Software trial time setting method and system based on dual verification mechanism

Abstract

The invention discloses a software trial time setting method and system based on a dual verification mechanism, which effectively increases a tamper-proof function of software trial time control, and comprises the following steps: step S1, a client collects equipment hardware feature information, generates hardware fingerprints, and sends the hardware fingerprints to a server; packaging the hardware fingerprint, the software version number and the application timestamp into an authorization request and sending the authorization request to a license server; s2, the server generates a dynamic encryption key according to a software version matching trial period; s3, the server encrypts the hardware fingerprint, the trial deadline and the function permission list by using the dynamic key, generates a license file after adding a digital signature, and issues the license file to the client; the method is novel in structure, ingenious in conception and easy and convenient to operate, the unique binding function of the license and the hardware equipment is effectively enhanced, the cracking resistance of the encryption key is improved, the real-time tamper-proof verification function is added, and the response efficiency of an exception handling mechanism is optimized.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and relates to a method and system for setting software trial time based on a double verification mechanism. Background Art

[0002] Traditional methods for implementing software trial time control generally have many problems, such as relying on the user's local system time, which makes it easy to circumvent restrictions by modifying the system time; using fixed encryption keys to store trial expiration times, which can be easily cracked by reverse engineering; and not combining hardware features, which allows licenses to be copied and used across devices.

[0003] Therefore, there is an urgent need for a software trial time control method that integrates multiple verification mechanisms to solve long-standing technical problems such as time tampering, key leakage, and hardware binding failure.

[0004] To this end, the present invention provides a software trial time setting method and system based on a double verification mechanism to solve the above problems. Summary of the Invention

[0005] In response to the above problems, the present invention proposes a software trial time setting method and system based on a double verification mechanism, which effectively solves the problems in the prior art.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] A method for setting a software trial period based on a double verification mechanism includes the following steps:

[0008] Step S1: The client collects device hardware feature information, generates a hardware fingerprint, and encapsulates the hardware fingerprint, software version number, and application timestamp into an authorization request and sends it to the license server;

[0009] Step S2: The server generates a dynamic encryption key based on the software version matching the trial period. The dynamic key is generated by the server timestamp and the hardware fingerprint fragment using the HMAC-SHA256 algorithm.

[0010] Step S3: The server uses a dynamic key to encrypt the hardware fingerprint, trial expiration date, and function permission list, adds a digital signature, generates a license file, and sends it to the client;

[0011] Step S4: The client performs double verification:

[0012] a) Decrypt the license and compare the current device hardware fingerprint with the license storage fingerprint;

[0013] b) Verify that the current system time is earlier than the trial deadline and the deviation is within the preset tolerance range;

[0014] Step S5: Control software functions according to the verification results:

[0015] When the double verification is passed, the corresponding functional module is unlocked and the real-time anti-tampering verification code is loaded into the memory;

[0016] When hardware mismatch or time tampering is detected, the license is cleared and the software is blocked from starting.

[0017] Preferably, the method for generating the hardware fingerprint in step S1 includes:

[0018] Collect at least two unique identifiers from the CPU serial number, hard disk ID, and MAC address;

[0019] The SHA-256 algorithm is used to perform a hash operation on the unique identifier to generate an irreversible hardware fingerprint string.

[0020] Preferably, the process of generating the dynamic encryption key in step S2 further includes:

[0021] Concatenate the NTP synchronization timestamp obtained from the server, the first 4 bytes of the hardware fingerprint, and the random number generated by the server;

[0022] SHA-256 hash preprocessing is performed on the spliced ​​data blocks, and the final key is generated through the HMAC-SHA256 algorithm combined with the preset seed value.

[0023] Preferably, in step S3, the license encryption adopts AES-256-GCM mode, the digital signature adopts ECDSA algorithm to sign the encrypted data packet, and the license contains the binding relationship between the server timestamp and the hardware fingerprint.

[0024] Preferably, the time verification in step S4b includes:

[0025] When the local system time is detected to be earlier than the last verification record time, it is determined to be a rollback attack;

[0026] When the time deviation exceeds the ±24-hour tolerance range, the trial expiration process is triggered.

[0027] In addition, the present invention also proposes a software trial time setting system based on a dual verification mechanism, including the above-mentioned software trial time setting method based on a dual verification mechanism, including:

[0028] A client module configured to collect hardware features, encapsulate authorization requests, perform local two-factor authentication, and dynamically load tamper-proof code;

[0029] a license server configured to generate dynamic keys, encrypt licenses, attach digital signatures, and record device activation status;

[0030] The verification module is deployed on the client and is used to calculate the hash value of key functions in real time and compare it with the pre-stored value to detect code tampering;

[0031] The exception handling module is configured to clear the license file and forcibly lock the software interface when a hardware mismatch or time anomaly is detected.

[0032] Preferably, the license server includes:

[0033] Time synchronization unit, which communicates with the NTP server to obtain an unalterable reference time;

[0034] Dynamic key generation unit, which generates keys based on hardware fingerprint fragments, server timestamps and random entropy source data;

[0035] The encryption signature unit uses a combination of AES-256-GCM and ECDSA algorithms to implement license encryption and integrity protection.

[0036] Preferably, the client module includes a secure storage area for isolating and storing dynamic keys and license files, and the secure storage area uses memory encryption technology to prevent data leakage during runtime.

[0037] Preferably, the exception handling module implements state machine control, including:

[0038] The mutual conversion logic between normal state, time abnormal state, and hardware mismatch state;

[0039] When it is detected that time rollback and hardware change occur simultaneously, the hardware exception handling strategy is executed first.

[0040] Preferably, the verification module maintains a hash check table in memory and performs real-time hash calculations on key functions. When it detects that the hash value deviation exceeds a threshold, it immediately terminates the software process and generates a security audit log.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The dynamic encryption key generation mechanism of the present invention effectively intercepts behaviors such as tampering with the user's local system time and license duplication and abuse through the dynamic encryption key generation mechanism and double verification process, achieving the core purpose of preventing the illegal extension of the trial period.

[0043] 2. The present invention has a hardware fingerprint and uses the hardware fingerprint (SHA-256 hash value of the CPU serial number, hard disk ID, and MAC address) as a dynamic factor of the encryption key, thereby achieving a strong association between the license and the specific device, and achieving the technical effect of preventing the license from being copied and used across devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of the overall architecture of the present invention.

[0045] Figure 2 Schematic diagram of the working process of the system in the present invention.

[0046] Figure 3 Schematic diagram of the steps for generating a dynamic key in the present invention.

[0047] Figure 4 Schematic diagram of the time verification logic in the present invention. DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] The following is combined with Figures 1 to 4 The specific embodiments of the present invention are described in further detail.

[0050] Depend on Figures 1 to 4 As shown, a method for setting a software trial time based on a double verification mechanism includes the following steps:

[0051] Step S1: The client collects device hardware feature information, generates a hardware fingerprint, and encapsulates the hardware fingerprint, software version number, and application timestamp into an authorization request and sends it to the license server;

[0052] In this embodiment, the client obtains the device's hardware identifiers, such as the PU serial number, hard disk serial number, and MAC address, through operating system API calls, ensuring that at least two identifiers are collected (for example, the CPU serial number and MAC address are obtained at the same time); the identification data is irreversibly processed using the SHA-256 hash algorithm to generate a 64-bit hexadecimal string as the hardware fingerprint (such as 9f86d081884c7d659a2feaa0c55ad...); the hardware fingerprint, software version number (such as v2.1.0), and application timestamp (such as 2023-08-20T14:30:00Z) are encapsulated into a JSON-formatted authorization request; the authorization request is sent to the license server via the HTTPS protocol to ensure encryption during the transmission process;

[0053] Step S2: The server generates a dynamic encryption key based on the software version matching the trial period. The dynamic key is generated by the server timestamp and the hardware fingerprint fragment using the HMAC-SHA256 algorithm.

[0054] In this embodiment, after receiving the request, the server queries the preset trial period rule according to the software version number (such as version v2.1.0 corresponds to a 30-day trial period) and calculates the trial expiration time (ExpiryTime=application time+30 days).

[0055] Dynamic key generation logic:

[0056] Extract the first 4 bytes from the hardware fingerprint string (such as 9f86d081).

[0057] Get the NTP synchronized server timestamp (such as 2023-08-20T14:30:05Z) with millisecond accuracy.

[0058] Generate a 16-byte random number (e.g. 0x3a7b...f2e1).

[0059] Concatenate the above parameters into a data block in the order of "random number||first 4 bytes of hardware fingerprint||timestamp".

[0060] Perform SHA-256 hash preprocessing on the data block to generate an intermediate value IntermediateHash.

[0061] Use the HMAC-SHA256 algorithm, combined with the seed value preset by the server (such as SecretSeed = 0x5a3d...c9b), to encrypt the intermediate value and generate the final 256-bit dynamic key.

[0062] Step S3: The server uses a dynamic key to encrypt the hardware fingerprint, trial expiration date, and function permission list, adds a digital signature, generates a license file, and sends it to the client;

[0063] In this embodiment, the hardware fingerprint, trial expiration time, and function permission list (such as ["Advanced Editing", "Export PDF"]) are serialized into a binary data stream;

[0064] The data stream is encrypted using AES-256-GCM mode. The initialization vector (IV) is derived from the dynamic key and encrypted to generate the ciphertext CipherText.

[0065] Append an ECDSA digital signature to the ciphertext:

[0066] Use the server private key to sign the ciphertext (using secp384r1 as the elliptic curve parameter) to generate the signature value Signature;

[0067] The final license file contains ciphertext, signature, and server timestamp.

[0068] Step S4: The client performs double verification:

[0069] a) Decrypt the license and compare the current device hardware fingerprint with the license storage fingerprint;

[0070] b) Verify that the current system time is earlier than the trial deadline and the deviation is within the preset tolerance range;

[0071] In this embodiment:

[0072] Hardware consistency check:

[0073] After decrypting the license, the system extracts the stored hardware fingerprint (e.g., 9f86d081884c7d...) and compares it with the fingerprint generated by the current device in real time. If there is a discrepancy (e.g., a MAC address tampering by a virtual machine is detected), an exception is triggered.

[0074] Time verification:

[0075] The client reads the local system time (e.g., 2023-08-25T10:00:00) and compares it with the ExpiryTime in the license (e.g., 2023-09-19T14:30:00Z). If the local time deviates from the server time by more than ±24 hours (e.g., the user sets the time back to 20230701), it is considered time tampering.

[0076] Step S5: Control software functions according to the verification results:

[0077] When the double verification is passed, the corresponding functional module is unlocked and the real-time anti-tampering verification code is loaded into the memory;

[0078] When hardware mismatch or time tampering is detected, the license is cleared and the software is blocked from starting;

[0079] In this embodiment, when the verification is passed: the software function module is unlocked (eg, the "Advanced Editing" menu item is displayed).

[0080] Load the anti-tampering verification code into the memory, calculate the hash value of key functions (such as license_verify()) in real time, and compare it with the pre-stored value.

[0081] When verification fails: clear the local license file (such as deleting license.dat); block the software startup process, and pop up a warning prompt (such as "Illegal tampering detected, please contact the supplier").

[0082] Further, by Figures 1 to 4 As shown, the method for generating the hardware fingerprint in step S1 includes:

[0083] Collect at least two unique identifiers from the CPU serial number, hard disk ID, and MAC address;

[0084] Use the SHA-256 algorithm to perform a hash operation on the unique identifier to generate an irreversible hardware fingerprint string;

[0085] In this embodiment, if the device cannot provide the CPU serial number (such as in some virtualized environments), the hard disk serial number + MAC address combination is collected by default; hash operation: multiple identification strings are spliced ​​in a fixed order (such as CPU serial number || hard disk ID || MAC address), and then a SHA-256 operation is performed to ensure uniqueness.

[0086] Further, by Figures 1 to 4 As shown, the process of generating the dynamic encryption key in step S2 further includes:

[0087] Concatenate the NTP synchronization timestamp obtained from the server, the first 4 bytes of the hardware fingerprint, and the random number generated by the server;

[0088] Perform SHA-256 hash preprocessing on the spliced ​​data blocks, and generate the final key through the HMAC-SHA256 algorithm combined with the preset seed value;

[0089] In this embodiment, when a dynamic key is generated:

[0090] Random numbers are generated through hardware entropy sources (such as Intel RDRAND instructions) to enhance unpredictability;

[0091] The timestamp format is unified to the IS08601 standard (e.g. 2023-08-20T14:30:05.123Z) to avoid time zone confusion;

[0092] The preset seed value is stored in the server's hardware security module (HSM) to prevent key leakage.

[0093] Further, by Figures 1 to 4 As shown, in step S3, the license encryption adopts AES-256-GCM mode, the digital signature adopts ECDSA algorithm to sign the encrypted data packet, and the license contains the binding relationship between the server timestamp and the hardware fingerprint;

[0094] It should be noted that AES-256-GCM encryption:

[0095] Attach an authentication tag (AuthenticationTag) during encryption to prevent tampering of the ciphertext;

[0096] The initialization vector (IV) length is set to 12 bytes, in line with NIST standards;

[0097] ECDSA signature verification: The client verifies the signature using the preset server public key to ensure the integrity of the license.

[0098] Further, by Figures 1 to 4 As shown, the time verification in step S4b includes:

[0099] When the local system time is detected to be earlier than the last verification record time, it is determined to be a rollback attack;

[0100] When the time deviation exceeds the ±24-hour tolerance range, the trial expiration process is triggered;

[0101] It should be noted that time rollback detection:

[0102] The client records the last verification timestamp in a local secure storage area (such as a registry or encrypted file);

[0103] At each startup, if the current system time is earlier than the last recorded time (e.g., the last time was 2023-08-25, and the current time is 2023-08-20), it is considered a rollback attack;

[0104] Tolerance processing: If the time deviation is +25 hours (for example, due to incorrect time zone settings), the trial expiration process will still be triggered.

[0105] In addition, the application also proposes a software trial time setting system based on a dual verification mechanism, including the above-mentioned software trial time setting method based on a dual verification mechanism, including:

[0106] A client module configured to collect hardware features, encapsulate authorization requests, perform local two-factor authentication, and dynamically load tamper-proof code;

[0107] a license server configured to generate dynamic keys, encrypt licenses, attach digital signatures, and record device activation status;

[0108] The verification module is deployed on the client and is used to calculate the hash value of key functions in real time and compare it with the pre-stored value to detect code tampering;

[0109] An exception handling module configured to clear the license file and forcibly lock the software interface when a hardware mismatch or time anomaly is detected;

[0110] In this embodiment, the client module:

[0111] The hardware acquisition module calls WMI (Windows) or lshw (Linux) commands to obtain hardware information.

[0112] Tamper-proof code dynamic loading is achieved through memory mapping technology to prevent it from being written to disk and reverse analyzed.

[0113] License Server:

[0114] The database records the device activation status (e.g., device ID: 9f86d081..., status: activated, expiration time: 2023-09-19).

[0115] Further, by Figures 1 to 4 As shown, the license server includes:

[0116] Time synchronization unit, which communicates with the NTP server to obtain an unalterable reference time;

[0117] Dynamic key generation unit, which generates keys based on hardware fingerprint fragments, server timestamps and random entropy source data;

[0118] The encryption and signature unit uses a combination of AES-256-GCM and ECDSA algorithms to implement license encryption and integrity protection;

[0119] In this embodiment, the time synchronization unit synchronizes with the NTP server (such as time.windows.com) every 5 minutes to ensure that the time error is less than 1 second.

[0120] Dynamic key generation unit: uses key derivation function (HKDF) to enhance key generation security.

[0121] Further, by Figures 1 to 4 As shown, the client module includes a secure storage area for isolating and storing dynamic keys and license files, and the secure storage area uses memory encryption technology to prevent runtime data leakage;

[0122] In this embodiment, the secure storage area:

[0123] Encrypt storage using CredentialGuard on Windows or eCryptfs on Linux;

[0124] Runtime keys are protected by a memory encryption engine (such as Intel SGX) to prevent debugging tools from reading them.

[0125] Further, by Figures 1 to 4 As shown, the exception handling module implements state machine control, including:

[0126] Conversion logic between normal state, time abnormal state, and hardware mismatch state;

[0127] When it is detected that time rollback and hardware change occur simultaneously, the hardware exception handling strategy is executed first;

[0128] In this embodiment, the state machine conversion logic:

[0129] When a hardware change is detected (such as replacing the network card) and the time is set back, a "Device Incompatible" prompt will pop up first instead of processing the time anomaly.

[0130] Further, by Figures 1 to 4 As shown, the verification module maintains a hash check table in memory and performs real-time hash calculations on key functions. When it detects that the hash value deviation exceeds the threshold, it immediately terminates the software process and generates a security audit log.

[0131] In this embodiment, the hash check table:

[0132] The hash values ​​of key functions are pre-stored (such as the hash of the main() function: 0x8a3d...), and the real-time calculation interval is 500 milliseconds.

[0133] If a deviation is detected (e.g. the hash value becomes 0x5b9e...), the process is terminated immediately and a log is generated.

[0134] The present invention has a novel structure, ingenious conception, and simple and convenient operation. Through this design, the anti-tampering function of the software trial time control is effectively increased, the unique binding function of the license and the hardware device is enhanced, the anti-cracking ability of the encryption key is improved, the real-time anti-tampering verification function is added, the response efficiency of the exception handling mechanism is optimized, the fault tolerance and reliability of the time verification are improved, and the security of sensitive data storage is strengthened.

[0135] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for setting software trial time based on a double verification mechanism, characterized in that: The following steps are involved: Step S1: The client collects device hardware feature information, generates a hardware fingerprint, and encapsulates the hardware fingerprint, software version number, and application timestamp into an authorization request and sends it to the license server; Step S2: The server generates a dynamic encryption key based on the software version matching the trial period. The dynamic key is generated by the server timestamp and the hardware fingerprint fragment using the HMAC-SHA256 algorithm. Step S3: The server uses a dynamic key to encrypt the hardware fingerprint, trial expiration date, and function permission list, adds a digital signature, generates a license file, and sends it to the client; Step S4: The client performs double verification: a) Decrypt the license and compare the current device hardware fingerprint with the license storage fingerprint; b) Verify that the current system time is earlier than the trial deadline and the deviation is within the preset tolerance range; Step S5: Control software functions according to the verification results: When the double verification is passed, the corresponding functional module is unlocked and the real-time anti-tampering verification code is loaded into the memory; When hardware mismatch or time tampering is detected, the license is cleared and the software is blocked from starting.

2. A method for setting software trial time based on a double verification mechanism according to claim 1, characterized in that: The method for generating the hardware fingerprint in step S1 includes: Collect at least two unique identifiers from the CPU serial number, hard disk ID, and MAC address; The SHA-256 algorithm is used to perform a hash operation on the unique identifier to generate an irreversible hardware fingerprint string.

3. A method for setting software trial time based on a double verification mechanism according to claim 1, characterized in that: The process of generating the dynamic encryption key in step S2 further includes: Concatenate the NTP synchronization timestamp obtained from the server, the first 4 bytes of the hardware fingerprint, and the random number generated by the server; SHA-256 hash preprocessing is performed on the spliced ​​data blocks, and the final key is generated through the HMAC-SHA256 algorithm combined with the preset seed value.

4. The method for setting software trial time based on a dual verification mechanism according to claim 1, characterized in that: In step S3, the license encryption adopts AES-256-GCM mode, and the digital signature adopts ECDSA algorithm to sign the encrypted data packet, and the license contains the binding relationship between the server timestamp and the hardware fingerprint.

5. The method for setting software trial time based on a dual verification mechanism according to claim 1, characterized in that: The time verification of step S4b includes: When the local system time is detected to be earlier than the last verification record time, it is determined to be a rollback attack; When the time deviation exceeds the ±24-hour tolerance range, the trial expiration process is triggered.

6. A software trial time setting system based on a dual verification mechanism, comprising a software trial time setting method based on a dual verification mechanism according to any one of claims 1 to 5, characterized in that: include: A client module configured to collect hardware features, encapsulate authorization requests, perform local two-factor authentication, and dynamically load tamper-proof code; a license server configured to generate dynamic keys, encrypt licenses, attach digital signatures, and record device activation status; The verification module is deployed on the client and is used to calculate the hash value of key functions in real time and compare it with the pre-stored value to detect code tampering; The exception handling module is configured to clear the license file and forcibly lock the software interface when a hardware mismatch or time anomaly is detected.

7. A method and system for setting software trial time based on a double verification mechanism according to claim 6, characterized in that: The license server includes: Time synchronization unit, which communicates with the NTP server to obtain an unalterable reference time; Dynamic key generation unit, which generates keys based on hardware fingerprint fragments, server timestamps and random entropy source data; The encryption signature unit uses a combination of AES-256-GCM and ECDSA algorithms to implement license encryption and integrity protection.

8. The method and system for setting software trial time based on a dual verification mechanism according to claim 6, characterized in that: The client module includes a secure storage area for isolating and storing dynamic keys and license files, and the secure storage area uses memory encryption technology to prevent runtime data leakage.

9. A method and system for setting software trial time based on a double verification mechanism according to claim 6, characterized in that: The exception handling module implements state machine control, including: The mutual conversion logic between normal state, time abnormal state, and hardware mismatch state; When it is detected that time rollback and hardware change occur simultaneously, the hardware exception handling strategy is executed first.

10. A method and system for setting software trial time based on a double verification mechanism according to claim 6, characterized in that: The verification module maintains a hash check table in memory and performs real-time hash calculations on key functions. When it detects that the hash value deviation exceeds a threshold, it immediately terminates the software process and generates a security audit log.

Images