Application system security protection method and system based on execution virtual machine

Abstract

The invention discloses an application system security protection method and system based on an execution virtual machine, and the method comprises the steps: reading a CLASS file and related metadata in a JAR package, and converting the code of the CLASS file into a pseudo code of an EVM line by line; encrypting the generated pseudo code by adopting a symmetric encryption algorithm, packaging the encrypted pseudo code and related metadata, and generating a program package protected by EVM (Error Vector Magnitude); dependency on EVM is added into the converted pseudo-code, and meanwhile, the pseudo-code is integrated with an EVM runtime environment; the JRE can load a runtime library of the EVM and start the EVM, and the EVM initializes an internal data structure; when the code is executed to be required to call a function, access a variable or a constant, searching a corresponding element from the HashMap of the initialized internal data structure by the EVM; judging whether the EVM searches a corresponding element in the HashMap or not; cache acquisition is carried out, and the data is directly delivered to a just-in-time compiler for final local code generation; and performing pre-compilation release on the EVM, and returning to the step S6 again.

Description

Technical Field

[0001] The present invention belongs to the technical field of software system security protection, and in particular, relates to an application system security protection method and system based on executing a virtual machine. Background Art

[0002] In the process of JAVA software product development, code security has always faced severe challenges. With the continuous development of reverse engineering technology, CLASS files and metadata in JAR assemblies are easily cracked, illegally modified, and recompiled. Traditional solutions based on code obfuscation and encryption have obvious flaws. Although these solutions can encrypt assemblies before running and decrypt them at run time, once the program starts executing, the fully decrypted code will appear in the memory. This undoubtedly provides crackers with an opportunity to dump code from memory, which in turn causes serious security issues. Summary of the invention

[0003] In view of the problem that the existing code obfuscation and encryption methods will cause complete decrypted code to appear in the memory when the application system is running, and there is a problem of leakage of dumped code from the memory, the present invention provides an application system security protection method and system based on executing a virtual machine.

[0004] In order to achieve the above technical objectives, the technical solution adopted by the present invention is as follows:

[0005] A method for protecting application system security based on executing a virtual machine, comprising the steps of:

[0006] S1. Read the CLASS file and related metadata in the JAR package, and convert the CLASS file code line by line into EVM pseudo code;

[0007] S2. Use a symmetric encryption algorithm to encrypt the generated pseudocode, package the encrypted pseudocode and related metadata, and generate a program package protected by EVM;

[0008] S3. Add dependency on EVM to the converted pseudocode and integrate it with the EVM runtime environment;

[0009] S4. JRE will load the EVM runtime library and start the EVM, and the EVM will initialize the internal data structure;

[0010] S5. When the code executes to the point where it needs to call a function, access a variable or a constant, the EVM searches for the corresponding element in the HashMap of the initialized internal data structure.

[0011] S6. Determine whether EVM searches for the corresponding element in HashMap. If the precompiled cache of the corresponding element is found, proceed to step S7. If the precompiled cache of the corresponding element is not found, proceed to step S8.

[0012] S7, cache acquisition, and directly hand it over to the just-in-time compiler for final native code generation;

[0013] S8, EVM performs pre-compilation and release, and returns to step S6 again to determine whether EVM searches for the corresponding element in the HashMap.

[0014] Furthermore, the detailed steps of using the symmetric encryption algorithm to encrypt the generated pseudocode are as follows:

[0015] Generate a random encryption key; it can be a complex key generated by the system based on factors such as the current time and hardware information.

[0016] Use the key to encrypt the pseudo code;

[0017] The pseudocode is divided into data blocks of fixed length, each data block is encrypted, and the encrypted results are concatenated.

[0018] Furthermore, a dependency on EVM is added to the converted pseudocode, and the code structure is modified so that the code can correctly call EVM-related functional modules at runtime. Instructions for initializing the EVM environment are added to the startup part of the code. These instructions are executed first when the program starts, and are responsible for loading the EVM runtime library and establishing a connection with the EVM runtime library. Specifically, a section of code is inserted into the main method of the CLASS file to call the initialization function of the EVM. This initialization function checks whether the EVM is already installed in the system. If not, it automatically downloads and installs the EVM. Once the EVM is installed, the initialization function configures the EVM environment variables, establishes a connection with the EVM runtime library, and returns control to the main method to continue execution.

[0019] Furthermore, the integration of the EVM runtime environment includes configuring relevant environment variables and adding the installation path of the EVM to the system's environment variables.

[0020] Furthermore, when the EVM is initialized for the first time, the corresponding elements are searched, including function, variable and constant search and pre-compilation release.

[0021] Furthermore, the pre-compilation release of EVM includes parsing and optimizing the pseudocode and converting it into an intermediate representation suitable for just-in-time compilation; EVM uses its built-in compilation engine to process it.

[0022] The compilation engine will first decrypt the encrypted pseudocode;

[0023] Then perform syntax and semantic analysis on the decrypted pseudocode;

[0024] During the analysis, the compilation engine identifies the key elements of instruction sequences, variable references, and function calls in the pseudocode and optimizes these elements;

[0025] For repeated instruction sequences, the compilation engine will perform merge optimization.

[0026] Furthermore, when the EVM performs a pre-compilation release, the pre-compiled result is stored in the cache. The next time the same function, variable, or constant needs to be called, the EVM will first search in the cache; if found, the result is obtained directly from the cache without the need to perform the pre-compilation operation again.

[0027] An application system security protection system based on an execution virtual machine, comprising an EVM code conversion and encryption unit, an EVM runtime integration unit and an EVM execution unit;

[0028] The EVM code conversion and encryption unit includes a code parsing submodule, a pseudo code generation submodule and an encryption submodule;

[0029] The code parsing submodule is responsible for reading the JAVA code in the JAR package and performing structural analysis on it;

[0030] Pseudocode generation submodule, generates pseudocode according to EVM specifications;

[0031] The encryption submodule uses a symmetric encryption algorithm to encrypt the pseudocode;

[0032] The EVM runtime integration unit includes a dependency building submodule and an environment configuration submodule;

[0033] Dependencies build submodules and add dependencies on EVM in the code;

[0034] Environment configuration submodule, configure related environment variables and paths;

[0035] The EVM execution unit includes a startup and initialization submodule, a search and precompilation submodule, and a cache management submodule;

[0036] The startup and initialization submodule is responsible for starting the EVM and initializing it;

[0037] Find and precompile submodules, find elements from HashMap and precompile;

[0038] The cache management submodule manages the precompiled cache.

[0039] Furthermore, the cache management submodule also monitors the cache hit rate, which is the ratio of the number of times data is successfully retrieved from the cache to the total number of requests.

[0040] Furthermore, the cache management submodule will regularly clean up and optimize the precompiled cache to ensure that the cache space is not over-occupied and that the data in the cache is always up-to-date and valid.

[0041] Furthermore, it also includes a static string obfuscation module, which is used for performing static string obfuscation. EVM will perform an obfuscation algorithm on all string constants in the program; the obfuscation algorithm is based on complex mathematical transformations and encryption. The original string is converted into a form that is difficult to understand and restore. Ensure that even if the cracker obtains the obfuscated string, it cannot easily restore the original content. For example, for a user ID string "user123", after obfuscation, it may become a string of seemingly random characters, such as "&*%$#@!abcdef", but when the program is running, EVM can correctly identify and use the obfuscated string without affecting the normal function of the program.

[0042] Unlike traditional obfuscators, EVM's static string obfuscation is not just simple encryption, but also involves optimizing the storage and use of strings in the program. It will perform special processing on string references, making it difficult for crackers to obtain valuable information by analyzing the string reference relationship in the program. At the same time, EVM will retain the semantic information of the string during the obfuscation process to ensure that the program can correctly understand and process these strings at runtime, and will not cause logical errors or functional abnormalities due to obfuscation.

[0043] Furthermore, it also includes an integrity check unit, which signs the compiled EVM code using RSA and SM2 asymmetric algorithms, and checks the integrity of the code package before the EVM runs. After the code is compiled, the code is signed with a private key to generate a digital signature. This digital signature contains the hash value of the code and other relevant information, which is used to verify the integrity and authenticity of the code.

[0044] When the EVM starts and is ready to run the code, it will first obtain the digital signature in the code package and verify it with the corresponding public key. If the verification is successful, it means that the code has not been tampered with during transmission and storage, is complete and credible, and can continue to perform subsequent startup and initialization operations. If the verification fails, the EVM will stop running immediately and issue an alarm, indicating that the code may have been damaged or attacked maliciously.

[0045] This integrity verification mechanism can not only prevent the code from being illegally modified during the distribution process, but also ensure that only authorized and untampered code can be executed in the running environment. It provides additional security for the entire application system to prevent security risks that may be caused by malicious code injection or tampered code execution. At the same time, due to the use of asymmetric algorithms, the confidentiality of private keys is well guaranteed, further enhancing the security and reliability of integrity verification.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The present invention can effectively prevent the code from being completely exposed in plain text in the memory, greatly improves the security of the code, and protects the intellectual property rights of developers.

[0048] The dynamic cache mechanism, dynamic change of memory base address and double verification of EVM technology increase the difficulty of cracking, reduce the risk of memory injection and tampering, and provide more reliable security protection for application systems.

[0049] By converting the JAR package into an EVM-protected form and optimizing the execution process, the security and execution efficiency of the code are improved without affecting the original functionality of the code.

[0050] Static string obfuscation technology effectively protects sensitive string information and avoids the performance and security issues that may be caused by traditional obfuscators.

[0051] The integrity verification mechanism ensures the integrity and authenticity of the code, prevents malicious code injection and tampering, and enhances the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is an overall flow chart of an application system security protection method based on executing a virtual machine in an embodiment of the present invention;

[0053] Figure 2 The overall structural block diagram of an application system security protection system based on executing a virtual machine. DETAILED DESCRIPTION

[0054] In order to facilitate the understanding of those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings. The contents mentioned in the implementation modes are not intended to limit the present invention.

[0055] like Figure 1 As shown, this embodiment provides an application system security protection method based on executing a virtual machine, including the steps of:

[0056] S1. Read the CLASS file and related metadata in the JAR package, and convert the CLASS file code line by line into EVM pseudo code;

[0057] S2. Use a symmetric encryption algorithm to encrypt the generated pseudocode, package the encrypted pseudocode and related metadata, and generate a program package protected by EVM;

[0058] S3. Add dependency on EVM to the converted pseudocode and integrate it with the EVM runtime environment;

[0059] S4. JRE will load the EVM runtime library and start the EVM, and the EVM will initialize the internal data structure;

[0060] S5. When the code executes to the point where it needs to call a function, access a variable or a constant, the EVM searches for the corresponding element in the HashMap of the initialized internal data structure.

[0061] S6. Determine whether EVM searches for the corresponding element in HashMap. If the precompiled cache of the corresponding element is found, proceed to step S7. If the precompiled cache of the corresponding element is not found, proceed to step S8.

[0062] S7, cache acquisition, and directly hand it over to the just-in-time compiler for final native code generation;

[0063] S8, EVM performs pre-compilation and release, and returns to step S6 again to determine whether EVM searches for the corresponding element in the HashMap.

[0064] Detailed steps to encrypt the generated pseudocode using a symmetric encryption algorithm:

[0065] Generate a random encryption key; it can be a complex key generated by the system based on factors such as the current time and hardware information.

[0066] Use the key to encrypt the pseudo code;

[0067] The pseudocode is divided into data blocks of fixed length, each data block is encrypted, and the encrypted results are concatenated.

[0068] Add a dependency on EVM to the converted pseudocode, and modify the code structure so that the code can correctly call EVM-related functional modules at runtime. Add instructions to initialize the EVM environment in the startup part of the code. These instructions will be executed first when the program starts, and are responsible for loading the EVM runtime library and establishing a connection with the EVM runtime library. Specifically, a section of code will be inserted into the main method of the CLASS file to call the EVM initialization function. This initialization function will check whether the EVM is already installed in the system. If not, it will automatically download and install the EVM. Once the EVM is installed, the initialization function will configure the EVM environment variables, establish a connection with the EVM runtime library, and return control to the main method to continue execution.

[0069] Integration of the EVM runtime environment includes configuring relevant environment variables and adding the EVM installation path to the system's environment variables.

[0070] When the EVM is initialized for the first time, the corresponding elements are searched, including function, variable and constant search and pre-compilation release.

[0071] EVM pre-compilation release includes parsing and optimizing pseudocode and converting it into an intermediate representation suitable for just-in-time compilation; EVM uses its built-in compilation engine to process,

[0072] The compilation engine will first decrypt the encrypted pseudocode;

[0073] Then perform syntax and semantic analysis on the decrypted pseudocode;

[0074] During the analysis, the compilation engine identifies the key elements of instruction sequences, variable references, and function calls in the pseudocode and optimizes these elements;

[0075] For repeated instruction sequences, the compilation engine will perform merge optimization.

[0076] When EVM performs precompilation and release, the precompiled result is stored in the cache. The next time the same function, variable, or constant needs to be called, EVM will first search in the cache; if found, the result is obtained directly from the cache without the need to perform the precompilation operation again.

[0077] An application system security protection system based on an execution virtual machine, comprising an EVM code conversion and encryption unit, an EVM runtime integration unit and an EVM execution unit;

[0078] The EVM code conversion and encryption unit includes a code parsing submodule, a pseudo code generation submodule and an encryption submodule;

[0079] The code parsing submodule is responsible for reading the JAVA code in the JAR package and performing structural analysis on it;

[0080] Pseudocode generation submodule, generates pseudocode according to EVM specifications;

[0081] The encryption submodule uses a symmetric encryption algorithm to encrypt the pseudocode;

[0082] The EVM runtime integration unit includes a dependency building submodule and an environment configuration submodule;

[0083] Dependencies build submodules and add dependencies on EVM in the code;

[0084] Environment configuration submodule, configure related environment variables and paths;

[0085] The EVM execution unit includes a startup and initialization submodule, a search and precompilation submodule, and a cache management submodule;

[0086] The startup and initialization submodule is responsible for starting the EVM and initializing it;

[0087] Find and precompile submodules, find elements from HashMap and precompile;

[0088] The cache management submodule manages the precompiled cache.

[0089] The code parsing submodule uses bytecode parsing technology to analyze the structure of the CLASS file byte by byte and identify the storage location and format of the key elements of the class, method and field. For example, for a CLASS file, the code parsing submodule will first identify the file header information, including the version number, constant pool size, etc. Then, it will traverse the constant pool and identify the various constant types in it, such as string constants, integer constants, class name constants, etc. Next, it will analyze the structure of the class, including the class access flag, parent class information, interface information, etc. Finally, it will analyze the methods and fields in the class to identify the method name, parameter type, return value type, and instruction sequence in the method body.

[0090] During the conversion process, the pseudocode generation submodule deeply analyzes the structure and logic of the JAVA code and converts the JAVA bytecode instructions into EVM pseudocode instructions; at the same time, it ensures that the pseudocode can accurately express the functions of the original JAVA code and is constructed strictly in accordance with the EVM specifications. For example, for the addition operation in JAVA, when converting it to EVM pseudocode, the appropriate addition instruction will be selected according to the EVM instruction set, and the type and order of the operands will be ensured to be correct.

[0091] The symmetric encryption algorithm uses the SM4 encryption standard. First, a random encryption key is generated and used to encrypt the pseudocode. A random encryption key can be a complex key generated by the system based on the current time, hardware information, and other factors. During the encryption process, the pseudocode is divided into data blocks of fixed length, each data block is encrypted, and the encrypted results are spliced ​​together. This ensures that the encrypted pseudocode is difficult to crack. Even if the cracker obtains the encrypted pseudocode, it cannot decrypt the original code within a reasonable time.

[0092] The dependency building submodule modifies the code structure so that the code can correctly call EVM-related functional modules at runtime. For example, add instructions to initialize the EVM environment in the startup part of the code. These instructions will be executed first when the program starts, and are responsible for loading the EVM runtime library and establishing a connection with the EVM runtime library. Specifically, a section of code will be inserted into the main method of the CLASS file to call the EVM initialization function. This initialization function will check whether the EVM is already installed in the system. If not, it will automatically download and install the EVM. Once the EVM is installed, the initialization function will configure the EVM environment variables, establish a connection with the EVM runtime library, and return control to the main method to continue execution.

[0093] The environment configuration submodule integrates the converted code with the EVM runtime environment. This includes configuring relevant environment variables, paths, etc., so that JRE can successfully find and start EVM when executing code. Specifically, the installation path of EVM will be added to the system's environment variables so that JRE can find the EVM runtime library. At the same time, some other environment variables will also be configured, such as EVM's log level, cache size, etc., to meet the needs of different application scenarios.

[0094] In the startup and initialization submodule, when JRE starts to execute the code protected by EVM, it first searches for the installation location of EVM in the system;

[0095] JRE will traverse the system's environment variables to find the installation path of EVM;

[0096] After finding the installation path of EVM, JRE will load the runtime library of EVM and start EVM. EVM performs its own initialization during the startup process. This includes loading necessary configuration files, such as encryption key files, environment variable configuration files, etc. At the same time, EVM will also initialize internal data structures, such as HashMap, cache manager, etc. These data structures will play an important role in the subsequent code execution process.

[0097] In the search and precompilation submodule, when the code is executed to the point where a function needs to be called, a variable or a constant needs to be accessed, the EVM will search for the corresponding element in the pre-built HashMap; the HashMap stores the relevant information of the converted and encrypted functions, variables and constants. This information is organized in a specific format for quick search. For example, for a function, the HashMap will store information such as the function's name, parameter type, return value type, and encrypted pseudocode. The EVM will search in the HashMap based on information such as the function's name and parameter type, and once the corresponding function is found, its encrypted pseudocode will be obtained.

[0098] Once the corresponding element is found, EVM will pre-compile and release it, and EVM will use its built-in compilation engine to process it; the pre-compilation process includes parsing and optimizing the pseudocode and converting it into an intermediate representation suitable for just-in-time compilation.

[0099] The compilation engine will first decrypt the encrypted pseudocode, and then perform syntax and semantic analysis on the decrypted pseudocode. During the analysis process, the compilation engine will identify key elements in the pseudocode, such as instruction sequences, variable references, and function calls, and optimize these elements. For example, for some repeated instruction sequences, the compilation engine will merge and optimize to reduce the execution time of the code. At the same time, the compilation engine will also make adjustments based on the system configuration and optimization strategy to improve the efficiency and quality of pre-compilation.

[0100] For subsequent calls to the same function, variable, or constant in the cache management submodule, the EVM directly obtains the processed results from the precompiled cache and skips the precompilation step. The precompiled cache is a memory area managed by the EVM that is used to store the results of precompiled functions, variables, and constants. When the EVM performs a precompilation release, the precompiled results are stored in the cache. The next time the same function, variable, or constant needs to be called, the EVM will first look in the cache. If found, the result is obtained directly from the cache without the need to precompile again.

[0101] The cache management submodule also monitors the cache hit rate, which is the ratio of the number of times data is successfully retrieved from the cache to the total number of requests.

[0102] The cache management submodule will regularly clean and optimize the precompiled cache to ensure that the cache space is not over-occupied and that the data in the cache is always up-to-date and valid.

[0103] It also includes a static string obfuscation module, which is used when static string obfuscation is performed. EVM will perform an obfuscation algorithm on all string constants in the program; the obfuscation algorithm is based on complex mathematical transformations and encryption. The original string is converted into a form that is difficult to understand and restore. Ensure that even if the cracker obtains the obfuscated string, the original content cannot be easily restored. For example, for a user ID string "user123", after obfuscation, it may become a string of seemingly random characters, such as "&*%$#@!abcdef", but when the program is running, EVM can correctly identify and use the obfuscated string without affecting the normal function of the program.

[0104] Unlike traditional obfuscators, EVM's static string obfuscation is not just simple encryption, but also involves optimizing the storage and use of strings in the program. It will perform special processing on string references, making it difficult for crackers to obtain valuable information by analyzing the string reference relationship in the program. At the same time, EVM will retain the semantic information of the string during the obfuscation process to ensure that the program can correctly understand and process these strings at runtime, and will not cause logical errors or functional abnormalities due to obfuscation.

[0105] It also includes an integrity check unit, which signs the compiled EVM code using RSA and SM2 asymmetric algorithms, and checks the integrity of the code package before the EVM runs. After the code is compiled, the private key is used to sign the code to generate a digital signature. This digital signature contains the hash value of the code and other relevant information, which is used to verify the integrity and authenticity of the code.

[0106] When the EVM starts and is ready to run the code, it will first obtain the digital signature in the code package and verify it with the corresponding public key. If the verification is successful, it means that the code has not been tampered with during transmission and storage, is complete and credible, and can continue to perform subsequent startup and initialization operations. If the verification fails, the EVM will stop running immediately and issue an alarm, indicating that the code may have been damaged or attacked maliciously.

[0107] This integrity verification mechanism can not only prevent the code from being illegally modified during the distribution process, but also ensure that only authorized and untampered code can be executed in the running environment. It provides additional security for the entire application system to prevent security risks that may be caused by malicious code injection or tampered code execution. At the same time, due to the use of asymmetric algorithms, the confidentiality of private keys is well guaranteed, further enhancing the security and reliability of integrity verification.

[0108] Compared with the prior art, the present invention has the following beneficial effects:

[0109] The present invention can effectively prevent the code from being completely exposed in plain text in the memory, greatly improves the security of the code, and protects the intellectual property rights of developers.

[0110] The dynamic cache mechanism, dynamic change of memory base address and double verification of EVM technology increase the difficulty of cracking, reduce the risk of memory injection and tampering, and provide more reliable security protection for application systems.

[0111] By converting the JAR package into an EVM-protected form and optimizing the execution process, the security and execution efficiency of the code are improved without affecting the original functionality of the code.

[0112] Static string obfuscation technology effectively protects sensitive string information and avoids the performance and security issues that may be caused by traditional obfuscators.

[0113] The integrity verification mechanism ensures the integrity and authenticity of the code, prevents malicious code injection and tampering, and enhances the overall security of the system.

[0114] The above is a detailed introduction to the application system security protection method and system based on the execution of a virtual machine provided by the present application. The description of the specific embodiment is only used to help understand the method and its core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for protecting application system security based on executing a virtual machine, characterized in that: Includes steps: S1. Read the CLASS file and related metadata in the JAR package, and convert the CLASS file code line by line into EVM pseudo code; S2. Use a symmetric encryption algorithm to encrypt the generated pseudocode, package the encrypted pseudocode and related metadata, and generate a program package protected by EVM; S3. Add dependency on EVM to the converted pseudocode and integrate it with the EVM runtime environment; S4. JRE will load the EVM runtime library and start the EVM, and the EVM will initialize the internal data structure; S5. When the code executes to the point where it needs to call a function, access a variable or a constant, the EVM searches for the corresponding element in the HashMap of the initialized internal data structure. S6. Determine whether EVM searches for the corresponding element in HashMap. If the precompiled cache of the corresponding element is found, proceed to step S7. If the precompiled cache of the corresponding element is not found, proceed to step S8. S7, cache acquisition, and directly hand it over to the just-in-time compiler for final native code generation; S8, EVM performs pre-compilation and release, and returns to step S6 again to determine whether EVM searches for the corresponding element in the HashMap.

2. The method for protecting the security of an application system based on executing a virtual machine according to claim 1, characterized in that: Detailed steps to encrypt the generated pseudocode using a symmetric encryption algorithm: Generate a random encryption key; Use the key to encrypt the pseudo code; The pseudocode is divided into data blocks of fixed length, each data block is encrypted, and the encrypted results are concatenated.

3. The method for protecting the security of an application system based on executing a virtual machine according to claim 2, characterized in that: Add the dependency on EVM to the converted pseudocode, and modify the code structure so that the code can correctly call EVM-related functional modules when running.

4. The method for protecting the security of an application system based on executing a virtual machine according to claim 3, characterized in that: Integration of the EVM runtime environment includes configuring relevant environment variables and adding the EVM installation path to the system's environment variables.

5. The method for protecting the security of an application system based on executing a virtual machine according to claim 4, characterized in that: When the EVM is initialized for the first time, the corresponding elements are searched, including function, variable and constant search and pre-compilation release.

6. The method for protecting the security of an application system based on executing a virtual machine according to claim 5, characterized in that: EVM pre-compilation release includes parsing and optimizing pseudocode and converting it into an intermediate representation suitable for just-in-time compilation; EVM uses its built-in compilation engine to process, The compilation engine will first decrypt the encrypted pseudocode; Then perform syntax and semantic analysis on the decrypted pseudocode; During the analysis, the compilation engine identifies the key elements of instruction sequences, variable references, and function calls in the pseudocode and optimizes these elements; For repeated instruction sequences, the compilation engine will perform merge optimization.

7. The method for protecting the security of an application system based on executing a virtual machine according to claim 6, characterized in that: When EVM performs precompilation and release, the precompiled result is stored in the cache. The next time the same function, variable, or constant needs to be called, EVM will first search in the cache; if found, the result is obtained directly from the cache without the need to perform the precompilation operation again.

8. The method for protecting application system security based on executing a virtual machine according to claim 7, characterized in that: An application system security protection system based on an execution virtual machine, comprising an EVM code conversion and encryption unit, an EVM runtime integration unit and an EVM execution unit; The EVM code conversion and encryption unit includes a code parsing submodule, a pseudo code generation submodule and an encryption submodule; The code parsing submodule is responsible for reading the JAVA code in the JAR package and performing structural analysis on it; Pseudocode generation submodule, generates pseudocode according to EVM specifications; The encryption submodule uses a symmetric encryption algorithm to encrypt the pseudocode; The EVM runtime integration unit includes a dependency building submodule and an environment configuration submodule; Dependencies build submodules and add dependencies on EVM in the code; Environment configuration submodule, configure related environment variables and paths; The EVM execution unit includes a startup and initialization submodule, a search and precompilation submodule, and a cache management submodule; The startup and initialization submodule is responsible for starting the EVM and initializing it; Find and precompile submodules, find elements from HashMap and precompile; The cache management submodule manages the precompiled cache.

9. A method according to claim 1, characterized in that: It also includes a static string obfuscation module, which is used when performing static string obfuscation. The EVM will perform an obfuscation algorithm on all string constants in the program; the obfuscation algorithm is based on complex mathematical transformations and encryption.

10. A method according to claim 1, characterized in that: It also includes an integrity check unit, which signs the compiled EVM code using the RSA and SM2 asymmetric algorithms, and checks the integrity of the code package before the EVM runs.

Images