Software protection method and device based on encrypted signature technology and medium

Abstract

The invention relates to the field of data security, in particular to a software protection method and device based on an encrypted signature technology and a medium. According to the method, a hardware encryption method is adopted, a core code segment is transformed, encrypted and compressed, invalid interference instructions are added, and the reverse cracking difficulty is greatly improved. The target file is prevented from being counterfeited and tampered by adding the signature, a credible mechanism of the target file is added, and the security of the target file after shell adding is greatly improved. The structure of the target file is not changed after the shell is added, and the method does not need to change a program entry address, so that the shell program is well hidden. According to the method, the credibility of the packed software is ensured in a signature mode, and the security of the target file is protected and is prevented from being reversely cracked by introducing a hardware encryption method. After the software is packed based on the method, the packed program appears in the form of ciphertext, and the anti-cracking difficulty is improved to a great extent.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security, and in particular to a software protection method and device based on encryption signature technology and a medium. BACKGROUND

[0002] With the continuous advancement and comprehensive popularization of domesticization, various industries have begun to widely apply domestic mainframes and systems. In some application fields with high security requirements, it is required to protect the binary code of software to prevent reverse cracking. Generally, packing is a very effective protection method for software. At present, the packing method under the domestic system mostly follows the packing mechanism of Windows and has made limited expansion on the traditional packing method, still facing the risk of reverse cracking. How to minimize the exposure of software binary code under the domestic system, increase effective anti-reverse cracking means to enhance the cracking difficulty of the code, and well hide the program is a difficult problem for security engineers to overcome.

[0003] Generally, existing software packing technologies are divided into embedded, additional and contained types. For example, the most commonly used embedded type is UPX tool, which supports packing of multiple file types and has an advanced compression algorithm, but this method cannot avoid the cracking of the packed software by the method of dynamic debugging. The additional packing method usually adds a code segment for processing security operations in the original ELF file, but cannot embed decompression, which is easy to expose the location of the shell. The contained type combines compression and protection types of shell, but the process of shell loading changes the entry address. The essence of packing is to attach a special program code segment (shell program) to the software program to be protected, and point the software program entry to the attached special shell program. The loading process of the packed software is as follows: first, the shell program obtains the interface address of the software program, and dynamically loads the required interface address in the code of the shell program by using the display link method. In the shell program, the data of each section (SECTION) or text (TEXT) is decrypted or decompressed according to the algorithm rule, and then the file is mapped to the specified memory address. The input table of the original program is modified and the code address in the HOOK-API table is filled, so as to indirectly obtain the program control right, and jump to the original entry point after verification, at which time the system can normally load the software program.

[0004] Most of the existing packing methods change the original software program file structure, change the program entry address during relocation, and map the program to the address space during loading. The disadvantage of this method is that the cracker can find the original program information by addressing in the shell program as long as the packed ELF file is loaded into the memory. SUMMARY

[0005] In view of the defects of the prior art, the application provides a software protection scheme based on encryption signature technology, an apparatus and a medium, the trustworthiness of the packed software is ensured in a signature manner, the security of an ELF file is protected by introducing a hardware encryption method, and the ELF file is prevented from being reverse cracked.Based on the method in the application, the packed program appears in the form of ciphertext after the software is packed, and the difficulty of anti-cracking is greatly improved.

[0006] In order to solve the technical problem, the technical scheme adopted by the application is as follows: a software protection method based on encryption signature technology, comprising the following steps: S01, extracting a core code data segment in a target file to be protected, the core code data segment comprising segment and section information in the target file and executable commands and a dynamic link table; S02, performing signature operation on the extracted core code data segment, performing hash operation on the core code data by calling a national secret algorithm in a secure U disk password chip to generate an operation result, sending the operation result to the secure U disk password chip, signing the operation result by using a private key in the secure U disk password chip, and attaching the signature result R as a separate section to the tail of the target file; S03, performing anti-cracking operation on the core code data segment, and then encrypting the core code data segment after the anti-cracking operation; S04, integrating the signature and the encrypted core code data segment and the packed part according to an ELF file format rule to form a packed program; S05, writing the packed program into a secure U disk; S06, decryption and verification, the target file needs to be decrypted and verified before the target file is run, if the target file is not signed or the signature verification fails, the target program is stopped from running, and if the signature verification succeeds, the target program is normally run.

[0007] Further, in step S01, the core code data segment in the target file to be protected is: S11, performing single-step tracking on a code program in the target file, modifying an overflow identifier after encountering an exception; S12, analyzing the type of an operation number, judging whether it is a direct addressing type, if yes, input locking or memory write protection is performed on the target file, critical input is locked, and the program execution flow is changed through register indirect jump, ELF header file information is obtained, the core position of the program code segment is located, and data is copied for subsequent processing, and if not, a defined statement or function entry is found, context is obtained, and core data of a code segment is analyzed and extracted for subsequent encryption processing.

[0008] Further, in step S03, the anti-cracking operation includes: 1, hiding itself through code transformation or compression algorithm, preventing detection by searching for strings; 2, splitting the key instruction block into multiple segments, dynamically splicing through JMP / CALL, and randomly adding invalid interference instructions to increase the difficulty of reverse cracking.

[0009] Further, in step S04, the correct ELF file header, program header table and SECTION header table are calculated according to the ELF file format rule, and then the core part and the shell part of the target file are integrated.

[0010] Further, step S05 is specifically: according to the section attached by the shell program, reading the stored signature value R from the end of the shell program, sending the signature value R to the secure U disk password chip, and decrypting H~ through the internal public key stored in the password chip, decrypting the encrypted protection segment of the target file, and performing SM3 hash operation on the decrypted data to obtain H, if H and H~ are the same, it is proved that the data has not been tampered with, and the target file is safe and reliable, the verification is passed, and the target file is executed; otherwise, the verification fails, and the execution of the target file is interrupted.

[0011] Further, the key input includes a keyboard and a port.

[0012] Further, in step S02, the SM3 national secret algorithm in the secure U disk password chip is called to perform hash operation on the core code data, and the SM2 signature algorithm in the secure U disk password chip is called to sign the operation result.

[0013] Further, in step S03, the SM4 symmetric encryption algorithm in the secure U disk password chip is called to encrypt the core code data segment after the anti-cracking operation.

[0014] The application also discloses a software protection device based on encryption signature technology, which comprises a processor and a memory storing program instructions, wherein the processor is configured to execute the software protection method based on encryption signature technology as described above when running the program instructions.

[0015] A storage medium stores program instructions, which execute the software protection method based on encryption signature technology as described above when running.

[0016] The application has the advantages that the hardware encryption method is used in the method, the core code section is transformed, encrypted, compressed, and invalid interference instructions are added, the difficulty of reverse cracking is greatly improved. The ELF file is prevented from being forged and tampered by adding the signature, the trusted mechanism of the ELF file is increased, and the security of the ELF file after the shell is greatly improved. The ELF file structure is not changed after the shell, and the program entry address is not changed in the method, the shell program is well hidden. The shell program size is not limited in the method, and the method has good expansibility. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A flowchart for the target file shell; Figure 2 A flowchart for the target file decryption and signature verification; Figure 3 A schematic diagram of the device described in Example 2. DETAILED DESCRIPTION

[0018] The application will be further described below in combination with the drawings and specific examples.

[0019] Example 1 First, the English expressions appearing in the application are explained: ELF: Executable and Linkable Format, executable connection format linux and domestic system executable program.

[0020] SECTION: section, segment, part of the code segment.

[0021] The embodiment discloses a software protection method based on encryption signature technology, and the method is realized based on a secure U disk. The secure U disk provides encryption and decryption and signature verification algorithms used for ELF file shell. When the software is protected by the shell, the core code section and the data section in the target ELF file are first extracted, SM3 hash operation is performed, the operation result H is sent to the secure U disk password chip, the private key stored in the password chip is used for signature, and the obtained signature result R is attached to the tail of the ELF file as a separate section (Section). The shell software calls the symmetric password algorithm provided by the secure U disk password chip, and the core data of the protected program is encrypted and protected by the SM4 algorithm.

[0022] The software after the shell is stored in the read-only area of the secure U disk. When the software runs, the shell program code section is first loaded by the system, the shell program code section decrypts the core code section and the data section in the protected ELF file, the decryption key is stored in the password chip of the secure U disk, the SM4 symmetric algorithm is called for decryption operation, and after the decryption is completed, the data is verified to ensure that the data is not tampered.

[0023] Figure 1 The flowchart of the target file is as follows: S01, extract the core code data segment in the target file to be protected, the core code data segment includes segment, section information and executable command, dynamic link table in the target file. Since there is an indirect jump in the assembler, it will make the control flow graph generated by the disassembler break, so it will affect the accuracy of extracting the core code, and the program mode of the indirect jump is adopted in the scheme.

[0024] The specific steps are: S11, single-step tracking of the code program in the target file, if an exception is encountered, modify the overflow flag, for example, replace the overflow instruction with NOP (empty instruction); S12, parse the type of the operand to determine whether it is a direct addressing type (determine the addressing type according to the operand type, which is a prior art), if it is a direct addressing type, lock the key input or memory write protection of the target file, lock the key input, and change the program execution flow through register indirect jump, get the ELF header file information, locate the core position of the program code segment, and copy the data for subsequent processing; if it is not a direct addressing type, find the defined statement or function entry, get the context, and parse and extract the core data of the code segment for subsequent encryption processing.

[0025] In this embodiment, the hardware instruction (such as x86's cli) is used for input locking, and the locked key input includes keyboard / port, which prevents external interference.

[0026] S02, signature operation is performed on the extracted core code data segment, the SM3 national cryptographic algorithm in the security U disk password chip is called to perform hash operation on the core code data to generate operation result, the operation result is sent to the security U disk password chip, and the private key in the security U disk password chip is used to sign the operation result, and the signature result R is attached to the tail of the target file as a separate section.

[0027] In this step, the SM3 national cryptographic algorithm in the security U disk password chip is called to perform hash operation on the core code data, and the SM2 signature algorithm in the security U disk password chip is called to sign the operation result.

[0028] S03, anti-cracking operation is performed on the core code data segment, and then the core code data segment after the anti-cracking operation is encrypted. The anti-cracking operation includes: 1, hide itself through code transformation or compression algorithm, prevent detection by searching for strings; 2, split the key instruction block into multiple segments, dynamically splice through JMP / CALL, and randomly add invalid interference instructions (such as NOP empty instructions), increase the difficulty of reverse cracking. This step calls the SM4 symmetric encryption algorithm of the security U disk password chip to encrypt the code segment data after the anti-cracking operation.

[0029] S04, according to the ELF file format rule, integrate the signature, encrypted core code data segment and shell part to form a shell program. The core part and the shell part of the target file are integrated, and the correct ELF file header, program header table, SECTION (section or segment) header table and other data storage formats and positions are calculated according to the ELF file format rule. Ensure that the newly generated ELF file after shell can run normally.

[0030] S05, write the shell program into the read-only area of the security U disk. The shell program writes the shell ELF program file into the read-only area of the security U disk through the security U disk private protocol.

[0031] The target file needs to be decrypted and verified before running. If the target file is not signed or the signature verification fails, the target program will stop running. If the signature verification is successful, the target program will run normally. As shown in Figure 2 The decryption and signature verification steps of the target file are as follows: According to the section (SECTION) attached by the shell program, read the stored signature value R from the end of the shell program, send the signature value R to the security U disk password chip, and decrypt H~ through the internal public key stored in the password chip. The encrypted protection segment of the target file is decrypted, and the decrypted data is subjected to SM3 hash operation to obtain H. If H and H~ are the same, it proves that the data has not been tampered with, the target file is safe and reliable, and the verification is passed. Execute the target file; otherwise, the verification fails, and the execution of the target file is interrupted.

[0032] The application is based on a secure password chip of a secure U disk, and the chip provides encryption and decryption and signature verification algorithms used for ELF file shell. When the protected ELF file is shelled by the shell software, the core code data extracted is signed, and the signature is verified when the shelled ELF file is running, so as to ensure that the data is not tampered with and the ELF file is trusted. The core code segment data is extracted and the code segment data before encryption is processed, the self is hidden by code transformation encryption compression, and the detection by searching for a string is prevented; the instructions around the routine are moved, the instructions of invalid interference are randomly added, different registers and operation codes are used, and the difficulty of reverse cracking is increased; further, the shell software calls the symmetric password algorithm provided by the secure U disk password chip, and the core data of the ELF file is encrypted and protected by the SM4 algorithm.

[0033] Embodiment 2 The embodiment of the present disclosure provides a software protection device based on encryption signature technology, as shown in the figure, comprising a processor (processor) 304 and a memory (memory) 301. Optionally, the device can also include a communication interface (Communication Interface) 302 and a bus 303. Among them, the processor 304, the communication interface 302, the memory 301 can complete the communication between each other through the bus 303. The communication interface 302 can be used for information transmission. The processor 304 can call the logic instructions in the memory 301 to execute the software protection method based on the encryption signature technology of the above-mentioned embodiment. Figure 3

[0034] In addition, the logic instructions in the memory 301 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium.

[0035] The memory 301 is a kind of computer readable storage medium, and can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 304 executes the program instructions / modules stored in the memory 301, thereby executing function application and data processing, i.e. implementing the software protection method based on the encryption signature technology in the above-mentioned embodiment.

[0036] The memory 301 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the terminal device, etc. In addition, the memory 301 can include a high-speed random access memory, and can also include a non-volatile memory.

[0037] Embodiment 3 ​The embodiment of the present disclosure provides a computer readable storage medium, which stores computer executable instructions configured to execute the software protection method based on the encryption signature technology.

[0038] The computer readable storage medium described above can be a transitory computer readable storage medium or a non-transitory computer readable storage medium.

[0039] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes one or more instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium can be a non-transitory storage medium, including a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes, or a transitory storage medium.

[0040] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for descriptive purposes only and is not intended to limit the scope of protection. As used in the description herein, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used herein means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.

[0041] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0042] In the embodiments disclosed herein, the disclosed methods, products (including but not limited to devices, apparatuses, etc.) can be implemented in other manners. For example, the described device embodiments are merely illustrative. For example, the division of the units is merely a logical function division. There can be another division manner for the actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms. The units described as separated components can or can not be physical separate units. The units shown as separate components can or can not be physical separate units, i.e., can be located in one place, or distributed to multiple network units. Some or all of the units can be selected according to the actual needs to implement the embodiments. In addition, the units in the embodiments disclosed herein can be integrated in a processing unit, or each unit can exist alone physically, or two or more units can be integrated in a unit.

Claims

1. A software protection method based on cryptographic signature techniques, characterized in that: The method comprises the following steps: S01, extracting the core code data segment in the target file to be protected, the core code data segment comprising segment and section information in the target file and executable commands and dynamic link tables, S02, performing signature operation on the extracted core code data segment, calling the national secret algorithm in the security U disk password chip to perform hash operation on the core code data to generate an operation result, sending the operation result to the security U disk password chip, signing the operation result using the private key in the security U disk password chip, and attaching the signature result R as a separate section to the tail of the target file; S03, performing anti-cracking operation on the core code data segment, and then encrypting the core code data segment after the anti-cracking operation; S04, integrating the signature and the encrypted core code data segment and the shell part according to the ELF file format rule to form a shell program; S05, writing the shell program into the security U disk; S06, decryption and verification, the target file needs to be decrypted and verified before running, if the target file is not signed or the signature verification fails, the target program is stopped, and if the signature verification succeeds, the target program is normally run.

2. The software protection method based on encryption signature technology according to claim 1, characterized in that: In step S01, the core code data segment in the target file to be protected is: S11, single-step tracking is performed on the code program in the target file, the overflow flag is modified after encountering an exception, the type of the operand is parsed, it is judged whether it is a direct addressing type, if it is a direct addressing type, input locking or memory write protection is performed on the target file, the key input is locked, and the program execution flow is changed through register indirect jump, the ELF header file information is obtained, the core position of the program code segment is located, and the data is copied for subsequent processing, if it is not a direct addressing type, the defined statement or function entry is found, the context is obtained, and the core data of the code segment is parsed for subsequent encryption processing. In step S03, the anti-cracking operation comprises: 1, hiding itself through code transformation or compression algorithm to prevent detection by searching for a string; 2, splitting the key instruction block into multiple segments, dynamically splicing through JMP / CALL, and randomly adding invalid interference instructions to increase the difficulty of reverse cracking.

3. The software protection method based on encryption signature technology according to claim 1, characterized in that: In step S04, the correct ELF file header, program header table and SECTION header table are calculated through the ELF file format rule, and then the core part of the target file and the shell part are integrated.

4. The software protection method based on encryption signature technology according to claim 1, characterized in that: Step S05 specifically comprises: reading the stored signature value R from the end of the shell program according to the section attached to the shell program, sending the signature value R to the security U disk password chip, decrypting H~ obtained through the internal public key stored in the password chip, decrypting the encrypted protection segment of the target file, performing SM3 hash operation on the decrypted data to obtain H, if H and H~ are the same, it is proved that the data has not been tampered with, the target file is safe and reliable, the verification is passed, and the target file is executed; 5. The software protection method based on encryption signature technology according to claim 1, characterized in that: Otherwise, the verification fails, and the execution of the target file is interrupted. The key input comprises a keyboard and a port.

6. The software protection method based on encryption signature technology according to claim 2, characterized in that: ​ 7. The software protection method based on encryption signature technology according to claim 1, characterized in that: In step S02, the SM3 national secret algorithm in the security U disk password chip is called to perform a hash operation on the core code data, and the SM2 signature algorithm in the security U disk password chip is called to sign the operation result.

8. The software protection method based on encryption signature technology according to claim 1, characterized in that: In step S03, the SM4 symmetric encryption algorithm in the security U disk password chip is called to encrypt the core code data segment after the anti-cracking operation.

9. A software protection apparatus based on cryptographic signature techniques, comprising a processor and a memory having stored program instructions, characterized in that: The processor is configured to execute the software protection method based on the encryption signature technology as claimed in any one of claims 1 to 8 when the program instruction is run.

10. A storage medium storing program instructions, characterized in that: The program instruction is configured to execute the software protection method based on the encryption signature technology as claimed in any one of claims 1 to 8 when the program instruction is run.

Images