Code security protection system and method

Abstract

The present application belongs to the technical field of information security. Provided are a code security protection system and method, the method comprising: dynamically obfuscating a source code and generating an obfuscation seed for the source code; performing code obfuscation on the dynamically obfuscated source code by means of a static obfuscation mode corresponding to the obfuscation seed, so as to obtain a trusted application program, achieving fusion of dynamic obfuscation and static obfuscation; and meanwhile, performing state monitoring during a running process of the trusted application program, and executing a corresponding code security protection solution on the basis of a state monitoring result. Thus, the running state health of the trusted application program can be ensured while various code attacks can be resisted, and compared with traditional code obfuscation tools, the code reconstructed by the present tool has more robust security and higher performance. The present application eliminates the contradiction between overheads and security, provides a code execution security solution having security superior to that of hardware, and has the characteristics of being independent of hardware and achieving good scalability, low cost, high efficiency and high security.

Description

Code security protection system and method

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application number 2024101364831, filed on January 31, 2024, entitled “Code Security Protection System and Method,” which is incorporated herein by reference in its entirety. Technical Field

[0003] The present application relates to the field of information security technology, and in particular to a code security protection system and method. Background Art

[0004] Currently, the most widely used trusted execution environments for code internationally are based on the Trusted Execution Environment (TEE) standard. From a cost-effective perspective, TEE offers a balance between security and cost. However, due to its hardware-based nature, TEEs are subject to vulnerabilities and upgrade difficulties. Therefore, TEEs are suitable for low-value scenarios but not for high-value, network-wide scenarios. Therefore, software algorithms are required to address data privacy and computational challenges in high-value scenarios. Among various software protection methods for addressing issues such as code piracy and code attacks, code obfuscation is considered the most economical and simplest solution.

[0005] Code obfuscation, as a security measure, has been widely used in commercial software and mobile applications, helping developers enhance application security and reduce the risk of reverse engineering and malicious tampering. Code obfuscation includes static and dynamic code obfuscation. Static code obfuscation offers advantages such as compile-time implementation and the absence of runtime support. However, it also has disadvantages such as limited dynamism and difficulty with dynamic analysis. Dynamic code obfuscation has advantages such as handling dynamically generated code and responsiveness to dynamic analysis, but it also carries performance overhead and runtime environment dependency. Its adaptability and real-time nature also result in higher performance overhead, as well as implementation and maintenance costs. Summary of the Invention

[0006] The present application provides a code security protection system and method to address the defects in the prior art that static code obfuscation cannot achieve dynamic protection and the cost of dynamic code obfuscation is high.

[0007] This application provides a code security protection system, including:

[0008] The SOT tool is used to obtain source code, dynamically obfuscate the source code and generate an obfuscation seed for the source code; and perform code obfuscation on the dynamically obfuscated source code based on a static obfuscation method corresponding to the obfuscation seed to obtain a trusted application.

[0009] The state manager is used to monitor the state of the trusted application during its operation and to execute a corresponding code security protection solution based on the state monitoring result.

[0010] According to a code security protection system provided by the present application, the state manager includes a cloud state manager and a terminal state manager. The terminal state manager is used to monitor the status of the trusted application, and execute a corresponding code security protection scheme based on the status monitoring results in an offline state, or feed back the status monitoring results to the cloud state manager through a secure channel, and cooperate with the cloud state manager to execute a corresponding code security protection scheme based on the status monitoring results.

[0011] According to a code security protection system provided by the present application, the dynamic obfuscation of the source code includes:

[0012] Obtaining a dynamically obfuscated source code by injecting at least one of a nail code, a heartbeat code, and a timestamp code into the source code;

[0013] The nail code is used for code security protection. The code security protection scheme corresponding to the nail code includes aggregating running status and data, pausing code running, reporting abnormal operations to the cloud status manager and the terminal status manager, blacklisting terminal devices or users, and destroying the code;

[0014] The timestamp code is used to verify the legitimacy and integrity of the trusted application, and to detect whether the trusted application has been tampered with or abused; the cloud state manager and the terminal state manager are used to cooperate to implement online verification; the terminal state manager is used to implement offline verification;

[0015] The heartbeat code is used to verify whether the trusted application is running normally and whether it is subject to tampering attacks.

[0016] According to a code security protection system provided by the present application, the code obfuscation of the source code after dynamic obfuscation based on the static obfuscation method corresponding to the obfuscation seed includes:

[0017] Input the obfuscation seed into a preset obfuscation code table to obtain a static obfuscation mode output by the obfuscation code table;

[0018] Code obfuscation is performed on the dynamically obfuscated source code based on the static obfuscation method.

[0019] According to a code security protection system provided by the present application, the obfuscation code table includes a mapping function for mapping the result after taking the module of the obfuscation seed to the corresponding static obfuscation method, and the obfuscation seed is a random number or a user identity identification code.

[0020] According to a code security protection system provided by the present application, when a preset event occurs, the terminal state manager sends a timestamp request to the cloud state manager. The cloud state manager records the occurrence time of the preset event and sends the time information corresponding to the preset event to the terminal state manager. After the preset event occurs, the terminal state manager sends a timestamp request including the time information to the cloud state manager. The cloud state manager determines the legitimacy of the preset event based on the received timestamp request to achieve online verification.

[0021] The terminal status manager is further configured to obtain time information based on a preset channel, determine the occurrence time and end time of a preset event according to the time information, and judge the legitimacy of the preset event based on the historical occurrence time and historical end time of the preset event to achieve offline verification.

[0022] According to a code security protection system provided by the present application, the terminal status manager is also used to obtain the heartbeat information sent by the trusted application at regular intervals, and send the heartbeat information to the cloud status manager after confirming that there is no abnormality. The terminal status manager is also used to send heartbeat information to the cloud status manager before the trusted application enters the offline running state, and obtain the running status of the trusted application in the offline running state.

[0023] According to a code security protection system provided by the present application, the static obfuscation method includes function forwarding, which is used to implement indirect calls, monitor, modify or record the target function in the source code through custom logic, and collect statistical information of function calls.

[0024] According to a code security protection system provided by the present application, the static obfuscation method includes dynamic loading, which is used to mark the core content or the part to be protected in the source code as dynamically loaded content, and the dynamically loaded content is stored in the cloud platform;

[0025] The terminal status manager is also used to send a loading request to the cloud status manager through a secure channel. The cloud status manager is also used to encrypt the dynamic loading content corresponding to the loading request after receiving the loading request, and send the encrypted dynamic loading content to the terminal status manager. The terminal status manager decrypts the dynamic loading content based on the key to achieve online dynamic loading.

[0026] According to a code security protection system provided by the present application, the terminal state manager is also used to send a preloading request to the cloud state manager before the trusted application enters the offline running state. The cloud state manager is also used to encrypt the dynamic loading content corresponding to the preloading request after receiving the preloading request, and send the encrypted dynamic loading content to the terminal state manager. The terminal state manager decrypts the dynamic loading content based on the key to realize offline dynamic loading.

[0027] According to a code security protection system provided by the present application, the terminal state manager is also used to manage the life cycle of the dynamically loaded content and delete the dynamically loaded content based on preset deletion conditions during the life cycle management process.

[0028] This application also provides a code security protection method, including:

[0029] Obtaining source code, dynamically obfuscating the source code, and generating an obfuscated seed for the source code;

[0030] Obfuscating the source code after dynamic obfuscation based on the static obfuscation method corresponding to the obfuscation seed to obtain a trusted application;

[0031] Status monitoring is performed during the operation of the trusted application, and a corresponding code security protection solution is executed according to the status monitoring result.

[0032] The code security protection system and method provided by this application dynamically obfuscates the source code and generates an obfuscation seed for the source code; based on the static obfuscation method corresponding to the obfuscation seed, the dynamically obfuscated source code is obfuscated to obtain a trusted application, thus achieving the fusion of dynamic and static obfuscation. At the same time, status monitoring is performed during the operation of the trusted application, and the corresponding code security protection scheme is executed according to the status monitoring results. This can not only ensure the healthy operation of the trusted application, but also resist various code attacks. Compared with traditional code obfuscation tools, the code reconstructed by this tool has stronger security and higher performance. This application resolves the contradiction between overhead and security, and provides a code execution security solution with better security than hardware. It has the characteristics of being independent of hardware, good scalability, low cost, high efficiency, and high security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0034] FIG1 is a schematic diagram of the structure of a code security protection system provided in an embodiment of the present application;

[0035] FIG2 is a schematic diagram of a process of dynamic obfuscation provided by an embodiment of the present application;

[0036] FIG3 is a schematic diagram of the structure of a state manager provided in an embodiment of the present application;

[0037] FIG4 is a schematic diagram of an offline operation of a terminal status manager provided in an embodiment of the present application;

[0038] FIG5a is a schematic diagram of the injection process of the nail code provided in an embodiment of the present application, and FIG5b is a schematic diagram of the triggering process of the nail code provided in an embodiment of the present application;

[0039] FIG6 is a schematic diagram of the workflow of the obfuscated code conversion table provided in an embodiment of the present application;

[0040] FIG7 is a schematic diagram of different obfuscation codes output by different obfuscation methods provided in an embodiment of the present application;

[0041] FIG8 is a schematic diagram of multi-version obfuscation codes provided in an embodiment of the present application;

[0042] FIG9 is a schematic diagram of an online timestamp generation process according to an embodiment of the present application;

[0043] FIG10 is a schematic diagram of an online timestamp request process provided in an embodiment of the present application;

[0044] FIG11 is a schematic diagram of an abnormal process of an online timestamp request provided in an embodiment of the present application;

[0045] FIG12 is a schematic diagram of a process for determining time information of an offline timestamp provided in an embodiment of the present application;

[0046] FIG13 is a schematic diagram of an abnormal process of an offline timestamp request provided in an embodiment of the present application;

[0047] FIG14 is a schematic diagram of a heartbeat information interaction process according to an embodiment of the present application;

[0048] FIG15 is a schematic diagram of a process for sending heartbeat information provided in an embodiment of the present application;

[0049] FIG16 is a schematic diagram of a heartbeat information abnormality process according to an embodiment of the present application;

[0050] FIG17 is a block diagram of the function transfer provided in an embodiment of the present application;

[0051] FIG18a is a schematic diagram of unobfuscated code function transfer provided by an embodiment of the present application, and FIG18b is a schematic diagram of obfuscated code function transfer provided by an embodiment of the present application;

[0052] Figure 19a is one obfuscated version of the function transfer provided in an embodiment of the present application, Figure 19b is a second obfuscated version of the function transfer provided in an embodiment of the present application, and Figure 19c is a third obfuscated version of the function transfer provided in an embodiment of the present application;

[0053] FIG20 is a schematic diagram of a dynamic loading process according to an embodiment of the present application;

[0054] FIG21 is a schematic diagram of an online dynamic loading process provided by an embodiment of the present application;

[0055] FIG22 is a schematic diagram of an offline dynamic preloading process provided in an embodiment of the present application;

[0056] FIG23 is a schematic diagram of an offline dynamic loading process according to an embodiment of the present application;

[0057] Figure 24a is a flow chart of reading dynamically loaded content provided in an embodiment of the present application, and Figure 24b is a flow chart of deleting dynamically loaded content provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0059] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. The terms "first", "second", and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in an appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are mutually contradictory.

[0060] This application provides a scenario-free dynamic code protection and terminal code monitoring solution under the cloud computing paradigm, and provides a Security Execution Environment Obfuscation Tool (SOT) tool to provide highly reliable code execution security for trusted applications (TA). Specifically, this application improves existing code protection technology, featuring independence from hardware, good scalability, low cost, high efficiency, and high security, thus resolving the contradiction between performance overhead and security. The technical solution of this application is described in detail below in conjunction with the accompanying drawings.

[0061] FIG1 is a schematic diagram of the structure of a code security protection system provided in an embodiment of the present application. As shown in FIG1 , an embodiment of the present application provides a code security protection system, including:

[0062] The SOT tool is used to obtain source code, dynamically obfuscate the source code and generate an obfuscation seed for the source code; and perform code obfuscation on the dynamically obfuscated source code based on a static obfuscation method corresponding to the obfuscation seed to obtain a trusted application.

[0063] Optionally, the SOT tool includes a static obfuscation function module and a dynamic obfuscation function module. The static obfuscation function module obfuscates the code through static obfuscation methods such as symbol renaming, control flow obfuscation, data flow obfuscation, constant obfuscation, false code insertion, string encryption, fuzzy logic, multi-layer obfuscation, code reduction, code insertion, junk instructions, disassembly obfuscation, and anti-alias detection. The dynamic obfuscation function module integrates static obfuscation methods through technologies such as nail code, heartbeat code, and timestamp code, and can obfuscate the source code and can also obfuscate the code during the operation of trusted applications.

[0064] Figure 2 is a flow chart of dynamic obfuscation provided by an embodiment of the present application. As shown in Figure 2, SOT first dynamically obfuscates the source code SC (Source Code), injects nail code, heartbeat code, and timestamp code, and generates obfuscation seeds at the same time, and then inputs the source code and obfuscation seeds into the static obfuscation process of the next stage. Next, SOT will dynamically obfuscate the source code according to the obfuscation seeds and obfuscation code table, and implement code obfuscation through obfuscation technologies such as obfuscation code table, function transfer, disassembly obfuscation, and alias detection. The output of SOT is SC' after static obfuscation and dynamic obfuscation. If the source code is a compiled language, it will be further compiled into machine code MC' (Machine Code), and interpreted languages ​​do not require additional compilation. The output of SOT will be merged into an application, which will be executed in a trusted terminal environment, referred to as a trusted application TA (Trusted Application).

[0065] The state manager is used to monitor the state of the trusted application during its operation and to execute a corresponding code security protection solution based on the state monitoring result.

[0066] Status monitoring can monitor whether the trusted application has reached the nail code, heartbeat code, and timestamp code, and determine whether the trusted application is running normally based on the status monitoring results. If an abnormality is detected, the code security protection plan is implemented, such as stopping the application.

[0067] If a trusted application runs into a nail program, it can authenticate itself to the trusted cloud platform and continue to run the trusted application after passing the authentication. In other embodiments, the trusted application can also run as a subroutine. If it runs into the nail code, the static obfuscation method is updated to confuse the non-running program code to ensure code security.

[0068] As can be understood, this application achieves a fusion of dynamic and static obfuscation, ensuring the healthy operation of trusted applications while protecting against a variety of code attacks. Compared to traditional code obfuscation tools, the code reconstructed by this tool has stronger security and higher performance. This application also resolves the contradiction between overhead and security, providing a code execution security solution that is more secure than hardware, with the characteristics of being independent of hardware, good scalability, low cost, high efficiency, and high security.

[0069] Figure 3 is a structural diagram of the state manager provided in an embodiment of the present application. As shown in Figure 3, based on the above embodiment, as an optional embodiment, the state manager includes a cloud state manager and a terminal state manager. The terminal state manager is used to monitor the status of the trusted application, and execute the corresponding code security protection scheme according to the status monitoring result in an offline state, or feed back the status monitoring result to the cloud state manager through a secure channel, and cooperate with the cloud state manager to execute the corresponding code security protection scheme according to the status monitoring result.

[0070] SOT state management is divided into a cloud state manager and a terminal state manager. The two interact through secure channels, monitoring the operational status of the TA in real time and issuing immediate alerts and mitigation measures when suspicious behavior occurs, achieving round-the-clock code operation monitoring and protection. The terminal device's state manager has the ability to control the TA. When an abnormal operating state is detected, it can immediately take mitigation measures, such as terminating the TA's operation, to reduce losses and risks.

[0071] Figure 4 is a schematic diagram of the offline operation of the terminal status manager provided in an embodiment of the present application. As shown in Figure 4, when the terminal status manager is operating offline, that is, in a scenario where the terminal status manager has no network communication connection with the cloud status manager, the terminal status manager can still monitor and control TA autonomously, self-sustainingly, and self-consistently, thereby realizing an offline and independent closed-loop status management mechanism for the terminal status manager.

[0072] It can be understood that the flexible control mechanism for offline and online integration provided by this application not only improves the robustness when facing network interruption problems, but also increases the flexibility of the solution, making it suitable for different types of applications and communication scenarios; it helps to develop offline operation modes without sacrificing security.

[0073] Based on the above embodiment, as an optional embodiment, the dynamically obfuscating the source code includes:

[0074] Obtaining a dynamically obfuscated source code by injecting at least one of a nail code, a heartbeat code, and a timestamp code into the source code;

[0075] The nail code is used for code security protection. The code security protection scheme corresponding to the nail code includes aggregating running status and data, pausing code running, reporting abnormal operations to the cloud status manager and the terminal status manager, blacklisting terminal devices or users, and destroying the code;

[0076] The timestamp code is used to verify the legitimacy and integrity of the trusted application, and to detect whether the trusted application has been tampered with or abused; the cloud state manager and the terminal state manager are used to cooperate to implement online verification; the terminal state manager is used to implement offline verification;

[0077] The heartbeat code is used to verify whether the trusted application is running normally and whether it is subject to tampering attacks.

[0078] Figure 5a is a schematic diagram of the injection process of the nail code provided in an embodiment of the present application, and Figure 5b is a schematic diagram of the process of triggering the nail code provided in an embodiment of the present application. As shown in Figures 5a and 5b, nail code is a section of code injected into the source code. It can add additional monitoring, control, status information collection, cloud connection, obfuscation and other functions without affecting the normal operation of the source code, and play a role in code security protection. If the nail condition is triggered while the TA code is running, a series of defense measures will be implemented, such as aggregating running status and data, pausing code execution, reporting abnormal operations to the cloud and terminal status manager, blacklisting the corresponding terminal device or user, etc. In extreme scenarios, nail code can also be used to trigger the self-destruction of the TA code to prevent the leakage of sensitive data and reduce the losses caused by attacks. The nail code will exchange information with the terminal status manager on the terminal device, and the cloud platform's cloud status manager and the terminal status manager of the terminal device will interact through a secure channel. In the scenario where the terminal device is running offline, the terminal status manager of the terminal device can also run independently and autonomously, launching a closed-loop offline protection mechanism for real-time monitoring and control.

[0079] It is understandable that the injection of nail code realizes the dynamic obfuscation function, and also plays the role of anti-debugging and intercepting modification behavior to protect code security. Combined with the cloud status manager and terminal status manager, real-time operation status monitoring and supervision can be achieved.

[0080] Based on the above embodiment, as an optional embodiment, the step of performing code obfuscation on the dynamically obfuscated source code based on the static obfuscation method corresponding to the obfuscation seed includes:

[0081] The obfuscation seed is input into a preset obfuscation coding table to obtain a static obfuscation method output by the obfuscation coding table; the obfuscation coding table includes a mapping function for mapping the result after taking the obfuscation seed modulo to the corresponding static obfuscation method, and the obfuscation seed is a random number or a user identity identification code.

[0082] Code obfuscation is performed on the dynamically obfuscated source code based on the static obfuscation method.

[0083] Figure 6 is a schematic diagram of the workflow of the obfuscation code table provided in an embodiment of the present application. As shown in Figure 6, various static obfuscation methods of the SOT tool are determined based on the input obfuscation seed. The obfuscation code table is a mapping function that maps the result after taking the obfuscation seed modulo to the corresponding static obfuscation method. Therefore, based on the obfuscation seed input to the SOT tool, the obfuscation method is transformed, thereby making the static obfuscation dynamic. This technology combines the advantages of traditional static obfuscation and dynamic obfuscation, while also eliminating the shortcomings of both. Compared with the traditional dynamic obfuscation method of injecting dynamic link libraries (.dll) or shared object files (.so), it not only copes with dynamic analysis, but also solves problems such as performance overhead and runtime environment dependence. Compared with the traditional dynamic obfuscation method of bytecode injection, more dynamic transformations of obfuscation methods are achieved. The obfuscation seed can be a customized random number, or it can be a user's unique identity identification code, etc.; the obfuscation method can be customized to provide greater flexibility for the obfuscation process.

[0084] FIG7 is a schematic diagram of different obfuscation methods provided in an embodiment of the present application outputting different obfuscated codes. As shown in FIG7 , the source code MC / SC is obfuscated by different obfuscation methods to generate different versions of obfuscated code MC' / SC'. These obfuscated codes use the technology of nail code to achieve a different function call graph for each code at runtime without affecting the normal function operation of the terminal program, so that different versions of the code have different logical orders, greatly increasing the difficulty of reverse engineering. The function call order of the unobfuscated code is that the main function calls function A, then function A calls function C, and the main function calls function B. Although the different versions of the obfuscated code insert nail flower instructions in different places and disrupt the function call graph, this action does not affect the normal operation of the program. The TA code is still consistent in the relative order of executing the main function and functions A, B, and C.

[0085] Figure 8 is a schematic diagram of the multi-version obfuscated code provided by an embodiment of the present application. As shown in Figure 8, the applications installed on different users' terminal devices use different versions of the obfuscated code, but there is no functional difference. The executed applications also maintain a connection with the terminal device's terminal state manager and cloud platform for round-the-clock information exchange and state management. After an attacker cracks one version of the TA code, they still need to expend more resources to attack and crack other versions of the TA code, creating a deterrent effect and forcing attackers to retreat.

[0086] It can be understood that this application determines the static obfuscation method by obfuscating the seed, which can ensure the diversity of TA code, increase the attack cost of attackers, and thus achieve code security protection.

[0087] Based on the above embodiment, as an optional embodiment, when a preset event occurs, the terminal state manager sends a timestamp request to the cloud state manager, and the cloud state manager records the occurrence time of the preset event and sends the time information corresponding to the preset event to the terminal state manager; after the preset event occurs, the terminal state manager sends a timestamp request including the time information to the cloud state manager, and the cloud state manager determines the legitimacy of the preset event based on the received timestamp request to achieve online verification;

[0088] The terminal status manager is further configured to obtain time information based on a preset channel, determine the occurrence time and end time of a preset event according to the time information, and judge the legitimacy of the preset event based on the historical occurrence time and historical end time of the preset event to achieve offline verification.

[0089] Figure 9 is a schematic diagram of the online timestamp generation process provided by an embodiment of the present application. As shown in Figure 9, a timestamp is a set of coded information containing the executed instructions or the events that occurred and the time of occurrence. The present application uses timestamps to verify the legitimacy and integrity of the code, and to detect whether the code has been tampered with or abused. The cloud platform can determine whether the code is expired or illegally used by verifying the timestamp, thereby improving the security of the code. When the terminal sends a timestamp request, it will use the private key to sign the request content to bind the identity and send it to the cloud state manager. After the cloud state manager verifies the request, it will send a trusted timestamp and sign it with the private key of the cloud state manager as a credential. The signed reply is tamper-proof and cannot be forged, providing trusted and reliable time information.

[0090] Figure 10 is a schematic diagram of the online timestamp request process provided by an embodiment of the present application. As shown in Figure 10, an event refers to a key code, instruction, or logical step related to the normal operation of the terminal device function. When an event occurs, the terminal device will send a timestamp request to the cloud, and after receiving the request, the cloud will record the occurrence of event A and reply to the terminal with the trusted and reliable time information Δ mentioned above. When the terminal's event A is completed, it will send a timestamp request containing Δ to the cloud again for reporting, and the cloud will verify the received information and determine the legitimacy of the event, and take corresponding measures. The application of timestamps can be used to verify the rationality of the occurrence of an event, and can also be used as a verification of the time status of the terminal and the cloud.

[0091] FIG11 is a schematic diagram of an abnormal online timestamp request process provided by an embodiment of the present application. As shown in FIG11 , when an abnormal event occurs, the rationality of the time of occurrence can be inferred by statistically calculating the reasonable time of occurrence of the event. The historical records collected by the cloud state manager can be used to determine whether the behavior of a terminal device is abnormal or malicious, and to take corresponding measures. The cold start problem can be solved by a warm-up period. During this period, the reasonable time of occurrence of the event can be set to a relatively wide range. As time and the amount of statistical data increase, it can be adjusted to be closer to the actual reasonable time of occurrence.

[0092] FIG12 is a schematic diagram of the time information determination process of the offline timestamp provided by the embodiment of the present application. As shown in FIG12 , when the terminal device needs to operate offline, the terminal status manager will obtain time information through different channels. The time basis for timestamp management is: ① The user obtains a reliable and trustworthy timestamp with a signature credential from the cloud status manager when logging in, downloading and upgrading software, and other network operations; ② The content timestamp of other channels, such as the time information of multimedia content obtained by the application through other channels; ③ The built-in system time of the terminal status manager; ④ The date and time recorded by the hardware clock device; ⑤ And the timestamps of some other channels. Among them, the most important time basis is point ①. Considering the offline situation, the terminal status manager will use the time point with a signature credential as the final basis, calculate the time elapsed from this time point, and compare the time points obtained by each channel, thereby ensuring that the time information of the terminal device is not subject to malicious tampering and attacks.

[0093] FIG13 is a schematic diagram of an abnormal process of an offline timestamp request provided by an embodiment of the present application. As shown in FIG13 , in an offline state, the terminal state manager will judge the legitimacy of an event based on historical statistical data. For example, when the occurrence time of event A is almost the same as the reasonable occurrence time of event A in the terminal's historical statistics, the state manager determines it as a normal event. Conversely, when the occurrence time of event A exceeds the reasonable occurrence time of event A in the terminal's historical statistics, the state manager determines it as an abnormal event. In addition, when there is a problem with the temporal continuity of the execution of an event, it will also be judged as an abnormal event. For example, event B is divided into two time segments for execution. Although the total time consumed is almost the same as the reasonable occurrence time of event B in the historical statistics, a time breakpoint occurs during the execution of event B. In the early stages of the use of the terminal device, the cold start problem can be solved by downloading the statistically reasonable occurrence time of the event from the cloud, or by using a preheater to allow the terminal device to be used for a period of time and to have a certain amount of statistical data before starting the monitoring of abnormal events.

[0094] It is understandable that this application verifies the legitimacy and integrity of the code through online timestamps and offline timestamps, detects whether the code has been tampered with or abused, and determines whether the code has expired or been illegally used, thereby improving the security of the code.

[0095] Based on the above embodiment, as an optional embodiment, the terminal status manager is also used to obtain the heartbeat information sent by the trusted application at regular intervals, and send the heartbeat information to the cloud status manager after confirming that there is no abnormality. The terminal status manager is also used to send heartbeat information to the cloud status manager before the trusted application enters the offline running state, and obtain the running status of the trusted application in the offline running state.

[0096] Figure 14 is a schematic diagram of the heartbeat information interaction process provided by an embodiment of the present application. As shown in Figure 14, the heartbeat mechanism refers to the process in which an application sends fixed information to the terminal state manager and the cloud state manager at regular intervals during a persistent connection, allowing the state manager to confirm the application's operating status. The TA code will be integrated into the heartbeat mechanism. Whenever the corresponding function is executed, it will send specified information and the current operating status to the terminal state manager and the cloud state manager. This allows the terminal device to provide timely feedback to the state manager when running a specific part of the program. The state manager can then verify whether the program is running normally or has not been tampered with, thereby monitoring the availability and health of the system or service. In addition, the heartbeat mechanism can also help developers promptly identify problems in the code and take appropriate measures. By regularly sending heartbeat signals, the program can confirm its own integrity and operating status and take appropriate protective measures. If the state manager does not receive the corresponding heartbeat information on time, it will take corresponding measures, such as restricting the terminal device's permissions. Therefore, the heartbeat mechanism can also prevent malicious modification or tampering of the program and increase the difficulty for attackers to reverse engineer the program.

[0097] FIG15 is a schematic diagram of the heartbeat information transmission process provided by an embodiment of the present application. As shown in FIG15 , the heartbeat mechanism is mainly divided into three layers: the trusted application on the terminal device, the terminal state manager, and the cloud state manager. The trusted application on the terminal device will periodically send heartbeat information to the terminal state manager, and the terminal state manager will send heartbeat information to the cloud state manager again after confirming that there are no abnormalities. Before the terminal device is about to enter the normal offline operation state, it will also notify the cloud state manager for record keeping to facilitate the identification of different situations such as normal offline, accidental disconnection, and malicious network manipulation. When offline or disconnected, the terminal state manager will continue to monitor the terminal's operating status and store the monitoring data in the terminal device's secure storage so that it can send information to the cloud state manager as soon as a network connection is established. After reestablishing a network connection, the terminal state manager will resend the previously missed heartbeats, and the cloud state manager will determine whether the reported offline operation state is abnormal or malicious by analyzing the reported offline operation state.

[0098] FIG16 is a schematic diagram of the heartbeat information anomaly process provided by an embodiment of the present application. As shown in FIG16 , in addition to monitoring the heartbeat information sent by the cloud state manager through the terminal device, the terminal state manager also has the function of monitoring the TA. Before the heartbeat information is sent to the cloud state manager, the terminal state manager will perform the first state analysis as the first line of defense for the defense system. This design also ensures that in an offline state, there is still a monitoring mechanism that can take defensive measures in the first place to achieve a preemptive effect, thereby improving the robustness of the system in unstable network conditions.

[0099] It can be understood that this application implements dual heartbeat monitoring by adding heartbeat code to the source code and combining the cloud status manager and the terminal status manager, thereby improving the accuracy of abnormality monitoring.

[0100] Based on the above embodiment, as an optional embodiment, the static obfuscation method includes function forwarding, which is used to implement indirect calls, monitor, modify or record the target function in the source code through custom logic, and collect statistical information of function calls.

[0101] Figure 17 is a principle block diagram of function forwarding provided in an embodiment of the present application. As shown in Figure 17, the main function of function forwarding is to provide an indirect calling path for creating a more abstract and difficult to understand execution logic sequence, so that analysts need to spend more resources to deeply understand the dynamic behavior of the program.

[0102] Function transfer also implements the following functions:

[0103] 1. Indirect Calls: Function forwarding introduces indirect calls, obscuring the actual logical order in the code. Combining function forwarding with other code obfuscation techniques, such as control flow obfuscation and instruction replacement, further increases code complexity, making it more difficult for analysts to understand and restore the source code.

[0104] 2. Behavioral Analysis: By replacing the target function's address with the address of a function forwarding mechanism, custom logic can be added to the function forwarding mechanism to monitor, modify, or record the target function. Function forwarding mechanisms are used to replace the original function and redirect the target function's call path to the function forwarding mechanism by modifying function pointers or import tables. This makes it difficult for analysts to directly view the original function's code and logic.

[0105] 3. Performance Analysis: Function forwarding can be used to collect statistics about function calls, such as execution time and number of calls. By adding logging logic to function forwarding, detailed information about function calls can be obtained.

[0106] Figure 18a is a schematic diagram of the function relay of unobfuscated code provided by an embodiment of the present application, and Figure 18b is a schematic diagram of the function relay of obfuscated code provided by an embodiment of the present application. As shown in Figures 18a and 18b, the main function calls a sub-function: in the unobfuscated code, the main function directly calls function A, and the return value of function A is directly given to the main function. In the obfuscated code, when the main function calls function A, it must first input parameters to the function relay. After receiving the parameters, the function relay calls function A. The return value of function A after execution also needs to be returned to the main function through the function relay.

[0107] Mutual calls between sub-functions: In the unobfuscated code, the main function first calls function A, then function A calls function C, and finally function C returns a value to function A, and function A returns a value to the main function. In the obfuscated code, the main function first passes a parameter to the function relay, then the function relay calls function A, then function A passes a parameter to the function relay, then function relay calls function C, then function C passes the return value to the function relay, then function relay passes the return value of function C to function A, then function A passes the return value to the function relay, and finally function relay passes the return value of function A to the main function.

[0108] Figure 19a is one of the obfuscated versions of the function transfer provided in the embodiment of the present application, Figure 19b is the second obfuscated version of the function transfer provided in the embodiment of the present application, and Figure 19c is the third obfuscated version of the function transfer provided in the embodiment of the present application. As shown in Figures 19a-19c, the function transfer performs function calls based on the input parameters and mapping tables. Through different mapping tables with different obfuscated versions, different terminals have different versions of mapping relationships. For example, the mapping results of a specific alias in different versions are inconsistent, making it impossible for attackers to easily determine the original function call relationship, thereby increasing the difficulty of reverse engineering.

[0109] It can be understood that this application provides an indirect function calling mechanism through the use of function forwarding, which makes the program have a more complex logical sequence, thereby effectively increasing the difficulty of reverse engineering.

[0110] FIG20 is a schematic diagram of a dynamic loading process provided by an embodiment of the present application. As shown in FIG20 , based on the above embodiment, as an optional embodiment, the static obfuscation method includes dynamic loading, and the dynamic loading is used to mark the core content or the portion to be protected in the source code as dynamically loaded content, and the dynamically loaded content is stored in the cloud platform;

[0111] During the code obfuscation process, dynamic loading refers to marking the core critical content of the software or parts that need to be protected, including code, function libraries, multimedia resources, dynamic link libraries (.dll), shared object files (.so), etc., as dynamically loaded content. Utilizing dynamic loading and encryption technology, this ensures that resources are dynamically loaded and run in real time, in conjunction with the terminal state manager and cloud state manager, only when needed. These dynamically loaded contents are automatically deleted at the end of their lifecycle and when no longer needed, reducing the risk of content leakage. This also prevents attackers from cracking and analyzing the complete content during reverse engineering, increasing software security and reducing the leakage of sensitive content.

[0112] The terminal status manager is also used to send a loading request to the cloud status manager through a secure channel. The cloud status manager is also used to encrypt the dynamic loading content corresponding to the loading request after receiving the loading request, and send the encrypted dynamic loading content to the terminal status manager. The terminal status manager decrypts the dynamic loading content based on the key to achieve online dynamic loading.

[0113] Figure 21 is a schematic diagram of the online dynamic loading process provided by an embodiment of the present application. As shown in Figure 21, resources marked as dynamically loaded content will be securely stored and kept by the cloud platform, and when the terminal device needs to use the resources, it will coordinate and interact with the cloud state manager through the terminal state manager. The terminal state manager first sends a loading request to the cloud state manager through a secure channel. After receiving the request, the cloud state manager will obtain the corresponding resources from the secure storage of the cloud platform, encrypt the resources using the public key of the terminal device, and then send the encrypted resources to the terminal state manager. After receiving the encrypted resources, the terminal device will use the private key to decrypt and use the resources.

[0114] The terminal status manager is also used to send a preloading request to the cloud status manager before the trusted application enters the offline running state. The cloud status manager is also used to encrypt the dynamic loading content corresponding to the preloading request after receiving the preloading request, and send the encrypted dynamic loading content to the terminal status manager. The terminal status manager decrypts the dynamic loading content based on the key to achieve offline dynamic loading.

[0115] Figure 22 is a schematic diagram of the offline dynamic preloading process provided by an embodiment of the present application. As shown in Figure 22, in a scenario where the terminal device needs to run offline, a preloading request can be sent to the cloud state manager in advance through the offline dynamic loading mode to ensure that the relevant dynamic loading resources can be obtained in the offline state. First, the user offline mode option can be provided on the terminal device for preloading, and after receiving the request, the cloud state manager retrieves all relevant resources from the secure storage of the cloud platform, packages and encrypts them, and sends them to the terminal device. After receiving the resource package, the terminal device will store it in the secure storage on the terminal device so that it can be read and used in the future when running offline. The content of the resource package stored in the terminal device can have a customized life cycle, and is maintained by the terminal's state manager and deleted without a trace when the conditions are met. Therefore, a specific life cycle can be used to force users to go online periodically to facilitate resource updates and maintenance.

[0116] FIG23 is a schematic diagram of the offline dynamic loading process provided by an embodiment of the present application. As shown in FIG23 , during offline operation, when the TA code executes the portion that needs to be dynamically loaded, a resource request is sent to the terminal state manager, and the terminal state manager uses the private key to decrypt the relevant resource for reading. After use, the terminal state manager will retain the resource for future reuse or perform customized operations such as deletion based on defined conditions.

[0117] The terminal state manager is further configured to manage the life cycle of the dynamically loaded content and delete the dynamically loaded content based on a preset deletion condition during the life cycle management process.

[0118] Figure 24a is a flow chart of reading dynamically loaded content provided by an embodiment of the present application, and Figure 24b is a flow chart of deleting dynamically loaded content provided by an embodiment of the present application. As shown in Figures 24a and 24b, dynamically loaded content has its own life cycle, which is managed by the terminal state manager. When required during operation, dynamic loading is performed in the cloud or offline; when no longer needed, resources are deleted without a trace according to the defined conditions, or temporarily unneeded resources are securely stored. The conditions that trigger the without a trace deletion can be any custom conditions such as specially defined time conditions or deadlines, number of uses, function or variable references, dynamic link libraries (.dll) or shared object files (.so) references, etc. The terminal state manager will keep or without a trace the temporarily stored resources based on these conditions.

[0119] It is understandable that this application utilizes dynamic loading and encryption technology to ensure that resources are loaded and run in real time only when needed, dynamically coordinating with the terminal and cloud state managers. This dynamically loaded content is automatically deleted after its lifecycle ends and when no longer needed, reducing the risk of content leakage. This also prevents attackers from cracking and analyzing the complete content during reverse engineering, increasing software security and reducing the leakage of sensitive content.

[0120] The code security protection method provided by the present application is described below. The code security protection method described below and the code security protection system described above can be referenced to each other.

[0121] This application also provides a code security protection method, which is implemented based on the code security protection system and includes:

[0122] Step 1: Obtain source code, dynamically obfuscate the source code, and generate an obfuscation seed for the source code;

[0123] Step 2, performing code obfuscation on the dynamically obfuscated source code based on the static obfuscation method corresponding to the obfuscation seed to obtain a trusted application;

[0124] Step 3: Perform status monitoring during the operation of the trusted application, and execute a corresponding code security protection solution based on the status monitoring result.

[0125] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A code security protection system, comprising: A SOT tool is used to obtain source code, dynamically obfuscate the source code, and generate an obfuscation seed for the source code; Obfuscating the source code after dynamic obfuscation based on the static obfuscation method corresponding to the obfuscation seed to obtain a trusted application; The state manager is used to monitor the state of the trusted application during its operation and to execute a corresponding code security protection solution based on the state monitoring result.

2. The code security protection system according to claim 1, wherein: The state manager includes a cloud state manager and a terminal state manager. The terminal state manager is used to monitor the state of the trusted application and execute the corresponding code security protection scheme based on the state monitoring results in an offline state, or feed back the state monitoring results to the cloud state manager through a secure channel, and cooperate with the cloud state manager to execute the corresponding code security protection scheme based on the state monitoring results.

3. The code security protection system according to claim 2, wherein: The dynamically obfuscating the source code includes: Obtaining a dynamically obfuscated source code by injecting at least one of a nail code, a heartbeat code, and a timestamp code into the source code; The nail code is used for code security protection. The code security protection scheme corresponding to the nail code includes aggregating running status and data, pausing code running, reporting abnormal operations to the cloud status manager and the terminal status manager, blacklisting terminal devices or users, and destroying the code; The timestamp code is used to verify the legitimacy and integrity of the trusted application, and to detect whether the trusted application has been tampered with or abused; the cloud state manager and the terminal state manager are used to cooperate to implement online verification; the terminal state manager is used to implement offline verification; The heartbeat code is used to verify whether the trusted application is running normally and whether it is subject to tampering attacks.

4. The code security protection system according to claim 3, wherein: Obfuscating the source code after dynamic obfuscation based on the static obfuscation method corresponding to the obfuscation seed includes: Input the obfuscation seed into a preset obfuscation code table to obtain a static obfuscation mode output by the obfuscation code table; Code obfuscation is performed on the dynamically obfuscated source code based on the static obfuscation method.

5. The code security protection system according to claim 4, wherein: The obfuscation code table includes a mapping function for mapping the result of modulo the obfuscation seed to the corresponding static obfuscation mode, and the obfuscation seed is a random number or a user identity identification code.

6. The code security protection system according to claim 3, wherein: When a preset event occurs, the terminal state manager sends a timestamp request to the cloud state manager. The cloud state manager records the occurrence time of the preset event and sends the time information corresponding to the preset event to the terminal state manager. After the preset event occurs, the terminal state manager sends a timestamp request including the time information to the cloud state manager. The cloud state manager determines the legitimacy of the preset event based on the received timestamp request to achieve online verification. The terminal status manager is further configured to obtain time information based on a preset channel, determine the occurrence time and end time of a preset event according to the time information, and judge the legitimacy of the preset event based on the historical occurrence time and historical end time of the preset event to achieve offline verification.

7. The code security protection system according to claim 3, wherein: The terminal status manager is also used to obtain the heartbeat information sent by the trusted application at regular intervals, and send the heartbeat information to the cloud status manager after confirming that there is no abnormality. The terminal status manager is also used to send heartbeat information to the cloud status manager before the trusted application enters the offline running state, and obtain the running status of the trusted application in the offline running state.

8. The code security protection system according to claim 1, wherein: The static obfuscation method includes function forwarding, which is used to implement indirect calls, monitor, modify or record the target function in the source code through custom logic, and collect statistical information of function calls.

9. The code security protection system according to claim 2, wherein: The static obfuscation method includes dynamic loading, which is used to mark the core content or the part to be protected in the source code as dynamically loaded content, and the dynamically loaded content is stored in the cloud platform; The terminal status manager is also used to send a loading request to the cloud status manager through a secure channel. The cloud status manager is also used to encrypt the dynamic loading content corresponding to the loading request after receiving the loading request, and send the encrypted dynamic loading content to the terminal status manager. The terminal status manager decrypts the dynamic loading content based on the key to achieve online dynamic loading.

10. The code security protection system according to claim 9, wherein: The terminal status manager is also used to send a preloading request to the cloud status manager before the trusted application enters the offline running state. The cloud status manager is also used to encrypt the dynamic loading content corresponding to the preloading request after receiving the preloading request, and send the encrypted dynamic loading content to the terminal status manager. The terminal status manager decrypts the dynamic loading content based on the key to achieve offline dynamic loading.

11. The code security protection system according to claim 9, wherein: The terminal state manager is further configured to manage the life cycle of the dynamically loaded content and delete the dynamically loaded content based on a preset deletion condition during the life cycle management process.

12. A code security protection method comprising: Obtaining source code, dynamically obfuscating the source code, and generating an obfuscated seed for the source code; Obfuscating the source code after dynamic obfuscation based on the static obfuscation method corresponding to the obfuscation seed to obtain a trusted application; Status monitoring is performed during the operation of the trusted application, and a corresponding code security protection solution is executed according to the status monitoring result.

Images