CN107992724A - A kind of software security reinforcement means - Google Patents

A kind of software security reinforcement means Download PDF

Info

Publication number
CN107992724A
CN107992724A CN201711337427.0A CN201711337427A CN107992724A CN 107992724 A CN107992724 A CN 107992724A CN 201711337427 A CN201711337427 A CN 201711337427A CN 107992724 A CN107992724 A CN 107992724A
Authority
CN
China
Prior art keywords
software
security
code
source code
executable file
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201711337427.0A
Other languages
Chinese (zh)
Inventor
王俊峰
吴鹏
田斌
王标
刘�东
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sichuan University
Original Assignee
Sichuan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sichuan University filed Critical Sichuan University
Priority to CN201711337427.0A priority Critical patent/CN107992724A/en
Publication of CN107992724A publication Critical patent/CN107992724A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12Protecting executable software
    • G06F21/14Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45558Hypervisor-specific management and integration aspects
    • G06F2009/45587Isolation or security of virtual machine instances
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033Test or assess software

Abstract

The invention discloses a kind of software security reinforcement means, and the security hardening of software is divided into 3 levels by it according to software Life cycle:Software source codes, executable file and software runtime environment.According to the respective feature of different layers, it is proposed that different reinforcement measures, based on software source code layer is scanned with software vulnerability;Executable file layer be divided into again it is static reinforce in terms of two with dynamic, the former prevents software to be disassembled, and based on software obfuscation technology, the latter prevents software by dynamic debugging, based on anti-debug technology;Running environment layer is to the autonomous controllable running environment for providing software product, based on high in the clouds isolation deployment techniques.In the method for the present invention, Software hardening design is realized by hierarchical, ensures to strengthen the safety of software using different technological means in the different layers, the security capabilities of comprehensive raising software, ensure that software is not propagated by malicious sabotage and infringement, ensure software security.

Description

A kind of software security reinforcement means
Technical field
The present invention relates to security of computer software field, particularly a kind of comprehensive, with different levels software security is reinforced Method.
Background technology
Software security refers to the method using engineering so that software still is able to work normally in the case of hostile attack Thought, i.e., using the method for systematization, standardization and quantification come instruct structure safety software.Software security is as information The foundation stone of technology development, has important impetus to social economy's growth, national development, indicates a national strategy side To becoming one of mark for weighing a national overall national strength.
The main problem that software security faces includes:Software causes intellectual property to be destroyed by illegal propagation use, software The malicious sabotage of software, the potential loophole of software is caused to be exploited and by malicious exploitation etc. by conversed analysis.Denmark's peace in 2015 The research team of full companies Secunia carries out vulnerability scanning to 2484 sections of softwares from 263 software vendors, it turns out that Total loophole number is 16081.At the same time, the infringement event that what software piracy was brought emerge in an endless stream is to cause the weight of information leakage Want reason.It is main to concentrate usually using certain one side of software as protection object currently for the research in terms of software security reinforcing Software anti-pirate, anti-reversing, authorize encryption and anti-tamper etc., and used technology includes software watermark, Code obfuscation, soft Part shell adding, virtual machine protection technique etc..
In summary, Current software security situation is severe, while corresponding security hardening technology is only from one or certain is several Side carries out enhancing protection to software, does not form the software security reinforcement protection system of complete set, it is impossible to software into Row is comprehensively and effectively protected.
The content of the invention
The technical problems to be solved by the invention are to provide a kind of software security reinforcement means, for software piracy, software Inversely, the various software security problems such as software vulnerability, realize the security hardening protection of software.
In order to solve the above technical problems, the technical solution adopted by the present invention is:A kind of software security reinforcement means, including with Lower step:
Step 1:Security hardening, including the safety of source code itself and form safety are carried out to the source code of software, i.e.,:
First according to the type of source code come initial option tool set;Secondly according to the target of Current Scan, in selection Most suitable hole scanner is selected in tool set;It is to perform vulnerability scanning again, generation scanning result report;Last basis Scanning result is reported to be made an amendment to source file;
Step 2:After compilation of source code is executable file level, executable file is reinforced, including static protection With dynamic protection;Wherein, static protect is:
Software implementation layout is obscured first, the code for being difficult to read that readable good code revision is behaved, secondly Implement data obfuscation, equivalencing is done to the data that software is related to, finally implement control and obscure, done from software execution flow journey Valency is replaced, and reaches the degree that software cannot analyze former software algorithm logic;
Dynamic protection is:Using technological means detection current process whether in debugged environment, if adjusted Examination, which then changes normal execution route or changes itself program, allows own collapse, so that increase debug time and complexity, with This prevents executable file from being debugged tracking;
Step 3:Software and user are physically isolated, protection software runtime environment safety.
Further, the step of step 1 carries out security hardening to the source code of software, which is divided into, to be performed a plurality of times, it is performed Foundation be to be directed to different source codes, be divided into general vulnerability scanning and dedicated vulnerability scanning.
Further, dynamic protection uses and demodulates method for testing in the step 2:Detected using system function, feature detection And the mode that is combined of behavioral value realizes anti-debug, first with providing system function (such as Windows in operating system IsDebuggerPresent, CheckRemoteDebuggerPresent function in system) come detect itself whether by Debugging, next enumerates currently running all processes, and the feature code of different debuggers is searched in the memory headroom of process Section and debugger window, reuse behavioral difference (such as time of execute instruction of software normal operation and commissioning test Difference), realize the anti-debug function of software.
Further, the step 3 is specially:Software deployment is in dedicated cloud platform, and application is with independent virtual Machine is disposed, i.e., single application is deployed on the different hosts of virtual machine isolation, realizes the isolation deployment of application;Client passes through Cloud desktop or SaaS patterns are applied to access, and user interacts only input and output with software, is not connect using process entirely Touch the software of physics.
Compared with prior art, the beneficial effects of the invention are as follows:1) Software hardening design is realized by hierarchical, in different layers Middle to ensure the safety to strengthen software using different technological means, source code uses Vulnerability-scanning technology, binary file Using obscuring and anti-debug technology, running environment is using isolation deployment techniques, the security capabilities of comprehensive raising software, it is ensured that Software is not propagated by malicious sabotage and infringement, ensures software security.2) this method is not only suitable for what new design software was also applied for Existing maturation software, the former is proposed with the three-layer protection scheme of this method, and the latter can be directed to it according to being actually needed In one layer or multilayer do software security reinforcement protection.
Brief description of the drawings
Fig. 1 is software security reinforcement system overall structure figure in the present invention.
Fig. 2 is source code Hole Detection schematic diagram in the present invention.
Fig. 3 is that executable file obscures method in the present invention.
Fig. 4 is that software isolates dispositions method in the present invention.
Embodiment
The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
The present invention proposes the theory of " software Life cycle " security hardening, in the form of software based on, by software Life cycle is divided into three levels of running environment of the source code of software, the executable file of software and software.First layer Using the Hole Detection of source code as core;For the second layer using Code obfuscation and anti-debug as core, third layer is deployed as core to isolate The heart, during actual implementation, can consider according to state, business demand and cost of software product etc., and selection should The protection of single level, portion's multilevel protection or whole level protections, its structure diagram in technical system is as shown in Figure 1. It is existing that details are as follows:
Source code protective layer, the main safety for protecting software source code, including the safety of source code itself and form safety, Completed using Hole Detection.The leak detection method that the present invention uses:According to the type of source code and detection target making inspection Strategy is surveyed, selects third party's detection instrument to complete Hole Detection according to inspection policies, testing result is used to instruct source code Modification, source code Hole Detection schematic diagram are as shown in Figure 2.
Wherein, inspection policies are to select suitable detection instrument according to the code speech and loophole type of source code to be measured.Source The code speech of code is different, the processing mode and focus of its vulnerability scanning are also not quite similar.Such as C/C++ language, Pay close attention to RAM leakage loophole;For Java language, abnormality processing loophole is paid close attention to;Apply, pay close attention to for web SQL injection, XSS loopholes etc..The type of loophole to be detected at the same time, is generally divided into universal loophole and proprietary loophole, the former refers to not Dependent on code speech, such as dead code;The latter is closely related with language, for example illegal pointer is usually related with C/C++.Detection Instrument is completed to detect using third party's tool set, such as, for the Soot instruments of Java code, for the PC- of C/C++ codes Lint instruments etc..The selection of instrument needs to consider loophole type, the several factors of the maturity of priority and instrument of detection.
Executable file protective layer, is broadly divided into static protection and the aspect of dynamic protection two, and static state prevents software from being converged by counter Compile or dynamic prevents software to be debugged.Prevent static disassembly from being completed using software obfuscation technology, its basic principle is:By for The modes such as generation, displacement by elements such as the character string in source code, function name, variables with insignificant alphabetical or digital representation, Part logic in re-written code, makes it become functionally of equal value, but elusive code form.
What the present invention used obscures method as shown in figure 3, original executable file P is obscured using layout, data are mixed Confuse and control and the mode such as obscure and be converted into semantic equivalence, be difficult to be understood or the file p ' of dis-assembling so that for same A is inputted, the two can obtain same output B.
Whether the mode for preventing dynamic debugging is in debugged environment using technological means detection current process, if It is being debugged then to change normal execution route or change itself program and allow and oneself is collapsing, so as to increases debug time and answer Miscellaneous degree, prevents executable file from being debugged tracking with this.The anti-tune method for testing that the present invention uses:Detected using system function, is special Sign detection and the mode that is combined of behavioral value realize anti-debug, first with the system function (ratio provided in operating system Such as IsDebuggerPresent, CheckRemoteDebuggerPresent function in Windows systems) detect itself Whether it is being debugged, next enumerates currently running all processes, and different debuggers are searched in the memory headroom of process Feature code section, for example the feature code section of OllyDbg is 0x41,0x00,0x62,0x00,0x6F, 0x00,0x75, 0x00,0x74,0x00 ... .0x4B, 0x00,0x00,0x00, or the current window for whether having the debugging software being currently running of detection Mouth handle, reuses software normal operation and the behavioral difference (such as time difference of execute instruction) of commissioning test, realizes soft The anti-debug function of part.
Running environment protective layer, mainly protects the safety of software from the angle of software runtime environment, utilizes software high in the clouds Isolation is disposed to complete.
Isolation dispositions method that the present invention uses as shown in figure 4, software deployment in dedicated cloud platform, and application is with only Vertical deploying virtual machine, i.e., single application are deployed on the different hosts of virtual machine isolation, realize the isolation deployment of application;Visitor Family end accesses application by cloud desktop or SaaS patterns, and user interacts only input with exporting with software, whole to use Process does not contact the software of physics, so as to ensure that software is not inversely cracked or destroyed.

Claims (4)

1. a kind of software security reinforcement means, it is characterised in that comprise the following steps:
Step 1:Security hardening, including the safety of source code itself and form safety are carried out to the source code of software, i.e.,:
First according to the type of source code come initial option tool set;Secondly according to the target of Current Scan, in the instrument of selection Concentrate the most suitable hole scanner of selection;It is to perform vulnerability scanning again, generation scanning result report;Finally according to scanning As a result report to be made an amendment to source file;
Step 2:After compilation of source code is executable file level, executable file is reinforced, including static protection and dynamic State is protected;Wherein, static protect is:
Software implementation layout is obscured first, the code for being difficult to read that readable good code revision is behaved, secondly implements The data that software is related to are done equivalencing by data obfuscation, are finally implemented control and are obscured, do equivalence from software execution flow journey and replace Change, reach the degree that software cannot analyze former software algorithm logic;
Dynamic protection is:Using technological means detection current process whether in debugged environment, if being debugged Change normal execution route or change itself program and allow own collapse, so as to increase debug time and complexity, hindered with this Only executable file is debugged tracking;
Step 3:Software and user are physically isolated, protection software runtime environment safety.
A kind of 2. software security reinforcement means as claimed in claim 1, it is characterised in that source generation of the step 1 to software The step of code progress security hardening, which is divided into, to be performed a plurality of times, its foundation performed is to be directed to different source codes, is divided into general leakage The dedicated vulnerability scanning of hole scanner uni.
3. a kind of software security reinforcement means as claimed in claim 1, it is characterised in that dynamic protection is adopted in the step 2 With anti-tune method for testing:Detected using system function, feature detection and the mode that is combined of behavioral value realize anti-debug, first Detect whether itself is being debugged using system function is provided in operating system, next enumerate it is currently running it is all into Journey, and the feature code section and debugger window of different debuggers are searched in the memory headroom of process, reusing software just Often operation and the behavioral difference of commissioning test, realize the anti-debug function of software.
4. a kind of software security reinforcement means as claimed in claim 1, it is characterised in that the step 3 is specially:Software portion Administration is in dedicated cloud platform, and application with independent deploying virtual machine, i.e., single application is deployed in virtual machine isolation not Disposed with the isolation on host, realizing application;Client accesses application, user and software by cloud desktop or SaaS patterns Interaction only input and output, the whole software for not contacting physics using process.
CN201711337427.0A 2017-12-14 2017-12-14 A kind of software security reinforcement means Pending CN107992724A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711337427.0A CN107992724A (en) 2017-12-14 2017-12-14 A kind of software security reinforcement means

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711337427.0A CN107992724A (en) 2017-12-14 2017-12-14 A kind of software security reinforcement means

Publications (1)

Publication Number Publication Date
CN107992724A true CN107992724A (en) 2018-05-04

Family

ID=62038448

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711337427.0A Pending CN107992724A (en) 2017-12-14 2017-12-14 A kind of software security reinforcement means

Country Status (1)

Country Link
CN (1) CN107992724A (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109684795A (en) * 2018-12-25 2019-04-26 成都卫士通信息产业股份有限公司 The method, apparatus and electronic equipment of application program anti-debug
CN112559983A (en) * 2021-02-23 2021-03-26 北京邮电大学 Software security reinforcing method and device, electronic equipment and storage medium
CN112925529A (en) * 2021-02-07 2021-06-08 联通(广东)产业互联网有限公司 Application security distribution method, system, device and medium based on distributed cloud platform
CN113779578A (en) * 2021-09-13 2021-12-10 支付宝(杭州)信息技术有限公司 Intelligent confusion method and system for mobile terminal application

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106055935A (en) * 2016-05-19 2016-10-26 北京金山安全软件有限公司 Process control method and device and electronic equipment
CN106372511A (en) * 2016-08-24 2017-02-01 北京奇虎测腾安全技术有限公司 Source code detection system and method
CN106650339A (en) * 2016-10-13 2017-05-10 国网江苏省电力公司电力科学研究院 Control flow complication-based Java code obfuscation method
CN106778104A (en) * 2017-01-20 2017-05-31 武汉斗鱼网络科技有限公司 A kind of anti-debug method and system of application program

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106055935A (en) * 2016-05-19 2016-10-26 北京金山安全软件有限公司 Process control method and device and electronic equipment
CN106372511A (en) * 2016-08-24 2017-02-01 北京奇虎测腾安全技术有限公司 Source code detection system and method
CN106650339A (en) * 2016-10-13 2017-05-10 国网江苏省电力公司电力科学研究院 Control flow complication-based Java code obfuscation method
CN106778104A (en) * 2017-01-20 2017-05-31 武汉斗鱼网络科技有限公司 A kind of anti-debug method and system of application program

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109684795A (en) * 2018-12-25 2019-04-26 成都卫士通信息产业股份有限公司 The method, apparatus and electronic equipment of application program anti-debug
CN109684795B (en) * 2018-12-25 2023-01-24 成都卫士通信息产业股份有限公司 Method and device for anti-debugging of application program and electronic equipment
CN112925529A (en) * 2021-02-07 2021-06-08 联通(广东)产业互联网有限公司 Application security distribution method, system, device and medium based on distributed cloud platform
CN112925529B (en) * 2021-02-07 2023-10-27 联通(广东)产业互联网有限公司 Application security distribution method, system, device and medium based on distributed cloud platform
CN112559983A (en) * 2021-02-23 2021-03-26 北京邮电大学 Software security reinforcing method and device, electronic equipment and storage medium
CN113779578A (en) * 2021-09-13 2021-12-10 支付宝(杭州)信息技术有限公司 Intelligent confusion method and system for mobile terminal application
WO2023035751A1 (en) * 2021-09-13 2023-03-16 支付宝(杭州)信息技术有限公司 Intelligent confusion for mobile terminal application
CN113779578B (en) * 2021-09-13 2024-01-19 支付宝(杭州)信息技术有限公司 Intelligent confusion method and system for mobile terminal application

Similar Documents

Publication Publication Date Title
Halfond et al. Using positive tainting and syntax-aware evaluation to counter SQL injection attacks
CN107992724A (en) A kind of software security reinforcement means
Shar et al. Defeating SQL injection
US9268945B2 (en) Detection of vulnerabilities in computer systems
Pistoia et al. A survey of static analysis methods for identifying security vulnerabilities in software systems
CN101438529B (en) Proactive computer malware protection through dynamic translation
Hedin et al. Value-sensitive hybrid information flow control for a javascript-like language
Barthe et al. Secure multi-execution through static program transformation
Izquierdo et al. Collaboro: a collaborative (meta) modeling tool
CN105653905A (en) Software protection method based on API (Application Program Interface) security attribute hiding and attack threat monitoring
Guo et al. Eliminating the hardware-software boundary: A proof-carrying approach for trust evaluation on computer systems
Okafor et al. Sok: Analysis of software supply chain security by establishing secure design properties
Shin et al. SQLUnitgen: Test case generation for SQL injection detection
Homaei et al. Athena: A framework to automatically generate security test oracle via extracting policies from source code and intended software behaviour
Weissman Penetration testing
Black et al. Guidelines on minimum standards for developer verification of software
CN101901184A (en) Method, device and system for inspecting vulnerability of application program
Zhu et al. Detecting privilege escalation attacks through instrumenting web application source code
Borzykh et al. Detecting Code Security Breaches by Means of Dataflow Analysis
Chen et al. Security vulnerabilities: From analysis to detection and masking techniques
Huang et al. Web application security—past, present, and future
Medhane Efficient solution for SQL injection attack detection and prevention
Rajaram et al. Taxonomy‐based testing and validation of a new defect classification for health software
Zhou et al. WASMOD: Detecting vulnerabilities in Wasm smart contracts
Antoniol Keynote paper: Search based software testing for software security: Breaking code to make it safer

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20180504

RJ01 Rejection of invention patent application after publication