WO2019134276A1

WO2019134276A1 - Method and system for protecting web page code, storage medium, and electronic device

Info

Publication number: WO2019134276A1
Application number: PCT/CN2018/081320
Authority: WO
Inventors: 周志刚; 陈少杰; 张文明
Original assignee: 武汉斗鱼网络科技有限公司
Priority date: 2018-01-05
Filing date: 2018-03-30
Publication date: 2019-07-11
Also published as: CN108319822B; CN108319822A

Abstract

Disclosed are a method for protecting a web page code, wherein same relates to the technical field of human-machine recognition. The method comprises the steps of: adding, to a core function of a web page code in advance, a detection code for determining whether the other functions and global variables of the set web page code exist; and when the core function is executed in a running environment of a client, the detection code detecting whether the functions and global variables of the set web page code exist in the running environment, recognizing, according to a detection result, whether the client is legitimate, and performing corresponding processing on the client. The method for protecting a web page code provided in the present invention can recognize the legitimacy of a client, thus protecting the web page code.

Description

Method, storage medium, electronic device and system for protecting webpage code

Technical field

The present invention relates to the field of human-machine recognition technology, and in particular, to a method, a storage medium, an electronic device and a system for protecting a webpage code.

Background technique

Currently, with the development of HTML5 technology, HTML5 is the next-generation HTML standard, and most browsers already have support for HTML5. For the HTML5 live broadcast platform, the main code of the page is JavaScript code, which is a scripting language, so when publishing the page, it is equivalent to the source code release, anyone can directly get the JavaScript code of the page, and The entire code is integrated into your own code to call the corresponding function.

For example, in the source code of the page, the function of a function is to decrypt the data sent by the server. Inevitably, this function will be very complicated, so the hacker does not need to analyze the implementation method. The hacker can directly copy this function code to himself. Executed in the code, so that the decryption of the data sent by the server can also be completed. Therefore, a way is needed to protect the core JavaScript code of the page from being copied.

Summary of the invention

Aiming at the defects existing in the prior art, the object of the present invention is to provide a method for protecting a webpage code, which can identify the legitimacy of the client and realize the protection of the webpage code.

In order to achieve the above objectives, the technical solution adopted by the present invention is:

A method of protecting webpage code, including steps:

A detection code for determining whether the set function of the webpage code and the global variable exist is added to a core function of the webpage code in advance;

When the core function is executed in a running environment of the client, the detection code detects whether there are other functions and global variables of the set webpage code in the running environment, and identifies whether the client is legal according to the detection result, and The client handles it accordingly.

Based on the foregoing technical solution, the method further includes the step of: encrypting the detection code.

Based on the above technical solutions, the steps include:

Set the function name and global variable name of the webpage code to be detected;

The detection code is added to the core function of the webpage code in advance, and the detection code determines whether there is a corresponding function and a global variable in the running environment according to the set function name and the global variable name, and encrypts the detection code;

Decrypting and running the detection code when the core function is executed in a running environment of the client, the detection code detecting whether there is a function and a global variable of the set webpage code in the running environment, and Send test results;

The server identifies whether the client is legal according to the detection result, and performs corresponding processing on the client.

On the basis of the foregoing technical solution, before sending the detection result to the server, the detection result is encrypted, and then the encrypted detection result is sent to the server, and the server decrypts the encrypted detection result after receiving the encrypted detection result. Then, according to the decrypted detection result, it is recognized whether the client is legal.

The present invention also provides a storage medium having stored thereon a computer program that, when executed by a processor, implements the steps of the above method.

The present invention also provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, the processor implementing the steps of the method when the computer program is executed.

The present invention also provides a system for protecting a webpage code, the system comprising a setting module, a detecting module and a processing module;

The setting module is configured to add, in advance, a detection code for determining whether the set function of the webpage code and the global variable exist in a core function of the webpage code;

The detecting module is configured to: when the core function is executed in a running environment of the client, control the detecting code to detect whether there are other functions and global variables of the set webpage code in the running environment, and the detection result is Sent to the processing module;

The processing module is configured to identify, according to the detection result obtained by the detection module, whether the client is legal, and perform corresponding processing on the client.

Based on the foregoing technical solution, the parameter setting module, the first encryption module, and the first decryption module are further included.

The parameter setting module is configured to set a function name and a global variable name of the webpage code to be detected;

The first encryption module is configured to encrypt the detection code after adding a detection code to a core function of the webpage code;

The first decryption module is configured to decrypt the detection code when the core function is executed in a running environment of a client;

The detecting module is further configured to: when the core function is executed in a running environment of the client, after the first decrypting module decrypts the detecting code, run the detecting code, and control the detecting code according to the setting The function name and the global variable name detect whether there is a function and a global variable of the set webpage code in the running environment.

On the basis of the foregoing technical solutions, the first encryption module and the first decryption module both adopt a DES symmetric encryption algorithm.

Based on the foregoing technical solution, the second encryption module and the second decryption module are further included;

The second encryption module is configured to encrypt the detection result of the detection module, and send the encrypted detection result to the processing module;

The processing module is further configured to send the encrypted detection result to the second decryption module;

The second decryption module is configured to decrypt the received detection result, and return the decrypted detection result to the processing module;

The processing module is further configured to identify, according to the decrypted detection result, whether the client is legal.

The advantages of the present invention over the prior art are:

(1) The method for protecting a webpage code of the present invention can determine the legitimacy of the client by implementing the function and the global variable of the set webpage code in the running environment of the client, thereby realizing the protection of the webpage code.

(2) The method for protecting the webpage code of the present invention first encrypts the detection code, and when the core function runs in the client, decrypts the detection code, which can effectively prevent the detection code from being discovered by the hacker, so as to prevent the hacker from evading it. Or tampering to ensure the reliability of the web page code protection method.

DRAWINGS

1 is a flowchart of a method for protecting a webpage code in an embodiment of the present invention;

2 is a block diagram showing the connection of an electronic device in an embodiment of the present invention.

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

Referring to FIG. 1, an embodiment of the present invention provides a method for protecting a webpage code, including the steps of:

S1: Set the function name and global variable name of the webpage code to be detected. The set function name and global variable name can be selected according to actual needs, preferably some function functions or global variables unique to the live platform, such as sending bullets. Curtain functions, etc.

S2: The detection code is added to the core function of the webpage code in advance, and the detection code determines whether there is a corresponding function and a global variable in the running environment according to the set function name and the global variable name.

The specific implementation process is: the detection code includes a plurality of functions for detecting whether the set global variable exists and a plurality of functions for detecting whether the set function exists. Among them, the function for detecting whether the set global variable exists is as follows:

The function name for detecting whether the set global variable exists is ExitsVariable, the variable name passed is variableName, and variableName is the set global variable name, and the function can detect whether the global variable exists.

If the global variable is set in the JS code of the live broadcast platform, it is used to store some global settings. This global variable is unique to the live broadcast platform. You can choose whether to detect the existence of the global variable and name the global variable. For dyConfig, you can get the global variable dyConfig by the following code, as follows:

dyConfigFlag=ExitsVariable("dyConfig");

Among them, ExitsVariable is a function for detecting the presence of a set global variable, "dyConfig" is the name of the global variable to be detected, and dyConfigFlag is the result value for detecting the existence of the global variable.

In addition, the function for detecting the presence of the set function is as follows:

Among them, the function name for detecting whether the set function exists is ExitsFunction, the variable name passed is funcName, and funcName is the set function name, and the function funcName can be detected by the ExitsFunction function.

For some function functions unique to the live broadcast platform, such as sending a barrage, displaying advertisements, etc., you can choose to detect whether the function functions unique to the live broadcast platform exist. For example, the function name of the send barrage is dySendDanmu, which can be sent by the following code. Whether the function of the barrage exists, as follows:

dySendDanmuFlag=ExitsFunction("dySendDanmu");

Among them, ExitsFunction is a function for detecting whether a set function exists, "dySendDanmu" is a function name for transmitting a barrage, and dySendDanmuFlag is a result value for detecting whether a function for transmitting a barrage exists.

When it is necessary to detect whether the function displaying the advertisement exists, the function name of the display advertisement is dySendDanmu, and the function of displaying the advertisement exists by the following code, as follows:

dyShowAdvertisementFlag=ExitsFunction("dyShowAdvertisement");

Among them, "dyShowAdvertisement" is the function name for displaying the advertisement, and dyShowAdvertisementFlag is the result value for detecting whether the function for displaying the advertisement exists.

When it is necessary to detect whether the function of the user is reported to the server, the function name of the function reported to the server is dySenddot. The following code can be used to obtain the function, as follows:

dySenddotFlag=ExitsFunction("dySenddot");

Among them, "dySenddot" is the function name of the user behavior reported to the server, and dySenddotFlag is the result value of detecting whether the function of the management user is reported to the server.

Similarly, the function name and the global variable name that need to be detected may be preset according to actual needs, and corresponding functions for detecting whether the set global variable exists or not, and a function for detecting the setting are added in the detection code. Whether the function exists or not.

S3: The encryption detection code can effectively prevent the detection code from being discovered by the hacker, so as to avoid hacking.

In the embodiment of the present invention, the DES symmetric encryption algorithm is used for encryption, and the detection code to be protected is encrypted by the key KEY value. The specific implementation process is to write an encryption function to encrypt the detection code to be protected, and a string can be obtained. Encrypted data EncryptJs, as follows:

EncryptJs=DES.Encrypt(getInterfaceFlag,KEY);

Among them, DES.Encrypt is the encryption interface Encrypt of the encryption algorithm DES, the parameter getInterfaceFlag is the JavaScript detection code to be protected, the parameter KEY is the key, and when a client logs in, the server generates a key similar to the key used for encryption. The KEY value is sent to the client so that the client decrypts the detection code, EncryptJs returns the result, and the result is a string of encrypted data.

The encrypted detection code becomes a string of encrypted constant data. The data has no readable meaning. The server saves the constant data in the webpage code and saves it as a string variable. When decryption is needed, the data is saved. String variables can be decrypted.

S4: When the core function is executed in the running environment of the client, the detection code is decrypted and run, and the detection code detects whether there is a function and a global variable of the set webpage code in the running environment, and sends the detection result to the server.

In the embodiment of the present invention, the DES symmetric encryption algorithm is used for decryption, and the detection code to be protected is decrypted by the key KEY value. The specific implementation process is to write a decryption function to decrypt the encrypted detection code, which will be encrypted. The obtained constant data is decrypted into the original code of the detection code as follows:

getInterfaceFlag=DES.Decrypt(encryptCode,KEY);

Among them, DES.Decrypt is the interface of the corresponding decryption algorithm, encryptCode is the constant data obtained by detecting the code encryption, KEY is the key KEY value sent by the server to the server, and getInterfaceFlag is the original code of the decrypted core code. So that the client can execute the corresponding detection code to complete the relevant logic functions.

After decrypting the detection code, the detection code is run, and the detection code can detect whether there is a set function and a global variable in the running environment, and correspondingly obtain a return result of each set function and global variable. If the set function or global variable exists, the corresponding return result is set to 1, and if it does not exist, the corresponding return result is set to 0.

When it is necessary to detect the global variable dyConfig, and whether the function of transmitting the barrage, displaying the advertisement, and puncturing the user behavior to report to the server exists, the set global variable name is dyConfig, and the set function names are dySendDanmu, dyShowAdvertisement, and dySenddot, respectively. Then, four return results can be obtained correspondingly, and the four returned results correspond to dyConfigFlag, dySendDanmuFlag, dyShowAdvertisementFlag, and dySenddotFlag, respectively, and the four returned results are packed to obtain a string Dataflag, and the packed string Dataflag is detected. The result is sent to the server, and the string Dataflag is expressed as: Dataflag=dyConfigFlag+dySendDanmuFlag+dyShowAdvertisementFlag+ dySenddotFlag, such as the string Dataflag is 1111, 1101 or 0000.

S5: The server identifies whether the client is legal according to the detection result, and processes the client accordingly.

When each character in the string of the detection result is 1, indicating that there is a set function and a global variable in the running environment of the client, the client may be considered to be legal when the client runs the detection result in the environment. Not all characters in the file are 1, indicating that there is at least one set function or global variable in the client running environment, the client may be considered illegal, and the server shall impose corresponding penalties on the client. Thereby achieving protection of the webpage code.

Further, in the embodiment of the present invention, before the detection result is sent to the server, the detection result is encrypted, and then the encrypted detection result is sent to the server, and after receiving the encrypted detection result, the server first Decrypt, and then according to the decrypted detection result to identify whether the client is legal. The method for encrypting and decrypting the above detection result also adopts the DES symmetric encryption algorithm, and uses the same key KEY to encrypt or decrypt the detection result, which can effectively prevent the detection result from being discovered by the hacker in the process of being sent to the server. In order to avoid hacking or circumventing it, the reliability of the webpage code protection method is guaranteed.

The principle of the method for protecting webpage code in the embodiment of the present invention is: since all functions and global variables in the webpage code are necessarily present in the normal webpage code, when the client uses the webpage code, if the user uses the webpage code, Will use the published webpage code, the detection code can detect that the set function and the global variable exist, then the client can be considered to be legal. If the hacker directly copies the webpage code, usually the hacker will not copy the webpage. Webpage code, and will not use the same global variables as in the normal webpage code. At this time, when the detection code runs in the client of the hacker, it must detect that at least one set function or global variable does not exist. The client is considered to be illegal, and the server can process the client to prevent misappropriation, thereby protecting the webpage code.

The embodiment of the invention further provides a storage medium on which a computer program is stored, and when the computer program is executed by the processor, the step of protecting the webpage code method is implemented.

Referring to FIG. 2, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and running on the processor, and the method for protecting the webpage code when the processor executes the computer program. step.

The embodiment of the invention further provides a system for protecting a webpage code, the system comprising a setting module, a detecting module and a processing module.

The setting module is configured to add, in advance, a detection function for determining whether other functions of the set webpage code and global variables exist in the core function of the webpage code; the detecting module is configured to control when the core function is executed in the running environment of the client The detection code detects whether there are other functions and global variables of the set webpage code in the running environment, and sends the detection result to the processing module; the processing module is configured to identify whether the client is legal according to the detection result obtained by the detecting module, and The client handles it accordingly.

Further, the system further includes a parameter setting module, a first encryption module, and a first decryption module. The parameter setting module is configured to set a function name and a global variable name of the webpage code to be detected; the first encryption module is configured to encrypt the detection code after adding the detection code to the core function of the webpage code; the first decryption module is used as the core The function decrypts the detection code when executed in the running environment of the client; the detection module is further configured to: when the core function is executed in the running environment of the client, after the first decryption module decrypts the detection code, run the detection code, and control the detection code according to the setting The function name and global variable name of the fixed function detect whether there is a function and a global variable of the set webpage code in the running environment.

In the embodiment of the present invention, the first encryption module and the first decryption module both adopt a DES symmetric encryption algorithm.

Further, the system further includes a second encryption module and a second decryption module, where the second encryption module is configured to encrypt the detection result of the detection module, and send the encrypted detection result to the processing module; the processing module is further configured to receive The encrypted detection result is sent to the second decryption module; the second decryption module is configured to decrypt the received detection result, and return the decrypted detection result to the processing module; the processing module is further configured to perform the detection according to the decryption The result is to determine if the client is legitimate.

The principle of the system for protecting webpage code in the embodiment of the present invention is that since all functions and global variables in the webpage code are necessarily present in the normal webpage code, when the client uses the webpage code, if the user uses the webpage code, Will use the published webpage code, the detection code can detect that the set function and the global variable exist, then the client can be considered to be legal. If the hacker directly copies the webpage code, usually the hacker will not copy the webpage. Webpage code, and will not use the same global variables as in the normal webpage code. At this time, when the detection code runs in the client of the hacker, it must detect that at least one set function or global variable does not exist. The client is considered to be illegal, and the server can process the client to prevent misappropriation, thereby protecting the webpage code.

The present invention is not limited to the above embodiments, and those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. These improvements and retouchings are also considered as protection of the present invention. Within the scope. The contents not described in detail in the present specification belong to the prior art well known to those skilled in the art.

Claims

A method for protecting a webpage code, comprising the steps of:

A detection code for determining whether the set function of the webpage code and the global variable exist is added to a core function of the webpage code in advance;

When the core function is executed in a running environment of the client, the detection code detects whether the function and the global variable of the set webpage code exist in the running environment, and identifies whether the client is legal according to the detection result, and The client handles it accordingly.
A method of protecting a webpage code according to claim 1, further comprising the step of encrypting said detection code.
The method for protecting a webpage code according to claim 2, further comprising the steps of:

Set the function name and global variable name of the webpage code to be detected;

The detection code is added to the core function of the webpage code in advance, and the detection code determines whether there is a corresponding function and a global variable in the running environment according to the set function name and the global variable name, and encrypts the detection code;

Decrypting and running the detection code when the core function is executed in a running environment of the client, the detection code detecting whether there is a function and a global variable of the set webpage code in the running environment, and Send test results;

The server identifies whether the client is legal according to the detection result, and performs corresponding processing on the client.
The method for protecting a webpage code according to claim 3, wherein before the detection result is sent to the server, the detection result is encrypted, and the encrypted detection result is sent to the server, and the server receives the encrypted After the result is detected, it is decrypted first, and then the client is legal according to the decrypted detection result.
A storage medium having stored thereon a computer program, characterized in that the computer program is executed by a processor to carry out the steps of the method of any one of claims 1 to 4.
An electronic device comprising a memory, a processor, and a computer program stored on the processor and running on the processor, wherein the processor executes the computer program to implement the above claims 1 to 4 The steps of any of the methods described.
A system for protecting webpage code, characterized in that: the system comprises a setting module, a detecting module and a processing module;

The setting module is configured to add, in advance, a detection code for determining whether the set function of the webpage code and the global variable exist in a core function of the webpage code;

The detecting module is configured to: when the core function is executed in a running environment of the client, control the detecting code to detect whether there are other functions and global variables of the set webpage code in the running environment, and the detection result is Sent to the processing module;

The processing module is configured to identify, according to the detection result obtained by the detection module, whether the client is legal, and perform corresponding processing on the client.
The system for protecting a webpage code according to claim 7, further comprising a parameter setting module, a first encryption module, and a first decryption module.

The parameter setting module is configured to set a function name and a global variable name of the webpage code to be detected;

The first encryption module is configured to encrypt the detection code after adding a detection code to a core function of the webpage code;

The first decryption module is configured to decrypt the detection code when the core function is executed in a running environment of a client;

The detecting module is further configured to: when the core function is executed in a running environment of the client, after the first decrypting module decrypts the detecting code, run the detecting code, and control the detecting code according to the setting The function name and the global variable name detect whether there is a function and a global variable of the set webpage code in the running environment.
The system for protecting webpage code according to claim 8, wherein the first encryption module and the first decryption module both adopt a DES symmetric encryption algorithm.
The system for protecting webpage code according to claim 8, further comprising: a second encryption module and a second decryption module;

The second encryption module is configured to encrypt the detection result of the detection module, and send the encrypted detection result to the processing module;

The processing module is further configured to send the encrypted detection result to the second decryption module;

The second decryption module is configured to decrypt the received detection result, and return the decrypted detection result to the processing module;

The processing module is further configured to identify, according to the decrypted detection result, whether the client is legal.