Shulou(Shulou.com)06/01 Report--

Recently, we have been working on the research and development of industry anti-disclosure solutions, and do source code encryption and anti-disclosure solutions.

So far, we have understood and implemented a number of projects, and to sum up, the industry has the following characteristics:

1. The level of software R & D personnel is relatively high. First of all, it is not easy to crack.

2. The level of anti-monitoring, anti-encryption and anti-leakage of software developers is relatively high, which is more difficult to prevent. Ordinary encryption products are easily killed in seconds. People who want to spend time, process forgery IP forgery dll injection, etc., lazy people go to the Internet under the tools, basically can be done. Not to mention those who understand security, it is believed that 95% of the encryption products on the market are very difficult to survive 10 minutes.

3. Most employees will resist monitoring or encryption. Unless the company is strong enough, the money is enough, and the unit is good enough, it is difficult to push. If you carry out the project, you need to find a balance.

In terms of software development environment, it is also more complex:

1. VC++ (MFC/ATL/COM/ service / Socket), JAVA (JSP/J2EE/J2SE/J2ME), PHP,C# (app/.net), protel and so on. If it is the power industry or embedded, PLC industrial control, Android development, then the development tools are even more strange. At this time, using traditional encryption products to solve the problem is basically a dead end, because it is impossible to associate so many processes.

2. it can not affect the local debugging and compilation, especially the network-related debugging or service debugging, and the debugging of the simulator

3. Most of the servers have linux, and the clients basically have virtual machines.

There are generally three points in the use of behavior management:

1. Employees need to be given some free space. For example, looking up information on the Internet, QQ, etc., as long as it does not involve company secrets, he is still allowed to do it, and does not monitor. In this way, it is not easy for employees to resent too much.

2. Safety and convenience are opposites. It is impossible to grasp a balance point that does not affect work efficiency at all. If the influence is too strong, it will be disgusted and will not help the company.

3. There is no absolute security. The purpose of security is to increase the cost of leakage, not to put an end to it. No one dares to pat on the chest and say that there is nothing wrong with their products. Even for a company as big as Microsoft, the products still have bug.

4. When there is a real need for an anti-disclosure plan, there must be a set of reasonable rules and regulations and a suitable security software, which can be used together and complement each other.

When selecting a product, some conditions need to be met at the same time:

1. Debug debug without affecting compilation

2. Does not affect version management, version comparison

3. Not just .cpp source code encryption, its appendages, obj,exe and so on need to be controlled.

4. Do not destroy the file

5. The best source code documents are plaintext on the server and ciphertext on the employee development machine, reducing dependence on encryption software and preventing security accidents.

6. It can not affect the search of information on the public network, QQ, etc., but it can not cause leakage.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.