Code protection method and electronic device

Abstract

The application relates to the technical field of software code protection, and discloses a code protection method and electronic equipment, which comprises the following steps: obtaining a first code file of a target program; determining protected data in the first code file and a first operation related to the protected data; configuring a first encryption mode for the protected data and a second operation of the first operation in an encryption domain in a second code file; configuring a first decryption mode for the protected data and / or an operation result of the second operation in the second code file; replacing the protected data in the first code file with a call for the first encryption mode, replacing the first operation in the first code file with a call for the second operation, and adding a call for the first decryption mode in the first code file to obtain a third code file, and the target program is compiled through the second code file and the third code file. The application can solve the problem that software code protection affects the debugging of software code.

Description

Technical Field

[0001] This invention relates to the field of software code protection technology, specifically to code protection methods and electronic devices. Background Technology

[0002] The field of software code protection technology has evolved from simple encryption to complex, multi-layered protection. Early software code protection relied primarily on basic techniques such as simple code obfuscation and string replacement. With the continuous advancement of reverse engineering tools, software protection technology has gradually evolved into a multi-layered, three-dimensional protection system. However, existing software code protection methods, while protecting the software code, can also affect its debugging. Summary of the Invention

[0003] This invention provides a code protection method and an electronic device to solve the problem of software code protection affecting software code debugging.

[0004] In a first aspect, the present invention provides a code protection method, comprising: Obtain the first code file of the target program; Determine the protected data in the first code file and the first operation related to the protected data; Configure a first encryption method for the protected data in the second code file; In the second code file, configure the second operation of the first operation in the encrypted domain. The input of the second operation includes the first encrypted data of the protected data under the first encryption method. The output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation. Configure a first decryption method for the protected data and / or the result of the second operation in the second code file; The protected data in the first code file is replaced with a call to the first encryption method, the first operation in the first code file is replaced with a call to the second operation, and a call to the first decryption method is added to the first code file to obtain a third code file. The target program is compiled from the second code file and the third code file.

[0005] In a second aspect, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the code protection method described in the first aspect or any corresponding embodiment thereof.

[0006] The code protection method provided in this application obtains a first code file of the target program, acquires the protected data in the first code file, and obtains a first operation related to the protected data. A first encryption method for the protected data is configured in a second code file, and the protected data in the first code file is replaced with a call to the first encryption method. Therefore, the protected data can be protected by avoiding direct reading from the first code file. Simultaneously, for the first operation related to the protected data, a second operation in the encrypted domain is configured in the second code file. The input of the second operation includes the first encrypted data of the protected data under the first encryption method, and the output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation. The first operation in the first code file is replaced with a call to the second operation. Therefore, the operation logic of the first operation related to the protected data can be avoided by directly reading from the first code file, and the second operation can be used to process data without disclosing the protected data, further improving the security of the protected data. Furthermore, a first decryption method for the protected data and / or the operation result of the second operation is configured in the second code file, and a call to the first decryption method is added to the first code file to obtain a third code file. Therefore, it can provide a way to read protected data or the result of the operation of protected data under the first operation according to actual needs. Thus, on the one hand, it can effectively protect the code file of the target program, and on the other hand, the encryption logic of the protected data and the first operation in the first code file can be configured separately in the second code file. This eliminates the need to configure additional encryption processing for the protected data and the first operation in the first or third code file, and avoids affecting the debugging of the main program of the target program compiled from the third code file. Attached Figure Description

[0007] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0008] Figure 1 This is a schematic diagram of the first type of code protection method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a second type of code protection method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the third process of the code protection method according to an embodiment of the present invention; Figure 4This is a schematic diagram of the data interaction process of the code protection method according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the fourth process of the code protection method according to an embodiment of the present invention; Figure 6 This is a structural block diagram of the code protection device according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0009] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0010] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0011] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0012] Relevant code protection technologies mainly focus on the following technical approaches: 1. Code obfuscation techniques; 2. Application of reflection mechanisms; 3. Code packing protection. These technical solutions generally suffer from drawbacks such as debugging difficulties, compatibility issues, and performance loss.

[0013] The main drawbacks of the related technologies are: 1. The contradiction between debugging and protection: While related technologies often improve the protection strength, they also seriously affect the debuggability of the program, which is not conducive to the location and repair of problems during the development process.

[0014] 2. Architectural complexity: The implementation of multi-module collaborative protection architecture and layered recursive encryption technologies is complex, integration is difficult, and maintenance costs are high.

[0015] 3. Platform Dependency: Many protection technologies heavily rely on platform-specific features (such as the Java class loader), making them difficult to apply across platforms, especially when applied to the .NET platform where there are technical barriers.

[0016] 4. Performance loss due to global protection: Encrypting the entire application can lead to a significant performance drop, affecting the user experience.

[0017] 5. Lack of specificity: Related technologies often adopt a global protection strategy, applying the same level of protection to sensitive algorithms and non-sensitive code, which lacks specificity and flexibility.

[0018] According to an embodiment of the present invention, a code protection method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0019] This embodiment provides a code protection method that can be used in electronic devices, such as servers and computers. Figure 1 This is a flowchart of a code protection method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps: Step S101: Obtain the first code file of the target program.

[0020] The first code file is the main program code file of the target program.

[0021] Step S102: Determine the protected data in the first code file and the first operation related to the protected data.

[0022] Among them, protected data represents key data that cannot be directly exposed to users.

[0023] In practical applications, programmers annotate the protected data in the first code file to obtain annotation information for the protected data. Then, the protected data in the first code file can be extracted based on this annotation information.

[0024] It's worth noting that, in addition to keeping the protected data confidential, the first code file typically requires subsequent operations on the protected data. Therefore, these operations related to the protected data must also be kept confidential to completely hide the protected data. Understandably, the first operation refers to operations related to the protected data, specifically including addition, subtraction, multiplication, division, trigonometric functions, etc.

[0025] Specifically, programmers can annotate the first operations related to the protected data to extract the first operations related to the protected data from the first code file. Alternatively, after extracting the protected data, the operations related to the protected data in the first code file can be further analyzed to obtain the first operations.

[0026] Step S103: Configure the first encryption method for the protected data in the second code file.

[0027] The second code file is a standard C format dynamic link library (DLL) code file.

[0028] Specifically, a source code generator is used to add a first encryption method to each protected data in the second code file. This first encryption method is used to obtain the first encrypted data of the protected data under the first encryption method.

[0029] Furthermore, the second code file provides an interface for calling the first encryption method. This interface can be used to call the first encryption method corresponding to the protected data in order to obtain the first encrypted data of the protected data.

[0030] For example, the following is a call interface definition for a first encryption method for protected data: Encrypt(plain: double|int|...): byte[], which is used to represent the first encrypted data of protected data plaintext data (such as protected data plain) of any primitive data type (such as double, int, etc.) to encrypt the ciphertext data (such as protected data plain) into a binary byte array (byte[]).

[0031] Step S104: Configure the second operation of the first operation in the encryption domain in the second code file. The input of the second operation includes the first encrypted data of the protected data under the first encryption method; the output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation.

[0032] The encrypted domain refers to the secure space or state in which data exists after it has been encrypted. Within the encrypted domain, the data exists in ciphertext form and requires decryption to obtain the plaintext information.

[0033] In practical applications, the homomorphic encryption operation of the first operation can be configured in the second code file to obtain the second operation.

[0034] Alternatively, a second operation can be configured based on the first operation, the decryption method corresponding to the first encryption method, and the encryption method for the result of the first operation. The second operation is used to decrypt the first encrypted data of the protected data using the decryption method corresponding to the first encryption method, and then perform an operation on the decryption result of the first encrypted data using the first operation. Finally, the operation result of the first operation is encrypted using the encryption method for the result of the first operation to obtain the second encrypted data. For example, given two operation parameters a and b, pa = Decrypt(a) and pb = Decrypt(b) are used to decrypt a and b respectively, obtaining the decryption results of a and b. Then, the two decryption results are added using presult = pa + pb to obtain the final result. Finally, Encrypt(presult) returns the encrypted data corresponding to the final result.

[0035] For example, the following is the definition of the calling interface for the second operation corresponding to different operations: 1. The calling interface for the second operation corresponding to the addition operation: Add(ct1: byte[], ct2: byte[]): byte[], is used to represent performing an addition operation on the first encrypted data (such as ct1 and ct2 of type byte[]) corresponding to the two protected data respectively, to obtain the second encrypted data corresponding to the operation result of the two protected data under the addition operation.

[0036] 2. The calling interface for the second operation corresponding to the subtraction operation: Sub(ct1: byte[], ct2: byte[]):byte[], is used to represent performing a subtraction operation on the first encrypted data (such as ct1 and ct2 of type byte[]) corresponding to the two protected data respectively, to obtain the second encrypted data corresponding to the operation result of the two protected data under the subtraction operation.

[0037] 3. The calling interface for the second operation corresponding to the multiplication operation: Mul(ct1: byte[], ct2: byte[]): byte[] is used to represent performing a multiplication operation on the first encrypted data (such as ct1 and ct2 of type byte[]) corresponding to the two protected data respectively, to obtain the second encrypted data corresponding to the operation result of the two protected data under the multiplication operation.

[0038] 4. The calling interface for the second operation corresponding to the division operation: Div(ct1: byte[], ct2: byte[]): byte[] is used to represent performing a division operation on the first encrypted data (such as ct1 and ct2 of type byte[]) corresponding to the two protected data respectively, to obtain the second encrypted data corresponding to the operation result of the two protected data under the division operation.

[0039] 5. The calling interface for the second operation corresponding to the sine operation: Sin(ct: byte[]): byte[], which is used to represent performing a sine operation on the first encrypted data (such as ct of type byte[]) corresponding to the protected data, to obtain the second encrypted data corresponding to the operation result of the protected data under the sine operation.

[0040] 6. The calling interface for the second operation corresponding to the cosine operation: Cos(ct: byte[]): byte[], which is used to represent performing a cosine operation on the first encrypted data (such as ct of type byte[]) corresponding to the protected data, to obtain the second encrypted data corresponding to the operation result of the protected data under the cosine operation.

[0041] Step S105: Configure a first decryption method for the protected data and / or the result of the second operation in the second code file.

[0042] Specifically, the data to be provided externally can be determined based on business needs, such as protected data or the result of a second operation. If the data provided externally includes protected data, a first decryption method for the protected data is configured in the second code file. If the data provided externally includes the result of a second operation, a first decryption method for the result of the second operation is configured in the second code file.

[0043] For example, the following is a call interface definition for a first decryption method: Decrypt(ct: byte[]): double|int|..., which restores encrypted data (such as the first encrypted data of protected data, or the result of the second operation) to plaintext data of type double / int, etc.

[0044] Step S106: Replace the protected data in the first code file with a call to the first encryption method, replace the first operation in the first code file with a call to the second operation, and add a call to the first decryption method in the first code file to obtain the third code file. The target program is compiled from the second code file and the third code file.

[0045] Specifically, the protected data in the first code file is replaced with calls to the first encryption method, the first operation in the first code file is replaced with calls to the second operation, and calls to the first decryption method are added to the first code file to obtain the third code file. The call to the first decryption method corresponding to the protected data is used to retrieve the corresponding protected data, and the call to the first decryption method corresponding to the result of the second operation is used to retrieve the decryption result corresponding to the result of the second operation (i.e., the result of the protected data under the first operation).

[0046] Then, the second code file is compiled Ahead-of-Time (AOT), and the third code file is compiled Just-In-Time (JIT) to obtain the target program. It's worth noting that JIT compilation of the third code file is used because in actual production environments, the target program needs frequent debugging. The third code file is compiled using .NET IL without any obfuscation or encryption, ensuring the program's debuggability. This allows the compiled result of the third code file to be directly attached to the process for breakpoint debugging. AOT compilation of the second code file, on the other hand, allows for encryption and obfuscation of the compiled result, increasing the difficulty of decompilation.

[0047] It should be noted that data exchange between the compilation results of the second code file and the compilation results of the third code file is transmitted through a predefined P / Invoke boundary. When the compilation result of the third code file uses protected data or the result of the second operation, encrypted data is transmitted only through the P / Invoke boundary. The data type of the encrypted data is an array, represented as byte[].

[0048] As an application example, let's take the protected data as the real number 49. When the protected data constA=49 exists in the first code file, the entry dataA=49 is defined in the compilation configuration of the corresponding second code file. Then, the first encryption method GetA() is added to the second code file, and the attribute annotation EncrypedData(“data_A”) is added. In the first code file, all uses of A are replaced with safeDLL.GetA(), and the first operation of A is also replaced with a call to the second operation corresponding to the first operation. For example, SinA is replaced with safeDLL.Sin(safeDLL.GetA()).

[0049] As an application example, the first algorithm in the first code file is: `double Calculate(long a, int b) => (1.234 * Math.Pow(10, 10)) / (a ​​* b * Math.Pow(2, 23))`. This algorithm needs to be protected, where 1.234, 1010, and 223 are the protected data. In the compilation configuration of the second code file, add entry IDs: `calculate_fix1`, `calculate_fix2`, and `calculate_fix3`, corresponding to the data 1.234, 1010, and 223 respectively. In the second code file, add `calculate_fix1`, `calculate_fix2`, and `calculate_fix3` to correspond to the first encryption methods `GetCalculateFix1`, `GetCalculateFix2`, and `GetCalculateFix3` respectively, and add the feature annotations `EncrypedData("calculate_fix1")`, `EncrypedData("calculate_fix2")`, and `EncrypedData("calculate_fix3")` respectively.

[0050] Add a method `Calculate` to the second code file, which receives encrypted data for parameter `a` and parameter `b`. Configure the second algorithm as: `Divide(Multipy(GetCalculateFix1(), GetCalculateFix2()), Multipy(Multipy(a, b), GetCalculateFix3())`, where `Divide` and `Multipy` are the homomorphic encryption operations for division and multiplication in the second code file, respectively. The calling interface for the second algorithm is defined as: `safeDLL.Calculate(safeDLL.Encrypt(a), safeDLL.Encrypt(b))`. Finally, modify the first code file, replacing parameters `a` and `b` with `safeDLL.Calculate(safeDLL.Encrypt(a), safeDLL.Encrypt(b))`, and configure the first decryption method for the result of the second operation: `safeDLL.Decrypt(result)`. Then, after obtaining the second encrypted data corresponding to the second operation, `safeDLL.Decrypt(result)` can be used to decrypt the result of the second operation to obtain the decrypted result of the second encrypted data.

[0051] For a specific application example, see Figure 2The compiled target program consists of two parts: a third code file (main program) and a second code file (dynamic link library). The third code file encrypts the protected data by calling the first encryption method in the second code file, obtaining first encrypted data and adding an identifier to it. The encrypted data management module in the third code file retrieves the first encrypted data based on the identifier. The business logic module transmits the first encrypted data through the P / Invoke boundary to the first algorithm in the second code file. The second algorithm then performs calculations on the first encrypted data according to the operation logic of the first algorithm, obtaining second encrypted data. The second encrypted data is transmitted through the P / Invoke boundary to the business logic module in the third code file, where the first decryption method in the encryption / decryption module of the second code file is called to obtain the decryption result of the protected data and / or the second encrypted data.

[0052] The code protection method provided in this embodiment obtains a first code file of the target program, acquires the protected data in the first code file, and obtains a first operation related to the protected data. A first encryption method for the protected data is configured in a second code file, and the protected data in the first code file is replaced with a call to the first encryption method. Therefore, the protected data can be protected by avoiding direct reading from the first code file. Simultaneously, for the first operation related to the protected data, a second operation in the encrypted domain is configured in the second code file. The input of the second operation includes the first encrypted data of the protected data under the first encryption method, and the output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation. The first operation in the first code file is replaced with a call to the second operation. Therefore, the operation logic of the first operation related to the protected data can be avoided by directly reading from the first code file, and the second operation can be used to process data without disclosing the protected data, further improving the security of the protected data. Furthermore, a first decryption method for the protected data and / or the operation result of the second operation is configured in the second code file, and a call to the first decryption method is added to the first code file to obtain a third code file. Therefore, it can provide a way to read protected data or the result of the operation of protected data under the first operation according to actual needs. Thus, on the one hand, it can effectively protect the code file of the target program, and on the other hand, the encryption logic of the protected data and the first operation in the first code file can be configured separately in the second code file. This eliminates the need to configure additional encryption processing for the protected data and the first operation in the first or third code file, and avoids affecting the debugging of the main program of the target program compiled from the third code file.

[0053] In some optional implementations, configuring a first encryption method for the protected data in the second code file in step S103 above includes: Step a1: Encrypt the protected data to obtain the first encrypted data.

[0054] Specifically, the extracted protected data is written into a configuration file, and a data identifier is configured for the protected data. The data identifier is a unique identifier for the protected data. The data identifier is used to configure the API for calling the first encryption method for the protected data. The data identifier will appear in a subsequent third-party code file, therefore, the data identifier cannot provide information related to the original value of the protected data.

[0055] In practical applications, an encryption method for the protected data can be pre-configured, and the protected data can be encrypted using this pre-configured encryption method to obtain the first encrypted data.

[0056] Step a2: Perform data segmentation on the first encrypted data to obtain multiple target segmented data.

[0057] In practical applications, multiple target segmentation data can be saved as constants, and only the target segmentation data can be stored in the second code file to prevent the leakage of the first encrypted data and further increase the difficulty of reverse reasoning to obtain the protected data.

[0058] Optionally, a segmentation and obfuscation strategy combining a three-segmentation method with a Feistel-like network algorithm can be used to segment the first encrypted data, resulting in multiple target segments. Alternatively, nonlinear operations such as XOR, bitwise operations, and circular shifts can be used to segment the first encrypted data, yielding multiple target segments. For example, a simple XOR segmentation and obfuscation method can be used to segment the first encrypted data, resulting in multiple target segments. Furthermore, other segmentation or obfuscation strategies with global dependencies can also be used to segment the first encrypted data, resulting in multiple target segments; no specific limitations are imposed on the segmentation methods here. The target segments can be represented as byte arrays.

[0059] Step a3: Construct a data recovery method corresponding to the data segmentation. The data recovery method is used to recover the first encrypted data from multiple target segmented data.

[0060] Specifically, the data recovery method is the reverse process of data segmentation of the first encrypted data mentioned above.

[0061] Step a4: Configure the acquisition method of the first encrypted data based on the data recovery method, so as to use it as the first encryption method. The acquisition method of the first encrypted data is used to obtain the first encrypted data through the data recovery method and multiple target segmented data.

[0062] Specifically, the method for obtaining the first encrypted data is configured based on the data recovery method. Furthermore, the interface for calling the method for obtaining the first encrypted data is configured based on the data identifier of the protected data. The first encryption method is used to reconstruct multiple target segmented data using the data recovery method to obtain the first encrypted data.

[0063] Step a5: Write the first encryption method into the second code file.

[0064] In practical applications, different rounds, masks, and state update strategies can be dynamically generated based on the data identifier of the protected data to configure the first encryption method for the protected data, thereby improving heterogeneity and reverse engineering difficulty. It should be noted that since the first code file contains the API call for the first encryption method for the protected data, and the engineering implementation of the first encryption method is written in the second code file, the API call for the first encryption method for the protected data is not affected by updates to the engineering implementation of the first encryption method.

[0065] As an application example, see Figure 3 During compilation, the source code generator encrypts the protected data to obtain the first encrypted data. Then, a segmentation obfuscation strategy (e.g., a three-segmentation method combined with global obfuscation similar to the Feistel algorithm) is selected to segment the first encrypted data, resulting in multiple target segmented data. A first encryption method is obtained by constructing a data recovery method corresponding to the data segmentation. This first encryption method is used to restore the multiple target segmented data, recovering them as the first encrypted data. At runtime, the first encrypted data can be obtained by calling the first encryption method.

[0066] As one optional implementation, step a2 above, which involves segmenting the first encrypted data to obtain multiple target segmented data, includes: randomly selecting a splitting point in the protected data (this splitting point is a position other than the beginning and end of the protected data); splitting the protected data into two arrays based on the splitting point; generating two random keys (the length of the random keys is the same as the length of the corresponding arrays) based on the lengths of the two arrays; then, performing an XOR operation between the two random keys and the corresponding arrays to obtain two target segmented data (the first target segmented data and the second target segmented data); and concatenating the two random keys to obtain another target segmented data (the third target segmented data).

[0067] Furthermore, a data recovery method corresponding to the data segmentation is constructed. Specifically, the data recovery method involves splitting the third target segment into two keys based on the lengths of the first and second target segmented data. The first target segment is then XORed with its corresponding split key to obtain a first array. The second target segment is then XORed with its corresponding split key to obtain a second array. Finally, the first and second arrays are concatenated to obtain the first encrypted data.

[0068] In some alternative implementations, step a2 above involves segmenting the first encrypted data to obtain multiple target segmented data, including: Step a21: The first encrypted data is segmented to obtain multiple initial segmented data.

[0069] Specifically, the first encrypted data undergoes a nonlinear transformation (such as XOR operation, bitwise operation, circular shift, etc.) to divide it into multiple initial segments. One approach is to use a three-segment method to perform the nonlinear transformation on the first encrypted data, resulting in multiple initial segments. This generates complex control and data flows at the assembly level.

[0070] Step a22: Obtain multiple target segmentation data by data obfuscating of the multiple initial segmentation data.

[0071] Specifically, multiple initial segmented data (i.e., multiple byte arrays) are obfuscated using a Feistel-like algorithm to obtain multiple target segmented data.

[0072] Taking the example of obtaining multiple target segment data by separately performing data obfuscation on multiple initial segment data using a Feistel-like algorithm, the Feistel-like algorithm (also known as Feistel-like network transformation) is applied to each initial segment data, and global dependencies are introduced to obfuscate the data of each initial segment data, resulting in multiple target segment data. Within a preset number of iterations (e.g., 3), the data obfuscation for each initial segment data includes the following steps: Step 1: For each iteration (e.g., 0 ≤ iteration y < 3), the first initial segment data P1' is obfuscated using P1''[i] = P1'[i] ⊕ P1'[j] ⊕ (j × 13 + i × 7) to obtain the first target segment data P1''. Here, j = (i × 23 + r × 7) mod n1, P1'[i] is the i-th data in the first initial segment data, P1'[j] is the j-th data in the first initial segment data, P1''[i] is the i-th data in the first target segment data, and n1 is the total number of bits in the first initial segment data.

[0073] Step 2: For each iteration, the second initial segment data P2' is obfuscated using P2''[i] = P2'[i] ⊕ P2'[j] ⊕ (j × 11 + i × 23) to obtain the second target segment data P2''. Here, j = (i × 17 + r × 11) mod n2, P2'[i] is the i-th data point in the second initial segment data, P2'[j] is the j-th data point in the second initial segment data, and n2 is the total number of bits in the second initial segment data.

[0074] Step 3: For each iteration, the third initial segment data P3' is obfuscated using P3''[i] = P3'[i] ⊕ P3'[j] ⊕ (j × 17 + i × 19) to obtain the third target segment data P3''. Here, j = (i × 31 + r × 13) mod n3, P3'[i] is the i-th data point in the third initial segment data, P3''[i] is the j-th data point in the third initial segment data, and n3 is the total number of bits in the third initial segment data.

[0075] As can be seen, the aforementioned global data obfuscation makes any local modification have an unpredictable impact on the overall data.

[0076] In some optional implementations, step a21 above involves segmenting the first encrypted data to obtain multiple target segmented data, including: Step a211: Obtain the first seed value for data segmentation.

[0077] The first seed value is a randomly generated value used to provide data for the recursive calculation of the subsequent second seed value.

[0078] Step a212: The first encrypted data is segmented based on the first seed value to obtain multiple initial segmented data.

[0079] Specifically, the first encrypted data is bitmasked and segmented using a first seed value to obtain multiple initial segmented data. It is necessary to ensure that all initial segmented data are available simultaneously to fully recover the first encrypted data, thereby further ensuring data security.

[0080] In some optional implementations, step a212 above involves segmenting the first encrypted data based on a first seed value to obtain multiple initial segmented data, including: Step a2121: Recursively process the first seed value based on the first encrypted data to obtain the second seed value.

[0081] Specifically, the randomly generated first seed value is recursively processed to obtain second seed values corresponding to each position of the first encrypted data.

[0082] It should be noted that the first seed value is recursively processed by the first encrypted data to obtain the second seed value. Therefore, the second seed value that can be dynamically used for data segmentation increases the difficulty of reverse engineering prediction.

[0083] In one example, the first seed value S0 = 0x12345678, and S0 is a randomly generated value.

[0084] The first seed value is recursively processed in the following manner to obtain the second seed value: S i+1 = (S i × 0x5DEECE66D + 0xB + (B[i] & 0xFF)) mod 2 48 ; S = S n ; where S represents the second seed values at each position, S n is the second seed value at the nth position, S i is the second seed value at the ith position, S i+1 is the second seed value at the (i + 1)th position, B[i] is the first encrypted data, mod is the modulo operation, 0 ≤ i < n, and n is the total number of bits of the first encrypted data.

[0085] Step a2122: Based on the second seed value, the first encrypted data is segmented to obtain multiple initial segmented data.

[0086] Specifically, the second seed value is used to perform bitmask segmentation on the first encrypted data to obtain multiple initial segmented data.

[0087] In some optional embodiments, the step of segmenting the first encrypted data based on the second seed value in step a2122 to obtain multiple initial segmented data includes: Step b1: Based on the second seed value, at least one pseudo-random value corresponding to each position in the first encrypted data is generated.

[0088] In one example, for each position i (0 ≤ i < n) in the first encrypted data, the target seed value and two pseudo-random values are generated through the following steps: S i ' = (S i × 0x5DEECE66D + 0xB) mod 2 48 ; r1 i = (Si ' 16) &0xFF; S i '' = (S i ' × 0x5DEECE66D + 0xB) mod 2 48 ; r2 i =(S i '' 16) &0xFF; Among them, S i ' represents the third seed value corresponding to the i-th position, r1 i S is the first pseudo-random value at the i-th position. i '' represents the target seed value corresponding to the i-th position, r2 i It is the second pseudo-random value at the i-th position.

[0089] Step b2: Based on at least one pseudo-random value corresponding to each position, the first encrypted data is segmented according to the position to obtain multiple initial segmented data.

[0090] Specifically, based on the pseudo-random values ​​corresponding to each position, the first encrypted data is segmented according to each position of the first encrypted data to obtain multiple initial segmented data.

[0091] In some optional implementations, step b2 above, based on at least one pseudo-random value corresponding to each position, divides the first encrypted data according to position to obtain multiple initial segmented data, including: Step b21: Based on at least one pseudo-random value corresponding to each position, the first encrypted data is segmented according to the position to obtain multiple first segmented data.

[0092] Specifically, based on the multivariable equation system and at least one pseudo-random value corresponding to each position, the first encrypted data is segmented according to position to obtain multiple first segmented data.

[0093] In one example, the first segment of data is obtained as follows: P1[i] = r1 i ⊕((B[i]&0xAA)|((i × 7 + 3)&0x55)); P2[i] = r2 i ⊕((B[i]&0x55)|((i × 11 + 5)&0xAA)); P3[i] = (r1 i ⊕ r2 i ⊕ B[i])+(S i ''&0x3F) (S) i'' 6) & 0x3F). Here, P1[i] is the first first - split data, P2[i] is the second first - split data, P3[i] is the third first - split data, ⊕ is the bit - wise exclusive - or operation, is the cyclic right - shift operation. 0xAA and 0x55 are complementary bit - masks, representing 10101010 and 01010101 in binary respectively.

[0094] It should be noted that all the first - split data after data splitting are required to recover the first encrypted data.

[0095] Step b22: Obtain the first state variables corresponding to each of the first - split data respectively.

[0096] Among them, the first state variable is a randomly generated random value. That is, initialize the first state variable for each of the first - split data.

[0097] Step b23: Update the corresponding first state variables based on the first - split data to obtain the second state variables corresponding to each of the first - split data respectively.

[0098] Specifically, based on the first - split data, perform recursive calculations on the first state variables corresponding to each of the first - split data respectively to obtain the second state variables corresponding to each of the first - split data respectively.

[0099] Step b24: Perform a state - dependent transformation on the corresponding first - split data based on the second state variables to obtain the second - split data corresponding to each of the first - split data, so as to obtain multiple initial - split data.

[0100] In one example, the first state variable A0 corresponding to the first first - split data = 0x67452301, the first state variable B0 corresponding to the second first - split data = 0xEFCDAB89, and the first state variable C0 corresponding to the third first - split data = 0x98BADCFE.

[0101] For each position i (0 ≤ i < n), perform recursive operations on each of the first state variables respectively to obtain the second state variables corresponding to each of the first state variables. Among them, the second state variable is obtained as follows: A i+1 = ((A i ⊕ (P1[i] & 0xFF)) 7) + (B i 13); B i+1 = ((B i ⊕ (P2[i] & 0xFF)) 11) + (C i 17); C i+1 =(C i ⊕(P3[i]&0xFF)) 19) + (A) i 5); where A i+1 B is the second state variable at the (i+1)th position corresponding to the first segment of data. i+1 C is the second state variable at the (i+1)th position corresponding to the second first segment data. i+1 This refers to the second state variable at the (i+1)th position corresponding to the third first segment data. This is a circular left shift operation.

[0102] Furthermore, the initial segmentation data is obtained as follows: P1'[i] = P1[i] ⊕ (A i+1 &0xFF)⊕((C i+1 13)&0xFF);P2'[i] = P2[i] ⊕(B i+1 &0xFF)⊕((A i+1 11)&0xFF);P3'[i] = P3[i] ⊕(C i+1 &0xFF)⊕((B i+1 7) &0xFF).

[0103] As can be seen, in the above data segmentation process, each step depends on the previous state, forming a complex data dependency chain, which makes it extremely difficult to obtain the first encrypted data and the protected data from static analysis at the assembly level.

[0104] The data recovery method is the reverse process of the data segmentation algorithm; it is the algorithmic implementation of the first encrypted data ultimately written into the second code file. Referring to the method for obtaining the target segmented data described above, the main steps in constructing the data recovery method are as follows: Step 1: Perform inverse scrambling transformation on multiple target segmentation data to obtain the initial segmentation data corresponding to each target segmentation data.

[0105] Specifically, within a preset number of iterations (e.g., 3), the inverse Feistel algorithm (also known as the inverse Feistel network transformation) is executed for each target segmentation data. The third segmentation data corresponding to each target segmentation data is obtained as follows: Step 11: By using P3'[i] = P3''[i] ⊕ P3''[j] ⊕ (j × 17 + i × 19), perform inverse confusion transformation on the third target segment data of each iteration round (e.g., 2 ≥ iteration round y≥0) in reverse order to obtain the third initial segment data P3'; where j = (i × 31 + r × 13) mod n3.

[0106] Step 12: By using P2'[i] = P2''[i] ⊕ P2''[j] ⊕ (j × 11 + i × 23), perform inverse confusion transformation on the second target segment data of each iteration in reverse order to obtain the second initial segment data P2'; where j = (i × 17 + r × 11) mod n2.

[0107] Step 13: By using P1'[i] = P1''[i] ⊕ P1''[j] ⊕ (j × 13 + i × 7), perform inverse confusion transformation on the first target segment data of each iteration in reverse order to obtain the first initial segment data P1'; where j = (i × 23 + r × 7) mod n1.

[0108] Step 2: For each initial segmented data, perform an inverse state dependency transformation on the corresponding initial segmented data based on the first state variable to obtain the second state variable corresponding to each initial segmented data.

[0109] Specifically, the first state variables are defined as: A0 = 0x67452301, B0 = 0xEFCDAB89, and C0 = 0x98BADCFE. The second state variables corresponding to each initial segmented data are obtained using the following formula: P1''[i] = P1'[i] ⊕(A i &0xFF)⊕((C i 13)&0xFF)). P2''[i] = P2'[i] ⊕(B i &0xFF)⊕((A i 11) &0xFF); P3''[i] = P3'[i] ⊕(C i &0xFF)⊕((B i 7) &0xFF); Then, the second state variable corresponding to each initial segmented data is updated using the following formula: A i+1 =(Ai ⊕ (P1''[i] & 0xFF)) 7) + (B i 13); B i+1 = ((B i ⊕ (P2[i]'' & 0xFF)) 11) + (C i 17); C i+1 = ((C i ⊕ (P3[i]'' & 0xFF)) 19) + (A i 5).

[0110] Step 3, for each position i (0 ≤ i < n), generate the target seed value and two pseudo-random values through the following steps: S i ' = (S i × 0x5DEECE66D + 0xB) mod 2 48 ; r1 i = (S i ' 16) & 0xFF; S i '' = (S i ' × 0x5DEECE66D + 0xB) mod 2 48 ; r2 i = (S i '' 16) & 0xFF.

[0111] Step 4, reconstruct the first encrypted data based on the target seed value and two pseudo-random values corresponding to each position respectively.

[0112] Specifically, decode P1''[i], P2''[i], P3''[i] respectively through the following formula to obtain the decoding results corresponding to P1''[i], P2''[i], P3''[i]: a = P1''[i] ⊕ r1 i ⊕ ((i × 7 + 3) & 0x55); b = P2''[i] ⊕ r2 i ⊕ ((i × 11 + 5) & 0xAA); c = P3''[i] (S i '' & 0x3F) + ((S i '' 6) &0x3F); where a is the decoding result of P1''[i], b is the decoding result of P2''[i], and c is the decoding result of P3''[i].

[0113] Then, based on the above decoding results, the first encrypted data is reconstructed: Specifically, first, the bit pattern of the first encrypted data is extracted from a and b: B'[i] = (a & 0xAA) | (b & 0x55). Then, the information in c is used for verification and correction: B''[i] = r1 i ⊕ r2 i ⊕ c; Finally, the first encrypted data is determined using the following formula:

[0114] Where B'[i] is the bit pattern of the first encrypted data, and B''[i] is the verification information of B'[i].

[0115] Step 5, update the second seed value at each position using the following formula: S i+1 = (S) i '' × 0x5DEECE66D+ 0xB + (B[i]&0xFF)) mod 2 48 .

[0116] Based on the above data recovery method, configure the acquisition method of the first encrypted data. The main algorithm remains unchanged, but the randomly generated variables in the middle are directly written into constant values ​​according to the generation results and written into the configuration file.

[0117] Therefore, the original data, such as the protected data and the first encrypted data, only exist in the compiled configuration file. The original data will not appear in the data segment of the code file at all. Moreover, each method of obtaining data involves complex calculations and has slightly different implementation details, which greatly increases the difficulty of cracking.

[0118] In some optional implementations, configuring the second operation of the first operation in the encryption domain in the second code file in step S104 above includes: Step c1: Determine the first parameter data of the preset encryption type in the first operation.

[0119] The preset encryption type is set according to the user's needs. The preset encryption type includes the polynomial degree parameter in the first operation (such as powers of 2, 4096, 8192, etc.) and the modular chain used to control precision and noise management (such as Q = {q0,q1, ..., q...}). L One or more of the following can be used: discrete Gaussian distribution parameters (such as σ) used for error sampling, and coding precision parameters (such as Δ) used to control the accuracy of approximate calculations. These parameters can be adjusted according to actual needs.

[0120] Step c2 involves encrypting the first parameter data to obtain the third encrypted data.

[0121] Specifically, the first parameter data is treated as protected data, and a second encryption method corresponding to the first parameter data is configured in the second code file. The method for determining the second encryption method is the same as that for determining the first encryption method, and will not be elaborated further here. The third encrypted data can be obtained by calling the first encryption method corresponding to the first parameter data in the second code file.

[0122] Step c3: Based on the third encrypted data and the operation logic of the first operation, configure the homomorphic encryption operation of the first operation in the second code file to obtain the second operation.

[0123] It should be noted that homomorphic encryption is a special encryption technique whose core feature is that it allows direct computational operations on ciphertext (such as the first encrypted data of protected data), and the decryption result is consistent with the result of performing the same operation on the original plaintext (such as protected data). This technology overcomes the limitations of traditional encryption methods, enabling data processing without revealing the original data, and provides key technical support for fields such as privacy computing, secure multi-party computation, and encrypted search.

[0124] Optionally, the second operation can adopt a lattice-based cipher (Cheon-Kim-Kim-Song, CKKS) scheme, or a homomorphic encryption scheme such as the Brakerski-Gentry-Vaikuntanathan (BGV) hierarchical homomorphic encryption scheme. The homomorphic encryption operation of the first operation is configured in the second code file to obtain the second operation, thereby realizing approximate homomorphic computation on real number data to improve computational efficiency and accuracy.

[0125] Specifically, each key involved in the homomorphic encryption operation is generated only once, and the keys are securely stored after generation. The public key is publicly disclosed, while the remaining keys are stored confidentially in a second configuration file as protected data.

[0126] 1. The keys involved in homomorphic encryption operations are generated in the following ways: (1) Private key generation: Sample polynomial s from the finite Hamming weight distribution HWT(h), where s ∈ R[X] / (X^N +1), and R[X] is the set of polynomials. Set the private key sk = (1, s).

[0127] (2) Public key generation: random sampling polynomial a, and a ∈ Rq0. Based on the Gaussian distribution sampling error polynomial e, calculate b = -a·s + e (mod q0), and output public key pk = (b, a).

[0128] (3) Relinearization of key generation: Choose the modulus parameter P. For i∈{0,..., log2q0 }: Random sampling a' i ∈ Rq0, sampling error e' i b' is calculated i = -a' i ·s + e' i + P^i·s 2 (mod q0), output relinearization key rlk = {(b' i , a' i )} i .

[0129] (4) Rotation key generation: For the required cyclic shift amount r, define an automorphism mapping τ And calculate τ (s), generate key pair (b" ,a" ), output rotation key rotk = { (b" ,a" )} .

[0130] 2. The keys involved in homomorphic encryption operations are stored and managed in the following ways: (1) Key serialization: Serialize each key (such as sk, pk, rlk) into a byte stream and store the byte stream of the key in a secure encryption manner.

[0131] (2) Key loading: After generating the method for obtaining the key using source code generator technology (not disclosed to the public), the key is loaded using the corresponding method.

[0132] In practical applications, the key that needs to be encrypted can be treated as protected data. The byte stream of the key can be stored using the secure encryption method described above for protected data, and then the key can be loaded.

[0133] In some optional implementations, the operation logic based on the third encrypted data and the first operation in step c3 above is used to configure the homomorphic encryption operation of the first operation in the second code file to obtain the second operation, including: Step c31: Configure the method for obtaining the third encrypted data in the second code file.

[0134] Specifically, in the second code file, a first acquisition method is added for the third encrypted data, and the identifier of the first acquisition method is marked.

[0135] Step c32: Based on the method of obtaining the third encrypted data and the operation logic of the first operation, configure the homomorphic encryption operation of the first operation in the second code file to obtain the second operation.

[0136] Specifically, the configuration of homomorphic encryption operations mainly includes the following steps: 1. Data Encoding. First, the real number data in the first operation (i.e., the input data of the first operation) is encoded, converting the real number data into a polynomial representation suitable for homomorphic encryption schemes.

[0137] The data encoding process includes: (1) Vector embedding. The input of the data encoding includes a vector z ∈ Rn containing real data, where Rn is an n-dimensional real space. The conjugate symmetric vector z' of z is constructed.

[0138] (2) Discrete Fourier Transform. Applying the inverse discrete Fourier transform, we obtain m1 = σ. -1 (z'). Where σ is the discrete Gaussian distribution parameter.

[0139] (3) Scaling quantization. Apply a scaling factor to obtain the polynomial m = [Δ·m1], where Δ is the scaling factor. The output of the data encoding includes the encoded polynomial m.

[0140] 2. Configure the ciphertext corresponding to the real data.

[0141] The input to the homomorphic encryption operation includes the encoded polynomial m and the public key pk = (b, a). A random polynomial v is sampled, and two error polynomials e1 and e2 are used. C0 = b·v + e1 + m (mod q0) and c1 = a·v + e2 (mod q0) are calculated, and the final output is the ciphertext ct = (c0, c1).

[0142] For example, given the real number 5.75, the process of encrypting 5.75 includes: 1. Constructing a vector z = [5.75] for the real number data; 2. Encoding it to obtain a polynomial m; 3. Encrypting m using the public key pk to obtain the ciphertext ct. The ciphertext ct can be securely transmitted and stored, but the original value 5.75 cannot be directly obtained.

[0143] 3. Configure the decryption method corresponding to the real data.

[0144] (1) Decryption algorithm. The input to the decryption algorithm includes the ciphertext ct = (c0, c1) and the private key sk = (1, s). The inner product m' = c0 + c1·s (mod q) is calculated, and the output includes the decrypted polynomial m'.

[0145] (2) Decoding algorithm. The input of the decoding algorithm includes the decrypted polynomial m'. The decoding algorithm is used to scale and restore the decrypted polynomial m' by m1' = m' / Δ.

[0146] (3) Discrete Fourier Transform. Apply the forward discrete Fourier transform to the decrypted polynomial m' to obtain the transformed conjugate symmetric vector z' = σ(m1').

[0147] (4) Result extraction. Extract the first n values ​​from the transformed conjugate symmetric vector z' to obtain the vector z containing real data.

[0148] For example, if the protected data is 5.75, the decryption process of the ciphertext ct of 5.75 includes: 1. Calculating the inner product using the private key sk to obtain m'; 2. Decoding m' by scaling it and then performing a discrete Fourier transform; 3. Extracting the approximate value 5.75 from the transform result.

[0149] In practical applications, homomorphic encryption operations for different operations are as follows: 1. Homomorphic encryption operation of addition. Input includes two ciphertexts (i.e., encrypted data) for the addition operation: ct1 = (c0, c1) and ct2 = (d0, d1). The computation process includes: ct... aaa = (c0 + d0 mod q, c1 + d1 mod q). The output includes: the encrypted data ct of the addition operation result. aaa Where c0 is the first component of ct1, c1 is the second component of ct1, d0 is the first component of ct2, and d1 is the second component of ct2.

[0150] 2. Homomorphic encryption operation for subtraction. Input includes two ciphertexts for subtraction: ct1 = (c0, c1) and ct2 = (d0, d1). The calculation process includes: ct... s = (c0 - d0 mod q, c1 - d1 mod q). The output includes: the encrypted data ct of the subtraction result. s .

[0151] 3. Homomorphic encryption of multiplication. Input includes: ciphertext of two multipliers, ct1 = (c0, c1) and ct2 = (d0, d1), and the relinearization key rlk. Intermediate results include: d0 = c0·d0 mod q, d1 = c0·d1 + c1·d0 mod q, d2 = c1·d1 mod q. The relinearization process includes: factoring d2 = Σ i P i·d2, i c'0 = d0 + Σ i b' i ·d2, i modq, c'1 = d1 + Σ i a' i ·d2, i mod q. The rescaling process includes: c"0= c'0 / P mod q l+1 c"1= c'1 / P modq l+1 The output includes: encrypted data of the result of the multiplication operation, ct' = (c"0, c"1).

[0152] 4. Homomorphic encryption operation for division. Since homomorphic encryption operation does not directly support division, division is achieved by calculating the reciprocal and combining it with multiplication. The input of the homomorphic encryption operation for division includes: the ciphertext of the dividend ct1 and the ciphertext of the divisor ct2. The calculation process includes: (1) using Newton's iteration method to obtain: x i+1 = x i (2-ct2·x) i (2) Set the initial value x0 to an appropriate constant (such as 0.5); (3) Iteratively calculate the reciprocal approx_inverse of ct2. Calculate the product of ct1 and its reciprocal based on the homomorphic encryption operation of the above multiplication operation, i.e., ct1·approx_inverse. The output includes: the encrypted data of the result of the division operation.

[0153] 5. Homomorphic Encryption of Trigonometric Function Operations. Trigonometric function calculations under homomorphic conditions are implemented based on polynomial approximation.

[0154] (1) Homomorphic encryption operation of sine operation. Input includes: ciphertext ct (angle value x) for sine operation. Calculation process includes: using Taylor series to approximate sin(x) ≈ x - x 3 / 6 + x 5 / 120 - x 7 / 5040 +...。 Then calculate x², x³, x 5 x 7 The sine result, result = x - x, is obtained by calculating the weights of each power term. 3 / 6 + x 5 / 120 - x 7 / 5040. The output includes: encrypted data of the result of the sine operation.

[0155] (2) Homomorphic encryption operation of cosine operation. Input includes: ciphertext ct (angle value x) for cosine operation. Calculation process includes: using Taylor series approximation to obtain cos(x) ≈ 1 - x 2 / 2 + x 4 / 24 - x 6 / 720 +...。 Then calculate x², x 4 x 6 For each power term, the cosine result is obtained based on the weight of each power term: result = 1 - x 2 / 2 + x 4 / 24 - x 6 / 720. The output includes: encrypted data of the result of the cosine operation.

[0156] The code protection method provided in this embodiment configures the homomorphic encryption operation of the first operation in the second code file based on the third encrypted data and the operation logic of the first operation, thereby obtaining the second operation. This enables data processing without disclosing the original protected data, improving the security of software files.

[0157] As a specific application example, in related technologies, the calculation result is obtained by directly performing calculations on the data in the main program. After adopting the code protection method of this invention, the data interaction between the compilation results of the second code file and the compilation results of the third code file is described below. Figure 4 The compilation result of the third code file (hereinafter referred to as the main program) obtains the first encrypted data of the protected data by calling the first encryption method in the compilation result of the second code file, and transmits it to the main program through the boundary. Then, the main program performs a calculation on the first encrypted data according to the second operation in the compilation result of the second code file, obtaining the second encrypted data corresponding to the result of the operation on the protected data under the first operation. Finally, the main program decrypts the second encrypted data by calling the first decryption method in the second code file, obtaining the result of the operation on the protected data under the first operation.

[0158] For a specific application example, see Figure 5During compilation, protected data is extracted and written to a configuration file, generating a data identifier for the protected data. A first encryption method for the protected data is defined in the second code file (hereinafter referred to as the DLL), and the calling interface for the first encryption method is configured according to the data identifier. Simultaneously, the protected data is encrypted using a source code generator to obtain first encrypted data. This first encrypted data is then segmented using a segmentation obfuscation algorithm (such as a three-segment method and global obfuscation with a Feistel-like algorithm) to obtain multiple target segmented data. A data recovery method corresponding to the data segmentation is constructed, and the method for obtaining the first encrypted data is configured in the DLL according to the data recovery method, thus configuring the engineering link of the first encryption method. The DLL configures the second operation in the encrypted domain of the first operation related to the protected data, and configures the first decryption method for the operation results of the protected data and / or the second operation. Furthermore, the protected data in the first code file is replaced with calls to the first encryption method, the first operation in the first code file is replaced with calls to the second operation, and a call to the first decryption method is added to the first code file, resulting in a third code file. During build, the DLL is AOT compiled and obfuscated and encrypted. The third code file is then JIT-compiled to obtain the main program, maintaining its debuggability. Data exchange between the main program and the DLL occurs through the P / Invoke boundary. The main program obtains protected data and the results of the first operation on that protected data by calling the DLL's interface.

[0159] This embodiment also provides a code protection device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0160] This embodiment provides a code protection device, such as Figure 6 As shown, it includes: The data acquisition module 601 is used to acquire the first code file of the target program.

[0161] The first processing module 602 is used to determine the protected data in the first code file and the first operation related to the protected data.

[0162] The first configuration module 603 is used to configure a first encryption method for the protected data in the second code file.

[0163] The second configuration module 604 is used to configure the second operation of the first operation in the encryption domain in the second code file. The input of the second operation includes the first encrypted data of the protected data under the first encryption method; the output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation.

[0164] The third configuration module 605 is used to configure a first decryption method for the protected data and / or the result of the second operation in the second code file.

[0165] The second processing module 606 is used to replace the protected data in the first code file with a call for the first encryption method, replace the first operation in the first code file with a call for the second operation, and add a call for the first decryption method in the first code file to obtain a third code file. The target program is compiled from the second code file and the third code file.

[0166] The code protection device provided in this embodiment of the invention can execute the waybill data analysis method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0167] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0168] The following is a detailed reference. Figure 7 The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 702 or a program loaded from memory 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device. The processor 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 707 is also connected to the bus 704.

[0169] Typically, the following devices can be connected to I / O interface 707: input devices 707 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0170] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 709, or installed from a memory 708, or installed from a ROM 702. When the computer program is executed by the processor 701, it performs the functions defined in the code protection method of the embodiments of the present invention.

[0171] Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0172] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the code protection methods shown in the above embodiments are implemented.

[0173] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0174] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A code protection method, characterized in that, The method includes: Obtain the first code file of the target program; Determine the protected data in the first code file and the first operation related to the protected data; The protected data is encrypted to obtain the first encrypted data; The first encrypted data is segmented to obtain multiple target segmented data. Construct a data recovery method corresponding to the data segmentation, the data recovery method being used to recover the first encrypted data from the plurality of target segmented data; The method for obtaining the first encrypted data is configured based on the data recovery method, and is used as the first encryption method. The method for obtaining the first encrypted data is used to obtain the first encrypted data through the data recovery method and the plurality of target segmented data. Write the first encryption method into the second code file; Determine the first parameter data of the preset encryption type in the first operation; The first parameter data is encrypted to obtain the third encrypted data; Based on the third encrypted data and the operation logic of the first operation, the homomorphic encryption operation of the first operation is configured in the second code file to obtain the second operation. The input of the second operation includes the first encrypted data of the protected data under the first encryption method; the output of the second operation includes the second encrypted data corresponding to the operation result of the protected data under the first operation. Configure a first decryption method for the protected data and / or the result of the second operation in the second code file; The protected data in the first code file is replaced with a call to the first encryption method, the first operation in the first code file is replaced with a call to the second operation, and a call to the first decryption method is added to the first code file to obtain a third code file. The target program is compiled from the second code file and the third code file.

2. The code protection method according to claim 1, characterized in that, The first encrypted data is segmented to obtain multiple target segmented data, including: The first encrypted data is segmented to obtain multiple initial segmented data; The initial segmented data are obfuscated to obtain multiple target segmented data.

3. The code protection method according to claim 2, characterized in that, The first encrypted data is segmented to obtain multiple initial segmented data, including: Obtain the first seed value for the data segmentation; Based on the first seed value, the first encrypted data is segmented to obtain the plurality of initial segmented data.

4. The code protection method according to claim 3, characterized in that, The step of segmenting the first encrypted data based on the first seed value to obtain the plurality of initial segmented data includes: Based on the first encrypted data, the first seed value is recursively processed to obtain the second seed value; The first encrypted data is segmented based on the second seed value to obtain the plurality of initial segmented data.

5. The code protection method according to claim 4, characterized in that, The step of segmenting the first encrypted data based on the second seed value to obtain the plurality of initial segmented data includes: Generate at least one pseudo-random value corresponding to each position in the first encrypted data based on the second seed value; Based on at least one pseudo-random value corresponding to each of the aforementioned positions, the first encrypted data is segmented according to the positions to obtain the plurality of initial segmented data.

6. The code protection method according to claim 5, characterized in that, The step of segmenting the first encrypted data according to the positions based on at least one pseudo-random value corresponding to each of the aforementioned positions to obtain the plurality of initial segmented data includes: Based on at least one pseudo-random value corresponding to each of the aforementioned positions, the first encrypted data is segmented according to the positions to obtain multiple first segmented data; Obtain the first state variable corresponding to each of the first segmented data; Based on the first segmentation data, the corresponding first state variables are updated to obtain the second state variables corresponding to each of the first segmentation data. Based on the second state variable, the corresponding first segmented data is processed to obtain the second segmented data corresponding to each of the first segmented data, so as to obtain the plurality of initial segmented data.

7. The code protection method according to claim 1, characterized in that, Based on the third encrypted data and the operational logic of the first operation, the homomorphic encryption operation of the first operation is configured in the second code file to obtain the second operation, including: Configure the method for obtaining the third encrypted data in the second code file; Based on the acquisition method of the third encrypted data and the operation logic of the first operation, the homomorphic encryption operation of the first operation is configured in the second code file to obtain the second operation.

8. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the code protection method of any one of claims 1 to 7 by executing the computer instructions.

Images