Cloud virtual machine process sensitive data confusion protection method

Abstract

The invention discloses a cloud virtual machine process sensitive data obfuscation protection method, which comprises the following steps of: 1, performing obfuscation processing on a program at a code level by using a compiler to obtain an obfuscation program, and compiling the obfuscation program to generate an intermediate code file; 2, processing the intermediate code file by adopting a static obfuscation model and a dynamic obfuscation model to generate a to-be-protected program; 3, obtaining multiple pieces of dimension information of the process; determining each dimension score based on each piece of dimension information; determining a target process based on each dimension score; and 4, injecting the to-be-protected process into the target process, selecting an injection point entering the to-be-protected process by utilizing the target process, and injecting the execution stream of the to-be-protected process into the injection point. The method not only destroys readability of reverse engineering, but also can resist cloud virtualization environment data monitoring threats.

Description

Technical Field

[0001] The present invention relates to the field of network security and cloud service security technology, and specifically to a method for obfuscating and protecting sensitive data of a cloud virtual machine process. Background Art

[0002] Currently, traditional approaches to protecting sensitive data in cloud virtualization environments primarily focus on establishing discrete security boundaries, isolating sensitive resources and restricting operational permissions to mitigate data exposure risks. However, these approaches have significant limitations. Their scope of protection often remains limited to passive protection of data objects, lacking continuous threat protection across program code storage, memory runtime, and process execution. In particular, they lack a protection system for sensitive data from source code compilation and process loading to instruction execution. This makes the following vulnerabilities difficult to address: static code reversibility risk, with no control flow obfuscation or anti-reversing hardening, allowing attackers to directly extract key logic from virtual machine images; runtime memory exposure, with a lack of dynamic data sharding encryption and inter-process communication channel camouflage, making it difficult to defend against side-channel attacks based on memory dumps or bus sniffing; and execution-state behavior traceability, with a lack of process injection camouflage and system call hijacking mechanisms, making it impossible to block the virtualization layer's ability to track and trace sensitive operations. Traditional solutions struggle to mitigate attacks against process-sensitive data, requiring a defense system that encompasses static storage-state obfuscation, dynamic runtime data anonymity, and process execution-state behavior anonymity.

[0003] With the rapid development of cloud services in recent years, they have become a core driving force for the development of global information technology and the digital economy. Enterprises are widely adopting multi-cloud and hybrid cloud architectures in their digital transformation, combining public and private clouds with on-premises data centers to meet diverse business needs. This architecture not only improves resource utilization efficiency and flexibility, but also effectively reduces the risk of dependence on a single cloud service provider. With the continuous maturity of cloud computing technology and its widespread adoption across various industries, critical tasks and core businesses are migrating to the cloud. The widespread adoption of cloud services provides enterprises with flexible and elastic scalability while reducing storage and computing resource costs, becoming a key driver of enterprise efficiency and cost optimization. The multi-tenant architecture of cloud environments, which relies on virtualization technology, the openness of remote access, and the complex service chain, presents potential avenues for data leakage. This poses a particular challenge to cloud service data security for enterprises and cloud service providers. User processes deployed on cloud virtualization platforms present privacy and security risks. Due to security flaws in the virtual machine monitoring layer's identification and monitoring mechanisms for system calls, the operating logic and data of user processes are at risk of being illegally intercepted. Furthermore, process execution behavior is susceptible to malicious tracking. These security vulnerabilities lead to the leakage of sensitive information, ultimately threatening the privacy and security mechanisms of the entire system. Summary of the Invention

[0004] The purpose of the present invention is to solve the problem that the virtualization system call identification mechanism in the cloud environment makes the process easy to be tracked and the virtualization data monitoring mechanism makes the process logic and data easy to be stolen. It provides a cloud virtual machine process sensitive data obfuscation protection method to protect process tracking and data analysis under the cloud environment virtualization mechanism, and improve the privacy and security of process data in the cloud environment.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a method for obfuscating and protecting sensitive data in a cloud virtual machine process, comprising the following steps:

[0006] Step 1: Use a compiler to perform obfuscation processing on the program at the code level to obtain an obfuscated program, and compile the obfuscated program to generate an intermediate code file;

[0007] Step 2: Processing the intermediate code file using static obfuscation and dynamic obfuscation models to generate a program to be protected; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions, and constant representations of the historical program, and modifying the control flow and data flow of the historical program to increase code complexity, and then encrypting the program;

[0008] Step 3: Obtain multiple dimension information of the process; determine each dimension score based on each dimension information; and determine the target process based on each dimension score;

[0009] Step 4: Inject the process to be protected into the target process, use the target process to select an injection point into the process to be protected, and inject the execution flow of the process to be protected into the injection point.

[0010] Preferably, the step 2 comprises:

[0011] Step 2.1, for the static obfuscation and dynamic obfuscation models, reorganize the control structure of the program by control flow flattening, flatten the code paths in the static obfuscation and dynamic obfuscation models, and obtain flattened obfuscation models;

[0012] Step 2.2: Using the flattening obfuscation model, the program of the intermediate code file is processed by instruction substitution and / or constant substitution to obtain an obfuscated code file.

[0013] Step 2.3: convert the obfuscation processing code file into a custom virtual instruction according to a preset mapping rule.

[0014] Step 2.4: Use a compiler to statically compile the custom virtual instructions to form a program to be protected.

[0015] Preferably, the multiple dimensional information includes: technical feasibility of the process, concealment of the process, functional adaptability of the process and risk control of the process.

[0016] Preferably, the step 4 comprises:

[0017] Step 4.1, reading the instruction pointer of the target process; modifying the instruction pointer, and injecting the modified instruction pointer into the target process to obtain the processing target process;

[0018] Step 4.2, determining an injection point based on the target process;

[0019] Step 4.3: Based on the injection point, inject the execution flow of the process to be protected into the injection point.

[0020] In a second aspect, the present invention also proposes a cloud virtual machine process sensitive data obfuscation protection system, comprising:

[0021] A file generation module is used to use a compiler to perform obfuscation processing on the program at the code level to obtain an obfuscated program, and compile the obfuscated program to generate an intermediate code file;

[0022] A program generation module to be protected is used to process the intermediate code file using static obfuscation and dynamic obfuscation models to generate a program to be protected; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions and constant representation of the historical program, and modifying the control flow and data flow of the historical program to increase code complexity, and then encrypting the program;

[0023] a target process determination module, configured to obtain multiple dimension information of the process; determine a score for each dimension based on each dimension information; and determine a target process based on each dimension score;

[0024] The injection module is used to inject the process to be protected into the target process, use the target process to select an injection point into the process to be protected, and inject the execution flow of the process to be protected into the injection point.

[0025] In a third aspect, the present invention also proposes an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0026] The memory is used to store one or more programs;

[0027] When the one or more programs are executed by the at least one processor, the cloud virtual machine process sensitive data obfuscation protection method is implemented.

[0028] In a fourth aspect, the present invention application further proposes a readable storage medium on which an execution program is stored. When the execution program is executed, the method for obfuscating and protecting sensitive data of a cloud virtual machine process is implemented.

[0029] The present invention's beneficial effects: By combining control flow complication, data segmentation, and dynamic data encryption, the present method addresses the risk of cloud node process logic and data leakage, establishing dual obfuscation protection in both static storage and dynamic runtime states. This approach not only reduces readability during reverse engineering but also protects against data surveillance threats in cloud virtualization environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flowchart of an implementation method for obfuscating and protecting sensitive data of a cloud virtual machine process according to the present invention;

[0031] Figure 2 Schematic diagram of injecting the protected process into the target process of the present invention;

[0032] Figure 3 The present invention uses PSTREE to be a display system FIREFOX process;

[0033] Figure 4 The FIREFOX process of the present invention has a persistent network connection, which can avoid behavioral detection of process injection.

[0034] Figure 5 This is an architecture diagram of an implementation method for obfuscating sensitive data of a cloud virtual machine process according to the present invention. DETAILED DESCRIPTION

[0035] Specific embodiments of the present invention will now be fully described with reference to the accompanying drawings. For clarity, many physical details will be included in the following description. However, it should be understood that these physical details are not intended to limit the present invention. In other words, in some embodiments of the present invention, these physical details are not essential. Furthermore, to simplify the illustrations, some commonly used structures and components are depicted in a simplified schematic manner.

[0036] Example 1:

[0037] The present invention provides a cloud virtual machine process sensitive data obfuscation protection method, such as Figure 1 As shown, the following steps are included:

[0038] Step 1: Use a compiler to perform obfuscation processing on the program at the code level to obtain an obfuscated program, and compile the obfuscated program to generate an intermediate code file;

[0039] Step 2: Processing the intermediate code file using static obfuscation and dynamic obfuscation models to generate a program to be protected; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions, and constant representations of the historical program, and modifying the control flow and data flow of the historical program to increase code complexity, and then encrypting the program;

[0040] Step 3: Obtain multiple dimension information of the process; determine each dimension score based on each dimension information; and determine the target process based on each dimension score;

[0041] Step 4: Inject the process to be protected into the target process, use the target process to select an injection point into the process to be protected, and inject the execution flow of the process to be protected into the injection point.

[0042] In step 1 above, the cloud service security protection layer example can be based on the LLVM compiler framework in the Ubuntu 20.04.2 environment. The Clang compiler can be used to obfuscate the program at the code level. The obfuscation algorithm can be implemented in C++, and the CMake 3.21.1 project management tool can be used to build the obfuscated program. The obfuscated program can be compiled to generate an LLVM intermediate code file.

[0043] In the above step 2, the intermediate code file is processed using static obfuscation and dynamic obfuscation models to generate a target program; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions and constant representation of the historical program, and modifying the control flow and data flow of the historical program to increase the code complexity, and then encrypting the target program, including the following steps:

[0044] Step 2.1, for the static obfuscation and dynamic obfuscation models, reorganize the control structure of the program by control flow flattening, flatten the code paths in the static obfuscation and dynamic obfuscation models, and obtain flattened obfuscation models;

[0045] Step 2.2: Using the flattening obfuscation model, the program of the intermediate code file is processed by instruction substitution and / or constant substitution to obtain an obfuscated code file.

[0046] Step 2.3: convert the obfuscation processing code file into a custom virtual instruction according to a preset mapping rule.

[0047] Step 2.4: Use a compiler to statically compile the custom virtual instructions to form a program to be protected.

[0048] In step 2.1 above, the static obfuscation and dynamic obfuscation models are reorganized by control flow flattening to restructure the control structure of the program. The code paths in the static obfuscation and dynamic obfuscation models are flattened to obtain flattened obfuscation models, making logical branches difficult to identify, increasing the difficulty for code analysts, hindering attackers' understanding of the code logic, and making the structure of the program at runtime more complex and difficult to infer, thereby effectively improving the security of the program and reducing the risk of malicious analysis and attacks.

[0049] In step 2.2 above, the data flow obfuscation technology is implemented in the obfuscated program by specifically implementing methods such as instruction substitution and constant substitution, aiming to enhance the effect of code obfuscation. Instruction substitution replaces the addition and subtraction operations in the data operation by replacing specific instruction sequences in the code. For the addition operation a=b+c, ​​a random function is used to find the template function for each replacement. The replacement templates are a=b-(-c), a=-(-b+(-c)) and r=rand(), a=b+r, a=a+c, and a=ar. For the subtraction operation a=bc, a random function is used to find the template function for each replacement. The replacement templates are a=b+(-c) and a=b+(-c), r=ramd(), a=b+r, a=ac, and a=ar. After the replacement, the instruction sequence during program execution is difficult to be accurately identified, increasing the difficulty for program analysts. Constant replacement replaces the original value of op by replacing the constant value, where r is an arbitrary integer random perturbation value, r = rand(), op = ((ax<<5)^r|((by>>3)^r))^(c^r). This makes the constant data in the code more obfuscated and difficult to understand. These two data flow obfuscation techniques complement each other, working together to increase the level of confusion and uncertainty in the program data flow during runtime, thereby effectively strengthening the code obfuscation effect. This combined data obfuscation method makes the program data flow more difficult to understand and analyze during runtime, improving program security and reducing the possibility of attackers gaining insight into the data and launching malicious attacks.

[0050] In step 2.3 above, virtual machine obfuscation technology is implemented. First, the program's intermediate code is converted into these custom virtual instructions. To enhance the obfuscation effect, these instructions do not directly reflect the program's actual behavior. Instead, they increase the code's complexity by mapping operations, making it difficult to directly understand and crack. To further enhance the program's resistance to analysis, each virtual instruction in the instruction set is encrypted using an XOR shift pseudo-random number generator (XORSHIFT). XORSHIFT is a pseudo-random number generation algorithm that encrypts the operands of each instruction by performing an XOR operation, making the instructions indecipherable to external observers. These encrypted instructions are not immediately executed during program execution but are instead decrypted. The decryption process relies on the same pseudo-random number generated by XORSHIFT as that used during encryption. The virtual machine decrypts the instructions in real time during runtime. This way, the program's instructions are encrypted at runtime, and only the virtual machine knows how to correctly decrypt and execute them. Even if an external analyst obtains the encrypted instructions, they cannot recover the program's true logic. Ultimately, the obfuscated and encrypted instruction set is embedded into the target program. Program execution relies on the virtual machine environment, which interprets and executes the decrypted instructions. This protection effectively increases the program's resistance to reverse engineering, as even if an attacker were able to obtain the obfuscated intermediate code, they would be unable to easily recover the program's true functionality. Virtual machine obfuscation ensures program security and stability, providing enhanced protection against malicious attacks and reverse engineering.

[0051] In step 2.4 above, the implemented obfuscation program is compiled into a static library file using the Clang compiler. This compilation encapsulates the obfuscation program's functionality and logic into a static library, making it more flexible and efficient in the subsequent code protection process. This static library file can be statically linked into the program to be protected, providing obfuscation protection support for program execution. It also provides a convenient way to integrate and call the protection process, providing foundational support for subsequent obfuscation protection measures. By integrating the features of the Clang compiler, the obfuscation program can provide the required obfuscation protection during program execution in the form of a static library, ensuring the program's security and stability.

[0052] The above-mentioned generated program to be protected, the file of the program to be protected integrates the obfuscation protection function, including control flow, data flow and virtual machine obfuscation technology, providing a strong layer of security protection for the code. The integrated compilation process effectively introduces obfuscation protection into the compilation stage of the program, providing comprehensive and reliable protection for the security of the program, and maintaining the original function and logical integrity of the code.

[0053] Furthermore, the multiple dimensional information includes: the technical feasibility of the process, the concealment of the process, the functional adaptability of the process and the risk control of the process.

[0054] The above step 3: obtaining multiple dimension information of the process; determining each dimension score based on each dimension information; and determining the target process based on each dimension score, includes:

[0055] Obtain process information in the Linux system in a virtualized environment, including multi-dimensional information on the process's technical feasibility, concealment, functional adaptability, and risk control. The suitability of a process is quantitatively analyzed across four dimensions: technical feasibility (e.g., whether the process is easy to exploit (e.g., permissions, memory protection mechanisms); concealment (e.g., whether it is difficult to detect after an attack (e.g., process runtime and name); functional adaptability (e.g., whether it possesses network monitoring and other attack functions); and risk (e.g., the system stability risks that may be caused by an attack). Each technical dimension is scored, and the most reliable process is selected as the target process. Intelligent Linux process assessment builds a quantitative analysis system based on the dual security features of the system and the process. At the system level, the global ASLR configuration status is detected by reading the PROC_SYS_KERNEL_RANDOMIZE_VA_SPACE file. At the process level, a comprehensive assessment of NX / ASLR protection status, network connection characteristics, and permission attributes is conducted.

[0056] The output of the evaluation is in a structured JSON format, which fully includes the system security configuration, process feature details, and detailed scoring for each dimension. To ensure the security of target selection, the model establishes a double veto mechanism: core system processes are automatically removed from the recommendation list, and isolated processes without network interaction are directly marked as invalid candidates. This quantitative system provides data-driven priority decision support for target process selection through multi-dimensional feature fusion and hierarchical decision-making mechanism. The recommended list of sorted target processes is obtained through an adaptive binding unit to obtain the most suitable target process unit, and then the legal memory space of the target process is located. Finally, the network service process is deployed to this memory area, thereby achieving a secure association between the service process and the target process, and the process with the highest current reliability score is selected as the target process.

[0057] Furthermore, the step 4 includes:

[0058] Step 4.1, reading the instruction pointer of the target process; modifying the instruction pointer, and injecting the modified instruction pointer into the target process to obtain the processing target process;

[0059] Step 4.2, determining an injection point based on the target process;

[0060] Step 4.3: Based on the injection point, inject the execution flow of the process to be protected into the injection point.

[0061] In step 4, the protected process is injected into the target process. The injection point is selected using the target process information. During the protection process, the protected program suspends execution by sending a SIGSTOP signal to the target process. This ensures that the target process can be effectively stopped without interrupting other operations. After sending this signal, the target process enters a suspended state, allowing the system to perform security checks, status assessments, or other necessary operations. This signal ensures subsequent process protection operations while avoiding potential security risks caused by the process continuing to run.

[0062] In step 4.1, use PTRACE to attach to the target process, and the execution of the process will be suspended. Provide methods to inspect and modify process registers, including the instruction pointer (INSTRUCTION POINTER, IP). By modifying the instruction pointer, the execution flow of the target process can be redirected to the injected network service process. Get the current register value. Use PTRACE's GETREGS request to read the register status of the target process, including the instruction pointer. Modify the instruction pointer and modify the instruction pointer to the address of the injected payload. The address needs to be increased by an offset. Apply the modified register value and write the updated register status back to the target process to complete the redirection of the instruction pointer, such as Figure 2 As shown, SHELLCODE uses FIREFOX as the target process and SHELLCODE is injected into the target process.

[0063] Step 4.2, write the executable file to the injection address memory. After successful injection, the target process will be executed in the context of the host process, thereby achieving the purpose of hiding and utilizing the host process resources, such as Figure 3 As shown, PSTREE is used to display the system FIREFOX process, but no network process can be seen.

[0064] After determining the appropriate injection address, the obfuscated executable file is written to that memory location. After successful injection, the target process will run under the control of the host process, using the target process's resources to hide its own behavior. This technology not only enhances the process's stealthiness, but also effectively utilizes the target process's computing resources, avoiding direct intervention in the process, thereby improving overall security and enhancing anti-analysis capabilities. Figure 4 As shown, the FIREFOX process has a persistent network connection, which avoids the network behavior detection of process injection.

[0065] Step 4.3. The above steps require the following environmental support: the system virtualization layer builds a resource-isolated computing environment based on the virtualization engine, providing a flexible virtual execution sandbox for upper-layer services; the cloud management layer serves as the central control unit, achieving unified scheduling and secure operation and maintenance of global resources through service orchestration, policy issuance, and dynamic monitoring; the client service layer carries the deployment and operation of user-defined applications (such as Web services and email systems), and directly responds to terminal business requests; and the cloud service security protection layer protects sensitive process data of the client service layer through code obfuscation and dynamic process injection, covering source code storage state anti-reverse analysis and process running state behavior concealment.

[0066] The present invention is distinguished by the fact that, in step 2, static libraries are used to obfuscate the intermediate code, combined with control flow complexity and data segmentation. Subsequently, dynamic obfuscation protection and dynamic data encryption are applied to the intermediate code of the cloud service program, converting the program into a custom virtual instruction set and executing it in a virtual machine environment. After these static and dynamic obfuscation protection processes, the final target program is generated. This approach effectively enhances the security and anti-analysis capabilities of the program logic and data.

[0067] In step 3, process information is obtained from the Linux system within a virtualized environment, including multi-dimensional information on the process's technical feasibility, concealment, functional adaptability, and risk control. Process suitability is quantitatively analyzed across four dimensions: technical feasibility (e.g., ease of exploitation, such as permissions and memory protection mechanisms); concealment (e.g., difficulty detecting after an attack, such as process runtime and name); functional adaptability (e.g., whether it possesses network monitoring and other attack capabilities); and risk (e.g., potential system stability risks posed by an attack). Each dimension is scored, and the most reliable process is selected as the target process. After injection, the target process is further hidden to ensure that its behavior remains undetected by external monitoring and detection.

[0068] The beneficial effects of the present invention are:

[0069] 1) Traditional methods address program reverse analysis protection through single-dimensional code obfuscation technology, but are unable to effectively address deep attacks on data flow monitoring by cloud virtualization data monitoring mechanisms. This invention significantly differs from traditional methods by proposing a multi-layered data analysis-resistant code obfuscation method. Combining control flow complexity, data segmentation, and dynamic data encryption, this method addresses the risk of cloud node process logic and data leakage, constructing dual obfuscation protection in both static storage and dynamic running states. This innovative approach not only undermines reverse engineering readability but also protects against data monitoring threats in cloud virtualization environments.

[0070] 2) Traditional process hiding techniques rely on a static host process selection mechanism, performing fixed injections only through a preset target process list. This makes it difficult to cope with the in-depth analysis of abnormal process lineage relationships by the virtualization monitoring layer in dynamic cloud environment scheduling scenarios. This invention significantly differs from traditional methods by proposing dynamic host process intelligent identification and binding technology. By considering the four dimensions of technical feasibility, concealment, functional adaptability, and risk control, it constructs a dynamic trustworthy scoring system for host processes, achieving highly concealed parasitic binding. This innovative approach not only eliminates the inherent behavioral characteristics of static injection strategies, but also forms a process stealth protection method that integrates with cloud virtualization architecture.

[0071] Traditional security solutions deploy code obfuscation and process injection technologies as isolated means to defend against static analysis and dynamic tracing, respectively, resulting in a split in the protection chain between static programs and dynamic processes in cloud environments. This invention breaks through traditional limitations and innovatively constructs a collaborative protection architecture for code obfuscation and process injection. Through a unified strategy, it forms a defense system that covers obfuscation reinforcement in the code storage state and covert execution in the process runtime state. This method achieves a combined protection of static program logic against reverse analysis and dynamic process behavior against tracing and identification in cloud environments, ensuring the security of sensitive data in cloud virtual machine processes.

[0072] Those skilled in the art should know that:

[0073] Traditional methods address program reverse analysis protection through single-dimensional code obfuscation techniques, but they are unable to effectively address the deep attacks on data flow monitoring by cloud virtualization data monitoring mechanisms. This invention significantly differs from traditional methods by proposing a multi-layered data analysis-resistant code obfuscation method. Combining control flow complexity, data segmentation, and dynamic data encryption, this method addresses the risk of cloud node process logic and data leakage by constructing dual obfuscation protection in both static storage and dynamic runtime states. This innovative approach not only undermines reverse engineering readability but also protects against data monitoring threats in cloud virtualization environments.

[0074] Traditional process hiding techniques rely on a static host process selection mechanism, performing fixed injections solely through a preset list of target processes. This makes them incapable of handling the in-depth analysis of abnormal process lineages by the virtualization monitoring layer in dynamic cloud environment scheduling scenarios. This invention significantly differs from traditional methods by proposing a dynamic host process intelligent identification and binding technology. By constructing a dynamic trustworthy host process scoring system based on four dimensions: technical feasibility, concealment, functional adaptability, and risk control, it achieves highly concealed parasitic binding. This innovative approach not only eliminates the inherent behavioral characteristics of static injection strategies, but also forms a process stealth protection method that integrates with cloud virtualization architectures.

[0075] Traditional security solutions deploy code obfuscation and process injection technologies as isolated means to defend against static analysis and dynamic tracing, respectively, resulting in a split in the protection chain between static programs and dynamic processes in cloud environments. This invention breaks through traditional limitations and innovatively constructs a collaborative protection architecture for code obfuscation and process injection. Through a unified strategy, it forms a defense system that covers obfuscation reinforcement in the code storage state and covert execution in the process runtime state. This method achieves a combined protection of static program logic against reverse analysis and dynamic process behavior against tracing and identification in cloud environments, ensuring the security of sensitive data in cloud virtual machine processes.

[0076] Example 2:

[0077] A cloud virtual machine process sensitive data obfuscation protection system of the present invention includes:

[0078] A file generation module is used to use a compiler to perform obfuscation processing on the program at the code level to obtain an obfuscated program, and compile the obfuscated program to generate an intermediate code file;

[0079] A program generation module to be protected is used to process the intermediate code file using static obfuscation and dynamic obfuscation models to generate a program to be protected; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions and constant representation of the historical program, and modifying the control flow and data flow of the historical program to increase code complexity, and then encrypting the program;

[0080] a target process determination module, configured to obtain multiple dimension information of the process; determine a score for each dimension based on each dimension information; and determine a target process based on each dimension score;

[0081] The injection module is used to inject the process to be protected into the target process, use the target process to select an injection point into the process to be protected, and inject the execution flow of the process to be protected into the injection point.

[0082] Its system architecture is as follows Figure 5 As shown. This architectural design aims to protect client processes in the cloud environment from external attacks and monitoring by the virtualization layer through the cloud service security protection layer protection mechanism. The system can be loaded into the cloud service security protection layer, client service layer, cloud management layer, and system virtualization layer to run the system of the present invention;

[0083] The cloud service security layer, serving as the system's security hub, coordinates and executes key security policies, including core functions such as process injection protection, code obfuscation reinforcement, and identity / authorization verification. It integrates code obfuscation, process injection, and security policy modules to form a multi-dimensional, multi-stage protection mechanism to prevent sensitive processes from being reverse-engineered or dynamically tracked, ensuring the security and confidentiality of data processing.

[0084] The client service layer, which directly serves end users, carries various application services such as email, web services, and instant messaging (IM). Modules such as email reception, forwarding, and file upload are responsible for processing user requests and enabling data exchange. This layer utilizes the protection capabilities provided by the security layer to ensure the confidentiality and integrity of user data during transmission and processing.

[0085] The cloud management layer includes service management, security management, monitoring system, and user management, achieving the organic coordination of service deployment, policy issuance, user authority control, and operation status monitoring, thereby improving overall security operation and maintenance capabilities.

[0086] System virtualization layer: As the underlying operating environment, this layer provides abstraction and isolation of computing resources through virtualization engines such as KVM, VMware, or hypervisors. It not only supports the flexible deployment and independent operation of upper-layer services but also provides strict execution environment isolation for sensitive processes. Through virtualization boundary control, it effectively prevents cross-data access and sensitive information leakage between different virtual machines, providing the foundation for achieving multi-tenant security isolation.

[0087] Using the Clang compiler based on the LLVM compiler framework, implemented in C++ and combined with control flow complexity, data segmentation, dynamic data encryption, and obfuscation algorithms, CMake is used as a project management tool to build obfuscated programs and obfuscate the program at the code level. A dynamic trust scoring system for host processes is constructed through the four dimensions of technical feasibility, concealment, functional adaptability, and risk control to achieve highly concealed parasitic binding. A collaborative protection architecture for code obfuscation and process injection is constructed, and a unified strategy is used to form a defense system covering obfuscation reinforcement in the code storage state and covert execution in the process runtime state. This approach achieves joint protection against reverse engineering analysis of static program logic and anti-tracking and identification of dynamic process behavior in cloud environments, ensuring the security of sensitive data in cloud virtual machine processes.

[0088] Example 3:

[0089] The present invention also provides an electronic device, which may be a computer, a single-chip microcomputer, a smart mobile device, or the like. The electronic device in this embodiment may include a processor, a memory, a transceiver component, and the like. The memory, processor, and transceiver component are connected via a bus; the memory may be used to store an execution program, which may include instructions; and the processor may be used to execute the instructions stored in the memory. The memory may also be used to store data, which may be accessed and / or modified during the execution of the instructions.

[0090] The processor may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a cloud virtual machine process sensitive data obfuscation protection method in the above embodiment.

[0091] Example 4:

[0092] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in the electronic device and, of course, extended storage media supported by the electronic device. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space. These instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a cloud virtual machine process sensitive data obfuscation protection method in the above embodiment.

[0093] Those skilled in the art will appreciate that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0094] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0095] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the pending claims.

Claims

1. A method for obfuscating and protecting sensitive data in cloud virtual machine processes, characterized by: The steps include: Step 1: Use a compiler to perform obfuscation processing on the program at the code level to obtain an obfuscated program, and compile the obfuscated program to generate an intermediate code file; Step 2: Processing the intermediate code file using static obfuscation and dynamic obfuscation models to generate a program to be protected; wherein the static obfuscation and dynamic obfuscation models are obtained by changing the execution flow, instructions, and constant representations of the historical program, and modifying the control flow and data flow of the historical program to increase code complexity, and then encrypting the program; Step 3: Obtain multiple dimension information of the process; determine each dimension score based on each dimension information; and determine the target process based on each dimension score; Step 4: Inject the process to be protected into the target process, use the target process to select an injection point into the process to be protected, and inject the execution flow of the process to be protected into the injection point.

2. The method according to claim 1, characterized in that The step 2 comprises: Step 2.1, for the static obfuscation and dynamic obfuscation models, reorganize the control structure of the program by control flow flattening, flatten the code paths in the static obfuscation and dynamic obfuscation models, and obtain flattened obfuscation models; Step 2.2: Using the flattening obfuscation model, the program of the intermediate code file is processed by instruction substitution and / or constant substitution to obtain an obfuscated code file; Step 2.3, converting the obfuscation processing code file into a custom virtual instruction according to a preset mapping rule; Step 2.4: Use a compiler to statically compile the custom virtual instructions to form a program to be protected.

3. The method according to claim 1, characterized in that The multiple dimensions of information include: the technical feasibility of the process, the concealment of the process, the functional adaptability of the process, and the risk control of the process.

4. The method according to claim 1, wherein The step 4 comprises: Step 4.1, reading the instruction pointer of the target process; modifying the instruction pointer, and injecting the modified instruction pointer into the target process to obtain the processed target process; Step 4.2, determining an injection point based on the target process; Step 4.3: Based on the injection point, inject the execution flow of the process to be protected into the injection point.

Images