step S103, the encryption strategy corresponding to each module is determined according to the calculation result of the first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and the encryption strategy with the highest score is selected for each module;

[0075] In step S104, encryption operation is performed for each module according to the encryption policy corresponding to each module.

[0076] In the present application, the method further includes identifying the application to be encrypted to extract preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features: functional features, security features, and dependency features;

[0077] In this application, when the preset feature is a functional feature, the identification of the application to be encrypted to extract the preset features of each module in the application to be encrypted includes: parsing the code of each module into an abstract syntax tree to parse the code structure of the module; extracting the keywords of the module by analyzing the term frequency-inverse document frequency of the module code to determine the code category through the keywords of the module; and extracting the functional features of the module according to the structure and code category of the code. Specifically, the identification process of the abstract syntax tree (AST) can be implemented by parsing the code (Coden) into an abstract syntax tree (ASTn). During the compilation process, the source code is first parsed by a parser into an abstract syntax tree. The abstract syntax tree is a tree-like data structure that represents the syntax structure of the source code. Each node represents a structure in the source code, such as a function definition, a loop statement, a conditional statement, etc. The abstract syntax tree can be used to understand and analyze the code structure. By modifying the abstract syntax tree, code refactoring or code style conversion can also be achieved. The abstract syntax tree can also review possible security vulnerabilities in the code and generate new code. Secondly, the keywords of the module are determined by analyzing the term frequency-inverse document frequency (TF-IDF) of the module code, and then the code category is determined. Among them, the term frequency-inverse document frequency (TF-IDF) is a commonly used weighting technique for information retrieval and text mining, which is used to evaluate the importance of a word for a document in a document set or corpus. TF-IDF consists of two parts: term frequency (TF) and inverse document frequency (IDF). The term frequency (TF) refers to the number of times a given word appears in the file. The higher the term frequency, the more important the word is in the document. However, the words with the highest frequency in an article are often some common words, such as "de", "shi", "ye", etc., and these words cannot well reflect the theme of the article. Therefore, a weight needs to be added to each word, that is, the inverse document frequency. The inverse document frequency (IDF) is a measure of the general importance of a word, and its size is inversely proportional to the commonness of a word. The calculation method is to divide the total number of documents in the corpus by the number of documents in the corpus that contain the word, and then take the logarithm of the obtained quotient. If a certain word is relatively rare, but it appears many times in this article, then it is very likely to reflect the characteristics of this article and is exactly the keyword we need.

[0078] The keywords of the code document can be extracted according to the TF-IDF value. Then the code category is determined according to the keywords of the code document.

[0079] When the code structure and code category are obtained, the functional features of the module are extracted according to the code structure and category.

[0080] When the preset feature is a security feature, the application to be encrypted is identified to extract the preset features of each module in the application to be encrypted, including: when the module is running, the module's mode, behavior and sensitive information are identified, and the module's mode, behavior and sensitive information are used as the module's security feature.

[0081] Security feature identification can be achieved through security pattern matching, runtime behavior monitoring, and sensitive information identification.

[0082] Among them, safe pattern matching Match (Coden, Patterns) is a technique used in programming to check data structures and branch processing. It allows the program to select different logical branches based on specific pattern matching. This technique is very useful when dealing with complex data structures and conditional judgments, and can improve the readability and maintainability of the code. Through safe pattern matching, you can check whether the data structure conforms to the expected pattern. For example, when processing different types of messages, you can use pattern matching to distinguish the type of message and execute the corresponding processing logic. Safe pattern matching can also be used to replace traditional conditional judgment statements such as if-else or switch statements. It can make the code more concise and intuitive, especially when dealing with multiple conditions. In some programming languages, safe pattern matching can be used to handle error conditions. For example, in the Rust language, pattern matching can be used to process the Result type, distinguish between success and failure, and execute the corresponding processing logic. Safe pattern matching can be used to deconstruct complex data structures and break them down into components for easy access and processing. For example, when processing objects containing multiple fields, pattern matching can be used to extract the required field values.

[0083] Runtime Behavior Monitoring refers to the process of real-time monitoring and analysis of the behavior of software or systems during their operation. This monitoring can help developers and system administrators understand the operating status of the system, detect potential problems, and ensure that the system is running as expected. By monitoring the runtime behavior of the system, performance bottlenecks and hot spots of resource consumption can be found, so as to carry out targeted optimization. It can also help detect errors and anomalies in the system, including memory leaks, improper resource management, unhandled exceptions, etc. It can also be used to detect and prevent security vulnerabilities such as SQL injection and cross-site scripting (XSS). In addition, by monitoring the runtime behavior of the system, it can be ensured that all components of the system are working properly and the system as a whole is in a healthy state. In some applications, runtime behavior monitoring can be used to analyze user behavior patterns to provide better user experience and services.

[0084] Sensitive information identification: Match (Coden, Patterns) is a method for identifying sensitive information, where "Coden" may refer to the code or text content to be identified, and "Patterns" refers to the pattern or rules used to match sensitive information. This method is often used in the field of data security, especially when processing and protecting sensitive data, such as personal identity information, financial data, medical data, etc.

[0085] Through sensitive information identification, corresponding protection measures can be taken, such as data encryption, access control, etc., to prevent sensitive data from being leaked or illegally used. In many countries and regions, there are strict laws and regulations requiring organizations to protect users' sensitive information. Sensitive information identification helps organizations comply with these laws and regulations and avoid legal risks. By protecting users' sensitive information, organizations can improve users' trust and enhance their confidence in products or services. For example, an organization may use sensitive information identification technology to scan all text fields in its database to identify whether they contain sensitive information. Once sensitive information is identified, the organization can take measures to protect this data, such as encrypted storage, restricting access rights, etc.

[0086] When the preset feature is a dependency feature, the application to be encrypted is identified to extract the preset features of each module in the application to be encrypted, including: parsing the code of the module to obtain dependency information; constructing a dependency graph according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and the edge represents the dependency relationship of each element; analyzing the dependency graph to obtain the dependency features of each module. Specifically, when identifying the dependency features and analyzing the dependencies of the modules, constructing a dependency graph Gn=(Vn,En) is a key step. This dependency graph describes the dependency relationships between the components in the application. Among them, in Gn=(Vn,En), Vn represents a node set and En represents an edge set. The following is a detailed explanation of this process: The node set Vn represents all components or entities that need to be analyzed in the application. These nodes can be any form of components such as functions, classes, modules, libraries, files, etc., which are independent entities in the application. When constructing the dependency graph, each such component will be represented as a node. These nodes should be able to clearly distinguish different components to facilitate subsequent dependency analysis. The edge set En represents the dependency relationship between components. Each edge connects a pair of nodes, representing the dependency relationship between the two nodes. When building the edge, you need to determine which components have dependencies. This usually involves static analysis of the source code to determine which components call which other components. In addition, dynamic analysis can also be considered to observe the interaction between components at runtime. 3. Build a dependency graph After determining the nodes and edges, you can start building the dependency graph. Each node represents a component and each edge represents a dependency relationship. The information on the edge can include the type of dependency (for example, call relationship, containment relationship, etc.), the strength of the dependency, etc. During the construction process, you need to pay attention to keeping the graph clear and readable. Overly complex graphs may be difficult to understand, so it is necessary to appropriately simplify and highlight key information. In addition, it is necessary to ensure the accuracy of the graph, that is, correctly reflect the actual dependencies between components. 4. Use the dependency graph for dependency analysis After building the dependency graph, you can use it for dependency analysis. By analyzing the nodes and edges in the graph, you can understand the dependencies between the components in the application and how these relationships affect the overall structure and behavior of the application. For example, you can understand the calling relationship between components by analyzing the connectivity of nodes in the graph; understand the strength and direction of dependencies by analyzing the weight and direction of edges; understand the key parts of the application by finding the key nodes and key paths in the graph, etc.

[0087] After obtaining the preset features of each module in the encryption application according to the above scheme, the preset features of each module in the application to be encrypted are stored in a feature matrix in the form of feature vectors, wherein, when the program to be encrypted contains multiple modules, each row of the feature matrix corresponds to a preset feature vector of one of the modules in the program to be encrypted.

[0088] In this application, a preset feature vector of each module in the application to be encrypted is extracted from the feature matrix;

[0089] Substituting the preset feature vector of each module into a first preset formula to obtain a calculation result of the first preset formula; determining the encryption strategy corresponding to each module according to the calculation result of the first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and selecting the encryption strategy with the highest score for each module;

[0090] Specifically, the characteristic vector of each module is substituted into the following first preset formula to obtain the calculation result of the first preset formula:

[0091]

[0092] Among them, S n is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

[0093] The encryption requirement value may be calculated by determining the values ​​corresponding to the functional features, security features, and dependency features under a given encryption strategy, and then performing a weighted summation of the corresponding values.

[0094] For example, the functional characteristics of a module indicate that the main function of the module is to store a large amount of data, and the security characteristics indicate that there is less or no sensitive information in the data. Since the symmetric encryption algorithm can quickly encrypt a large amount of data and the key management is relatively simple, it is more suitable for encrypting the module. Therefore, if the given encryption strategy is a symmetric encryption strategy (such as AES encryption, DES encryption, etc.), the value corresponding to the functional characteristics is 5, and the value corresponding to the security characteristics is 5. Although asymmetric encryption can provide higher security, the security requirements for this scenario are not high, and the key management of asymmetric encryption is more complicated, and the encryption speed is not as good as symmetric encryption. Therefore, if the given encryption strategy is asymmetric encryption (such as RSA encryption, ECC encryption, etc.), the value corresponding to the functional characteristics is 3, and the value corresponding to the security characteristics is also 3.

[0095] For the value corresponding to the dependency feature, some specific hardware security modules or cryptographic accelerators may be used to improve the efficiency and security of asymmetric encryption. Therefore, if the module dependency feature indicates that the device on which the software depends has these specific hardware security modules or cryptographic accelerators, then if the given encryption strategy is asymmetric encryption, the value corresponding to the dependency feature is 5. If the given encryption strategy is symmetric encryption, the value corresponding to the dependency feature is 3.

[0096] For example, assuming that the encryption strategy is asymmetric encryption, the value of the functional feature is 3, the value of the security feature is 3, and the value of the dependency feature is 5 according to the analysis of the module preset features. When the encryption strategy is symmetric encryption, the value of the functional feature is 5, the value of the security feature is 5, and the value of the dependency feature is 3 according to the analysis of the module preset features. When the encryption strategy is lightweight obfuscation encryption, the value of the functional feature is 3, the value of the security feature is 4, and the value of the dependency feature is 5 according to the analysis of the module preset features. Substitute the module feature vector into the following first preset formula:

[0097]

[0098] This formula means that among multiple possible encryption strategies, an encryption strategy that can maximize the encryption requirement value is selected. arg max is a mathematical operator that means finding the variable value that maximizes a function in a set of values. Therefore, the first preset formula is used to find an encryption strategy S that makes the encryption requirement value E(T n ) reaches the maximum value. Therefore, when substituting the preset feature vector into the first preset formula, it is first necessary to calculate the encryption requirement values ​​under different encryption strategies. Assuming α=0.5, β=0.3, γ=0.2, then the encryption requirement values ​​under the asymmetric encryption strategy are calculated to be 3.4, the encryption requirement values ​​under the symmetric encryption strategy are 4.6, and the encryption requirement values ​​under the lightweight obfuscation encryption strategy are calculated to be 3.7. Therefore, in this example, the encryption requirement value under the symmetric encryption strategy is the largest, and therefore, the symmetric encryption strategy is the calculation result of the first preset formula, that is, in this example, the encryption strategy corresponding to the module is the symmetric encryption strategy.

[0099] According to the above method, the encryption strategy corresponding to each module in the application can be calculated, so that encryption operation is performed for each module according to the encryption strategy corresponding to each module.

[0100] In one embodiment, the method can also be implemented as the following steps A1-A2:

[0101] In step A1, the application to be encrypted is identified to extract preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features:

[0102] Functional features, security features, and dependency features;

[0103] In step A2, the preset features of each module in the application to be encrypted are stored in a feature matrix in the form of feature vectors, wherein, when the program to be encrypted contains multiple modules, each row of the feature matrix corresponds to a preset feature vector of one of the modules in the program to be encrypted.

[0104] In one embodiment, when the preset feature is a functional feature, the above step A1 of identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted can be implemented as the following steps B1-B3:

[0105] In step B1, the code of each module is parsed into an abstract syntax tree to parse the code structure of the module;

[0106] In step B2, keywords of the module are extracted by analyzing the word frequency-inverse document frequency of the module code, so as to determine the code category through the keywords of the module;

[0107] In step B3, the functional features of the module are extracted according to the structure of the code and the code category.

[0108] In one embodiment, when the preset feature is a security feature, the above step A1 of identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted can be implemented as follows:

[0109] When the module is running, the module's pattern, behavior, and sensitive information are identified and used as the module's security features.

[0110] In one embodiment, when the preset feature is a dependent feature, the above step A1 of identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted can be implemented as the following steps C1-C3:

[0111] In step C1, the module code is parsed to obtain dependency information;

[0112] In step C2, a dependency graph is constructed according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and an edge represents a dependency relationship of each element;

[0113] In step C3, the dependency graph is analyzed to obtain dependency features of each module.

[0114] After building the dependency graph, the following analysis can be performed:

[0115] Loop detection: Checks whether there are loops in the graph. If there are loops, it may mean that the code has circular dependency issues, which is usually a bad programming practice and may make the code difficult to maintain and understand.

[0116] Analysis of coupling between modules: By analyzing the number of edges between nodes and the weight of the edges (such as the level of detail of the import), the degree of coupling between different modules can be evaluated. High coupling may mean that some modules are too dependent on other modules, which may lead to fragile and difficult to maintain code.

[0117] Critical path analysis: Find the most important paths in the graph (such as the longest path, the shortest path, etc.). The modules on these paths may be the key parts of the code and need to be protected and optimized.

[0118] Module importance assessment: By analyzing the degree of a node (i.e., the number of edges connected to it) or other related indicators, the importance of each module in the system can be assessed. This is helpful for optimizing code, determining test priorities, etc.

[0119] In addition, in addition to analyzing the degree of integration and interaction between modules and other modules, software, and systems, dependency feature analysis can also determine the hardware, operating system, network, and other environments on which the software depends.

[0120] In one embodiment, the above step S102 may be implemented as the following steps:

[0121] Substitute the characteristic vector of each module into the following first preset formula to obtain the calculation result of the first preset formula:

[0122]

[0123] Among them, S n is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

[0124] In one embodiment, the encryption requirement value corresponding to a specific encryption policy in the encryption policy is calculated as follows:

[0125] E(T n )=αf n +βs n +γd n ;

[0126] Among them, E(T n) is the encryption requirement value; α, β and γ are weight parameters, indicating the weights of functional features, security features and dependency features in the encryption requirement, f n is the functional characteristic, s n is a safety feature, d n Dependent features.

[0127] Figure 2 A block diagram of an application encryption device in one embodiment of the present application is shown in FIG. Figure 2 As shown, the device includes the following modules:

[0128] An extraction module 201 is used to extract a preset feature vector of each module in the application to be encrypted from the feature matrix;

[0129] A substitution module 202 is used to substitute the preset feature vector of each module into the first preset formula to obtain a calculation result of the first preset formula;

[0130] A determination module 203, configured to determine the encryption strategy corresponding to each module according to the calculation result of a first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module;

[0131] The encryption module 204 is used to perform encryption operations for each module according to the encryption policy corresponding to each module.

[0132] In one embodiment, the apparatus further comprises:

[0133] The identification module is used to identify the application to be encrypted so as to extract the preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features:

[0134] Functional features, security features, and dependency features;

[0135] A storage module is used to store the preset features of each module in the application to be encrypted into a feature matrix in the form of feature vectors, wherein, when the program to be encrypted contains multiple modules, each row of the feature matrix corresponds to a preset feature vector of one of the modules in the program to be encrypted.

[0136] In one embodiment, when the preset feature is a functional feature, the identification module includes:

[0137] A first parsing submodule, used for parsing the code of each module into an abstract syntax tree to parse the code structure of the module;

[0138] A first extraction submodule, configured to extract keywords of the module by analyzing the word frequency-inverse document frequency of the module code, so as to determine the code category by the keywords of the module;

[0139] The second extraction submodule is used to extract the functional characteristics of the module according to the structure of the code and the code category.

[0140] In one embodiment, when the preset feature is a security feature, the recognition module includes:

[0141] The identification submodule is used to identify the module's mode, behavior and sensitive information when the module is running, and use the module's mode, behavior and sensitive information as the module's security features.

[0142] In one embodiment, when the preset feature is a dependent feature, the recognition module includes:

[0143] The second parsing submodule is used to parse the module code to obtain dependency information;

[0144] A construction submodule, used to construct a dependency graph according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and an edge represents a dependency relationship of each element;

[0145] The analysis submodule is used to analyze the dependency graph to obtain the dependency characteristics of each module.

[0146] In one embodiment, the substitution module includes:

[0147] The substitution submodule is used to substitute the feature vector of each module into the following first preset formula to obtain the calculation result of the first preset formula:

[0148]

[0149] Among them, S n is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

[0150] In one embodiment, the encryption requirement value corresponding to a specific encryption strategy in the encryption strategy is calculated as follows:

[0151] E(T n )=αf n +βs n +γd n ;

[0152] Among them, E(T n ) is the encryption requirement value; α, β and γ are weight parameters, indicating the weights of functional features, security features and dependency features in the encryption requirement, f nis the functional characteristic, s n is a safety feature, d n Dependent features.

[0153] Figure 3 FIG. 1 is a schematic diagram of the hardware structure of an application encryption system in an embodiment of the present application. Figure 3 As shown, the application encryption system includes:

[0154] at least one processor 320; and,

[0155] A memory 304 in communication with the at least one processor 320; wherein,

[0156] The memory 304 stores instructions that can be executed by the at least one processor 320, and the instructions are executed by the at least one processor 320 to implement the application encryption method described in any of the above embodiments.

[0157] Reference Figure 3 The application encryption system 300 may include one or more of the following components: a processing component 302 , a memory 304 , a power component 306 , a multimedia component 308 , an audio component 310 , an input / output (I / O) interface 312 , a sensor component 314 , and a communication component 316 .

[0158] The processing component 302 generally controls the overall operation of the application encryption system 300. The processing component 302 may include one or more processors 320 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 302 may include one or more modules to facilitate the interaction between the processing component 302 and other components. For example, the processing component 302 may include a multimedia module to facilitate the interaction between the multimedia component 308 and the processing component 302.

[0159] The memory 304 is configured to store various types of data to support the operation of the application encryption system 300. Examples of such data include instructions for any application or method operating on the application encryption system 300, such as text, pictures, videos, etc. The memory 304 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0160] The power component 306 provides power to various components of the application encryption system 300. The power component 306 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the application encryption system 300.

[0161] The multimedia component 308 includes a screen that provides an output interface between the application encryption system 300 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 308 may also include a front camera and / or a rear camera. When the application encryption system 300 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0162] The audio component 310 is configured to output and / or input audio signals. For example, the audio component 310 includes a microphone (MIC), and when the application encryption system 300 is in an operation mode, such as an alarm mode, a recording mode, a voice recognition mode, and a voice output mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 304 or sent via the communication component 316. In some embodiments, the audio component 310 also includes a speaker for outputting audio signals.

[0163] I / O interface 312 provides an interface between processing component 302 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0164] The sensor assembly 314 includes one or more sensors for providing various aspects of status assessment for the application encryption system 300. For example, the sensor assembly 314 may include a sound sensor. In addition, the sensor assembly 314 may detect the open / closed state of the application encryption system 300, the relative positioning of the components, such as the display and keypad of the application encryption system 300, and the sensor assembly 314 may also detect the operating state of the application encryption system 300 or a component of the application encryption system 300, such as the operating state of the wind distribution plate, the structural state, the operating state of the discharge scraper, etc., the orientation or acceleration / deceleration of the application encryption system 300 and the temperature change of the application encryption system 300. The sensor assembly 314 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 314 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 314 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, a material stacking thickness sensor or a temperature sensor.

[0165] The communication component 316 is configured to enable the application encryption system 300 to provide the ability to communicate with other devices and cloud platforms in a wired or wireless manner. The application encryption system 300 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 316 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 316 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0166] In an exemplary embodiment, the application encryption system 300 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to execute the application encryption method described in any of the above embodiments.

[0167] The present application also provides a computer-readable storage medium, characterized in that when the instructions in the storage medium are executed by a processor corresponding to the application encryption system, the application encryption system can implement the application encryption method recorded in any one of the above embodiments.

[0168] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0169] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0172] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An application encryption method, characterized in that: include: Extracting a preset feature vector of each module in the application to be encrypted from the feature matrix; Substituting the preset feature vector of each module into the first preset formula to obtain a calculation result of the first preset formula; Determine the encryption strategy corresponding to each module according to the calculation result of the first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module; Perform encryption operations for each module according to the encryption strategy corresponding to each module.

2. The method according to claim 1, characterized in that The method further comprises: The application to be encrypted is identified to extract preset features of each module in the application to be encrypted, wherein the preset features include at least one of the following features: Functional features, security features, and dependency features; The preset features of each module in the application to be encrypted are stored in the feature matrix in the form of feature vectors, wherein, when the program to be encrypted includes multiple modules, each row of the feature matrix corresponds to the preset feature vector of one of the modules in the program to be encrypted.

3. The method according to claim 2, characterized in that When the preset feature is a functional feature, the identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted includes: Parsing the code of each module into an abstract syntax tree to parse the code structure of the module; Extracting keywords of the module by analyzing the word frequency-inverse document frequency of the module code, so as to determine the code category by the keywords of the module; The functional characteristics of the module are extracted according to the structure of the code and the code category.

4. The method according to claim 2, characterized in that When the preset feature is a security feature, the identifying the application to be encrypted to extract the preset feature of each module in the application to be encrypted includes: When the module is running, the module's pattern, behavior, and sensitive information are identified and used as the module's security features.

5. The method according to claim 2, characterized in that When the preset feature is a dependent feature, the application to be encrypted is identified to extract the preset features of each module in the application to be encrypted, including: Parse the module code to obtain dependency information; Constructing a dependency graph according to the dependency information, wherein each node in the dependency graph represents an element or entity in the code, and an edge represents a dependency relationship of each element; The dependency graph is analyzed to obtain dependency characteristics of each module.

6. The method according to claim 1, characterized in that Substituting the preset feature vector of each module into the first preset formula to obtain the calculation result of the first preset formula includes: Substitute the characteristic vector of each module into the following first preset formula to obtain the calculation result of the first preset formula: Where, is the encryption strategy in the nth order, S is the encryption strategy set, E(T n ) is the encryption requirement value, and the first preset formula represents the encryption strategy corresponding to the maximum value among the different encryption requirement values ​​obtained under different encryption strategies as S n The output result is:

7. The method according to claim 6, characterized in that The encryption requirement value corresponding to a specific encryption strategy in the encryption strategy is calculated as follows: E(T n )=αf n +βs n +γd n ; Among them, E(T n ) is the encryption requirement value; α, β and γ are weight parameters, indicating the weights of functional features, security features and dependency features in the encryption requirement, f n is the functional characteristic, s n is a safety feature, d n Dependent features.

8. An application encryption device, characterized in that: include: An extraction module, used for extracting a preset feature vector of each module in the application to be encrypted from the feature matrix; A substitution module, used for substituting the preset feature vector of each module into the first preset formula to obtain a calculation result of the first preset formula; A determination module, configured to determine the encryption strategy corresponding to each module according to a calculation result of a first preset formula, wherein the first preset formula is used to calculate the score of each module under different encryption strategies, and select the encryption strategy with the highest score for each module; The encryption module is used to perform encryption operations for each module according to the encryption strategy corresponding to each module.

9. An application encryption system, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to implement the application encryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor corresponding to the application encryption system, the application encryption system can implement the application encryption method as described in any one of claims 1 to 7.

Images