Client source code encryption method and device, equipment and storage medium

Abstract

The invention discloses a client source code encryption method and device, equipment and a storage medium, belongs to the field of data processing, and is used for effectively protecting a client source code. The method comprises the following steps: acquiring a plurality of pieces of routing component information in a to-be-encrypted client source code, and merging the routing component information meeting a preset information merging rule to obtain a plurality of pieces of routing merged information; based on a preset symmetric encryption algorithm and the plurality of first keys, each path of route merging information is encrypted to obtain a plurality of pieces of first encrypted information, and different pieces of route merging information correspond to different first keys; equipment attribute information of a first client is acquired, a second key pair is generated based on the equipment attribute information, and the first client is a client to be subjected to source code encryption; metadata information is determined based on the address information of the multiple pieces of first encryption information and the multiple first secret keys, and the metadata information is encrypted based on a second encryption public key in the second secret key pair.

Description

Technical Field

[0001] This application belongs to the field of data processing, specifically relating to a client-side source code encryption method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of the internet, cross-platform applications have become increasingly common. Electron is a popular open-source framework that allows developers to build cross-platform desktop applications using JavaScript, HTML, and CSS. While Electron offers many development conveniences, its source code, being based on web technologies, is easily reverse-engineered and cracked. This poses a challenge to the protection of sensitive information and intellectual property.

[0003] Therefore, a method is needed to effectively protect the client-side source code. Summary of the Invention

[0004] This application provides a client source code encryption method that can effectively protect the client source code.

[0005] In a first aspect, embodiments of this application provide a client source code encryption method, the method comprising: obtaining multiple routing component information in the client source code to be encrypted, and merging the routing component information that satisfies a preset information merging rule to obtain multiple routing merge information; encrypting each of the routing merge information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, wherein different routing merge information corresponds to different first keys; obtaining device attribute information of a first client, and generating a second key pair based on the device attribute information, wherein the first client is the client to be encrypted; determining metadata information based on address information of the multiple first encrypted information and the multiple first keys, and encrypting the metadata information based on a second encryption public key in the second key pair. Secondly, embodiments of this application provide a client source code encryption device, the device comprising: a first acquisition module, configured to acquire multiple routing component information in the client source code to be encrypted, and merge the routing component information that satisfies a preset information merging rule to obtain multiple route merge information; a first encryption module, configured to encrypt each of the route merge information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, wherein different route merge information corresponds to different first keys; a second acquisition module, configured to acquire device attribute information of a first client, and generate a second key pair based on the device attribute information, wherein the first client is the client to be encrypted; and a second encryption module, configured to determine metadata information based on the address information of the multiple first encrypted information and the multiple first encryption keys, and encrypt the metadata information based on the second encryption public key in the second key pair.

[0006] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0007] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0008] Fifthly, embodiments of this application provide a computer program product that, when executed by a processor, implements the steps of the method described in the first aspect.

[0009] In a sixth aspect, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.

[0010] In this embodiment, by obtaining multiple routing component information from the client source code to be encrypted, and merging the routing component information that meets the preset information merging rules, multiple routing merge information is obtained; each of the routing merge information is encrypted based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, with different routing merge information corresponding to different first keys; device attribute information of a first client is obtained, and a second key pair is generated based on the device attribute information, wherein the first client is the client to be encrypted; metadata information is determined based on the address information of the multiple first encrypted information and the multiple first keys, and the metadata information is encrypted based on the second encryption public key in the second key pair, which can effectively protect the client source code. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a client-side source code encryption method provided in an embodiment of this application; Figure 2 These are schematic diagrams illustrating the structures of two first abstract syntax trees provided in embodiments of this application; Figure 3 This is a flowchart illustrating the second client-side source code encryption method provided in this application embodiment; Figure 4 This is a swimlane diagram illustrating a client-side source code encryption / decryption method provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a client source code encryption device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a client source code encryption device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0014] The client source code encryption method provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0015] Figure 1 This illustration shows a client-side source code encryption method provided by an embodiment of the present invention. The method can be executed by an electronic device, which may include a server and / or a terminal device, wherein the terminal device may be, for example, an in-vehicle terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed on the client-side source code encryption device, and the method includes the following steps: Step 102: Obtain multiple routing component information from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple route merge information.

[0016] The execution subject of the client source code encryption method described in this application can be client source code encryption software or client encryption system. When the execution subject is a client source code encryption system, the client source code encryption system can include a client module and a server module. The client module can be installed on the client, and the server module can be installed on the server. This application embodiment takes a client source code encryption system including a client module and a server module as an example.

[0017] The server-side module in the client source code encryption system obtains multiple routing component information from the client source code to be encrypted, and merges multiple routing component information that meet the preset information merging rules to obtain one or more routing merge information. Here, the client source code is the source code of an application that can be installed on the client, the preset information merging rules are pre-set rules for merging multiple routing component information that meet the conditions, and the routing merge information is the information obtained by merging multiple routing component information.

[0018] The server-side module retrieves the routing file from the software project. Typically, the routing file is a JavaScript file that defines different routes and their corresponding components. The server-side module then obtains the relevant information for each component included in the routing file, i.e., the routing component information. After retrieving multiple routing component information entries, the server-side module can merge these entries according to information merging rules. These rules are set based on the actual situation and can include merging two related routing component entries, merging five related routing component entries, or merging multiple routing component entries with a similarity greater than a preset threshold. The preset threshold can be determined based on the specific circumstances.

[0019] Step 104: Encrypt each of the route merging information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information.

[0020] Different routing merging information corresponds to different first keys.

[0021] After merging information from multiple routing components to obtain one or more merged routing information, the server module performs symmetric encryption on each merged routing information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information. Different first keys are used to encrypt different merged routing information.

[0022] When encrypting route merging information using a symmetric encryption algorithm, either the SM4 or AES algorithm can be used. During encryption, the client module uses the symmetric encryption algorithm and the first key corresponding to each route merging information to encrypt each piece of information, thus obtaining the first encrypted information corresponding to each route merging information.

[0023] Specifically, the first key corresponding to each route merging information can be pre-set or determined based on the route merging information. For example, the server module can pre-set a first key library, and then, when determining the first key corresponding to each route merging information, can randomly select a first key from the first key library as the first key corresponding to the route merging information; the server module can also determine the content hash value of each route merging information, determine an identifier based on the content hash value, and then determine the corresponding first key based on the identifier, and finally encrypt the route merging information based on the determined first key to obtain the first encrypted information.

[0024] When encrypting multiple route merging messages and determining the first encrypted information corresponding to each route merging message, the address information corresponding to the unencrypted route merging message and the first encrypted information is the same. For example, if the address information of the route merging message is A, then the address of the first encrypted information is also A.

[0025] Step 106: Obtain the device attribute information of the first client, and generate a second key pair based on the device attribute information.

[0026] The first client is the client whose source code is to be encrypted. In other words, the first client is a terminal capable of downloading, installing, and executing the client software source code. The client source code encryption system needs to protect the client source code during the process of the first client downloading, installing, and executing the client software source code.

[0027] The client module in the client source code encryption system can obtain the device attribute information of the first client and generate a second key pair based on the device attribute information. The first client is the client to be encrypted, and the second key pair can be an asymmetric encryption key pair, which includes a second encryption public key and a second decryption private key. The second encryption public key is used to encrypt data, and the second decryption private key is used to decrypt the encrypted data.

[0028] Furthermore, the client module can obtain the device attribute information of the client that needs to encrypt the software source code, and generate a second key pair based on the device attribute information, where the device attribute information is unique to the client terminal device. After generating the second key pair, the client module sends the second encryption public key from the generated second key pair to the server module, so that the server module can encrypt the data according to the second encryption public key, thereby completing the encrypted communication between the server module and the client module.

[0029] Specifically, when the application is installed on the client, the client module installed on the client can generate a hardware binding identifier based on the hardware serial number of the device, and then generate a key pair for asymmetric encryption based on the hardware binding identifier. The asymmetric encryption key pair generation method is as follows: (1) Hardware information collection: The application collects the CPU serial number, motherboard serial number, hard disk serial number, network adapter MAC address, BIOS information, etc. of the hardware; (2) Information merging: The collected information and the current timestamp are merged into a string, and the merged string is processed using a hash algorithm to generate a hardware binding identifier; (3) Generating asymmetric encryption key pair: The hardware binding identifier is used as a seed, and a key pair is generated using the general algorithm RSA or SM2.

[0030] Step 108: Determine metadata information based on the address information of multiple said first encrypted information and multiple said first keys, and encrypt the metadata information with the second encryption public key in the second key pair.

[0031] After determining the first encrypted information, the server module can generate a metadata sub - information based on each first encrypted information and its corresponding first key, and then determine the metadata information according to multiple first encrypted information and the first keys corresponding to each first encrypted information. That is, the metadata information stores the first keys corresponding to each first encrypted information. After determining the metadata information, the server module then performs asymmetric encryption on the metadata information according to the received second encryption public key and obtains the encrypted information (the second encrypted information). That is to say, the server module performs asymmetric encryption on the source code and metadata information of the client application so that only the client module installed on the client can decrypt the encrypted metadata information. That is, only the client module can obtain the key of the first encrypted information included in the metadata, and then ensure that only the client module can obtain the encrypted source code through the first key, thus effectively protecting the source code.

[0032] Specifically, when determining the metadata information, the server module can determine the identifier of the routing merge information corresponding to each first encrypted information, the routing path (address information) and its function description as the metadata information, and store the metadata information in the server. For example, the generated metadata information can be as follows: "path: " / ", name: "Home", file: "Home.js", desc: "Home page", key: a" and "path: " / about", name: "About", file: "About.js", desc: "About", key: b", where key: a and key: b are both the first keys.

[0033] In summary, the server-side module installed on the server can obtain multiple routing component information from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple merged routing information. Then, it encrypts each merged routing information based on a preset symmetric encryption algorithm and multiple first keys, obtaining multiple first encrypted information. When the client installs the application with source code encryption, it downloads and installs the encrypted information, i.e., the first encrypted information. The client-side module installed on the client can obtain the device attribute information of the first client, generate a second key pair based on the device attribute information, and then send the second encryption public key from the second key pair to the server-side module. After receiving the second encryption public key, the server-side module determines the metadata information based on the address information of the multiple first encrypted information and the multiple first keys, and then encrypts the metadata based on the second encryption public key, thus obtaining second encrypted data. The server-side module can send the second encrypted data to the client module, so that the client can decrypt the second encrypted data using the second decryption private key, and then determine the first encrypted information to be decrypted based on the decrypted metadata information, and decrypt it using its corresponding first key.

[0034] The client source code encryption method provided in this invention obtains multiple routing component information from the client source code to be encrypted, merges the routing component information that meets a preset information merging rule to obtain multiple route merge information; encrypts each of the route merge information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, with different route merge information corresponding to different first keys; obtains device attribute information of a first client, and generates a second key pair based on the device attribute information, wherein the first client is the client to be encrypted; determines metadata information based on the address information of the multiple first encrypted information and the multiple first keys, and encrypts the metadata information based on the second encryption public key in the second key pair, thereby effectively protecting the client source code.

[0035] In one implementation, obtaining multiple routing component information from the client source code to be encrypted (step 102) can be performed via steps A1-A2: Step A1: Perform code obfuscation and code compression on the client source code to obtain the processed first source code.

[0036] The code obfuscation process includes one or more of the following: variable name replacement, control flow flattening, and string encryption. The code compression process includes one or more of the following: whitespace removal, comment removal, and syntax simplification.

[0037] Before obtaining information about multiple routing components in the client source code, the server module can streamline the client source code, such as by obfuscating and / or compressing it. Code obfuscation increases the difficulty of understanding the client source code, while code compression reduces the file size of the client source code.

[0038] Specifically, the code obfuscation processing that the server can perform can include one or more of the following: variable name replacement, control flow flattening, and string encryption. The code compression processing that can be performed can include one or more of the following: whitespace removal, comment removal, and syntax simplification. Among these, variable name replacement: replacing variable names and function names with short and meaningless names; control flow flattening: changing the execution order of the code to increase the difficulty of understanding; string encryption: encrypting strings to convert them into an unreadable form and decrypting them at runtime; whitespace removal: cleaning up whitespace characters in the code to reduce file size; comment removal: removing comments from the code to reduce file size; and syntax simplification: using simplified syntax structures, such as merging multiple lines of code into one line.

[0039] Step A2: Determine the information of the multiple routing components included in the first source code.

[0040] After determining the first source code, the server module determines the routing component information included in the first source code, and then obtains multiple routing component information.

[0041] The embodiments in this specification, by obfuscating and / or compressing the client source code, can not only reduce the size of the data to be encrypted, but also increase the difficulty of understanding the data to be encrypted, thereby better protecting the data source code.

[0042] In one implementation, merging the routing component information that satisfies the preset information merging rules to obtain multiple route merging information (step 102) can be performed via steps B1-B3: Step B1: Obtain multiple first routing information and determine the first reference relationship of each first routing information.

[0043] Wherein, the first routing information is any of the routing component information, and the first reference relationship is used to characterize the routing component information that has a reference relationship with the first routing information.

[0044] The server module obtains multiple first routing information entries and determines the first reference relationship corresponding to each first routing information entry. Here, the first routing information entry is one of the multiple routing component information entries obtained, and the first reference relationship is the routing component information included in the obtained first routing information entry that has a reference relationship. Furthermore, the server module can use each routing component information entry as first routing information and obtain the first reference relationship of that first routing information entry, that is, obtain the first reference relationships included in all routing component information.

[0045] Specifically, route component information can include the path information, route name information, route component, and route description information of the route component, such as "Route 1, Path: / , Route Name: Home, Route Component: Home.vue, Route Description: Home, where Home.vue references Welcome.vue and Hello.vue components, Hello.vue references Name.vue component, and also references the format.ts utility class" and "Route 2, Path: / about, Route Name: About, Route Component: About.vue, Route Description: About, where About.vue references Version.vue and Introduction.vue". Therefore, it can be seen that the server-side module can obtain the first reference relationship included in the route component information. For example, the first reference relationship included in the route component information of route 1 is "Home.vue references Welcome.vue and Hello.vue" and "Hello.vue references Name.vue and format.ts", and the first reference relationship included in the route component information of route 2 is "About.vue references Version.vue and Introduction.vue".

[0046] Step B2: Based on multiple first reference relationships, determine the first abstract syntax tree obtained by merging multiple routing component information through a traversal algorithm.

[0047] After determining the initial reference relationships included in the information of each routing component, the server-side module merges the information of related routing components based on multiple initial reference relationships using a traversal algorithm to obtain the first abstract syntax tree (AST). In other words, the server-side module uses a parser (such as Babel or TypeScript Compiler) to convert the source code into an AST. The AST provides a hierarchical representation of the code structure, facilitating the analysis of the code's components. For example, when it is determined based on the initial reference relationships that component A references component B, and component B references components C and D, the server-side module can determine the first AST for components A, B, C, and D.

[0048] Specifically, when constructing the first abstract syntax tree based on multiple first reference relationships, the server module can treat each routing component information as a node and determine other connected nodes based on the first reference relationships corresponding to each routing component information, such as... Figure 2 As shown in (a), this is the first abstract syntax tree determined when the reference relationships are "Home.vue references Welcome.vue and Hello.vue" and "Hello.vue references Name.vue and format.ts". Figure 2 (b) is the first abstract syntax tree corresponding to the reference relationship "About.vue references Version.vue and Introduction.vue".

[0049] During traversal, the server module can use a hash table or dictionary to store processed nodes and their results, avoiding redundant calculations. The implementation is as follows: when a node is accessed, its cache is checked. If the cache already contains a result, it is used directly; otherwise, the node is processed and the cache is updated.

[0050] Step B3: Merge the routing component information included in the first abstract syntax tree to obtain the routing merge information.

[0051] After determining the first abstract syntax tree based on the reference relationships, the server module merges the multiple route merging information included in the first abstract syntax tree to obtain the route merge information. In other words, the server module can merge multiple route component information with reference relationships to obtain the route merge information.

[0052] In this embodiment of the application, by merging the information of multiple routing components included in the determined first abstract syntax tree, all functions, classes and variables corresponding to the same route are aggregated into a code block file, which can classify and encrypt files according to their functions, so as to effectively classify and encrypt the client source code.

[0053] In one implementation, the step of determining the first abstract syntax tree (step B2) by merging the information of multiple routing components based on multiple first reference relationships using a traversal algorithm can be performed via steps C1-C4: Step C1: Based on multiple first reference relationships, determine the first node of the first abstract syntax tree.

[0054] The first node is the starting node of the first abstract syntax tree.

[0055] When determining the first abstract syntax tree (AST), the server module can determine the first node in the AST based on multiple acquired first reference relationships. The first node is the starting node of the AST to be determined. In other words, the server module obtains the starting route component information from multiple route component information sets and determines the first node based on it.

[0056] Step C2: Based on the routing component information that has a reference relationship with the second routing information, determine multiple second nodes.

[0057] Wherein, the second routing information is the routing component information corresponding to the first node, and the second node is the next node of the first node.

[0058] After determining the first node, the server module identifies the routing component information that is associated with the second routing information corresponding to the first node, and determines the second node based on the identified routing component information that is referenced by the second routing information. For example, if the routing component information corresponding to the first node includes the reference relationship "component A references components B and C", then the second node can be determined based on components B and C.

[0059] Step C3: Determine the first reference frequency of each second node based on the first reference relationship.

[0060] The first reference frequency is used to characterize the frequency at which the routing component information corresponding to the second node is referenced.

[0061] After identifying multiple second nodes, the server module can determine the first reference frequency of each second node based on the first reference relationship. The first reference frequency characterizes the frequency with which the routing component information corresponding to the second node is referenced. For example, when there are three routing component information entries: "Component A references Component B and Component C, Component B references Component C, and Component C references Component D," the first reference frequency of component A can be determined to be 0, the first reference frequency of component B to be 1, the first reference frequency of component C to be 2, and the first reference frequency of component D to be 1.

[0062] In other words, before traversing, the server module first needs to obtain the reference frequency of the adjacent node (or the second node). The reference frequency of the adjacent node (or the second node) can represent the frequency of the occurrence of the adjacent node (or the second node) in multiple routing component information. The higher the first reference frequency, the higher the frequency of the routing component information corresponding to the second node is referenced in multiple routing component information (the higher the frequency of occurrence).

[0063] Step C4: Determine the traversal order corresponding to the multiple second nodes based on the first reference frequency, and perform traversal operations on the multiple second nodes based on the traversal order.

[0064] After determining the first reference frequency of each second node, the server module can sort the traversal order of each second node according to its first reference frequency. For example, the traversal order can be set according to the order of the first reference frequency. That is, when the first reference frequency of component A is 0, the first reference frequency of component B is 1, the first reference frequency of component C is 2, and the first reference frequency of component D is 1, the traversal order of the second nodes can be determined as component C, component B, component D, component A.

[0065] Specifically, during the traversal, the server module records the number of times each node is accessed, prioritizing nodes with higher access frequencies, as these nodes may appear in multiple traversals. Then, nodes are sorted by type, identifying their type (e.g., functions, classes, variables), processing function-type nodes first, then class-type nodes, and finally variable-type nodes. The implementation is as follows: Before starting the DFS, all nodes are initially sorted, and the sorting results are stored using a hash table or priority queue. During the traversal, whenever a node is accessed, its access frequency is updated, and the order of adjacent nodes is adjusted, optimizing the node processing order in real time.

[0066] More specifically, the server module can not only determine the traversal order of each second node based on its first reference frequency, but also sort multiple second nodes according to a preset sorting rule to determine the traversal order of each second node. The preset sorting rule is used to sort multiple second nodes, and it can sort them according to information such as the type and variables of each second node. For example, it can sort by node type, identify the type of the node, such as function, class, variable, etc., and sort them by function type nodes first, then class type nodes, and finally variable type nodes.

[0067] Figure 3 This is a flowchart illustrating the second client-side source code encryption method provided in one embodiment of this specification, as shown below. Figure 3 As shown, the schematic diagram includes: Step 302: Obtain information on multiple routing components from the client source code to be encrypted.

[0068] Step 304: Obtain multiple first routing information and determine the first reference relationship of each first routing information.

[0069] Wherein, the first routing information is any of the routing component information, and the first reference relationship is used to characterize the routing component information that has a reference relationship with the first routing information.

[0070] Step 306: Based on multiple first reference relationships, determine the first node of the first abstract syntax tree.

[0071] The first node is the starting node of the first abstract syntax tree.

[0072] Step 308: Based on the routing component information that has a reference relationship with the second routing information, determine a plurality of second nodes.

[0073] Wherein, the second routing information is the routing component information corresponding to the first node, and the second node is the next node of the first node.

[0074] Step 310: Determine the first reference frequency of each second node based on the first reference relationship.

[0075] The first reference frequency is used to characterize the frequency at which the routing component information corresponding to the second node is referenced.

[0076] Step 312: Determine the traversal order corresponding to the multiple second nodes based on the first reference frequency, and perform traversal operations on the multiple second nodes based on the traversal order.

[0077] Step 314: Merge the routing component information included in the first abstract syntax tree to obtain routing merge information.

[0078] Step 316: Encrypt each of the route merging information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information.

[0079] Different routing merging information corresponds to different first keys.

[0080] Step 318: Obtain the device attribute information of the first client, and generate a second key pair based on the device attribute information.

[0081] The first client is the client whose source code is to be encrypted.

[0082] Step 320: Determine metadata information based on the address information of multiple first encrypted information and multiple first keys, and encrypt the metadata information based on the second encryption public key in the second key pair.

[0083] In the embodiments described in the specification, by traversing multiple routing component information, routing component information with reference relationships is merged to encrypt the merged routing information. Files are classified and encrypted according to function to effectively classify and encrypt the client source code.

[0084] In one implementation, steps D1-D5 can also be performed: Step D1: Obtain the second encrypted information.

[0085] The second encrypted information is obtained by encrypting the metadata information based on the second public key in the second key pair.

[0086] After the server module encrypts the metadata using the second public key from the second key pair, it determines the encrypted routing merge information as the second encrypted information. Once the second encrypted information is determined, the server module installed on the server sends it to the client module installed on the client, allowing the client module to decrypt it.

[0087] Step D2: Decrypt the first encrypted information based on the second decryption private key in the second key pair to obtain the metadata information.

[0088] The client module installed on the client receives the second encrypted information sent by the server module, and decrypts the second encrypted information based on the second decryption private key in the second key pair, thereby obtaining the decryption result, i.e., metadata information.

[0089] Step D3: Obtain the third encrypted information that meets the preset route decryption conditions.

[0090] The third encrypted information is one of multiple first encrypted information.

[0091] The client module obtains the preset routing decryption conditions, determines the first encrypted information that meets the preset routing decryption conditions among multiple first encrypted information, and identifies the first encrypted information that meets the preset routing decryption conditions as the third encrypted information. The preset routing decryption conditions are pre-set conditions used to determine the first decrypted information that needs to be decrypted among multiple first encrypted information.

[0092] Specifically, the preset route decryption conditions are preset according to the actual situation. They can be to determine the third encrypted information from multiple first encrypted information according to the preset first order, or to determine the third encrypted information according to the decryption instruction after receiving the user's decryption instruction. The decryption instruction includes relevant information of the third encrypted information.

[0093] Step D4: Determine the first address and the second key based on the metadata information.

[0094] Wherein, the first address is the address information corresponding to the third encrypted information, and the second key is the key in the metadata information corresponding to the first address.

[0095] After determining the third encrypted information, the client module can determine the first address and the second key corresponding to the third encrypted information through the metadata information. The first address is not only the address information of the third encrypted information, but also the address information of the route merging information (which is encrypted to obtain the third encrypted information) corresponding to the third encrypted information. The second key is the key corresponding to the third encrypted information (the route merging information is encrypted based on the second key to obtain the third encrypted information).

[0096] Step D5: Decrypt the third encrypted information based on the first address and the second key.

[0097] After determining the first address and the second key, the client module can determine the address of the third encrypted information based on the first address, and then decrypt the third encrypted information based on the second key. After obtaining the route merging information corresponding to the decrypted third encrypted information, the client module can perform corresponding operations based on the route merging information.

[0098] Specifically, the dynamic encryption and decryption process of data is divided into four stages: metadata loading, decryption information acquisition, code block decryption, and loading execution. It mainly relies on the analyzer, decryptor, and loader in the client process. The main steps are as follows: (1) Metadata loading: Obtain the second encrypted information and decrypt it based on the second decryption private key to obtain the metadata information; (2) Decryption information acquisition: Obtain the third encrypted information that meets the preset route decryption conditions, and obtain the first address and second key corresponding to the third encrypted information; (3) Code block decryption: The decryptor obtains the first address and second key, loads the corresponding code block file, and converts it into ArrayBuffer format for decryption operation. The decryption key and a predefined symmetric decryption algorithm (SM4 or AES) are used to decrypt the corresponding code block file. After the decryption operation is completed, it is converted into a readable file format and passed to the loader for processing; (4) Loading execution: The loader loads the code block into memory for execution. Since the content of the file obtained after decryption is in plain text form, it is converted into a Blob object for subsequent loading. Loading is accomplished by creating a new DOM element or directly inserting HTML, while listening for its lifecycle events. Once the component is unloaded, the code block is destroyed from memory.

[0099] This application embodiment obtains third encrypted information that meets the preset routing decryption conditions, and decrypts it according to the corresponding first address and second key, thereby preventing the entire code file from being decrypted at once and increasing the difficulty of obtaining the source code.

[0100] In one implementation, obtaining the third encrypted information that satisfies the preset route decryption conditions (step D3) can be achieved by executing steps E1-E2: Step E1: After detecting the routing switch action of the first user, obtain the second address.

[0101] The second address is the address information of the routing information switched by the first user.

[0102] The client module can detect the actions performed by the first user in the client. When the first user's action is a route switching action, it obtains the second address, which is the address information of the route information switched by the first user.

[0103] The client module can perform metadata query when the first user switches routes in the client application. The specific process is as follows: (1) Route change listening: The analyzer injects a listening method into the main process to listen for route change events. When the user switches routes in the application, the listening event is triggered, and the route address to be switched by the user is intercepted; (2) Metadata mapping lookup: The analyzer uses the intercepted route address to query the metadata information list, uses the route address to match the corresponding metadata information, and passes the decryption key and code block file address to the decryptor.

[0104] Step E2: Determine the first encrypted information corresponding to the second address as the third encrypted information.

[0105] When the server encrypts the route merging information, the address information of the route merging information is the same as the address information of the first encrypted information obtained after encryption. Therefore, the client module can determine the address information of the route information to be switched as the address information of the encrypted information to be decrypted. The client module determines the first encrypted information in the address based on the second address, and determines the determined first encrypted information as the third encrypted information to complete the decryption operation of the third encrypted information.

[0106] Specifically, when a user accesses a certain routing address (such as / about), the analyzer intercepts that the user wants to access the routing address / about; then it reads the information of the routing address / about in the metadata information file (such as path: " / about", name: "About", file: "About.js", desc: "About", key: b), and passes the obtained metadata information content to the decryptor; the decryptor reads the corresponding code block file About.js, decrypts the code block file using the key b, and passes the file content to the loader; the loader loads the code block file content into memory and renders it on the user interface.

[0107] Figure 4 It is a swimlane diagram of a client source code encryption and decryption method provided by an embodiment of this specification, as Figure 4 shown, this diagram includes: Step 4.1: The server module obtains multiple routing component information in the client source code to be encrypted, and merges the routing component information that meets the preset information merging rules to obtain multiple routing merge information.

[0108] Step 4.2: The server module encrypts each routing merge information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information.

[0109] Among them, different said routing merge information corresponds to different said first keys.

[0110] Step 4.3: The server module sends multiple first encrypted information to the client module.

[0111] Step 4.4: The client module obtains the device attribute information of the first client, and generates a second key pair based on the device attribute information.

[0112] Among them, the first client is the client to be encrypted with the source code.

[0113] Step 4.5: The client module sends the second encryption public key in the second key pair to the server module.

[0114] Step 4.6: The server module determines metadata information based on the address information of multiple said first encrypted information and multiple said first keys.

[0115] Step 4.7: The server module encrypts the metadata information based on the second encryption public key in the second key pair to obtain second encrypted information.

[0116] Among them, the second encrypted information is obtained by encrypting the metadata information based on the second encryption public key in the second key pair.

[0117] Step 4.8: The server module sends the second encrypted information to the client module.

[0118] Step 4.9: The client module decrypts the first encrypted information based on the second decryption private key in the second key pair to obtain the metadata information.

[0119] Step 4.10: After the client module detects the routing switch action of the first user, it obtains the second address.

[0120] The second address is the address information of the routing information switched by the first user.

[0121] Step 4.11: The client module determines the second key corresponding to the second address based on the metadata information, so as to decrypt the first encrypted information corresponding to the second address.

[0122] In the embodiment of the specification, after detecting the routing switching action of the first user, the second address is obtained, thereby determining the key and first encrypted information corresponding to the second address. Then, the first encrypted information is decrypted according to the key. In this way, when the user switches routes, only the corresponding encrypted routing information is decrypted. This not only prevents the entire code file from being decrypted at once, which increases the difficulty of obtaining the source code, but also enables decryption on demand, effectively protecting the source code of the client software.

[0123] It should be noted that the client source code encryption method provided in this application embodiment can be executed by a client source code encryption device, or a control module within that client source code encryption device for executing the client source code encryption method. This application embodiment uses the execution of the client source code encryption method by a client source code encryption device as an example to illustrate the client source code encryption device provided in this application embodiment.

[0124] Figure 5 This is a schematic diagram of the structure of a client-side source code encryption device according to an embodiment of the present invention. Figure 5 The client source code encryption device shown includes: a first acquisition module 502, a first encryption module 504, a second acquisition module 506, and a second encryption module 508.

[0125] The first acquisition module 502 is used to acquire multiple routing component information from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple route merge information.

[0126] The first encryption module 504 is used to encrypt each of the route merging information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, wherein different route merging information corresponds to different first keys.

[0127] The second acquisition module 506 is used to acquire device attribute information of the first client and generate a second key pair based on the device attribute information, wherein the first client is the client to be encrypted from source code.

[0128] The second encryption module 508 is used to determine metadata information based on the address information of multiple first encryption information and multiple first encryption keys, and to encrypt the metadata information based on the second encryption public key in the second key pair.

[0129] The client source code encryption device in this application embodiment can be a device, or it can be a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0130] The client source code encryption device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0131] The client source code encryption device provided in this application embodiment can achieve... Figures 1 to 4 The various processes implemented in the method embodiments are not described in detail here to avoid repetition.

[0132] Based on the same technical concept, embodiments of this application also provide an electronic device for executing the aforementioned client source code encryption method. Figure 6This is a schematic diagram of the structure of an electronic device to implement various embodiments of this application. The electronic device can vary significantly due to differences in configuration or performance, and may include a processor 602, a communications interface 604, a memory 606, and a communication bus 608. The processor 602, communications interface 604, and memory 606 communicate with each other via the communication bus 608. The processor 602 can call a computer program stored in the memory 606 and executable on the processor 602 to perform the following steps: Obtain information on multiple routing components from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple merged routing information. Each of the route merging information is encrypted based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, and different route merging information corresponds to different first keys; Obtain the device attribute information of the first client and generate a second key pair based on the device attribute information. The first client is the client to be encrypted from source code. Metadata information is determined based on the address information of multiple first encrypted information and multiple first keys, and the metadata information is encrypted based on the second encryption public key in the second key pair.

[0133] In one implementation, obtaining information about multiple routing components in the client source code to be encrypted includes: The client source code is subjected to code obfuscation and code compression to obtain the processed first source code. The code obfuscation includes one or more of the following: variable name replacement, control flow flattening, and string encryption. The code compression includes one or more of the following: whitespace removal, comment removal, and syntax simplification. Determine the information of the multiple routing components included in the first source code.

[0134] In one implementation, the routing component information that satisfies a preset information merging rule is merged to obtain multiple routing merge information, including: Multiple first routing information are obtained, and a first reference relationship is determined for each of the first routing information. The first routing information is any of the routing component information, and the first reference relationship is used to characterize the routing component information that has a reference relationship with the first routing information. Based on multiple first reference relationships, a first abstract syntax tree obtained by merging multiple routing component information is determined by a traversal algorithm; The routing component information included in the first abstract syntax tree is merged to obtain the routing merge information.

[0135] In one implementation, determining the first abstract syntax tree obtained by merging the routing component information based on multiple first reference relationships using a traversal algorithm includes: Based on multiple first reference relationships, the first node of the first abstract syntax tree is determined, and the first node is the starting node of the first abstract syntax tree; Based on the routing component information that has a reference relationship with the second routing information, multiple second nodes are determined, where the second routing information is the routing component information corresponding to the first node, and the second node is the next node of the first node; Based on the first reference relationship, a first reference frequency is determined for each second node, and the first reference frequency is used to characterize the frequency of reference of the routing component information corresponding to the second node; Based on the first reference frequency, the traversal order corresponding to the multiple second nodes is determined, so as to perform traversal operations on the multiple second nodes based on the traversal order.

[0136] In one implementation, the method further includes: Obtain second encrypted information, which is obtained by encrypting the metadata information based on the second public key in the second key pair; The first encrypted information is decrypted based on the second decryption private key in the second key pair to obtain the metadata information; Obtain third encrypted information that meets the preset route decryption conditions, wherein the third encrypted information is one of multiple first encrypted information; A first address and a second key are determined based on the metadata information, wherein the first address is the address information corresponding to the third encrypted information, and the second key is the key in the metadata information corresponding to the first address; The third encrypted information is decrypted based on the first address and the second key.

[0137] In one implementation, obtaining the third encrypted information that satisfies the preset route decryption conditions includes: After detecting the routing switch action of the first user, obtain the second address, which is the address information of the routing information switched by the first user; The first encrypted information corresponding to the second address is determined as the third encrypted information.

[0138] The specific execution steps can be found in the various steps of the above-described client source code encryption method embodiment, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0139] It should be noted that the electronic devices in the embodiments of this application include: servers, terminals, or other devices besides terminals.

[0140] The above electronic device structure does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or arrange them differently. For example, an input unit may include a Graphics Processing Unit (GPU) and a microphone, and a display unit may use a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar display panels. User input units include at least one of a touch panel and other input devices. A touch panel is also called a touchscreen. Other input devices may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be elaborated further here.

[0141] Memory can be used to store software programs and various data. Memory can primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, memory can include volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0142] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly handles operations related to the operating system, user interface, and applications, while the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor.

[0143] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described client source code encryption method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0144] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0145] This application also provides a computer program product. When the computer program product is executed by a processor, it implements the various processes of the above-described client source code encryption method embodiment and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0146] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described client source code encryption method embodiment and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0147] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0148] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0149] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0150] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A client-side source code encryption method, characterized in that, include: Obtain information on multiple routing components from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple merged routing information. Each of the route merging information is encrypted based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, and different route merging information corresponds to different first keys; Obtain the device attribute information of the first client and generate a second key pair based on the device attribute information. The first client is the client to be encrypted from source code. Metadata information is determined based on the address information of multiple first encrypted information and multiple first keys, and the metadata information is encrypted based on the second encryption public key in the second key pair.

2. The method according to claim 1, characterized in that, The process of obtaining information about multiple routing components in the client source code to be encrypted includes: The client source code is subjected to code obfuscation and code compression to obtain the processed first source code. The code obfuscation includes one or more of the following: variable name replacement, control flow flattening, and string encryption. The code compression includes one or more of the following: whitespace removal, comment removal, and syntax simplification. Determine the information of the multiple routing components included in the first source code.

3. The method according to claim 1, characterized in that, The routing component information that meets the preset information merging rules is merged to obtain multiple route merging information, including: Multiple first routing information are obtained, and a first reference relationship is determined for each of the first routing information. The first routing information is any of the routing component information, and the first reference relationship is used to characterize the routing component information that has a reference relationship with the first routing information. Based on multiple first reference relationships, a first abstract syntax tree obtained by merging multiple routing component information is determined by a traversal algorithm; The routing component information included in the first abstract syntax tree is merged to obtain the routing merge information.

4. The method according to claim 3, characterized in that, The step of determining the first abstract syntax tree, obtained by merging the information of multiple routing components, based on multiple first reference relationships and through a traversal algorithm, includes: Based on multiple first reference relationships, the first node of the first abstract syntax tree is determined, and the first node is the starting node of the first abstract syntax tree; Based on the routing component information that has a reference relationship with the second routing information, multiple second nodes are determined, where the second routing information is the routing component information corresponding to the first node, and the second node is the next node of the first node; Based on the first reference relationship, a first reference frequency is determined for each second node, and the first reference frequency is used to characterize the frequency of reference of the routing component information corresponding to the second node; Based on the first reference frequency, the traversal order corresponding to the multiple second nodes is determined, so as to perform traversal operations on the multiple second nodes based on the traversal order.

5. The method according to claim 1, characterized in that, The method further includes: Obtain second encrypted information, which is obtained by encrypting the metadata information based on the second public key in the second key pair; The first encrypted information is decrypted based on the second decryption private key in the second key pair to obtain the metadata information; Obtain third encrypted information that meets the preset route decryption conditions, wherein the third encrypted information is one of multiple first encrypted information; A first address and a second key are determined based on the metadata information, wherein the first address is the address information corresponding to the third encrypted information, and the second key is the key in the metadata information corresponding to the first address; The third encrypted information is decrypted based on the first address and the second key.

6. The method according to claim 5, characterized in that, The step of obtaining the third encrypted information that satisfies the preset route decryption conditions includes: After detecting the routing switch action of the first user, obtain the second address, which is the address information of the routing information switched by the first user; The first encrypted information corresponding to the second address is determined as the third encrypted information.

7. A client-side source code encryption device, characterized in that, include: The first acquisition module is used to acquire multiple routing component information from the client source code to be encrypted, and merge the routing component information that meets the preset information merging rules to obtain multiple route merge information; The first encryption module is used to encrypt each of the route merging information based on a preset symmetric encryption algorithm and multiple first keys to obtain multiple first encrypted information, wherein different route merging information corresponds to different first keys; The second acquisition module is used to acquire device attribute information of the first client and generate a second key pair based on the device attribute information, wherein the first client is the client to be encrypted from source code. The second encryption module is used to determine metadata information based on the address information of multiple first encryption information and multiple first encryption keys, and to encrypt the metadata information based on the second encryption public key in the second key pair.

8. A computer device, characterized in that, The device includes: Processor; and A memory configured to store computer-executable instructions configured to be executed by the processor, the executable instructions including steps for performing the client source code encryption method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is used to store computer-executable instructions that cause the computer to execute the client source code encryption method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the client source code encryption method according to any one of claims 1 to 6.

Images