JavaScript code encryption method and device

Abstract

The invention relates to a JavaScript code encryption method and device, and belongs to the technical field of software security and code obfuscation, and the method comprises the steps: carrying out static and dynamic analysis on a JavaScript code to obtain a plurality of code blocks, calculating the complexity corresponding to each code block, distributing the code blocks to different virtual machines according to the complexity, and storing the code blocks in the virtual machines; due to the fact that different instruction sets are adopted by different virtual machines, after the code blocks are obfuscated based on the different virtual machines, the complexity and the dynamic nature of codes can be increased, an attacker cannot easily recover code logic through static or dynamic analysis, debugging and reverse engineering are effectively prevented, and the code safety is improved.

Description

Technical Field

[0001] The present application relates to the technical field of software security and code obfuscation, and in particular to a method and device for encrypting JavaScript code. Background Art

[0002] JavaScript is a scripting language widely used in web development, especially in front-end development. However, since JavaScript code is executed in the browser as plain text, it is easy to be obtained, decompiled and tampered with. Therefore, the need to protect JavaScript code is urgent.

[0003] Traditional obfuscation technology mainly relies on static virtual machine instruction sets and fixed code obfuscation methods. Although it improves the readability of the code to a certain extent, it is still easily cracked by advanced reverse engineering tools and techniques (such as debuggers and memory analyzers). Attackers can use tools to gradually analyze and restore static bytecodes. The overall protection mechanism is facing failure, resulting in insufficient code protection and poor software security. Summary of the invention

[0004] To this end, the present invention provides a JavaScript code encryption method and device to solve the problem of poor software security caused by insufficient code protection of existing obfuscation technology.

[0005] In a first aspect, a method for encrypting JavaScript code is provided, the method comprising: The method comprises: Perform static and dynamic analysis on the JavaScript code to obtain multiple first code blocks; Obtaining a first complexity corresponding to each of the first code blocks according to each of the first code blocks; Distributing the first code block to different virtual machines according to the first complexity; different virtual machines use different instruction sets; The first code block is obfuscated based on the virtual machine.

[0006] Further, obtaining the first complexity corresponding to each of the first code blocks according to each of the first code blocks includes: The first complexity corresponding to each of the first code blocks is obtained by a complexity formula, and the complexity formula is: Ci = w1×f1(Ci)+ w2×f2(Ci)+…+ wn×fn(Ci); Among them, Ci is the first complexity, w1, w2, ..., wn are the weights of each computing operation involved in the first code block, and f1(Ci), f2(Ci), ..., fn(Ci) are the computing operations involved in the first code block.

[0007] Further, distributing the first code block to different virtual machines according to the first complexity includes: Distributing each of the first code blocks one by one; The distribution process includes: obtaining a second code block and a second complexity corresponding to the second code block; Obtaining a preset complexity interval of each of the virtual machines; the preset complexity intervals of each of the virtual machines are different and have no intersection; Setting the preset complexity interval including the second complexity as a target preset complexity interval; The second code block is sent to the virtual machine corresponding to the target preset complexity interval.

[0008] Further, the obfuscating the first code block based on the virtual machine includes: Converting the first code into bytecode; Mapping the bytecode to the virtual machine to obtain a mapping table; The mapping table is subjected to execution path randomization processing.

[0009] Furthermore, mapping the bytecode to the virtual machine to obtain a mapping table includes: The mapping table is obtained by a bytecode mapping formula, and the bytecode mapping formula is: Mplex = map(Bci, VM); Among them, Mplex is a mapping table, Bci is a bytecode, and VM is a virtual machine.

[0010] Furthermore, before executing the path randomization process on the mapping table, the method includes: The period of execution path randomization processing is obtained by a period formula, and the period formula is: S = ; Wherein, S is the period of execution path randomization processing, k is the adjustment parameter, Lsys is the current load of the system, and Lmax is the maximum load of the system.

[0011] Furthermore, the method further comprises: Different virtual machines use different state storage methods; Different execution logics are used for instruction decoding of different virtual machines.

[0012] Furthermore, the method further comprises: Determine whether to trigger the self-modifying virtual machine logic based on user behavior and environmental information; If the self-modifying virtual machine logic is triggered, the virtual machine will generate new execution rules according to the current system state, and the self-modified virtual machine will execute bytecode operations according to the new rules.

[0013] Furthermore, the method further comprises: The state of the virtual machine is encrypted and decrypted by an encryption algorithm; the encryption algorithm includes: a symmetric encryption algorithm, a hash encryption algorithm or a digital signature encryption algorithm.

[0014] In a second aspect, a JavaScript code encryption device is provided, the device comprising: An analysis module, used for performing static and dynamic analysis on the JavaScript code to obtain a plurality of first code blocks; A complexity module, used for obtaining a first complexity corresponding to each of the first code blocks according to each of the first code blocks; a distribution module, configured to distribute the first code block to different virtual machines according to the first complexity; different virtual machines adopt different instruction sets; A processing module is used to perform obfuscation processing on the first code block based on the virtual machine.

[0015] The present invention adopts the above technical solution and has at least the following beneficial effects: A JavaScript code encryption method and device are provided. The JavaScript code is subjected to static and dynamic analysis to obtain multiple code blocks, and the complexity corresponding to each code block is calculated. The code blocks are distributed to different virtual machines according to the complexity. Since different virtual machines use different instruction sets, the code blocks are obfuscated based on different virtual machines, which can increase the complexity and dynamics of the code, making it impossible for attackers to easily restore the code logic through static or dynamic analysis, effectively preventing debugging and reverse engineering, and improving code security.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 is a flowchart of a JavaScript code encryption method shown in an exemplary embodiment of the present invention; Figure 2 The figure is a schematic block diagram of a JavaScript code encryption device shown in an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0020] JavaScript is a scripting language widely used in web development, especially in front-end development. However, since JavaScript code is executed in plain text in the browser, it is extremely easy to be obtained, decompiled and tampered with. Therefore, the need to protect JavaScript code is very urgent. VMP (Virtual Machine Protection) obfuscation technology improves the security of the code by converting the original code into bytecode and interpreting and executing it through a virtual machine. However, due to the dynamic characteristics of JavaScript and the different operating environments, the application of VMP obfuscation in JavaScript faces new challenges.

[0021] In the existing technology, traditional VMP mainly relies on static virtual machine instruction sets and fixed code obfuscation methods. Once the virtual machine instruction set is reverse cracked, the overall protection mechanism may become invalid. Usually, the statically mapped bytecode does not change during operation, so attackers can use tools to gradually analyze and restore the static bytecode.

[0022] The embodiment of the present application provides a JavaScript code encryption method and device, which obfuscates the code blocks through different virtual machines based on the complexity of the code blocks, increases the complexity and dynamism of the code, and makes it difficult for attackers to easily restore the code logic through static or dynamic analysis. Through virtual machine state encryption and dynamic virtual machine switching, it resists analysis methods such as debugging tools and memory viewing tools, and prevents malicious users from obtaining code state information when the program is running.

[0023] The method in this application is described below through specific examples.

[0024] See also Figure 1 , Figure 1 is a flowchart of a JavaScript code encryption method shown in an exemplary embodiment of the present invention, see Figure 1 , the method comprising: Step S11, performing static and dynamic analysis on the JavaScript code to obtain a plurality of first code blocks; Step S12: obtaining a first complexity corresponding to each first code block according to each first code block; Step S13: Distribute the first code block to different virtual machines according to the first complexity; different virtual machines use different instruction sets; Step S14: Obfuscate the first code block based on the virtual machine.

[0025] It should be noted that the JavaScript code encryption method provided in this embodiment is applicable to scenarios including, but not limited to, JavaScript code obfuscation encryption in specific practice.

[0026] It can be understood that the JavaScript code encryption method provided in this embodiment performs static and dynamic analysis on the JavaScript code to obtain multiple code blocks, calculates the complexity corresponding to each code block, and distributes the code blocks to different virtual machines based on the complexity. Since different virtual machines use different instruction sets, after the code blocks are obfuscated based on different virtual machines, the complexity and dynamics of the code can be increased, making it impossible for attackers to easily restore the code logic through static or dynamic analysis, effectively preventing debugging and reverse engineering, and improving code security.

[0027] In specific practice, step S11 "perform static and dynamic analysis on the JavaScript code to obtain multiple first code blocks" includes: using static analysis tools (such as AST parsing, symbolic execution) and dynamic analysis tools (such as execution tracing) to divide the JavaScript code into blocks.

[0028] Specifically, the static analysis process is: parsing each function, class, and method in the JavaScript source code, and identifying logical blocks based on the program's control flow graph (CFG); the dynamic analysis process is: dynamically identifying which code blocks may pose a security threat during execution by recording the frequency of function calls, memory usage, etc. during code execution.

[0029] In specific practice, step S12 "obtaining the first complexity corresponding to each first code block based on each first code block" includes: obtaining the first complexity corresponding to each first code block through the complexity formula, the complexity formula is: Ci =w1×f1(Ci)+ w2×f2(Ci)+…+ wn×fn(Ci); wherein, Ci is the first complexity, w1, w2,…, wn are the weights of each computing operation involved in the first code block, and f1(Ci), f2(Ci),…, fn(Ci) are the computing operations involved in the first code block.

[0030] It should be noted that w1, w2, ..., wn are the weights of each computing operation, and factors considered include memory consumption, execution time, function calls, etc.; f1(Ci), f2(Ci), ..., fn(Ci) are the computing operations involved, such as computing amount, memory usage, function calls, etc.

[0031] It is understandable that the technical solution provided in this embodiment makes the execution path of JavaScript code difficult to predict based on the complexity of the code block through the dynamic switching mechanism of heterogeneous virtual machines, thereby further increasing the difficulty for attackers to crack the code.

[0032] In specific practice, step S13 "distributing the first code block to different virtual machines according to the first complexity" includes: distributing each first code block one by one; the distribution process includes: obtaining the second code block and the second complexity corresponding to the second code block; obtaining the preset complexity interval of each virtual machine; the preset complexity interval of each virtual machine is different and has no intersection; setting the preset complexity interval containing the second complexity as the target preset complexity interval; sending the second code block to the virtual machine corresponding to the target preset complexity interval.

[0033] It should be noted that each time a code block that has not been distributed is obtained from the first code block as the second code block, and the second code block is distributed. The second code block is a code block to be distributed and processed selected from the first code block.

[0034] Specifically, the preset complexity range is obtained based on each virtual machine performing obfuscation operations on multiple code blocks multiple times, and the preset complexity range can also be set according to specific business needs.

[0035] It should be noted that the core algorithm block (high-risk code block), involving key logic such as encryption and data operations, is assigned to a virtual machine with higher execution capabilities, that is, it is handled by a virtual machine with a higher upper and lower limit of the preset complexity range. Low-risk code blocks (such as UI rendering, general calculations, etc.): are assigned to virtual machines with higher computing efficiency but lower security requirements, that is, they are handled by virtual machines with lower upper and lower limits of the preset complexity range.

[0036] It can be understood that the technical solution provided in this embodiment can effectively improve the security and dynamism of the code by determining the allocation and protection strategy of each code block according to the risk level when the code block is executed.

[0037] In specific practice, step S14 "obfuscating the first code block based on the virtual machine" includes: converting the first code into bytecode; mapping the bytecode to the virtual machine to obtain a mapping table; and performing execution path randomization on the mapping table.

[0038] Specifically, in converting the first code into bytecode, the bytecode generation process is: converting each code block C into bytecode through a compiler or an interpreter.

[0039] Specifically, mapping the bytecode to the virtual machine to obtain a mapping table includes: obtaining the mapping table through a bytecode mapping formula, the bytecode mapping formula is: Mplex = map(Bci, VM); wherein Mplex is the mapping table, Bci is the bytecode, and VM is the virtual machine.

[0040] It should be noted that when mapping the bytecode to the virtual machine to obtain a mapping table, dynamic bytecode mapping can also be added. Specifically, according to the runtime environment factors (such as system load, timestamp, user behavior, etc.), the bytecode mapping relationship is dynamically generated and the bytecode instruction order is randomized. The mapping formula is: , where Mbase is the base bytecode mapping table; R is a random number used to control the randomization of bytecode mapping; and T is a timestamp, which serves as a dynamic factor at runtime.

[0041] Specifically, the mapping table is processed for execution path randomization. The processing process is as follows: when the virtual machine is executed, each loaded bytecode sequence and execution path are generated based on the new mapping table to ensure that each execution path has a different mapping method. The dynamic randomization of the bytecode will modify the bytecode instruction sequence during the execution process, so that each execution path is different. The execution path randomization formula is: , where Bexec is the executed bytecode and Mrandom is the randomized mapping table.

[0042] In specific practice, before performing execution path randomization processing on the mapping table, the process further includes: obtaining a cycle of execution path randomization processing by using a cycle formula, and the cycle formula is: S = ; Wherein, S is the period of execution path randomization processing, k is the adjustment parameter, Lsys is the current load of the system, and Lmax is the maximum load of the system.

[0043] It should be noted that the period of bytecode randomization is adjusted according to the execution load and computational complexity of the virtual machine. For example, when the system load is low, the frequency of randomization is increased so that the mapping of each bytecode block changes more frequently.

[0044] It can be understood that the technical solution provided in this embodiment ensures that each execution path is unpredictable through execution path randomization, thereby increasing the difficulty of cracking.

[0045] In specific practice, the method also includes: merging the obfuscated first code block using the existing technology to form a new JavaScript code as the target code, and the target code can be deployed to the project later.

[0046] In specific practice, the method also includes: different virtual machines all use different state storage methods; and different virtual machines all use different execution logics for instruction decoding.

[0047] It should be noted that each virtual machine adopts a heterogeneous virtual machine design. The instruction set of each virtual machine is completely independent, and the bytecode encoding of the same operation in different virtual machines is different. Different virtual machines use unique state storage methods, such as register, stack or memory mapping storage, which further increases the difficulty of cracking. The instruction decoding and execution logic of each virtual machine are designed independently to ensure that even if an attacker cracks a virtual machine, its logic cannot be extended to other virtual machines.

[0048] In specific practice, the method also includes: determining whether to trigger the self-modifying virtual machine logic based on user behavior and environmental information; if the self-modifying virtual machine logic is triggered, the virtual machine will generate new execution rules based on the current system state, and the self-modified virtual machine will execute bytecode operations according to the new rules.

[0049] Specifically, the process of self-modifying the virtual machine logic is as follows: 1. When each virtual machine instruction is executed, conditional judgment is used to dynamically decide whether to modify the execution method of certain instructions. The virtual machine will determine whether to trigger self-modification based on user behavior (such as input characters, click behavior, etc.) and environmental information (such as memory, load). For example, when the user enters a specific command or the system load changes, the virtual machine will trigger the modification of the execution path. Trigger condition formula: , where: U is user input (such as keyboard input, mouse click, etc.); T is a timestamp (such as system startup time or virtual machine running time); S is the current state of the virtual machine (such as registers, stack memory, etc.). 2. When the self-modification condition is met, the virtual machine will generate new execution rules based on the current system state. The self-modified virtual machine executes the bytecode according to the new rules to ensure the unpredictability of the execution path. 3. Based on the evaluation results of the triggering conditions, the virtual machine will decide whether to modify the current bytecode execution path. This can be done by dynamically inserting new instructions or modifying the execution method of existing instructions. Instruction modification example 1 Replacement instruction: The original bytecode instruction is replaced by a different instruction through the self-modification mechanism. The execution method of this instruction is generated by conditional judgment. Instruction modification example 2 Add redundant instructions: Add meaningless instructions to disrupt the instruction stream, making it difficult for reverse engineers to determine the true instruction sequence.

[0050] It can be understood that the technical solution, adaptive modification mechanism and real-time feedback control provided in this embodiment enable the execution logic of the virtual machine to be dynamically modified and adjusted based on the external environment, thereby enhancing the unpredictability and protection capabilities of code execution.

[0051] In specific practice, the method also includes: encrypting and decrypting the state of the virtual machine through an encryption algorithm; the encryption algorithm includes: a symmetric encryption algorithm, a hash encryption algorithm or a digital signature encryption algorithm.

[0052] Specifically, the encryption process is as follows: 1. When the virtual machine executes to the switching point, the state data of the virtual machine (such as registers, stack contents, memory blocks, etc.) is extracted and encrypted using a symmetric encryption algorithm (such as AES); 2. The key is generated not only based on timestamps and random numbers, but also in combination with hardware features (such as CPU serial number, device ID) to ensure that the key is unique and cannot be reused each time it is executed; 3. After the target virtual machine loads the encrypted state data, it is decrypted using the same key.

[0053] It can be understood that the technical solution provided in this embodiment, the binding of the encryption key with the hardware feature increases the uniqueness of the key, and combined with the hash verification mechanism to ensure that the state has not been tampered with, further improves the protection strength of the virtual machine state.

[0054] See also Figure 2 , Figure 2 is a schematic block diagram of a JavaScript code encryption device shown in an exemplary embodiment of the present invention, see Figure 2 , a JavaScript code encryption device 100, comprising: An analysis module 101 is used to perform static and dynamic analysis on the JavaScript code to obtain a plurality of first code blocks; A complexity module 102, configured to obtain a first complexity corresponding to each first code block according to each first code block; A distribution module 103, configured to distribute the first code block to different virtual machines according to the first complexity; different virtual machines use different instruction sets; The processing module 104 is configured to perform obfuscation processing on the first code block based on the virtual machine.

[0055] It should be noted that the JavaScript code encryption device provided in this embodiment is applicable to scenarios including, but not limited to, JavaScript code obfuscation encryption in specific practice.

[0056] It can be understood that the JavaScript code encryption device provided in this embodiment performs static and dynamic analysis on the JavaScript code to obtain multiple code blocks, calculates the complexity corresponding to each code block, and distributes the code blocks to different virtual machines according to the complexity. Since different virtual machines use different instruction sets, after the code blocks are obfuscated based on different virtual machines, the complexity and dynamics of the code can be increased, making it impossible for attackers to easily restore the code logic through static or dynamic analysis, effectively preventing debugging and reverse engineering, and improving code security.

[0057] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

[0058] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0059] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0060] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A JavaScript code encryption method, characterized in that: The method comprises: Perform static and dynamic analysis on the JavaScript code to obtain multiple first code blocks; Obtaining a first complexity corresponding to each of the first code blocks according to each of the first code blocks; Distributing the first code block to different virtual machines according to the first complexity; different virtual machines use different instruction sets; The first code block is obfuscated based on the virtual machine.

2. The encryption method according to claim 1, characterized in that: The obtaining, according to each of the first code blocks, a first complexity corresponding to each of the first code blocks includes: The first complexity corresponding to each of the first code blocks is obtained by a complexity formula, and the complexity formula is: Ci = w1×f1(Ci)+ w2×f2(Ci)+…+ wn×fn(Ci); Among them, Ci is the first complexity, w1, w2, ..., wn are the weights of each computing operation involved in the first code block, and f1(Ci), f2(Ci), ..., fn(Ci) are the computing operations involved in the first code block.

3. The encryption method according to claim 1, characterized in that: The distributing the first code block to different virtual machines according to the first complexity includes: Distributing each of the first code blocks one by one; The distribution process includes: obtaining a second code block and a second complexity corresponding to the second code block; Obtaining a preset complexity interval of each of the virtual machines; the preset complexity intervals of each of the virtual machines are different and have no intersection; Setting the preset complexity interval including the second complexity as a target preset complexity interval; The second code block is sent to the virtual machine corresponding to the target preset complexity interval.

4. The encryption method according to claim 1, characterized in that: The obfuscating the first code block based on the virtual machine includes: Converting the first code into bytecode; Mapping the bytecode to the virtual machine to obtain a mapping table; The mapping table is subjected to execution path randomization processing.

5. The encryption method according to claim 4, characterized in that: Mapping the bytecode to the virtual machine to obtain a mapping table includes: The mapping table is obtained by a bytecode mapping formula, and the bytecode mapping formula is: Mplex = map(Bci, VM); Among them, Mplex is a mapping table, Bci is a bytecode, and VM is a virtual machine.

6. The encryption method according to claim 5, characterized in that: Before performing execution path randomization processing on the mapping table, the method further includes: The period of execution path randomization processing is obtained by a period formula, and the period formula is: S = ； Where S is the period of execution path randomization processing, k is the adjustment parameter, Lsys is the current load of the system, and Lmax is the maximum load of the system.

7. The encryption method according to claim 1, characterized in that: The method further comprises: Different virtual machines use different state storage methods; Different execution logics are used for instruction decoding of different virtual machines.

8. The encryption method according to claim 1, characterized in that: The method further comprises: Determine whether to trigger the self-modifying virtual machine logic based on user behavior and environmental information; If the self-modifying virtual machine logic is triggered, the virtual machine will generate new execution rules according to the current system state, and the self-modified virtual machine will execute bytecode operations according to the new rules.

9. The encryption method according to claim 8, characterized in that: The method further comprises: The state of the virtual machine is encrypted and decrypted by an encryption algorithm; the encryption algorithm includes: a symmetric encryption algorithm, a hash encryption algorithm or a digital signature encryption algorithm.

10. A JavaScript code encryption device, characterized in that: The device comprises: An analysis module, used for performing static and dynamic analysis on the JavaScript code to obtain a plurality of first code blocks; A complexity module, used for obtaining a first complexity corresponding to each of the first code blocks according to each of the first code blocks; a distribution module, configured to distribute the first code block to different virtual machines according to the first complexity; different virtual machines adopt different instruction sets; A processing module is used to perform obfuscation processing on the first code block based on the virtual machine.

Images