Code migration method and device, electronic equipment and storage medium

Abstract

The embodiment of the application belongs to the field of cryptography, and relates to a code migration method and device, an electronic device and a storage medium. When code related to protected password operations in the source code of a password application program needs to be migrated to a target secure running environment, the method automatically identifies the code related to the protected password operations in the source code through an intelligent agent, and converts the code into a programming language supported by the target environment. Subsequently, the converted code is compiled, function consistency is verified, and compatibility is adjusted to generate final code highly adapted to the target environment and complete deployment. The application realizes full-process automation from password operation identification, code conversion, verification to deployment, significantly improves the accuracy and efficiency of password application migration, reduces the technical threshold and labor cost of manual modification, and ensures the function consistency, environment compatibility and running safety of the code after migration, thereby guaranteeing the safety, continuity and reliability of the password service.

Description

Technical Field

[0001] This application relates to the field of cryptography, and in particular to a method, apparatus, electronic device, and storage medium for code migration. Background Technology

[0002] In business sectors with high data security requirements, such as finance, cryptographic techniques are typically used to protect business data and interaction processes to ensure the confidentiality, integrity, and availability of information. Currently, business systems generally employ open-source cryptographic algorithm libraries to implement encryption / decryption, signature verification, hash calculations, and other cryptographic functions when performing operations involving protected business processes.

[0003] However, open-source cryptographic algorithm libraries, due to their open development process, complex implementation mechanisms, and lack of unified security audits, often suffer from problems such as difficulty in ensuring security and uncontrollable implementation, making it difficult to meet the compliance requirements of national or industry information security standards for cryptographic modules.

[0004] To meet the aforementioned security requirements, existing technologies typically rely on technical personnel to manually modify business systems, migrating their cryptographic algorithm implementations to dedicated cryptographic modules that conform to security standards. While this approach can improve system security, it suffers from problems such as long technical modification cycles, high manual labor input, low migration efficiency, and high maintenance costs, making it difficult to meet the security modification needs of large-scale systems.

[0005] Therefore, there is an urgent need to provide an efficient solution for migrating cryptographic applications to automate the migration of cryptographic functions from open-source algorithm libraries to secure and compliant cryptographic modules, thereby reducing manual input and improving the overall maintainability and reliability of the system while ensuring security. Summary of the Invention

[0006] This application provides a code migration method, apparatus, electronic device, and storage medium that can efficiently migrate cryptographic applications.

[0007] In a first aspect, embodiments of this application provide a code migration method, the method comprising:

[0008] Obtain the source code corresponding to the password application; the password application contains password operations that need to be protected;

[0009] The code recognition agent outputs the first code in the source code that corresponds to the protected password operation;

[0010] The code-converting agent performs programming language conversion on the first code and outputs the second code; the second code is written in a programming language supported by the target secure operating environment.

[0011] The second code is input into the compilation and verification agent, which then performs compilation, functional consistency verification, and compatibility adjustment on the second code to obtain a third code adapted to the target secure operating environment. The functional consistency verification verifies the consistency between the functionality of the compiled second code and the functionality of the first code. The compatibility adjustment process adjusts the functionally consistent compiled second code according to the type of the target secure operating environment. When compilation fails or functional consistency verification fails, the compilation and verification agent checks and corrects the errors until the third code is obtained.

[0012] The first code in the source code is migrated to the target secure operating environment in the form of the third code.

[0013] Secondly, embodiments of this application provide a code migration apparatus, the apparatus comprising:

[0014] The acquisition module is used to acquire the source code corresponding to the password application; the password application contains password operations that need to be protected.

[0015] The code recognition module is used to output the first code in the source code corresponding to the password operation to be protected through the code recognition agent;

[0016] The language conversion module is used to convert the first code into a programming language through a code conversion agent and output the second code; the second code is written in a programming language supported by the target secure operating environment.

[0017] An adaptation processing module is used to input the second code into a compilation and verification agent, so that the compilation and verification agent performs compilation processing, functional consistency verification, and compatibility adjustment processing on the second code to obtain third code adapted to the target secure operating environment; wherein, the functional consistency verification refers to verifying the consistency between the function of the compiled second code and the function of the first code; the compatibility adjustment processing refers to adjusting the compatibility of the compiled second code with consistent function according to the type of the target secure operating environment; when the compilation and verification agent encounters errors such as compilation failure or failure of functional consistency verification, it checks and corrects the errors until the third code is obtained;

[0018] The code migration module is used to migrate the first code in the source code to the target secure operating environment in the form of the third code.

[0019] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor performs the method described in the first aspect.

[0020] Fourthly, embodiments of this application provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the method described in the first aspect.

[0021] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, which, when executed by a processor, can implement the method described in the first aspect.

[0022] In the code migration scheme provided in this application embodiment, when it is necessary to migrate the protected cryptographic operation-related code from the source code of the cryptographic application to the target secure operating environment, an intelligent agent accurately identifies the protected cryptographic operation code in the source code and converts it into a programming language supported by the target secure operating environment. Subsequently, the intelligent agent performs compilation, functional consistency verification, and compatibility adjustment on the converted code to obtain code highly adapted to the target secure operating environment, thereby deploying the adapted code in the target secure operating environment. This method automates the entire process from protected cryptographic operation identification, code conversion, verification to deployment, significantly improving the accuracy and efficiency of code migration, reducing technical barriers and labor costs, while ensuring the functional consistency, environmental compatibility, and operational security of the migrated code, thus guaranteeing the continuity and reliability of cryptographic services. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating a code migration method provided in an embodiment of this application;

[0025] Figure 2 A schematic diagram of the structure of a code migration device provided in an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this embodiment. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. In addition, the timing of the steps in the following method embodiments is only an example and not a strict limitation.

[0028] It should be noted that, in the cases involving user information in the embodiments of this application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to large language models or other models) comply with relevant laws and standards.

[0029] First, the terms or concepts involved in the embodiments of this application will be explained:

[0030] A Trusted Execution Environment (TEE) is a secure, isolated area implemented through a combination of hardware and software, designed to protect sensitive data and critical operations from external attacks. Its core functions include data isolation, computational isolation, communication control, and error isolation, ensuring that even if the main operating system is compromised, the data and code within the TEE remain confidential and intact.

[0031] A cryptographic module, in the field of information security, refers to the core component that implements cryptographic algorithms and services. It serves as the fundamental carrier for ensuring data confidentiality, integrity, authentication, and non-repudiation; in other words, it provides a secure operating environment for cryptographic applications. It is widely used in various scenarios such as computers, servers, smart terminals, IoT devices, and financial POS machines. Through standardized interfaces, it provides core functions such as encryption, decryption, signing, signature verification, and key management, ensuring data security during storage and transmission. The core value of a cryptographic module lies in encapsulating complex cryptographic algorithms (such as symmetric encryption, asymmetric encryption, and hash algorithms) into callable services, avoiding developers' repeated implementation of algorithms (reducing security risks), and providing standardized key management mechanisms. For example, a cryptographic module can be a module or device that provides a standard Secure Device Function (SDF) interface to the outside world, or it can refer to a component that provides a trusted execution environment.

[0032] Cryptographic modules are widely used in various industries, including finance, to ensure business security. These modules must be deployed in accordance with certain information security requirements, such as the national standard GB / T 39786 "Information Security Technology - Basic Requirements for Cryptographic Applications in Information Systems". Furthermore, the core financial system (Level 3+) must meet the Level 3 standard of GM / T 0054-2018 "Basic Requirements for Cryptographic Applications in Information Systems", and the accompanying cryptographic modules must pass Level 2 or higher certification of GM / T 0028-2024 "Security Requirements for Cryptographic Modules". This means that cryptographic modules need to be deployed in a secure operating environment, including external cryptographic devices.

[0033] Currently, considering factors such as cost and convenience, most cryptographic applications use open-source cryptographic algorithm libraries. However, these open-source cryptographic algorithm libraries can no longer meet current information security requirements.

[0034] To meet information security requirements, cryptographic applications can be migrated to cryptographic modules. Currently, this mainly relies on technicians manually migrating cryptographic applications from the codebase to the cryptographic modules, which requires a significant technical investment.

[0035] Therefore, this application provides a code migration method. When it is necessary to migrate the protected cryptographic operation-related code from the source code of a cryptographic application to a target secure operating environment, an intelligent agent is used to identify and convert the protected cryptographic operation code in the source code, and then convert it into a programming language supported by the target environment. Subsequently, the converted code is compiled, its functional consistency is verified, and its compatibility is adjusted to generate highly adapted final code, which is then deployed. This method automates the entire process from the identification of protected cryptographic operations, code conversion, verification to deployment. It not only significantly improves the accuracy and efficiency of code migration and reduces the technical threshold and labor costs, but also ensures the functional consistency, environmental compatibility, and operational security of the migrated code, thereby guaranteeing the continuity and reliability of cryptographic services.

[0036] The execution process of the code migration method provided in this application embodiment is described in detail below with reference to the accompanying drawings. Optionally, the code migration method is executed by a computer, server, etc. The code recognition agent, code conversion agent, and compilation and verification agent involved in this embodiment can be the same agent or different agents, and this application does not limit this.

[0037] Figure 1 A flowchart of a code migration method provided in an embodiment of this application is shown below. Figure 1 As shown, the method includes the following steps:

[0038] 101. Obtain the source code of the password application; the password application contains password operations that need to be protected.

[0039] 102. Identify the first code in the source code of the intelligent agent that corresponds to the password operation that needs to be protected by code recognition.

[0040] 103. The code-converting agent converts the first code into a programming language and outputs the second code; the second code is written in a programming language supported by the target secure operating environment.

[0041] 104. Input the second code into the compilation and verification agent so that the agent can perform compilation processing, functional consistency verification, and compatibility adjustment processing on the second code to obtain a third code that is compatible with the target secure operating environment. Among them, functional consistency verification refers to verifying the consistency of the function of the compiled second code with the function of the first code; compatibility adjustment processing refers to adjusting the compatibility of the compiled second code with consistent function according to the type of the target secure operating environment; when compilation failure or functional consistency verification failure occurs, the compilation and verification agent checks and corrects the error until the third code is obtained.

[0042] 105. Migrate the first code in the source code to the target secure operating environment as the third code.

[0043] In practical applications, a cryptographic application refers to a program involving cryptographic algorithms. Protected cryptographic operations are those related to the private key and symmetric key, and whose key information cannot be exposed. Typically, when storing the source code of a cryptographic application, protected cryptographic operation code and non-protected cryptographic operation code (unprotected cryptographic operation code and business logic code) are organized together. Therefore, during code migration, the first step is to identify the primary code corresponding to the protected cryptographic operations from the source code. In this application, the primary code may also be referred to as the protected cryptographic operation code.

[0044] Optionally, cryptographic operations may include, but are not limited to: generating symmetric keys, generating key pairs, generating P10, symmetric encryption, symmetric decryption, digital signature operations (attached signature, detached signature, raw signature), digital signature verification operations (attached verification, detached verification, raw verification), creating digital envelopes, decrypting digital envelopes, creating signed digital envelopes, decrypting signed digital envelopes, message digest operations, and hash-based message authentication code (HMAC) operations.

[0045] Furthermore, the cryptographic operations requiring protection may include, but are not limited to, symmetric key operations and asymmetric private key operations. Symmetric key operations may include, but are not limited to, symmetric encryption operations, symmetric decryption operations, and HMAC operations. Asymmetric private key operations may include, but are not limited to, generating asymmetric key pairs, generating P10 operations, attaching signature operations, detaching signature operations, raw signature operations, decrypting digital envelope operations, and decrypting signed digital envelope operations.

[0046] In an alternative embodiment, the code recognition agent can determine the code corresponding to the cryptographic operation that needs to be protected through semantic analysis and / or data stream tracing.

[0047] Typically, the programming language used to write the source code differs from the programming language supported by the target secure operating environment. For example, the source code is often written in Java, while the target secure operating environment supports C. To migrate the cryptographic operation code from the source code to the target secure operating environment, a programming language conversion is required to adapt it. Therefore, after identifying the first code corresponding to the cryptographic operation that needs protection, a code conversion agent performs a programming language conversion on the first code, outputting the second code.

[0048] The target secure operating environment refers to the environment in which the code program corresponding to the protected cryptographic operations can run securely. For example, the target secure operating environment can be the operating environment of an external cryptographic device or a cryptographic module. Cryptographic devices or modules typically provide a Secure Device Function Interface (SDF). The supported programming language is usually C. Alternatively, the target secure operating environment can be a TEE (Trusted Execution Environment). Its supported programming language is also usually C.

[0049] Optionally, regarding the method for determining the target secure operating environment, one possible implementation is to determine it through information input by the user. For example, the information of the target secure operating environment could be the name of the target secure operating environment. Another possible implementation is to determine it by checking the operating environment of the device currently performing the code migration; that is, the operating environment of the device currently performing the code migration is the target secure operating environment.

[0050] Furthermore, if the programming language of the source code is the same as the programming language of the code supported by the target secure operating environment, then programming language conversion can be skipped and step 104 can be executed directly.

[0051] After the code is converted to a programming language, it needs to be compiled and deployed. Therefore, after obtaining the second code in a programming language supported by the target secure operating environment, the second code is input into the compilation and verification agent, which then performs compilation processing, functional consistency verification, and compatibility adjustment on the second code to obtain the third code adapted to the target secure operating environment.

[0052] The compilation process refers to the conversion of the second code into machine language. If compilation is successful, functional consistency verification continues. If a compilation error occurs, the compilation verification agent checks and corrects the error until compilation succeeds.

[0053] Functional consistency verification refers to verifying the consistency between the functionality of the compiled second code and the functionality of the first code. If the functional consistency verification passes, compatibility adjustments continue. If an error occurs during functional consistency verification, the compilation and verification agent checks and corrects the error until the functional consistency verification passes.

[0054] Among them, compatibility adjustment processing refers to adjusting the compatibility of the compiled second code with consistent verification functions according to the type of the target secure operating environment.

[0055] Optionally, the target secure operating environment includes a trusted execution environment. Trusted execution environments can be of two types: process-based and virtual machine-based.

[0056] Compatibility adjustments include: if the target secure runtime environment is a process-based Trusted Execution Environment (TEE), adaptations are needed to suit the characteristics of this restricted environment (e.g., restricted system call mechanisms, specific memory management methods, etc.). One possible implementation is to replace the system call interfaces in the verified functionally consistent compiled second code with interfaces corresponding to the TEE, ensuring the code's executableness and functional consistency within the restricted environment. For example, standard C library (libc) calls can be replaced with TEE-specific interface calls (e.g., the TEEC_InvokeCommand call in the ARMTrustZone environment). Another possible implementation involves dependency trimming of the verified functionally consistent compiled second code to reduce dependencies on incompatible libraries. For example, libraries that cannot run within the TEE (such as multithreading libraries) can be removed, and their functionality implemented with lightweight alternatives, ensuring the generated target code can run securely and stably in the TEE.

[0057] If the target secure operating environment is a trusted execution environment based on a virtual machine, it is usually compatible with the standard library and no compatibility adjustments are required.

[0058] Next, the third code is deployed to the target secure operating environment, the first code is deleted from the source code, and all calls and dependencies to the first code in the source code are updated to point to the newly deployed third code, thus completing the code migration.

[0059] The method provided in this embodiment, when migrating protected cryptographic operation-related code from the source code of a cryptographic application to a target secure operating environment, accurately identifies the protected cryptographic operation code in the source code through an intelligent agent and converts it into a programming language supported by the target secure operating environment. Subsequently, the intelligent agent performs compilation, functional consistency verification, and compatibility adjustments on the converted code to obtain code highly adapted to the target secure operating environment, which is then deployed. This method automates the entire process from cryptographic operation identification, code conversion, verification to deployment, significantly improving the accuracy and efficiency of code migration, reducing technical barriers and labor costs, and ensuring the functional consistency, functional integrity, environmental compatibility, and operational security of the migrated code, thereby guaranteeing the continuity and reliability of cryptographic services.

[0060] In some scenarios, the accuracy of an agent's output depends not only on the agent's reasoning ability but also on the accuracy of the prompts. In cryptography, more explicit prompts can be used to improve the accuracy of the agent's responses.

[0061] In an optional embodiment, one implementation of step 102 is as follows: The source code is input to the code recognition agent, and the first prompt words are sequentially input to the code recognition agent according to the order of the first prompt words in the first prompt word set, so that the code recognition agent outputs the first code. The first prompt words in the first prompt word set are used to sequentially instruct the code recognition agent to output at least one of the following information:

[0062] Does the source code contain any cryptographic-related operations?

[0063] The operation types of cryptographic-related operations in the source code.

[0064] The code in the source code that relates to password operations that require protection.

[0065] Furthermore, if the code recognition agent responds negatively after any first prompt word is input, it indicates that the source code detected by the agent involves unprotected password operations. One possible implementation is to terminate the dialogue with the code recognition agent. Another possible implementation, to avoid errors in the agent's judgment, allows the input of the next first prompt word.

[0066] For example, the first prompt word set contains first prompt word 1, first prompt word 2, and first prompt word 3. Inputting first prompt word 1, first prompt word 2, and first prompt word 3 into the code recognition agent can be done in the following dialogue format:

[0067] - First prompt 1: Does this method use or implement any operations related to [cryptography]? Please answer "yes" or "no". Specifically, cryptography includes [key generation, encryption, signature, hash, etc.].

[0068] - Code recognition agent's response 1: Yes or No.

[0069] - First hint 2: What type of cryptographic operation does this method involve?

[0070] - Answer 2 regarding code-based intelligent agents: [encryption, signature, etc.]. Or: Sorry, the previous answer was incorrect.

[0071] - First prompt word 3: List statements related to [encryption, verification, etc.].

[0072] - Answer 3 for code recognition agent: [encryption: [code 1,...], signature: [code 2,code 3], ...]. Or: Sorry, the previous answer was incorrect.

[0073] During the dialogue with the code recognition agent, if the agent responds negatively at any point, the dialogue ends. For example, if the agent's response 1 is "no," the dialogue ends. However, if the agent responds negatively, the next prompt word can still be entered. For example, if the agent's response 1 is "no," the next prompt word can be entered. If the agent's response 2 is "This method does not involve password operations," the dialogue ends.

[0074] In this embodiment, within the field of cryptography, a progressive prompting strategy is employed to accurately identify protected cryptographic operations in source code. Through multiple rounds of dialogue, the code recognition agent is guided step-by-step to complete the analysis. This simplifies the process by systematically breaking down the code recognition task, significantly improving recognition accuracy, reducing the risk of false positives, and enhancing the controllability and reliability of the entire analysis process.

[0075] In an optional embodiment, one implementation of step 103 is as follows: inputting the first code into the code-converting agent, and sequentially inputting the second prompt words from the second prompt word set into the code-converting agent, so that the code-converting agent outputs the second code. The last second prompt word in the second prompt word set is used to instruct the code-converting agent to perform few-sample learning based on at least one code-converting example to convert the first code into the second code.

[0076] Furthermore, the second prompt words in the second prompt word set, excluding the last one, are used to sequentially instruct the code-transforming agent to output at least one of the following information:

[0077] The function of the first code;

[0078] The first code uses an open-source cryptographic algorithm library;

[0079] The user is prompted to enter the name of the target secure operating environment.

[0080] For example, the second set of prompt words contains second prompt word 1, second prompt word 2, and second prompt word 3. Inputting first prompt word 1, first prompt word 2, and first prompt word 3 into the code-transfer agent can be done in the following dialogue format:

[0081] -Second prompt 1: As a cryptographic algorithm expert, please analyze and state the goal of this method?

[0082] - Response 1 to the code-transformation agent: Explain the function's purpose, for example: The goal of this method is to sign a message using an SM2 private key and return the signature value.

[0083] -Second prompt 2: Does this method use an open-source cryptographic algorithm library?

[0084] -Response 2 to the code-transformation agent: Yes or No

[0085] -Second prompt 3: If so, which open-source cryptographic algorithm library was called?

[0086] - Answer 3 to code-transformation agent: For example: BouncyCastle / Openssl / Tonsguo / VendorJCE…

[0087] -Response 4 of Code Transformation Agent: Prompt the user to input whether to change to calling TEE?

[0088] -Second prompt word 4: Yes

[0089] - Second prompt word 5: If using TEE, convert this code to C code. For example: {source code} → {C code}, with dependencies [A, B].

[0090] In this context, the method in the second prompt word 1 refers to the method of the first code. The second prompt word 1 sets the role for the code conversion agent, and the initial question is used to guide the agent to understand the functional goals of the code.

[0091] In this embodiment, within the field of cryptography, to accurately convert the first code into protected cryptographic operations within the target secure operating environment, a progressive prompting strategy is employed. Through multiple rounds of dialogue, the code-conversion agent is gradually guided to fully understand the code's functionality, thereby completing the programming language conversion. This systematic breakdown of the code-to-language conversion task improves the accuracy of the conversion.

[0092] In an optional embodiment, in step 104, the code can be optimized iteratively based on a reasoning-action (ReAct) process. Specifically:

[0093] Furthermore, in step 104, when the compilation verification agent encounters a compilation failure error, the error message is analyzed, the C code is adjusted (such as fixing syntax, type, or dependency issues), and then recompiled. Optionally, at least one of the following checks and corrective actions can be performed based on the compilation failure error message:

[0094] Perform dependency call checks and modify deprecated functions;

[0095] If the error message indicates that a method has not been imported, then remove the unimported method.

[0096] If the error message indicates an incorrect parameter type, then correct the parameter type.

[0097] Furthermore, in step 104, if the compilation and verification of the agent fails the functional consistency verification, it checks whether the input and output match, adjusts the logic or calling method, and ensures that the converted C code is consistent with the original function. Optionally, at least one of the following checks and corrections can be performed:

[0098] If it is determined that random numbers are introduced when implementing the function corresponding to the first code, then the verification function corresponding to the first code is called to verify the consistency of the function;

[0099] Determine the format of the plaintext and the consistency of the values ​​when performing functional consistency verification;

[0100] Determine the format and value consistency of the key used for functional consistency verification;

[0101] Determine whether the parameters used for functional consistency verification have been preprocessed.

[0102] For example, the following is an example of ReAct correction code for prompt words input into the compiler verification agent:

[0103] - Initial memory: Details about this code include: C code, [dependencies,...]

[0104] -System rules: You need to operate in a cycle of thinking, acting, and observing.

[0105] At the end of each loop, output an answer. Use "Thoughts" to describe your thoughts on the question.

[0106] The options for the ⟨Action> are limited to: [...]

[0107] -Task hint: Implement this code in C, keeping the same input and return types {C code}

[0108] -Thought 1: We need to ensure that all necessary dependencies are included in [...].

[0109] Action 1: Update dependencies ([md-5, rand,...]).

[0110] -Observation 1: Warning: The deprecated function 'base64::encode' was used: It is recommended to use Engine::encode[...] instead.

[0111] - Reflection 2: The error message indicates the presence of unused imports, missing methods, and [...];

[0112] I need to resolve these issues by removing unused imports [...].

[0113] Action 2: Code Modification ({Java code}).

[0114] -Observation 2: Error: Method 'xxx' of structure 'XXX' was not found in the current scope [...].

[0115] ...(after N iterations)...

[0116] -Observation N: Compilation successful; however, the input and output results of the SM2 signature test are inconsistent.

[0117] -Thinking about N+1: Since SM2 signatures introduce random numbers, inconsistent signature results cannot be used to determine that the verification failed;

[0118] We first use the SM2 signature verification function to verify the signature;

[0119] If it still fails, check if the plaintext and key formats and values ​​are consistent, because the signature only depends on the plaintext and key. Additionally,

[0120] - Action N+1: Call the SM2 signature verification function.

[0121] -Observation N+1: The test input and output results are still inconsistent;

[0122] -Consider N+2: The signature depends only on the plaintext and the key;

[0123] Check that the plaintext and key formats and values ​​are consistent;

[0124] - Action N+2: Plaintext and key formats and values ​​must be consistent;

[0125] -Observation N+2: The test input and output results are still inconsistent;

[0126] -Thinking about N+3: Most SM2 signature implementations in Java use plaintext as parameters, but C implementations (especially SDF implementations) require preprocessing of the plaintext to check for parameter errors;

[0127] - Action N+3: Modify the code to preprocess the plaintext before using it as input, recalculate the signature, and call the signature verification function to verify it;

[0128] -Observe N+3: Test if the input and output results are consistent, obtain the results and exit the task.

[0129] Figure 2 This is a schematic diagram of the structure of a code migration device provided in an embodiment of this application, as shown below. Figure 2 As shown, the device includes: an acquisition module 201, a code recognition module 202, a language conversion module 203, an adaptation processing module 204, and a code migration module 205.

[0130] Module 201 is used to obtain the source code corresponding to the password application; the password application contains password operations that need to be protected.

[0131] The code recognition module 202 is used to output the first code in the source code corresponding to the password operation that needs to be protected through the code recognition agent;

[0132] The language conversion module 203 is used to convert the first code into a programming language through a code conversion agent and output the second code; the second code is written in a programming language supported by the target secure operating environment.

[0133] The adaptation processing module 204 is used to input the second code into the compilation and verification agent, so that the compilation and verification agent can perform compilation processing, functional consistency verification, and compatibility adjustment processing on the second code to obtain third code that is adapted to the target secure operating environment. Among them, functional consistency verification refers to verifying the consistency between the function of the compiled second code and the function of the first code; compatibility adjustment processing refers to adjusting the compatibility of the compiled second code with verified functional consistency according to the type of the target secure operating environment; when compilation failure or functional consistency verification failure occurs, the compilation and verification agent checks and corrects the errors until the third code is obtained.

[0134] Code migration module 205 is used to migrate the first code in the source code to the target secure runtime environment in the form of third code.

[0135] In an optional embodiment, the adaptation processing module 204 is specifically used to: when the compilation verification agent encounters a compilation failure error, perform at least one of the following checks and correction processes based on the compilation failure error message:

[0136] Perform dependency call checks and modify deprecated functions;

[0137] If the error message indicates that a method has not been imported, then remove the unimported method.

[0138] If the error message indicates an incorrect parameter type, then correct the parameter type.

[0139] In an optional embodiment, the adaptation processing module 204 is specifically used to: perform at least one of the following checks and corrections if the compilation and verification agent fails the functional consistency verification:

[0140] If it is determined that random numbers are introduced when implementing the function corresponding to the first code, then the verification function corresponding to the first code is called to verify the consistency of the function;

[0141] Determine the format of the plaintext and the consistency of the values ​​when performing functional consistency verification;

[0142] Determine the format and value consistency of the key used for functional consistency verification;

[0143] Determine whether the parameters used for functional consistency verification have been preprocessed.

[0144] In an optional embodiment, the code recognition module 202 is specifically used for:

[0145] The source code is input into the code recognition agent, and the first prompt words are input into the code recognition agent in sequence according to the order of the first prompt words in the first prompt word set, so that the code recognition agent outputs the first code;

[0146] The first prompt word in the first prompt word set is used to sequentially instruct the code recognition agent to output at least one of the following information:

[0147] Does the source code contain any cryptographic operations?

[0148] The operation types of cryptographic-related operations in the source code;

[0149] The code in the source code that relates to password operations that require protection.

[0150] In an optional embodiment, the language conversion module 203 is specifically used for:

[0151] The first code is input into the code conversion agent, and the second prompt words from the second prompt word set are sequentially input into the code conversion agent so that the code conversion agent outputs the second code; the second prompt words contain at least one code conversion example supported by the target secure operating environment; the last second prompt word in the second prompt word set is used to instruct the code conversion agent to perform few-shot learning based on at least one code conversion example in order to convert the first code into the second code.

[0152] In an optional embodiment, the second prompt words in the second prompt word set, excluding the last second prompt word, are used to sequentially instruct the code-transforming agent to output at least one of the following information:

[0153] The function of the first code;

[0154] The first code uses an open-source cryptographic algorithm library;

[0155] The user is prompted to enter the name of the target secure operating environment.

[0156] In an optional embodiment, the target secure operating environment includes: a trusted execution environment; the type of trusted execution environment includes process type-based and virtual machine type-based; the compatibility adjustment process includes:

[0157] If the target secure operating environment is a process-based trusted execution environment, then the system call interfaces in the compiled second code with consistent verification functions will be replaced with the interfaces corresponding to the trusted execution environment, and / or dependency trimming will be performed on the compiled second code with consistent verification functions to obtain the target code.

[0158] Figure 2The device shown can perform the steps in the prompt word input method in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0159] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 3 As shown, in practice, this electronic device includes a memory 21 and a processor 22.

[0160] Memory 21 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device, data structures, contact data, phone book data, messages, pictures, videos, etc.

[0161] The processor 22, coupled to the memory 21, is used to execute a computer program in the memory 21 to implement the code migration method provided in the foregoing embodiments.

[0162] Furthermore, such as Figure 3 As shown, the electronic device also includes other components such as a communication component 23, a display 24, a power supply component 25, and an audio component 26. Figure 3 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 3 The components shown are as follows. The electronic device in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server device such as a conventional server, cloud server, or server array.

[0163] The aforementioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0164] The aforementioned communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel.

[0165] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0166] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0167] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0168] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile components, or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, digital video disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium.

[0169] Accordingly, this application also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above method embodiments. It should be understood that each step or combination of steps in the above method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above method embodiments.

[0170] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A code migration method, characterized in that, The method includes: Obtain the source code corresponding to the password application; the password application contains password operations that need to be protected; The code recognition agent outputs the first code in the source code corresponding to the password operation that needs to be protected; The code-converting agent converts the first code into a programming language and outputs the second code; the second code is written in a programming language supported by the target secure operating environment. The second code is input into the compilation and verification agent, which then performs compilation, functional consistency verification, and compatibility adjustment on the second code to obtain a third code adapted to the target secure operating environment. The functional consistency verification verifies the consistency between the functionality of the compiled second code and the functionality of the first code. The compatibility adjustment process adjusts the functionally consistent compiled second code according to the type of the target secure operating environment. When compilation fails or functional consistency verification fails, the compilation and verification agent checks and corrects the errors until the third code is obtained. The first code in the source code is migrated to the target secure operating environment in the form of the third code.

2. The method according to claim 1, characterized in that, When a compilation failure occurs, the compilation verification agent performs at least one of the following checks and corrective actions based on the error message: Perform dependency call checks and modify deprecated functions; If the error message indicates that a method has not been imported, then remove the unimported method; If the error message indicates that the parameter type is incorrect, then correct the parameter type.

3. The method according to claim 1, characterized in that, If the compilation and verification agent fails the functional consistency verification, it shall perform at least one of the following checks and corrective actions: If it is determined that random numbers are introduced when implementing the function corresponding to the first code, then the verification function corresponding to the first code is called to verify the consistency of the function; Determine the format of the plaintext and the consistency of the values ​​when performing functional consistency verification; Determine the format and value consistency of the key used for functional consistency verification; Determine whether the parameters used for functional consistency verification have been preprocessed.

4. The method according to any one of claims 1-3, characterized in that, The step of outputting the first code in the source code corresponding to the password operation to be protected through code recognition intelligent agent includes: The source code is input into the code recognition agent, and the first prompt words are sequentially input into the code recognition agent according to the order of the first prompt words in the first prompt word set, so that the code recognition agent outputs the first code; The first prompt word in the first prompt word set is used to sequentially instruct the code recognition agent to output at least one of the following information: Does the source code contain any cryptography-related operations? The operation type of the cryptographic-related operations in the source code; The source code contains code related to cryptographic operations that require protection.

5. The method according to any one of claims 1-3, characterized in that, The step of converting the first code into a programming language and outputting the second code through the code-converting agent includes: The first code is input to the code conversion agent, and the second prompt words from the second prompt word set are sequentially input to the code conversion agent so that the code conversion agent outputs the second code; the second prompt words contain at least one code conversion example supported by the target secure operating environment; the last second prompt word in the second prompt word set is used to instruct the code conversion agent to perform few-sample learning based on the at least one code conversion example to convert the first code into the second code.

6. The method according to claim 5, characterized in that, The second prompt words in the second prompt word set, excluding the last one, are used to sequentially instruct the code-transforming agent to output at least one of the following information: The function of the first code; The first code uses an open-source cryptographic algorithm library; The user is prompted to enter the name of the target secure operating environment.

7. The method according to any one of claims 1-3, characterized in that, The target secure operating environment includes: a trusted execution environment; the trusted execution environment type includes process-type-based and virtual machine-type-based types; the compatibility adjustment process includes: If the target secure operating environment is a process-based trusted execution environment, then the system call interface in the compiled second code with consistent verification functions is replaced with the interface corresponding to the trusted execution environment, and / or the dependency trimming is performed on the compiled second code with consistent verification functions to obtain the target code.

8. A code migration device, characterized in that, The device includes: The acquisition module is used to acquire the source code corresponding to the password application; the password application contains password operations that need to be protected. The code recognition module is used to output the first code in the source code corresponding to the password operation to be protected through the code recognition agent; The language conversion module is used to convert the first code into a programming language through a code conversion agent and output the second code; the second code is written in a programming language supported by the target secure operating environment. An adaptation processing module is used to input the second code into a compilation and verification agent, so that the compilation and verification agent performs compilation processing, functional consistency verification, and compatibility adjustment processing on the second code to obtain third code adapted to the target secure operating environment; wherein, the functional consistency verification refers to verifying the consistency between the function of the compiled second code and the function of the first code; the compatibility adjustment processing refers to adjusting the compatibility of the compiled second code with consistent function according to the type of the target secure operating environment; when the compilation and verification agent encounters errors such as compilation failure or failure of functional consistency verification, it checks and corrects the errors until the third code is obtained; The code migration module is used to migrate the first code in the source code to the target secure operating environment in the form of the third code.

9. An electronic device, characterized in that, include: The system includes a memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor performs the code migration method as described in any one of claims 1 to 7.

10. A non-transitory machine-readable storage medium, characterized in that, The non-transitory machine-readable storage medium stores executable code that, when executed by a processor of an electronic device, causes the processor to perform the code migration method as described in any one of claims 1 to 7.

Images