AST callback mechanism-based code sensitive information removal method, device and medium

Abstract

The invention discloses a code sensitive information removing method and device based on an AST callback mechanism and a medium. The method comprises the following steps that 1, codes are input; accessing the complete engineering project into a compiler tool chain, and adding an AST callback processing plug-in into compilation parameters; 2) performing syntactic analysis on the code to generate an abstract syntax tree AST corresponding to the code structure; 3) registering a user-defined AST node callback mechanism, and traversing all target nodes according to the node type of AST; 4) constructing a cross-translation unit global symbol index table; 5) reading a configuration file provided by a user, and obtaining a sensitive element matching rule and a corresponding confusion strategy; the method comprises the steps of (1) carrying out sensitive information identification, (2) carrying out classification confusion processing, (3) carrying out code updating after confusion, (4) carrying out recompilation on the confused codes, and (5) outputting a compilation result after the confused codes pass semantic verification of a compiler. Based on a cross-translation unit of an AST callback mechanism, the integrity and accuracy of sensitive information identification can be improved.

Description

Technical Field

[0001] This invention relates to information security technology, and in particular to a method, device and medium for desensitizing code based on an AST callback mechanism. Background Technology

[0002] With the development of the software industry, the protection and security of source code intellectual property rights are becoming increasingly important. The security risks posed by the exposure of code in highly complex, large-scale software projects are becoming increasingly significant. Traditional source code protection methods include closed-source distribution, removal of sensitive information, and obfuscation.

[0003] LLVM provides complete intermediate representation (IR) and abstract syntax tree (AST) processing capabilities, enabling static analysis, optimization, and code transformation in the compilation chain. The encryption methods used, such as HMAC-SHA256 and AES, can protect sensitive information.

[0004] Patent CN119312295A describes a code obfuscation method, system, and medium for large-scale code models. The method involves converting the large-scale code model into an Abstract Syntax Tree (AST) using a static analysis tool, obfuscating the AST by scrambling function order, splitting variables, swapping variable and function names, and then encrypting the variable and function names using AES encoding. However, this method only applies to large-scale JavaScript code, lacking generality. Furthermore, the obfuscation method only swaps variable and function names, failing to cover the various code elements actually contained within the code and lacking configurability. It is evident that traditional AST matching, based on individual translation units, struggles to trace cross-file variable or function reference relationships, and AST node matching lacks flexibility and completeness. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a method, device and medium for desensitizing code based on AST callback mechanism, which addresses the deficiencies in the prior art.

[0006] The technical solution adopted by this invention to solve its technical problem is: a method for removing sensitive information from code based on an AST callback mechanism, comprising the following steps: 1) Code input; Connect the complete project to the compiler toolchain and add an AST callback processing plugin to the compilation parameters; 2) Perform syntax analysis on the code to generate an Abstract Syntax Tree (AST) corresponding to the code structure; 3) Register a custom AST node callback mechanism to traverse all target nodes according to the node type of the AST; Node types include function declarations, variable declarations, type definitions, and constants; During the traversal, collect node identification information, source file location, and scope information; The identification information includes: name and type; 4) Construct a global symbol index table across translation units to manage global symbol information from multiple source files in a unified manner; the global symbols include global functions, global variables, and global types; 5) Read the user-provided configuration file to obtain the sensitive element matching rules and corresponding obfuscation strategies; 6) Sensitive information matching; During the AST node callback traversal, obtain the type, name, and scope information of the callback node; The system dynamically binds and matches the node information acquired in real time with the matching rules in the configuration file; it then determines whether a node is a sensitive element based on the matching rules in the configuration file, including name matching (string or regular expression) or type matching (function, variable, type, constant). By combining a global symbol index table, sensitive element nodes can be located across files and scopes; 7) Hierarchical confusion handling; Based on the sensitivity level of the matched sensitive elements, an obfuscation strategy is applied to the nodes. 8) Update code after obfuscation; 9) Recompile the obfuscated code, and output the compilation result after passing the compiler's semantic verification.

[0007] According to the above scheme, step 1) specifically includes: The compiler reads the complete project and obtains the code. Add an AST callback processing plugin to the compilation parameters to allow AST callback processing to intervene in real time during the AST construction phase and obtain node information.

[0008] According to the above scheme, in step 4), step 4.1) initializes the global index table. The global index table is used to store the symbol information of sensitive information units in the project, including symbol name, symbol type, file path, line number, column number, and scope information. Step 4.2) Based on the node identification information, source file location, and scope information collected during the traversal, for each node, extract its name and type, declaration and definition location (file, line number, column number), and scope information (global, local, namespace, class / structure body, etc.) and record them in the index table; Step 4.3) Merge the index table entries for the same symbol from different files and different scopes, while maintaining the type hierarchy in the index table.

[0009] According to the above scheme, in step 5), the sensitive element matching rules include the sensitive element types that need to be matched; the sensitive element types include function names, variable names, types, and constants.

[0010] According to the above scheme, in step 5), the obfuscation strategy includes the sensitivity level bound to each matching rule, and the obfuscation processing method for the corresponding level; The obfuscation methods include rule replacement, HMAC, and AES.

[0011] According to the above scheme, in step 7), the obfuscation strategy is performed on the node as follows; Sensitivity level is high: irreversible encryption (HMAC-SHA256, SM4) is performed to generate a unique token, ensuring that it is unrecoverable under any context; The sensitivity level is medium sensitivity: reversible encryption (AES, RC4) is performed to facilitate internal debugging and tracing. Sensitivity level is low: Perform lightweight naming rule replacement or semantic prefix adjustment.

[0012] According to the above scheme, step 8) specifically includes the following: Generate a copy of the code that is completely identical to the original project directory structure; Based on the mapping relationship between AST nodes and code locations, the matched sensitive elements are precisely rewritten in the code copy.

[0013] According to the above scheme, in step 9), the obfuscated code is recompiled as follows: the rewritten obfuscated code is re-integrated into the compiler toolchain for compilation, and the compiler performs semantic verification to ensure that the obfuscated code is completely consistent with the original code in terms of symbol references, type matching, and linking relationships.

[0014] The beneficial effects of this invention are: 1. Based on the AST callback mechanism, the cross-translation unit method in this invention, by uniformly traversing multiple source files and recording file inclusion relationships and symbolic references, can identify sensitive information in different modules and translation units, thereby avoiding the limitations of traditional tools that are limited to single-file analysis and improving the completeness and accuracy of sensitive information identification.

[0015] 2. The method of the present invention allows users to flexibly configure different sensitive information identification rules and use different sensitive information detection rules without modifying the source code and compiler, thereby improving configurability and scalability. Attached Figure Description

[0016] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a flowchart of a method according to an embodiment of the present invention; Figure 2 This is a schematic representation of the global symbol index in an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0018] like Figure 1 As shown, a method for removing sensitive information from code based on an AST callback mechanism includes the following steps: 1) Code input; Integrate the complete project into the compiler toolchain and add an AST callback processing plugin to the compilation parameters; The compiler reads the complete project and obtains the code. Add an AST callback processing plugin to the compilation parameters to allow AST callback processing to intervene in real time during the AST construction phase and obtain node information; 2) Use a compiler to perform syntax analysis on the code and generate an Abstract Syntax Tree (AST) that corresponds one-to-one with the code structure; 3) After the compiler starts, it will load the AST callback processing plugin and register a custom AST node callback mechanism; Register a custom AST node callback mechanism to traverse all target nodes according to the node type of the AST; node types include function declarations, variable declarations, type definitions, and constants; During the traversal, collect node identification information, source file location, and scope. The identification information includes: name and type; 4) Construct a global symbol index table across translation units to uniformly manage symbol information such as global functions, variables, and types in multiple source files; Specifically as follows: Step 4.1) Initialize the global index table. The global index table is used to store symbol information of sensitive information units in the project, including symbol name, symbol type, file path, line number, column number, and scope information. Step 4.2) Based on the node identification information, source file location, and scope information collected during the traversal, for each node, extract its name and type, declaration and definition location (file, line number, column number), and scope information (global, local, namespace, class / structure body, etc.) and record them in the index table; Step 4.3) Merge the index table entries for the same symbol from different files and different scopes, while maintaining the type hierarchy in the index table; During the symbol collection process, sensitive information matching rules from external configuration files can be dynamically loaded and bound to symbols in the index table to quickly determine whether a symbol belongs to sensitive information in subsequent analysis.

[0019] The structure of the global symbol index table is as follows: Figure 2 As shown; 5) Read the user-provided configuration file to obtain the sensitive element matching rules and corresponding obfuscation strategies; The sensitive element matching rules include the types of sensitive elements to be matched; the sensitive element types include function names, variable names, types, and constants. The hierarchical obfuscation strategy includes a sensitivity level (high / medium / low) bound to each matching rule, and the obfuscation processing method for the corresponding level; The obfuscation methods include rule replacement, HMAC, and AES. 6) Sensitive information matching; During the AST node callback traversal, obtain the type, name, and scope information of the callback node; The system dynamically binds and matches the real-time acquired node semantic information (type, name, scope) with the matching rules in the configuration file; and then determines whether a node is a sensitive element based on the matching rules in the configuration file. That is, perform sensitive element type matching; include: Node type matching: function, variable, type, constant; Node name matching: using strings or regular expressions; By combining a global symbol index table, it is possible to accurately locate sensitive elements across files and scopes; 7) Hierarchical Confusion Handling Based on the sensitivity level of the matched sensitive elements, a differentiated obfuscation strategy is executed on the nodes; High Sensitivity Level: Performs irreversible encryption (HMAC-SHA256, SM4) to generate a unique token, ensuring that it is unrecoverable under any context; Medium sensitivity level: Performs reversible encryption (AES, RC4) for easy internal debugging and tracing; Low sensitivity level: Perform lightweight naming rule replacement or semantic prefix adjustment; 8) Code update after obfuscation Generate a copy of the code that is completely identical to the original project directory structure; Based on the mapping relationship between AST nodes and code locations, the matched sensitive elements are precisely rewritten in the code copy; 9) Recompile the obfuscated code, pass the compiler's semantic verification, and output the compilation result; The rewritten obfuscated code is then re-integrated into the compiler toolchain and compiled to pass the compiler's semantic verification. This ensures that the obfuscated code is completely consistent with the original code in terms of symbol references, type matching, and linking relationships, guaranteeing compilability and functional integrity.

[0020] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for removing sensitive information from code based on an AST callback mechanism, characterized in that, Includes the following steps: 1) Code input; Integrate the complete project into the compiler toolchain and add an AST callback processing plugin to the compilation parameters; 2) Perform syntax analysis on the code to generate an Abstract Syntax Tree (AST) corresponding to the code structure; 3) Register a custom AST node callback mechanism to traverse all target nodes according to the node type of the AST; Node types include function declarations, variable declarations, type definitions, and constants; During the traversal, collect node identification information, source file location, and scope information; 4) Construct a global symbol index table across translation units to manage global symbol information from multiple source files in a unified manner; the global symbols include global functions, global variables, and global types; 5) Read the user-provided configuration file to obtain the sensitive element matching rules and corresponding obfuscation strategies; 6) Sensitive information matching; During the AST node callback traversal, obtain the type, name, and scope information of the callback node; The acquired node information is dynamically bound and matched with the matching rules in the configuration file; then, the matching rules in the configuration file are used to determine whether a node is a sensitive element. By combining a global symbol index table, sensitive element nodes can be located across files and scopes; 7) Hierarchical confusion handling; Based on the sensitivity level of the matched sensitive elements, an obfuscation strategy is applied to the nodes. 8) Update code after obfuscation; 9) Recompile the obfuscated code and output the compilation results.

2. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, Step 1) specifically includes: The compiler reads the complete project and obtains the code. Add an AST callback processing plugin to the compilation parameters to allow AST callback processing to intervene in real time during the AST construction phase and obtain node information.

3. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 4), step 4.1) initializes the global index table. The global index table is used to store symbol information of sensitive information units in the project, including symbol name, symbol type, file path, line number, column number, and scope information. Step 4.2) Based on the node identification information, source file location, and scope information collected during the traversal, for each node, extract its name and type, declaration and definition location, and scope information and record them in the index table; Step 4.3) Merge the index table entries for the same symbol from different files and different scopes, while maintaining the type hierarchy in the index table.

4. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 5), the sensitive element matching rules include the sensitive element types that need to be matched; the sensitive element types include function names, variable names, types, and constants.

5. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 5), the obfuscation strategy includes the sensitivity level bound to each matching rule, and the obfuscation processing method for the corresponding level; The obfuscation methods include rule replacement, HMAC, and AES.

6. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 7), the obfuscation strategy is applied to the node as follows; Sensitivity level is high sensitivity: irreversible encryption is performed, a unique token is generated, and it is ensured that the encryption is unrecoverable under any circumstances; Sensitivity level: Medium sensitivity; Reversible encryption will be performed. Sensitivity level is low: Perform lightweight naming rule replacement or semantic prefix adjustment.

7. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 8), the specific details are as follows: Generate a copy of the code that is completely identical to the original project directory structure; Based on the mapping relationship between AST nodes and code locations, the matched sensitive elements are precisely rewritten in the code copy.

8. The method for removing sensitive information from code based on the AST callback mechanism according to claim 1, characterized in that, In step 9), the obfuscated code is recompiled, specifically as follows: the rewritten obfuscated code is re-integrated into the compiler toolchain for compilation, and semantic verification by the compiler is performed to ensure that the obfuscated code is completely consistent with the original code in terms of symbol references, type matching, and linking relationships.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 8.

Images