Batch authorization and activation method for operating system in off-line scene

Abstract

The invention discloses an operating system batch authorization and activation method in an offline scene. The method comprises the following steps: generating a key file and an authorization program, generating a public key and a private key through an asymmetric encryption algorithm, and then generating an authorizer program and a verifier program; collecting hardware information of to-be-authorized machines and generating a to-be-authorized machine list; a Hash algorithm is applied to the to-be-authorized machine list to generate a hardware information abstract, a private key is used for signature, and an authorization code file is generated; and installing the authorization file deployment package on the target machine, running the calibrator program, checking the hardware information and verifying the authorization code so as to confirm whether the target machine is authorized or not. According to the method, batch authorization and activation of the operating system in a non-networking environment are ensured, and the system security and the convenience of authorization management are enhanced.

Description

Technical Field

[0001] The invention belongs to the field of computer technology, and in particular to an operating system batch authorization and activation method in an offline scenario. Background Art

[0002] The current operating system authorization and activation methods are of great significance in research and application at home and abroad. With the development of information technology and the increase in localization demand, domestic operating systems have gradually emerged and are in urgent need of rights protection. In some special scenarios, such as laboratories or other environments with high security requirements, devices cannot be connected to the Internet, and existing offline authorization solutions are difficult to effectively implement batch authorization for domestic operating systems, especially for unified authorization and management of large-scale devices. In addition, existing offline authorization solutions usually lack in-depth verification of hardware information, which can easily lead to authorization security issues.

[0003] At present, the authorization and activation methods of operating systems used in engineering practice mainly face the following difficulties:

[0004] (1) There is a lack of effective authorization and activation mechanisms for operating systems running in offline scenarios. The current authorization and activation methods for operating systems are mainly based on online server activation models. The patent "Method, device and computer system for authorized startup of embedded operating systems" (CN112256352A) discloses an authorization mechanism bound to a chip identification code, which is intended to authorize specific chip models. This method controls the scope of authorization by applying to the activation server for an authorization file for a specific chip model, and controls the number of authorizations through the number of authorizations managed by the activation server. That is, the authorization mechanism of this method needs to be completed with the help of an activation server.

[0005] (2) In offline scenarios, there is a lack of batch activation authorization mechanism for operating systems. The current authorization and activation methods for operating systems in offline scenarios are mainly applicable to the activation of a single device or the activation range. The patent (CN102456111B) discloses a method for authorization management mechanism with multiple encryptions. This method binds to the machine hardware information and can specify the permitted time range. After multiple encryptions, the authorization file is generated and distributed to the target machine. The key used to decrypt the authorization file is placed in the kernel state, ensuring that the authorization file cannot be tampered with at will. This method has high security, but the authorization file it generates is bound to a single machine.

[0006] In summary, how to provide an efficient authorization and activation mechanism for an operating system running in an offline scenario, and how to ensure authorization efficiency while ensuring authorization security have become issues that need to be addressed urgently. Summary of the invention

[0007] The purpose of the present invention is to address the problems existing in the above-mentioned prior art and provide a method for batch authorization and activation of operating systems in an offline scenario. By integrating multiple encryption technologies, the security and reliability of authorization are effectively improved. The method is particularly suitable for application scenarios that cannot be connected to the Internet and require unified authorization of large-scale devices, which greatly protects the intellectual property rights and market competitiveness of domestic operating systems.

[0008] The technical solution to achieve the purpose of the present invention is: on the one hand, a method for batch authorization and activation of operating systems in an offline scenario is provided, and the method comprises the following steps:

[0009] Step 1, generating a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0010] Step 2: Determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0011] Step 3, generating an authorization code for the list of machines to be authorized, the authorizing party runs the authorizer program, performs batch authorization for multiple machines in the list to be authorized, generates an authorization code, and provides the authorization file deployment package to the authorized party;

[0012] Step 4, perform authorization check on the target machine, first check whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized, and then use the public key to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized, otherwise it is prompted that the machine is not authorized.

[0013] Furthermore, step 1 specifically includes:

[0014] Step 1-1: The authorized party uses an asymmetric encryption algorithm to generate a key file, including a public key file and a private key file;

[0015] In step 1-2, the authorizer generates an authorizer program and a verifier program, wherein the authorizer program is used by the authorizer to generate an authorization code file; the verifier program is installed on the target machine along with the system, and the public key file is embedded in the verifier program, and the verifier program is used by the authorized party to detect whether the target machine is authorized.

[0016] Furthermore, the hardware information in step 2 includes: hard disk serial number information, CPU model information and MAC address information of the machine to be authorized.

[0017] Furthermore, in step 2, the hardware information is saved in the format of "hard disk serial number, CPU model, MAC address" to the list of machines to be authorized. Each row in the list corresponds to the hardware information of a machine, and the list of machines to be authorized is provided to the authorizing party.

[0018] Furthermore, step 3 specifically includes:

[0019] Step 3-1, the authorizer runs the authorizer program, loads the list of machines to be authorized, hashes them using a hash algorithm, and generates intermediate layer summary information;

[0020] Step 3-2, load the private key file, sign the intermediate layer summary information, and generate signature information;

[0021] Step 3-3, encode the signature information to generate a final authorization code file;

[0022] Step 3-4, generate the authorization file deployment package, including: authorization code file and the list of machines to be authorized;

[0023] Step 3-5: providing the authorization file deployment package to the authorized party.

[0024] Furthermore, step 4 specifically includes:

[0025] Step 4-1, the authorized party installs the authorization file deployment package generated in step 3-4 on the target machine to be activated to obtain the authorization code file; then runs the verifier program to load and parse the list of machines to be authorized;

[0026] Step 4-2, the checker program reads the hardware information of the current system, including the hard disk serial number information, CPU model information, and MAC information, and compares the read hardware information with the items in the list of machines to be authorized one by one. If there is an item that matches the hardware information of the target machine, it proceeds to the next step, otherwise, it outputs a prompt message that the machine is not authorized;

[0027] Step 4-3, using a hash algorithm to hash the list of authorized machines to generate intermediate layer summary information;

[0028] Step 4-4, load the authorization code file content, decode the authorization file, and obtain the signature information; then load the public key file and use the public key file to decrypt the signature information;

[0029] Step 4-5, compare the decrypted information with the intermediate layer summary information generated in step 4-3. If they are the same, the verification is successful and a prompt message indicating that the machine has been authorized is output. Otherwise, a prompt message indicating that the machine has not been authorized is output.

[0030] On the other hand, a system for batch authorization and activation of operating systems in an offline scenario is provided, the system comprising:

[0031] The first module is used to generate a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0032] The second module is used to determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0033] The third module is used to generate an authorization code for the list of machines to be authorized, and the authorizer runs the authorizer program to perform batch authorization for multiple machines in the list to be authorized, generate an authorization code, and provide the authorization file deployment package to the authorized party;

[0034] The fourth module is used to perform authorization detection on the target machine. First, it checks whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized. Then, the public key is used to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized. Otherwise, it is prompted that the machine is not authorized.

[0035] Compared with the prior art, the present invention has the following significant advantages:

[0036] (1) The present invention provides a method for batch authorization and activation of an operating system in an offline scenario, which can realize rapid batch authorization and activation of a large number of devices without the need for networking. By adopting an asymmetric encryption algorithm and a hash algorithm, the security and reliability of the authorization code file are ensured. This method is particularly suitable for high-security scenarios that cannot be connected to the Internet and require unified authorization of large-scale devices, and has broad application prospects.

[0037] (2) This method ensures batch authorization and activation of operating systems in an offline environment, enhancing system security and the convenience of authorization management.

[0038] (3) In areas with extremely high security requirements, such as laboratories, this technology can greatly improve the efficiency of unified authorization and management of large-scale equipment, reduce the risk of human operation, and ensure the safe and stable operation of the system.

[0039] (4) In terms of economic benefits, by adopting the method of the present invention, the maintenance cost of the online authorization server can be reduced, and the potential safety hazards of network authorization can be reduced. At the same time, the present invention can greatly improve the efficiency of equipment deployment, reduce the time cost and error rate of manual authorization operations, and thus bring significant economic benefits.

[0040] The present invention is further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 The figure is a flow chart of the batch authorization process of the method of the present invention in one embodiment.

[0042] Figure 2 The figure is a flow chart of target machine authorization detection of the method of the present invention in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] It should be noted that if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0045] The purpose of the present invention is to provide a method for batch authorization and activation of operating systems in an offline scenario, so as to solve the problem that batch authorization and activation cannot be performed in an offline environment in the prior art. The present invention generates a public key and a private key through an asymmetric encryption algorithm, and then generates an authorizer and a verifier program; collects the hardware information of the machine to be authorized and generates a list of machines to be authorized; generates an authorization code for the list of machines to be authorized, processes the hardware information summary through a hash algorithm and uses a private key signature to generate an authorization code file; installs the authorization file deployment package on the target machine, runs the verifier program, checks the hardware information and verifies the authorization code to confirm whether the target machine has been authorized. This method ensures batch authorization and activation of operating systems in a non-networked environment, and enhances system security and the convenience of authorization management.

[0046] In one embodiment, in combination Figure 1 , provides a method for batch authorization and activation of operating systems in an offline scenario, the method comprising the following steps:

[0047] S1, generating a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0048] S2, determining a list of machines to be authorized, the authorized party collecting the hardware information of the machines to be authorized, and providing the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0049] S3, generating an authorization code for the list of machines to be authorized, the authorizing party runs the authorizer program, performs batch authorization for multiple machines in the list to be authorized, generates an authorization code, and provides the authorization file deployment package to the authorized party;

[0050] S4, conduct authorization check on the target machine, first check whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized, and then use the public key to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized, otherwise it is prompted that the machine is not authorized.

[0051] Furthermore, in one embodiment, S1 specifically includes:

[0052] S1.1, the authorized party uses an asymmetric encryption algorithm to generate a key file, including a public key file and a private key file;

[0053] S1.2, the authorizer generates an authorizer program and a verifier program, wherein the authorizer program is used by the authorizer to generate an authorization code file; the verifier program is installed on the target machine along with the system, and the public key file is embedded in the verifier program, and the verifier program is used by the authorized party to detect whether the target machine is authorized.

[0054] Preferably, the RSA asymmetric encryption algorithm is used to generate two key files, an RSA public key and an RSA private key.

[0055] Furthermore, in one of the embodiments, the hardware information in S2 includes: hard disk serial number information, CPU model information and MAC address information of the machine to be authorized.

[0056] In S2, the hardware information is saved in the format of "hard disk serial number, CPU model, MAC address" to the list of machines to be authorized. Each line in the list corresponds to the hardware information of a machine, and the list of machines to be authorized is provided to the authorizing party.

[0057] Further, in one embodiment, in combination Figure 1 , S3 specifically includes:

[0058] S3.1, the authorizer runs the authorizer program, loads the list of machines to be authorized, hashes them using a hash algorithm, and generates intermediate layer summary information;

[0059] Preferably, the HA256 hash algorithm is used here.

[0060] S3.2, load the private key file, sign the intermediate layer summary information, and generate signature information;

[0061] S3.3, encode the signature information to generate a final authorization code file;

[0062] Preferably, the signature information is encoded using the BASE64 encode algorithm;

[0063] S3.4, generate an authorization file deployment package, including: an authorization code file and a list of machines to be authorized;

[0064] S3.5, providing the authorization file deployment package to the authorized party.

[0065] Further, in one embodiment, in combination Figure 2 , S4 specifically includes:

[0066] S4.1, the authorized party installs the authorization file deployment package generated in S3.4 on the target machine to be activated and obtains the authorization code file; then runs the verifier program to load and parse the list of machines to be authorized;

[0067] S4.2, the checker program reads the hardware information of the current system, including the hard disk serial number information, CPU model information, and MAC information, and compares the read hardware information with the items in the list of machines to be authorized one by one. If there is an item that matches the hardware information of the target machine, it proceeds to the next step, otherwise, it outputs a prompt message that the machine is not authorized;

[0068] S4.3, using a hash algorithm to perform hash processing on the list of authorized machines to generate intermediate layer summary information;

[0069] Preferably, the hash algorithm here is the same as S3.1.

[0070] S4.4, load the authorization code file content, decode the authorization file, and obtain the signature information; then load the public key file, and use the public key file to decrypt the signature information;

[0071] Preferably, the BASE64 DECODE algorithm is used to decode the authorization file.

[0072] S4.5, compare the decrypted information with the intermediate layer summary information generated in S4.3. If they are the same, the verification is successful and a prompt message indicating that the machine has been authorized is output. Otherwise, a prompt message indicating that the machine has not been authorized is output.

[0073] In one embodiment, a system for batch authorization and activation of an operating system in an offline scenario is provided, the system comprising:

[0074] The first module is used to generate a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0075] The second module is used to determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0076] The third module is used to generate an authorization code for the list of machines to be authorized, and the authorizer runs the authorizer program to perform batch authorization for multiple machines in the list to be authorized, generate an authorization code, and provide the authorization file deployment package to the authorized party;

[0077] The fourth module is used to perform authorization detection on the target machine. First, it checks whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized. Then, the public key is used to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized. Otherwise, it is prompted that the machine is not authorized.

[0078] For the specific limitations of the operating system batch authorization and activation system in offline scenarios, please refer to the limitations of the operating system batch authorization and activation method in offline scenarios above, which will not be repeated here. Each module in the above-mentioned operating system batch authorization and activation system in offline scenarios can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0079] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following is achieved:

[0080] Step 1, generating a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0081] Step 2: Determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0082] Step 3, generating an authorization code for the list of machines to be authorized, the authorizing party runs the authorizer program, performs batch authorization for multiple machines in the list to be authorized, generates an authorization code, and provides the authorization file deployment package to the authorized party;

[0083] Step 4, perform authorization check on the target machine, first check whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized, and then use the public key to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized, otherwise it is prompted that the machine is not authorized.

[0084] For the specific limitations of each step, please refer to the limitations of operating system batch authorization and activation methods in offline scenarios above, which will not be repeated here.

[0085] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements:

[0086] Step 1, generating a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program;

[0087] Step 2: Determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file;

[0088] Step 3, generating an authorization code for the list of machines to be authorized, the authorizing party runs the authorizer program, performs batch authorization for multiple machines in the list to be authorized, generates an authorization code, and provides the authorization file deployment package to the authorized party;

[0089] Step 4, perform authorization check on the target machine, first check whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized, and then use the public key to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized, otherwise it is prompted that the machine is not authorized.

[0090] For the specific limitations of each step, please refer to the limitations of operating system batch authorization and activation methods in offline scenarios above, which will not be repeated here.

[0091] The method for batch authorization and activation of operating systems in offline scenarios provided by the present invention can realize rapid batch authorization and activation of a large number of devices without the need for networking. By adopting an asymmetric encryption algorithm and a hash algorithm, the security and reliability of the authorization code file are ensured. This method is particularly suitable for high-security scenarios that cannot be connected to the Internet and require unified authorization of large-scale devices, and has broad application prospects.

[0092] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for batch authorization and activation of operating systems in an offline scenario, characterized in that: The method comprises the following steps: Step 1, generating a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program; Step 2: Determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file; Step 3, generating an authorization code for the list of machines to be authorized, the authorizing party runs the authorizer program, performs batch authorization for multiple machines in the list to be authorized, generates an authorization code, and provides the authorization file deployment package to the authorized party; Step 4, perform authorization check on the target machine, first check whether the hardware information of the current machine is included in the hardware information list of the machine to be authorized, and then use the public key to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to have authorized information, otherwise it is prompted that the machine is not authorized information.

2. The method for batch authorization and activation of operating systems in an offline scenario according to claim 1, characterized in that: Step 1 specifically includes: Step 1-1: The authorized party uses an asymmetric encryption algorithm to generate a key file, including a public key file and a private key file; In step 1-2, the authorizer generates an authorizer program and a verifier program, wherein the authorizer program is used by the authorizer to generate an authorization code file; the verifier program is installed on the target machine along with the system, and the public key file is embedded in the verifier program, and the verifier program is used by the authorized party to detect whether the target machine is authorized.

3. The method for batch authorization and activation of operating systems in an offline scenario according to claim 1, characterized in that: The hardware information in step 2 includes: hard disk serial number information, CPU model information and MAC address information of the machine to be authorized.

4. The method for batch authorization and activation of operating systems in an offline scenario according to claim 3, characterized in that: In step 2, the hardware information is saved in the format of "hard disk serial number, CPU model, MAC address" to the list of machines to be authorized. Each line in the list corresponds to the hardware information of a machine, and the list of machines to be authorized is provided to the authorizing party.

5. The method for batch authorization and activation of operating systems in an offline scenario according to claim 1 is characterized in that: Step 3 specifically includes: Step 3-1, the authorizer runs the authorizer program, loads the list of machines to be authorized, hashes them using a hash algorithm, and generates intermediate layer summary information; Step 3-2, load the private key file, sign the intermediate layer summary information, and generate signature information; Step 3-3, encode the signature information to generate a final authorization code file; Step 3-4, generate the authorization file deployment package, including: authorization code file and the list of machines to be authorized; Step 3-5: providing the authorization file deployment package to the authorized party.

6. The method for batch authorization and activation of operating systems in an offline scenario according to claim 5, characterized in that: Step 4 specifically includes: Step 4-1, the authorized party installs the authorization file deployment package generated in step 3-4 on the target machine to be activated to obtain the authorization code file; then runs the verifier program to load and parse the list of machines to be authorized; Step 4-2, the checker program reads the hardware information of the current system, including the hard disk serial number information, CPU model information, and MAC information, and compares the read hardware information with the items in the list of machines to be authorized one by one. If there is an item that matches the hardware information of the target machine, it proceeds to the next step, otherwise, it outputs a prompt message that the machine is not authorized; Step 4-3, using a hash algorithm to hash the list of authorized machines to generate intermediate layer summary information; Step 4-4, load the authorization code file content, decode the authorization file, and obtain the signature information; then load the public key file and use the public key file to decrypt the signature information; Step 4-5, compare the decrypted information with the intermediate layer summary information generated in step 4-3. If they are the same, the verification is successful and a prompt message indicating that the machine has been authorized is output. Otherwise, a prompt message indicating that the machine has not been authorized is output.

7. The method for batch authorization and activation of operating systems in an offline scenario according to claim 6, characterized in that: The hashing algorithm in step 3-1 and step 4-3 is the same.

8. The method for batch authorization and activation of operating systems in an offline scenario according to claim 6, characterized in that: In step 4-4, the BASE64 DECODE algorithm is used to decode the authorization file.

9. The operating system batch authorization and activation system in an offline scenario according to any one of the methods of claims 1 to 8, characterized in that: The system comprises: The first module is used to generate a key file and an authorization program, wherein the authorization program includes an authorizer program and a verifier program; The second module is used to determine the list of machines to be authorized, and the authorized party collects the hardware information of the machines to be authorized and provides the hardware information of the machines to be authorized to the authorizer in the form of a text file; The third module is used to generate an authorization code for the list of machines to be authorized, and the authorizer runs the authorizer program to perform batch authorization for multiple machines in the list to be authorized, generate an authorization code, and provide the authorization file deployment package to the authorized party; The fourth module is used to perform authorization detection on the target machine. First, it checks whether the current hardware information is included in the hardware information list of the machine to be authorized. Then, the public key is used to verify whether the decoded authorization file is consistent with the hardware information list of the machine to be authorized processed by the SHA256 hash algorithm. If they are consistent, the verification is successful and the machine is prompted to be authorized. Otherwise, it is prompted that the machine is not authorized.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images