Program transmission method, program execution method, device, equipment and medium

Abstract

The invention discloses a program transmission method and device, a program execution method and device, equipment and a medium. The method comprises the steps of obtaining a source program; performing sensitive variable identification on the source program according to the pre-training algorithm model, and determining an initial global sensitive variable set; identifying dynamic sensitive variables in the source program according to the initial global sensitive variable set, and updating the initial global sensitive variable set to obtain a global sensitive variable set; and converting the source program according to the variable hiding function set, the instruction conversion structure and the global sensitive variable set to obtain a desensitization program and a sensitive variable matrix, and transmitting the desensitization program and the sensitive variable matrix to a receiving end. A comprehensive global sensitive variable set is determined, all sentences containing sensitive variables in a program are converted into unrecognizable custom functions, a converted desensitization program is obtained, and meanwhile a corresponding sensitive variable matrix is generated and transmitted to a receiving end. The possibility that sensitive variables are exposed in an untrusted environment is avoided, and then program sensitive data protection is achieved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a program transmission method, program execution method, apparatus, device, and medium. Background Technology

[0002] While the widespread application of cloud computing has solved the problem of high resource dependence in big data analysis, the lack of transparency in cloud services has led to widespread public concern regarding cloud environment security. For users, the cloud computing environment is like a black box; they can only obtain the computation results but cannot know whether the computing environment's data processing is secure and reliable. At the same time, in these untrusted environments, the confidentiality and integrity of sensitive program data and code cannot be adequately protected, and may even face significant threats such as leaks.

[0003] Currently, most existing technologies are based on trusted execution environment control flow obfuscation methods to protect sensitive variables of remote programs. Users can use trusted hardware to move the execution of sensitive data in a program to a trusted security zone, thereby protecting sensitive data and code confidentiality.

[0004] However, solutions for runtime data protection in cloud environments are still immature. Such data protection remains a challenging problem, and it can only protect control flow variables in the program, failing to meet the requirements for protecting arbitrary sensitive variables in the program. Summary of the Invention

[0005] This invention provides a program transmission method, program execution method, apparatus, device, and medium to identify and convert sensitive variables in a program, thereby protecting sensitive program data.

[0006] According to a first aspect of the present invention, a program transmission method is provided, applied at a transmission end, comprising:

[0007] Obtain the source code;

[0008] Based on the pre-trained algorithm model, the source program is used to identify sensitive variables and determine the initial global set of sensitive variables.

[0009] Based on the initial global sensitive variable set, the dynamic sensitive variables in the source program are identified, and the initial global sensitive variable set is updated to obtain the global sensitive variable set;

[0010] The source program is transformed based on the variable hiding function set, instruction conversion structure, and the global sensitive variable set to obtain the desensitized program and sensitive variable matrix, which are then transmitted to the receiving end.

[0011] According to a second aspect of the present invention, a program execution method is provided, applied at a receiving end, the receiving end including a trusted environment and an untrusted environment, comprising:

[0012] The desensitization procedure is received in the untrusted environment, and the sensitive variable matrix is ​​received in the trusted environment and stored in the memory model by allocating stack space through a preset storage structure.

[0013] The desensitization program is run in the untrusted environment, and the resulting functions and instructions are transferred to the memory model.

[0014] The program execution result is obtained by calling the functions and instructions in the trusted environment through the memory model.

[0015] According to a third aspect of the present invention, a program transmission apparatus is provided, applied at a transmission end, comprising:

[0016] The program acquisition module is used to acquire the source program.

[0017] The set determination module is used to identify sensitive variables in the source program based on the pre-trained algorithm model and determine the initial global set of sensitive variables.

[0018] The set update module is used to identify dynamic sensitive variables in the source program based on the initial global sensitive variable set, update the initial global sensitive variable set, and obtain a global sensitive variable set.

[0019] The program conversion module is used to convert the source program according to the variable hiding function set, instruction conversion structure and the global sensitive variable set, to obtain the desensitized program and sensitive variable matrix and transmit them to the receiving end.

[0020] According to a fourth aspect of the present invention, a program execution apparatus is provided, characterized in that it is applied to a receiving end, the receiving end comprising a trusted environment and an untrusted environment, including:

[0021] The information acquisition module is used to receive the desensitization program in the untrusted environment, and to receive the sensitive variable matrix in the trusted environment and store it in the memory model by allocating stack space in the memory model through a preset storage structure.

[0022] The program execution module is used to run the desensitization program in the untrusted environment and transfer the functions and instructions obtained from the execution to the memory model;

[0023] The result determination module is used to call the functions and instructions in the trusted environment through the memory model to obtain the program execution result.

[0024] According to a fifth aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0025] At least one processor; and

[0026] A memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the program transfer method or program execution method according to any embodiment of the present invention.

[0028] According to a sixth aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the program transfer method or program execution method described in any embodiment of the present invention.

[0029] According to a seventh aspect of the present invention, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the program transmission method or program execution method of any embodiment of the present invention.

[0030] The technical solution of this invention involves: acquiring the source program; identifying sensitive variables in the source program based on a pre-trained algorithm model to determine an initial global sensitive variable set; identifying dynamic sensitive variables in the source program based on the initial global sensitive variable set, updating the initial global sensitive variable set to obtain a global sensitive variable set; and transforming the source program based on a variable hiding function set, instruction conversion structure, and the global sensitive variable set to obtain a de-identified program and a sensitive variable matrix, which are then transmitted to the receiving end. By determining a comprehensive global sensitive variable set and converting all statements in the program containing sensitive variables into unrecognizable user-defined functions, a transformed de-identified program is obtained, and a corresponding sensitive variable matrix is ​​generated and transmitted to the receiving end. This avoids the possibility of sensitive variables being exposed to an untrusted environment, thereby achieving sensitive data protection for the program.

[0031] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart of a program transmission method provided according to Embodiment 1 of the present invention;

[0034] Figure 2 This is a flowchart of a program execution method provided according to Embodiment 2 of the present invention;

[0035] Figure 3 This is an example diagram of a memory model in a program execution method according to Embodiment 2 of the present invention;

[0036] Figure 4 This is a schematic diagram of the structure of a program transmission device according to Embodiment 3 of the present invention;

[0037] Figure 5 This is a schematic diagram of the structure of a program execution device according to Embodiment 4 of the present invention;

[0038] Figure 6 This is a schematic diagram of the structure of an electronic device that implements an embodiment of the present invention. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0040] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0041] Example 1

[0042] Figure 1 This is a flowchart of a program transmission method provided in Embodiment 1 of the present invention. This embodiment is applicable to the situation where a program containing sensitive information is transmitted after being de-identified. The method is applied at the transmission end and can be executed by a program transmission device. This program transmission device can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0043] S110, Obtain the source program.

[0044] In this embodiment, the transmitting end can be understood as the user's local environment. The source program can be understood as a program containing sensitive variables.

[0045] Specifically, the processor can obtain the source program to be de-identified and transmitted.

[0046] S120. Based on the pre-trained algorithm model, identify sensitive variables in the source program and determine the initial global set of sensitive variables.

[0047] In this embodiment, the pre-trained algorithm model can be understood as an algorithm model used for sensitive variable identification. For example, it can be a Named Entity Recognition (NER) algorithm model based on word embeddings. The NER algorithm model converts words into fixed-length vectors, and captures the semantic information and contextual relationships of words through these vectors, thereby capturing sensitive variables in the program. The model can be pre-trained using a large number of financial source program samples to initialize the Global Sensitive Variable Set (GSVS). At the same time, more data can be labeled using sensitive information obtained from security software scans and newly added financial program samples, thereby improving the model's recognition accuracy. The initial sensitive variables can be understood as variables containing sensitive information. Here, they can be understood as static variables, that is, variables that do not involve calculations, such as variables related to customer identity information and financial information.

[0048] Specifically, the processor can identify sensitive variables in the source program through a pre-trained algorithm model, thus identifying the initial set of sensitive variables contained in the source program.

[0049] S130. Identify dynamic sensitive variables in the source program based on the initial global sensitive variable set, update the initial global sensitive variable set, and obtain the global sensitive variable set.

[0050] In this embodiment, dynamic sensitive variables can be understood as other sensitive variables related to the sensitive variables in the initial global sensitive variable set. The global sensitive variable set can be understood as a set containing all static and dynamic sensitive variables.

[0051] Specifically, the processor can filter dynamic sensitive variables in the source program based on the initial global sensitive variable set. For example, dynamic sensitive variables can be filtered using methods such as taint analysis. The initial global sensitive variable set is then updated based on the filtering results to obtain the global sensitive variable set.

[0052] S140. The source program is transformed according to the variable hiding function set, instruction conversion structure and global sensitive variable set to obtain the desensitized program and sensitive variable matrix and transmit them to the receiving end.

[0053] In this embodiment, the variable hiding function set can be understood as functions used to transform program statements containing sensitive variables, thereby hiding the sensitive variables in the statements. The desensitization program can be understood as the program obtained after desensitizing the sensitive variables. The sensitive variable matrix can be understood as a matrix used to represent the relationship between each instruction and its corresponding program. The receiving end can be understood as the end used to receive the transformed program and execute it, for example, it could be the cloud.

[0054] In this embodiment, the instruction translation structure can be understood as a structure used to represent the instruction corresponding to the translated program statement. For example, it can be the instruction structure of an 11-tuple instruction. The instruction translation structure can be:

[0055] <i(s),left,leftVlu,leftType,right,rightVlu,rightType,op,re,reVlu,reType>

[0056] Where i(s) represents the unique identifier of the program statement being transformed in the source program, used to identify which statement in the source program it corresponds to; left, leftVlu, leftType represent the left source operand; right, rightVlu, rightType represent the right source operand; op represents the operator; and re, reVlu, reType represent the destination operand. The different values ​​of leftType, rightType, and reType indicate whether the current operand is an array, an object, or a regular variable.

[0057] Specifically, the processor can use a global set of sensitive variables to transform statements in the source program that contain sensitive variables through a set of variable hiding functions and instruction conversion structures, thereby obtaining a desensitized program and a sensitive variable matrix. The sensitive variable matrix can then be encrypted to obtain the encrypted sensitive variable matrix and transmitted to the receiving end.

[0058] The technical solution of this invention involves: acquiring the source program; identifying sensitive variables in the source program based on a pre-trained algorithm model to determine an initial global sensitive variable set; identifying dynamic sensitive variables in the source program based on the initial global sensitive variable set, updating the initial global sensitive variable set to obtain a global sensitive variable set; and transforming the source program based on a variable hiding function set, instruction conversion structure, and the global sensitive variable set to obtain a de-identified program and a sensitive variable matrix, which are then transmitted to the receiving end. By determining a comprehensive global sensitive variable set and converting all statements in the program containing sensitive variables into unrecognizable user-defined functions, a transformed de-identified program is obtained, and a corresponding sensitive variable matrix is ​​generated and transmitted to the receiving end. This avoids the possibility of sensitive variables being exposed to an untrusted environment, thereby achieving sensitive data protection for the program.

[0059] Furthermore, based on the above embodiments, the steps of identifying dynamic sensitive variables in the source program according to the initial global sensitive variable set, updating the initial global sensitive variable set, and obtaining the global sensitive variable set can be refined as follows:

[0060] Extract method statements from the source program to form the current set of method statements; for each method statement in the current set of method statements, generate a set of right-hand variables and a set of left-hand variables; perform forward analysis on the right-hand variable set based on the initial set of global sensitive variables to determine if there are any dynamic sensitive variables; perform backward analysis on the left-hand variable set based on the initial set of global sensitive variables to determine if there are any dynamic sensitive variables; update the initial set of global sensitive variables based on the identified dynamic sensitive variables to obtain the global set of sensitive variables.

[0061] In this embodiment, the current set of method statements can be understood as the set of statements in the source program that involve method functions. The set of left-hand variables can be understood as the set of left-hand variables in a three-address code equation. The set of right-hand variables can be understood as the set of right-hand variables in a three-address code equation.

[0062] Specifically, the processor can extract method statements from the source program as the current method statement set. For each method statement in the current method statement set, the processor can perform taint analysis on the current method statement, generating the right-hand and left-hand variable sets of the three-address code equation for the current method statement. The taint analysis can be abstracted as a triplet.<sources,sinks,sanitizers> The process takes the form of a taint source, representing the direct introduction of untrusted or confidential data into the system; a sink, representing the direct generation of security-sensitive operations (violating data integrity) or the leakage of private data to the outside world (violating data confidentiality); and a sanitizer, representing the process of preventing data propagation from harming the information security of the software system through data encryption or removal of harmful operations. The processor can perform forward analysis on the right-hand variable set based on the initial global sensitive variable set to determine if dynamic sensitive variables exist in the right-hand variable set; and perform backward analysis on the left-hand variable set based on the initial global sensitive variable set to determine if dynamic sensitive variables exist in the left-hand variable set. The processor can update the initial global sensitive variable set based on the identified dynamic sensitive variables to obtain the global sensitive variable set.

[0063] For example, a specific example can be used to illustrate forward analysis. For instance, the source code could be: rMchc = mchc + avaMchc, the initial set of global sensitive variables is {rMchc}, and the set of global sensitive variables after forward analysis is {rMchc, mchc, avaMchc}. Similarly, a specific example can be used to illustrate backward analysis. The source code could be: rMchc = mchc + avaMchc, the initial set of global sensitive variables is {mchc}, and the set of global sensitive variables after backward analysis is {rMchc, mchc}.

[0064] Furthermore, based on the above embodiments, the steps of transforming the source program according to the variable hiding function set, instruction conversion set, and global sensitive variable set to obtain the de-identified program and sensitive variable matrix, and transmitting them to the receiving end, include:

[0065] For each program statement in the source program, a function for obtaining a globally unique identifier is determined. This function is used to allocate a globally unique identifier at the initial stage of each program statement and allocate stack space at the receiving end. The program statements to be converted in the source program are identified using a global sensitive variable set. The program statements to be converted are replaced according to the variable hiding function set. Combined with the function for obtaining the globally unique identifier, the converted desensitized program is determined and transmitted to the receiving end. The operation instructions for each program statement to be converted are determined using an instruction conversion set, resulting in an operation instruction set. Based on the operation instruction set and the desensitized program, the sensitive variable matrix is ​​determined and transmitted to the receiving end.

[0066] In this embodiment, the function to obtain a globally unique identifier can be understood as a function used to generate a globally unique identifier for each program statement. A globally unique identifier (UUID) can be understood as an identifier set to distinguish each program statement. Stack space can be understood as a dynamically allocated storage area used to store information such as local variables, function parameters, and return addresses during function calls. The program statement to be converted can be understood as a statement containing sensitive variables. The operation instruction set can be understood as a set of commands used to complete various tasks during program execution.

[0067] Specifically, for each program statement in the source program, the first step is to determine the corresponding function for obtaining a globally unique identifier (GUID). This function is used to allocate a GUID at the initial stage of each program statement and allocate stack space at the receiving end. The processor can identify the program statements containing sensitive variables from all program statements in the source program using a global set of sensitive variables. The processor can analyze the program statements to be converted and determine their corresponding variable hiding functions in the variable hiding function set. By replacing the program statements with the variable hiding functions and combining this with the function for obtaining the GUID, the processor determines the de-identified program and transmits it to the untrusted environment at the receiving end. The processor can generate operation instructions for each program statement to be converted using an instruction conversion set, obtaining an operation instruction set. Based on the operation instruction set and the de-identified program, the processor determines the sensitive variable matrix, encrypts it, and transmits it to the trusted environment at the receiving end.

[0068] Based on the above embodiments, the steps of replacing the statements in the program to be converted according to the variable hiding function set, and combining this with obtaining the globally unique identifier function to determine the converted de-identified program can be refined as follows:

[0069] The program statement to be converted is converted into a statement in the form of intermediate three-address code; according to the type of the statement and the position of the sensitive variable in the global sensitive variable set in the statement, the replacement variable hiding function corresponding to the statement is determined from the variable hiding function set and replaced; the types include assignment statements and branch statements; the program statement to be converted is replaced according to the replacement variable hiding function, and combined with the function to obtain the globally unique identifier, the converted desensitized program is determined and transmitted to the receiving end.

[0070] In this embodiment, the intermediate three-address code form can be understood as an important representation in the intermediate code generation stage; it is a simplified form of machine instructions used to represent expressions in high-level languages. The variable substitution hiding function can be understood as the variable hiding function corresponding to the content involved in the statement. The type can be understood as a way to distinguish the type of statement; for example, it can include assignment statements and branching statements. An assignment statement can be understood as a statement that assigns a value to a variable. A branching statement can be understood as an important statement structure for implementing conditional execution; it can determine the program's execution path based on different conditions. The memory model is used to provide a safe execution environment; for example, it can be the Encalve memory model.

[0071] Specifically, the processor can convert the program statements to be converted into intermediate three-address code forms. This conversion is performed on the three-address code of the source program, which is the intermediate representation of the converted program. The processor can then identify the statement type of the converted statement. Based on the statement type and the position of the sensitive variable in the global sensitive variable set (e.g., on the left or right side of the statement's equation), the processor determines the corresponding replacement variable hiding function from the variable hiding function set and performs the replacement. The processor can then use the replacement variable hiding function to replace the program statements to be converted, and combined with the function to obtain a globally unique identifier, determine the converted de-identified program and transmit it to the receiving end.

[0072] For example, the sensitive variable hiding functions in the variable hiding function set may include: `getUuid()`: For each method in the program, it obtains a globally unique identifier at method initialization, allocates a stack space for it in the memory model, and uses this stack frame for addressing. `get(L(s),i(s),UUID)`: Converts assignment statements (of type assignment statement) to the form of the middle three-address code. The conversion is performed when the sensitive variable appears on the right side of the statement equation (position: right side), providing a solution for simple output needs. Here, `L(s)` represents the `s`th instruction in the instruction set, `i(s)` represents the `s`th statement in the source program, and `UUID` represents the globally unique identifier of the `s`th statement. `update(L(s),i(s),UUID)`: Converts assignment statements to the form of the middle three-address code. The conversion is performed when the sensitive variable appears on the left side of the statement equation. `evaluate(L(s),i(s),UUID)`: Converts branch statements to the form of the middle three-address code. `deleteUuid`: To prevent memory leaks, it deletes the stack space and stack frame used for function initialization after program execution ends.

[0073] For example, the program conversion can be demonstrated with a specific example. Operators and corresponding formulas can be predefined. The operators are ◇ and ⊙. The three-address code of the basic statement of the program is shown in Table 1. Code (1) is the basic branch statement, and codes (2) and (3) are ordinary assignment statements. It is assumed that the control flow x and y are the initial sensitive variables.

[0074] Table 1. Examples of Basic Program Conversion

[0075]

[0076] For all branching statements in the source program (i.e., code (1) in Table 1), each conditional expression is converted into an `evaluate` function and a corresponding instruction set as shown in the example above. Once called, this function returns a boolean value based on the result of x◇y. For non-branching statements in the program that contain sensitive variables (i.e., code (2) and code (3) in Table 1), they are converted into an `update` function and a corresponding instruction set as shown in the example above. This function updates the value of the sensitive variables within the memory model based on the calculation results between the sensitive variables stored in the memory model.

[0077] The technical solution of this invention uses sensitive sources in the initial global sensitive variables as pollution sources, and identifies other variables contaminated by these sources as dynamic sensitive variables during program execution, thus vertically expanding the range of sensitive variables and achieving high versatility. By designing an 11-tuple instruction transformation structure and variable hiding functions, program statements containing sensitive variables are replaced during program transformation, converting them into unrecognizable functions. Simultaneously, a corresponding instruction set is generated and transmitted to the remote receiving end, avoiding the possibility of sensitive variables being exposed to untrusted environments, thereby achieving a highly secure solution for protecting sensitive program data.

[0078] Example 2

[0079] Figure 2 This is a flowchart of a program execution method provided in Embodiment 2 of the present invention. This embodiment is applicable to the execution of de-identified programs. The method is applied at a receiving end, which includes a trusted environment and an untrusted environment. The method can be executed by a program execution device, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 2 As shown, the method includes:

[0080] S210. Receive the desensitization program in an untrusted environment, and receive the sensitive variable matrix in a trusted environment and store it in the memory model by allocating stack space through a preset storage structure.

[0081] In this embodiment, an untrusted environment can be understood as an environment with a relatively low level of security for the program. A trusted environment can be understood as an environment with high security and reliability, such as an environment constructed through an RSDHider Enclave. A preset storage structure can be understood as a pre-defined storage method.

[0082] Specifically, the receiving processor can receive the desensitization program in an untrusted environment, and receive the sensitive variable matrix in a trusted environment and store it in the memory model by allocating stack space in the memory model through a preset storage structure.

[0083] S220. Run the desensitization program in an untrusted environment and transfer the resulting functions and instructions to the memory model.

[0084] In this embodiment, a function can be understood as a function in the program when the de-identification procedure is run. An instruction can be understood as an instruction corresponding to the de-identification procedure.

[0085] Specifically, the receiving processor can run the desensitization program in an untrusted environment. When it runs a function, it transfers the function and its corresponding instructions to the memory model.

[0086] S230. Functions and instructions are called in a trusted environment through a memory model to obtain program execution results.

[0087] In this embodiment, the program execution result can be understood as the output result obtained after the program is executed.

[0088] Specifically, in a trusted environment, the memory model is used to determine the globally unique identifier corresponding to the instruction through a sensitive variable matrix. The corresponding array, object, and ordinary variable are then found in the stack space using the globally unique identifier. Finally, the program execution result is obtained by combining the operation corresponding to the function with the array, object, and ordinary variable.

[0089] The technical solution of this invention involves running a desensitization program in an untrusted environment to obtain the function to be called and the instructions to be sent to a memory model in a trusted environment. By designing array and object type data structures in the memory model and allocating stack frame addressing using UUID, the protection of hiding sensitive variables of non-basic types is achieved. Function calls are performed through the memory model to obtain the function execution results, thereby achieving the purpose of protecting the confidentiality of sensitive program data.

[0090] Furthermore, based on the above embodiments, the steps for calling functions and instructions to obtain program execution results can be refined as follows:

[0091] Based on the sensitivity variable matrix, determine the unique identifier of the target program statement corresponding to the instruction in the source program; determine the data corresponding to the unique identifier from the stack space; call the function according to the instruction and data to obtain the function execution result; determine the program execution result based on the execution results of each function.

[0092] In this embodiment, the target program statement can be understood as the program statement to which the current function belongs. The target unique identifier is used to indicate the location of the target program statement in the source program. The function execution result can be understood as the result after the function call.

[0093] Specifically, the memory model can determine the unique identifier of the target program statement in the source program based on the sensitivity variable matrix, thus identifying the corresponding program statement. The memory model can then determine the data corresponding to the unique identifier from the stack space; this data can be of types such as ordinary variables, arrays, and objects. The memory model can then call functions based on the instructions and data to obtain the function execution results. Since subsequent calculations may exist, the memory model can continue to the next function call according to the desensitization procedure order based on the function execution results until the final program execution result is determined.

[0094] For example, a concrete example can be used to illustrate the structure of the memory model. Figure 3 This is an example diagram of a memory model in a program execution method provided in Embodiment 2 of the present invention, as shown below. Figure 3 As shown, the memory model can be the RSDHiderEncalve memory model, which includes a pre-stored sensitivity matrix, a method execution area, an instruction interpreter, and a stack space. When the memory model receives functions and instructions, it first parses the instructions using the instruction interpreter. The sensitivity matrix determines the identifier i(s) of the target program statement corresponding to the parsed instruction. The identifier is then used to locate the corresponding data from the stack space, which is given to the instruction interpreter. The method execution area then combines the program statement and data to perform a function call, obtaining the function call result, which is then output to the untrusted environment.

[0095] Example 3

[0096] Figure 4 This is a schematic diagram of a program transmission device provided in Embodiment 3 of the present invention. This device is applied at the transmission end. Figure 4 As shown, the device includes: a program acquisition module 41, a set determination module 42, a set update module 43, and a program conversion module 44.

[0097] Program acquisition module 41 is used to acquire the source program;

[0098] The set determination module 42 is used to identify sensitive variables in the source program based on the pre-trained algorithm model and determine the initial global set of sensitive variables.

[0099] The set update module 43 is used to identify dynamic sensitive variables in the source program based on the initial global sensitive variable set, update the initial global sensitive variable set, and obtain a global sensitive variable set.

[0100] The program conversion module 44 is used to convert the source program according to the variable hiding function set, instruction conversion structure and the global sensitive variable set, to obtain the desensitized program and sensitive variable matrix and transmit them to the receiving end.

[0101] The technical solution of this invention involves: acquiring the source program; identifying sensitive variables in the source program based on a pre-trained algorithm model to determine an initial global sensitive variable set; identifying dynamic sensitive variables in the source program based on the initial global sensitive variable set, updating the initial global sensitive variable set to obtain a global sensitive variable set; and transforming the source program based on a variable hiding function set, instruction conversion structure, and the global sensitive variable set to obtain a de-identified program and a sensitive variable matrix, which are then transmitted to the receiving end. By determining a comprehensive global sensitive variable set and converting all statements in the program containing sensitive variables into unrecognizable user-defined functions, a transformed de-identified program is obtained, and a corresponding sensitive variable matrix is ​​generated and transmitted to the receiving end. This avoids the possibility of sensitive variables being exposed to an untrusted environment, thereby achieving sensitive data protection for the program.

[0102] Furthermore, the set update module 43 is specifically used for:

[0103] Extract method statements from the source program as the current set of method statements;

[0104] For each method statement in the current set of method statements, generate a set of variables on the right and a set of variables on the left.

[0105] Based on the initial global set of sensitive variables, a forward analysis is performed on the right-hand variable set to determine whether there are dynamic sensitive variables.

[0106] Based on the initial global set of sensitive variables, a backward analysis is performed on the left-hand set of variables to determine whether there are dynamic sensitive variables.

[0107] The initial global sensitive variable set is updated based on the identified dynamic sensitive variables to obtain the global sensitive variable set.

[0108] Furthermore, the program conversion module 44 includes:

[0109] The first determining unit is used to determine the global unique identifier acquisition function corresponding to each program statement in the source program. The global unique identifier acquisition function is used to allocate a global unique identifier at the beginning of each program statement and allocate stack space at the receiving end.

[0110] The statement recognition unit is used to identify the program statements to be converted in the source program through the global sensitive variable set;

[0111] The second determining unit is used to replace the program statements to be converted according to the variable hiding function set, and in combination with the function to obtain the globally unique identifier, determine the desensitized program after conversion and transmit it to the receiving end.

[0112] The third determining unit is used to determine the operation instructions for each of the program statements to be converted through the instruction conversion set, thereby obtaining an operation instruction set.

[0113] The fourth determining unit is used to determine the sensitive variable matrix and transmit it to the receiving end according to the operation instruction set and the desensitization procedure.

[0114] Specifically, the fourth determining unit is used for:

[0115] Convert the program statement to be converted into a statement in the form of intermediate three-address code;

[0116] Based on the type of the statement and the position of the sensitive variable in the global sensitive variable set in the statement, the replacement variable hiding function corresponding to the statement is determined from the variable hiding function set and replaced; the type includes assignment statements and branch statements.

[0117] The program statements to be converted are replaced according to the variable hiding function, and the converted de-identified program is determined and transmitted to the receiving end in combination with the global unique identifier function.

[0118] The program transmission device provided in the embodiments of the present invention can execute the program transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0119] Example 4

[0120] Figure 5 This is a schematic diagram of a program execution device provided in Embodiment 4 of the present invention. The device is applied at a receiving end, which includes a trusted environment and an untrusted environment. Figure 5 As shown, the device includes: an information acquisition module 51, a program execution module 52, and a result determination module 53.

[0121] Information acquisition module 51 is used to receive the desensitization program in the untrusted environment, receive the sensitive variable matrix in the trusted environment, and store it in the memory model by allocating stack space in the memory model through a preset storage structure;

[0122] Program execution module 52 is used to run the desensitization program in the untrusted environment and transmit the functions and instructions obtained from the run to the memory model;

[0123] The result determination module 53 is used to call the function and instructions in the trusted environment through the memory model to obtain the program execution result.

[0124] The technical solution of this invention involves running a desensitization program in an untrusted environment to obtain the function to be called and the instructions to be sent to a memory model in a trusted environment. By designing array and object type data structures in the memory model and allocating stack frame addressing using UUID, the protection of hiding sensitive variables of non-basic types is achieved. Function calls are performed through the memory model to obtain the function execution results, thereby achieving the purpose of protecting the confidentiality of sensitive program data.

[0125] Furthermore, the result determination module 53 is specifically used for:

[0126] Based on the sensitivity variable matrix, determine the unique identifier of the target program statement corresponding to the instruction in the source program;

[0127] Determine the data corresponding to the unique identifier of the target from the stack space;

[0128] The function is invoked according to the instructions and the data to obtain the function execution result;

[0129] The program execution result is determined based on the execution results of each function.

[0130] The program execution device provided in the embodiments of the present invention can execute the program execution method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0131] Example 5

[0132] Figure 6A schematic diagram of an electronic device 60 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0133] like Figure 6 As shown, the electronic device 60 includes at least one processor 61 and a memory, such as a read-only memory (ROM) 62 and a random access memory (RAM) 63, communicatively connected to the at least one processor 61. The memory stores computer programs executable by the at least one processor. The processor 61 can perform various appropriate actions and processes based on the computer program stored in the ROM 62 or loaded into the RAM 63 from storage unit 68. The RAM 63 may also store various programs and data required for the operation of the electronic device 60. The processor 61, ROM 62, and RAM 63 are interconnected via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0134] Multiple components in electronic device 60 are connected to I / O interface 65, including: input unit 66, such as keyboard, mouse, etc.; output unit 67, such as various types of monitors, speakers, etc.; storage unit 68, such as disk, optical disk, etc.; and communication unit 69, such as network card, modem, wireless transceiver, etc. Communication unit 69 allows electronic device 60 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0135] Processor 61 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 61 performs the various methods and processes described above, such as program execution methods or program transfer methods.

[0136] In some embodiments, the program execution method or program transfer method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 60 via ROM 62 and / or communication unit 69. When the computer program is loaded into RAM 63 and executed by processor 61, one or more steps of the program execution method or program transfer method described above may be performed. Alternatively, in other embodiments, processor 61 may be configured to execute the program execution method or program transfer method by any other suitable means (e.g., by means of firmware).

[0137] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0138] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0139] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0140] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0141] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0142] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0143] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the program execution method or program transmission method of any embodiment of the present invention.

[0144] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0145] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0146] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A program transmission method, characterized in that, Applied to the transmission end, including: Obtain the source code; Based on the pre-trained algorithm model, the source program is used to identify sensitive variables and determine the initial global set of sensitive variables. Based on the initial global sensitive variable set, the dynamic sensitive variables in the source program are identified, and the initial global sensitive variable set is updated to obtain the global sensitive variable set; The source program is transformed based on the variable hiding function set, instruction conversion structure, and the global sensitive variable set to obtain the desensitized program and sensitive variable matrix, which are then transmitted to the receiving end.

2. The method according to claim 1, characterized in that, The step of identifying dynamic sensitive variables in the source program based on the initial global sensitive variable set, updating the initial global sensitive variable set, and obtaining a global sensitive variable set includes: Extract method statements from the source program as the current set of method statements; For each method statement in the current set of method statements, generate a set of variables on the right and a set of variables on the left. Based on the initial global set of sensitive variables, a forward analysis is performed on the right-hand variable set to determine whether there are dynamic sensitive variables. Based on the initial global set of sensitive variables, a backward analysis is performed on the left-hand set of variables to determine whether there are dynamic sensitive variables. The initial global sensitive variable set is updated based on the identified dynamic sensitive variables to obtain the global sensitive variable set.

3. The method according to claim 1, characterized in that, The step of transforming the source program according to the variable hiding function set, instruction conversion set, and the global sensitive variable set to obtain the de-identified program and sensitive variable matrix, and transmitting them to the receiving end, includes: For each program statement in the source program, a function for obtaining a globally unique identifier is determined. The function for obtaining a globally unique identifier is used to allocate a globally unique identifier at the beginning of each program statement and allocate stack space at the receiving end. The global set of sensitive variables is used to identify the program statements in the source program that need to be converted. The program statements to be converted are replaced according to the variable hiding function set, and the converted de-identified program is determined and transmitted to the receiving end in combination with the function to obtain the globally unique identifier. The operation instructions for each program statement to be converted are determined by the instruction conversion set, thus obtaining the operation instruction set; Based on the operation instruction set and the desensitization procedure, the sensitive variable matrix is ​​determined and transmitted to the receiving end.

4. The method according to claim 3, characterized in that, The step of replacing the program statements to be converted according to the variable hiding function set, combined with the step of obtaining the globally unique identifier function, determining the converted de-identified program, and transmitting it to the receiving end includes: Convert the program statement to be converted into a statement in the form of intermediate three-address code; Based on the type of the statement and the position of the sensitive variable in the global sensitive variable set in the statement, the replacement variable hiding function corresponding to the statement is determined from the variable hiding function set and replaced; the type includes assignment statements and branch statements. The program statements to be converted are replaced according to the variable hiding function, and the converted de-identified program is determined and transmitted to the receiving end in combination with the global unique identifier function.

5. A program execution method, characterized in that, Applied to a receiving end, wherein the receiving end includes a trusted environment and an untrusted environment, the method includes: The desensitization procedure is received in the untrusted environment, and the sensitive variable matrix is ​​received in the trusted environment and stored in the memory model by allocating stack space through a preset storage structure. The desensitization program is run in the untrusted environment, and the resulting functions and instructions are transferred to the memory model. The program execution result is obtained by calling the functions and instructions in the trusted environment through the memory model.

6. The method according to claim 5, characterized in that, The process of calling the function and instructions to obtain the program execution result includes: Based on the sensitivity variable matrix, determine the unique identifier of the target program statement corresponding to the instruction in the source program; Determine the data corresponding to the unique identifier of the target from the stack space; The function is invoked according to the instructions and the data to obtain the function execution result; The program execution result is determined based on the execution results of each function.

7. A program transmission device, characterized in that, Applied to the transmission end, including: The program acquisition module is used to acquire the source program. The set determination module is used to identify sensitive variables in the source program based on the pre-trained algorithm model and determine the initial global set of sensitive variables. The set update module is used to identify dynamic sensitive variables in the source program based on the initial global sensitive variable set, update the initial global sensitive variable set, and obtain a global sensitive variable set. The program conversion module is used to convert the source program according to the variable hiding function set, instruction conversion structure and the global sensitive variable set, to obtain the desensitized program and sensitive variable matrix and transmit them to the receiving end.

8. A program execution device, characterized in that, Applied to the receiving end, the receiving end includes a trusted environment and an untrusted environment, including: The information acquisition module is used to receive the desensitization program in the untrusted environment, and to receive the sensitive variable matrix in the trusted environment and store it in the memory model by allocating stack space in the memory model through a preset storage structure. The program execution module is used to run the desensitization program in the untrusted environment and transfer the functions and instructions obtained from the execution to the memory model; The result determination module is used to call the functions and instructions in the trusted environment through the memory model to obtain the program execution result.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the program transfer method of any one of claims 1-4 or the program execution method of any one of claims 5-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the program transfer method of any one of claims 1-4 or the program execution method of any one of claims 5-6.

Images