Software authorization protection method based on binary system

Abstract

The invention discloses a binary system-based software authorization protection method, which comprises the following steps of: determining a parameter set used by application software, and calculating a password hash function value of an executable file of the application software; acquiring equipment information of authorized hardware to form an equipment unique identification code; performing password hash function calculation on the equipment unique identification code to obtain an encryption key; combining the parameter set and the password hash function value into a confusion character string; encrypting the obfuscated character string by adopting an encryption key, and storing the obfuscated character string as a binary file; and when the application software is started and runs, authorization protection verification is automatically carried out according to the binary file. According to the method, the parameter set, the password hash function value and the equipment information are combined to form the binary file by adopting a character string confusion technology and a key encryption technology, so that the security of software authorization is improved, and the risk of decompilation cracking is reduced; software authorization protection verification is carried out automatically according to the binary file, and the verification cost is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of software authorization protection, and in particular to a binary-based software authorization protection method. Background Art

[0002] In the process of modern software development and distribution, software authorization protection is an important topic. Traditional software authorization schemes are usually faced with various risks of cracking and decompilation. Although some existing encryption technologies (such as AES encryption) can provide a certain degree of protection, through technical means such as decompilation, attackers can directly skip the authorization verification logic, resulting in a significant reduction in actual security. Therefore, it is necessary to study software authorization protection methods.

[0003] In the prior art, Chinese patent CN116167020A discloses a software authorization method and system, the software authorization method comprising: when a customer purchases a target software, the customer information, software operating environment information and authorization information of the target software are bound and encrypted to generate an authorization certificate, and then the target software and the authorization certificate are provided to the customer; when the customer uses the target software, the target software uses the authorization certificate for authorization verification, and after the verification is passed, the target software is monitored for usage according to the authorization information and reported to the authorization server; the authorization server determines whether the use of the target software is legal according to the reported information.

[0004] Although the above-mentioned existing technologies bind and encrypt the customer information, software operating environment information and authorization information of the target software, there is still the possibility of being simulated or cracked. The security of software authorization needs to be improved, and the risk of decompilation and cracking is relatively high. In addition, the above-mentioned existing technologies require reporting on software usage and judging the legality of software usage through the authorization server, which requires continuous network connection and the verification cost of software authorization protection is relatively high. Summary of the invention

[0005] The present application provides a binary-based software authorization protection method to solve the problems in existing software authorization protection technologies that the security of software authorization needs to be improved, the risk of decompilation and cracking is high, and the verification cost of software authorization protection is high.

[0006] On the one hand, the present application provides a binary-based software authorization protection method, comprising the following steps:

[0007] Step 1: determine the parameter set used by the application software and calculate the cryptographic hash function value of the executable file of the application software.

[0008] Step 2: Obtain the device information of the authorized hardware to form a unique device identification code.

[0009] Step three, performing cryptographic hash function calculation on the unique identification code of the device to obtain an encryption key.

[0010] Step 4: Combine the parameter set and the cryptographic hash function value into an obfuscated character string.

[0011] Step five: encrypt the obfuscated string using the encryption key and save it as a binary file.

[0012] Step 6: When the application software is started and running, authorization protection verification is automatically performed based on the binary file.

[0013] In a possible implementation, in step 1, the parameter set adopts one of a functional parameter set, an environment-related parameter set, a business logic parameter set, and a security parameter set.

[0014] In a possible implementation, in step 1, the cryptographic hash function value of the executable file adopts one of a SHA series hash function value, a RIPEMD hash function value, a Whirlpool hash function value, and an MD5 hash function value.

[0015] In a possible implementation, in step 2, the device information of the authorized hardware includes: a physical network card address and a CPU serial number.

[0016] In a possible implementation, in step 3, the cryptographic hash function calculation uses one of the SHA series hash functions, RIPEMD hash function, Whirlpool hash function and MD5 hash function.

[0017] In a possible implementation, in step three, the encryption key is obtained by dynamic calculation.

[0018] In a possible implementation, in step 1, authorization parameters are also filled in.

[0019] In step 4, when the parameter set and the cryptographic hash function value are combined into the obfuscated character string, the authorization parameter is also combined together.

[0020] In a possible implementation, the authorization parameters include: the number of authorized users and the authorized usage time.

[0021] The binary-based software authorization protection method in this application has the following advantages:

[0022] By adopting obfuscated string technology and key encryption technology, the parameter set used by the application software, the cryptographic hash function value of the executable file and the device information of the authorized hardware are combined to form a binary file. The mutual binding of the parameter set, cryptographic hash function value and device information improves the security of software authorization. This multi-level encryption verification mechanism also reduces the risk of decompilation and cracking. By automatically performing software authorization protection verification based on the binary file when the application software is started and running, no user intervention is required, which improves the user experience and does not require the setting of an authorization server for online verification, reducing the verification cost.

[0023] By using dynamic calculation to obtain the encryption key, the security risks of static storage of the key are avoided and the anti-cracking capability is further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a binary-based software authorization protection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] like Figure 1 As shown, the embodiment of the present application provides a binary-based software authorization protection method, comprising the following steps:

[0028] Step 1: determine the parameter set used by the application software and calculate the cryptographic hash function value of the executable file of the application software.

[0029] Step 2: Obtain the device information of the authorized hardware to form a unique device identification code.

[0030] Step three, performing cryptographic hash function calculation on the unique identification code of the device to obtain an encryption key.

[0031] Step 4: Combine the parameter set and the cryptographic hash function value into an obfuscated character string.

[0032] Step five: encrypt the obfuscated string using the encryption key and save it as a binary file.

[0033] Step 6: When the application software is started and running, authorization protection verification is automatically performed based on the binary file.

[0034] Exemplarily, in step one, the parameter set adopts one of a functional parameter set, an environment-related parameter set, a business logic parameter set and a security parameter set.

[0035] Specifically, in this embodiment, the parameter set used by the application software adopts the klist parameter set in the security parameter set. The klist parameter set is used to manage the ticket information of the computer network authorization protocol (Kerberos). In other possible embodiments, other parameter sets may also be used.

[0036] Exemplarily, in step 1, the cryptographic hash function value of the executable file adopts one of a SHA series hash function value, a RIPEMD hash function value, a Whirlpool hash function value and an MD5 hash function value.

[0037] Specifically, in this embodiment, the cryptographic hash function value of the executable file adopts the MD5 hash function value. The general form of the MD5 hash function value is a 128-bit (16-byte) hash value, which is used to ensure the integrity of the data. In other possible embodiments, other cryptographic hash function values ​​may also be adopted.

[0038] Exemplarily, in step 2, the device information of the authorized hardware includes: a physical network card address and a CPU serial number.

[0039] Specifically, in this embodiment, the physical network card address and the CPU serial number together form the device unique identification code, so that there is a unique corresponding relationship between the device unique identification code and the authorized hardware. In other possible embodiments, other device information of the authorized hardware can also be added to further strengthen the uniqueness of the corresponding relationship.

[0040] Exemplarily, in step three, the cryptographic hash function calculation adopts one of the SHA series hash function, RIPEMD hash function, Whirlpool hash function and MD5 hash function.

[0041] Specifically, in this embodiment, in step three, the MD5 hash function is used to perform a cryptographic hash function calculation on the device unique identification code to obtain the MD5 hash function value of the device unique identification code as the encryption key.

[0042] Exemplarily, in step three, the encryption key is obtained by dynamic calculation.

[0043] Specifically, in this embodiment, the encryption key is not stored statically, but a dynamic cryptographic hash function is calculated based on the unique device identification code composed of the device information of the current hardware at each run. In this way, only when the current hardware is authorized hardware, the encryption key obtained by dynamic calculation is the same as the actual encryption key, so that the authorization verification is successful; if the current hardware is not authorized hardware, the encryption key obtained by dynamic calculation is different from the actual encryption key, and the authorization verification fails. By using the dynamic calculation method to obtain the encryption key, the security risk of static storage of the key is avoided, and the anti-cracking capability is further improved.

[0044] Exemplarily, in step one, authorization parameters are also filled in.

[0045] In step 4, when the parameter set and the cryptographic hash function value are combined into the obfuscated character string, the authorization parameter is also combined together.

[0046] Exemplarily, the authorization parameters include: the number of authorized users and the authorized usage time.

[0047] Specifically, in this embodiment, the filled authorization parameter selects the authorized usage time.

[0048] Specifically, in this embodiment, in step 4, when the parameter set, the cryptographic hash function value, and the authorization parameter are combined into an obfuscated string, an obfuscation operation is performed using a string conversion method based on a mapping relationship to obtain an obfuscated string. This embodiment provides an example process of a string conversion method based on a mapping relationship as follows: define a mapping relationship array; obtain the initial string of the parameter set, the cryptographic hash function value, and the authorization parameter; pass each character of the initial string through the mapping relationship array to obtain the corresponding value in the mapping relationship array to obtain the obfuscated string. Similarly, when it is necessary to restore the obfuscated string to the initial string, it is only necessary to perform the opposite mapping operation based on the mapping relationship array.

[0049] In other possible embodiments, character replacement, character encoding, character scrambling and other methods may be used to perform obfuscation operations to obtain an obfuscated character string.

[0050] Specifically, in this embodiment, in step 5, the obfuscated string is encrypted using an encryption key based on the existing AES encryption technology. It should be understood that although this embodiment uses the existing encryption technology, the generation of the encryption key, the generation of the obfuscated string, and the combination of the obfuscated string and the encryption key are not in the existing technology. In other possible embodiments, the obfuscated string can also be encrypted using an encryption key based on other existing encryption technologies.

[0051] The embodiment of the present application combines the parameter set used by the application software, the cryptographic hash function value of the executable file, and the device information of the authorized hardware into a binary file by adopting the obfuscated string technology and the key encryption technology. The mutual binding of the parameter set, the cryptographic hash function value, and the device information improves the security of the software authorization. This multi-level encryption verification mechanism also reduces the risk of decompilation and cracking. When the application software is started and running, the software authorization protection verification is automatically performed according to the binary file without user intervention, which improves the user experience and does not require the setting of the authorization server for online verification, thereby reducing the verification cost.

[0052] By using dynamic calculation to obtain the encryption key, the security risks of static storage of the key are avoided and the anti-cracking capability is further improved.

[0053] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0054] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A binary-based software authorization protection method, characterized in that: The following steps are involved: Step 1, determining a parameter set used by the application software and calculating a cryptographic hash function value of an executable file of the application software; Step 2: Obtain device information of the authorized hardware to form a unique device identification code; Step 3, performing cryptographic hash function calculation on the unique identification code of the device to obtain an encryption key; Step 4, combining the parameter set and the cryptographic hash function value into an obfuscated character string; Step 5: encrypt the obfuscated string using the encryption key and save it as a binary file; Step 6: When the application software is started and running, authorization protection verification is automatically performed based on the binary file.

2. A binary-based software authorization protection method according to claim 1, characterized in that: In step one, the parameter set adopts one of a functional parameter set, an environment-related parameter set, a business logic parameter set and a security parameter set.

3. A binary-based software authorization protection method according to claim 1, characterized in that: In step 1, the cryptographic hash function value of the executable file adopts one of a SHA series hash function value, a RIPEMD hash function value, a Whirlpool hash function value and an MD5 hash function value.

4. A binary-based software authorization protection method according to claim 1, characterized in that: In step 2, the device information of the authorized hardware includes: physical network card address and CPU serial number.

5. A binary-based software authorization protection method according to claim 1, characterized in that: In step 3, the cryptographic hash function calculation adopts one of the SHA series hash functions, RIPEMD hash function, Whirlpool hash function and MD5 hash function.

6. A binary-based software authorization protection method according to claim 1, characterized in that: In step three, the encryption key is obtained by dynamic calculation.

7. A binary-based software authorization protection method according to claim 1, characterized in that: In step one, the authorization parameters are also filled in; In step 4, when the parameter set and the cryptographic hash function value are combined into the obfuscated character string, the authorization parameter is also combined together.

8. A binary-based software authorization protection method according to claim 7, characterized in that: The authorization parameters include: the number of authorized users and the authorized usage time.

Images