Software file, and software running method and related apparatus therefor

Abstract

Disclosed in the embodiments of the present disclosure are a software file, and a software running method and a related apparatus therefor. The software running method comprises: acquiring a starting request for starting working software of a software file; starting a bootloader of the software file according to the starting request, and allocating an encryption memory for an encryption container corresponding to the software file; by means of the bootloader, instructing a security processor to acquire a first decryption key for an encryption container disk mirror image file of the software file, and sending the first decryption key to the encryption container, so that the encryption container decrypts the encryption container disk mirror image file, so as to obtain an encryption container disk mirror image and the working software, which are stored in the encryption memory; running the encryption container disk mirror image to start the encryption container; and when it is indicated that the encryption container determines that a local authorization file in the encryption container disk mirror image is legitimate, starting the working software. The software file, and the software running method and the related apparatus therefor provided in the embodiments of the present disclosure can improve the anti-reversing and anti-cracking capabilities of software.

Description

A software file, software operation method and related device

[0001] This application claims priority to Chinese patent application No. 202310865291.X filed on July 13, 2023. The contents of the above-mentioned Chinese patent application disclosure are hereby incorporated by reference in their entirety as a part of this application. Technical Field

[0002] The embodiments of the present disclosure relate to a software file, a software running method and related devices. Background Art

[0003] Commercial software is typically distributed through offline CD sales and online downloads, with users granted access to software features through licensing, thereby generating profits for the company. However, pirated software can be used through reverse engineering to disable the authorized features in the software, while the business functions of the software remain functional. This can significantly impact the profits of software companies, and therefore, the anti-piracy capabilities of software are directly linked to the profits of software companies.

[0004] Software reverse engineering technology disassembles software binary files to obtain computer CPU instructions, which are then analyzed and cracked. Therefore, to prevent disassembly of software binary files, software is encrypted to improve its anti-piracy capabilities. However, encrypted software can still be reverse engineered and cracked.

[0005] Therefore, how to improve the software's anti-reverse engineering and cracking capabilities has become a problem that technical personnel in this field urgently need to solve.

[0006] Summary of the Invention

[0007] The technical problem solved by the embodiments of the present disclosure is how to improve the anti-reverse engineering and cracking capabilities of software.

[0008] To solve the above problems, the embodiments of the present disclosure provide the following technical solutions.

[0009] The present disclosure provides a software file, including:

[0010] An encrypted container disk image file, encrypted using a first encryption key, including the encrypted container disk image packaged with the working software;

[0011] A boot program is configured to instruct the security processor to obtain a first decryption key corresponding to the first encryption key, so that the encrypted container decrypts the encrypted container disk image file according to the first decryption key to obtain the encrypted container disk image and the working software stored in the encrypted memory of the encrypted container, wherein the encrypted container is the container corresponding to the encrypted container disk image.

[0012] Optionally, it also includes: a key ciphertext of the first encryption key, wherein the key ciphertext is obtained by encrypting the first encryption key with a second encryption key; the boot program is used to instruct the security processor to decrypt the key ciphertext according to the second decryption key to obtain the first encryption key and the first decryption key, so that the encrypted container decrypts the encrypted container disk image file according to the first decryption key to obtain the encrypted container disk image and the working software stored in the encrypted memory of the encrypted container, wherein the first encryption key corresponds to the first decryption key, and the second decryption key corresponds to the second encryption key.

[0013] Optionally, the second encryption key includes a second public key, and the second decryption key includes a second private key.

[0014] Optionally, the first encryption key includes a first public key, and the first decryption key includes a first private key.

[0015] The present disclosure also provides a software running method applicable to an operating system, wherein the software includes the software file as described in any one of the above items, including:

[0016] Obtaining a startup request for the working software to start the software file;

[0017] Starting the boot program of the software file according to the startup request, and allocating encrypted memory to the encrypted container corresponding to the software file;

[0018] Instructing the secure processor, through the boot program, to obtain a first decryption key for the encrypted container disk image file of the software file and sending the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and the working software stored in the encrypted memory, wherein the first decryption key corresponds to the first encryption key, and the encrypted container disk image file is encrypted by the first encryption key;

[0019] When the encrypted container is instructed to determine that the local authorization file in the encrypted container disk image is legal, the working software is started.

[0020] Optionally, it also includes:

[0021] When the encrypted container is instructed to determine that the local authorization file of the working software is illegal, the encrypted container is instructed to obtain an authorization reply from the software server corresponding to the working software, so that when the encrypted container obtains the authorization legal reply, the working software is started.

[0022] Optionally, it also includes:

[0023] When the encrypted container is instructed to determine that the local authorization file of the working software is illegal, the encrypted container is instructed to obtain an authorization reply from the software server corresponding to the working software, so that the encrypted container exits abnormally when obtaining an illegal authorization reply.

[0024] Optionally, the step of instructing the encrypted container to obtain an authorization response from a software server corresponding to the working software includes:

[0025] Instructing the encrypted container to obtain software authorization feature information of the working software and a software authorization code obtained according to the software authorization feature information;

[0026] The encrypted container is instructed to send the software authorization feature information and the software authorization code to the software server of the working software to obtain the authorization response.

[0027] Optionally, it also includes:

[0028] When the encrypted container is instructed to connect to the software server of the working software, and the encrypted container cannot connect to the software server, the working software is started in a trial state.

[0029] Optionally, the software file further includes a key ciphertext obtained by encrypting the first encryption key using a second encryption key, and the step of instructing the security processor through the boot program to obtain the first decryption key of the encrypted container disk image file of the software file and sending the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file further includes:

[0030] instructing the security processor, through the boot program, to obtain a second decryption key for the key ciphertext, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key, wherein the second decryption key corresponds to the second encryption key;

[0031] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0032] Optionally, the second encryption key includes a second public key, the second decryption key includes a second private key, and the step of instructing the security processor, through the boot program, to obtain the first decryption key of the encrypted container disk image file of the software file and decrypting the encrypted container disk image file further includes:

[0033] instructing the security processor to obtain the second private key through the boot program, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key;

[0034] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0035] The present disclosure also provides a software running device, applicable to an operating system, wherein the software includes the software file as described in any one of the above items, including:

[0036] a startup request obtaining unit adapted to obtain a startup request for starting the working software of the software file;

[0037] an encrypted memory allocation unit, adapted to start the boot program of the software file according to the startup request, and allocate encrypted memory to the encrypted container corresponding to the software file;

[0038] an encrypted container disk image and working software acquisition unit, adapted to instruct the security processor, through the boot program, to acquire a first decryption key of the encrypted container disk image file of the software file and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software stored in the encrypted memory, wherein the first decryption key corresponds to a first encryption key, and the encrypted container disk image file is encrypted by the first encryption key;

[0039] The working software starting unit is adapted to start the working software when instructing the encrypted container to determine that the local authorization file in the encrypted container disk image is legal.

[0040] Optionally, it also includes:

[0041] The authorization reply obtaining unit is adapted to instruct the encrypted container to obtain an authorization reply from the software server corresponding to the working software when the encrypted container is instructed to determine that the local authorization file of the working software is illegal, so that the working software can be started when the encrypted container obtains the authorization legality reply.

[0042] Optionally, the authorization reply acquisition unit is further adapted to instruct the encrypted container to obtain an authorization reply from the software server corresponding to the working software when the encrypted container is instructed to determine that the local authorization file of the working software is illegal, so that the encrypted container exits abnormally when it obtains an illegal authorization reply.

[0043] Optionally, the authorization reply obtaining unit is adapted to instruct the encrypted container to obtain an authorization reply from a software server corresponding to the working software, including:

[0044] Instructing the encrypted container to obtain software authorization feature information of the working software and a software authorization code obtained according to the software authorization feature information;

[0045] The encrypted container is instructed to send the software authorization feature information and the software authorization code to the software server of the working software to obtain the authorization response.

[0046] Optionally, the working software starting unit is further adapted to start the working software in a trial state when the encrypted container is instructed to connect to the software server of the working software and the encrypted container cannot be connected to the software server.

[0047] Optionally, the software file further includes a key ciphertext obtained by encrypting the first encryption key using a second encryption key. The encrypted container disk image and working software acquisition unit is adapted to instruct the security processor, through the boot program, to acquire the first decryption key of the encrypted container disk image file of the software file and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file. The unit further includes:

[0048] instructing the security processor, through the boot program, to obtain a second decryption key for the key ciphertext, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key, wherein the second decryption key corresponds to the second encryption key;

[0049] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0050] Optionally, the second encryption key includes a second public key, and the second decryption key includes a second private key. The encrypted container disk image and working software acquisition unit is adapted to instruct the security processor to acquire the first decryption key of the encrypted container disk image file of the software file through the boot program, and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file. The unit further includes:

[0051] instructing the security processor to obtain the second private key through the boot program, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key;

[0052] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0053] The embodiment of the present disclosure further provides an operating system, which can execute a program that implements any of the aforementioned software running methods.

[0054] An embodiment of the present disclosure further provides a computer system, comprising: an operating system, wherein the operating system can execute a program that implements any of the aforementioned software running methods.

[0055] The software execution method provided by the embodiment of the present disclosure is applied to an operating system and includes: obtaining a startup request for starting working software of the software file; starting a boot program of the software file according to the startup request and allocating encrypted memory for the encrypted container corresponding to the software file; instructing a security processor through the boot program to obtain a first decryption key of the encrypted container disk image file of the software file and sending it to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software stored in the encrypted memory, wherein the first decryption key corresponds to a first encryption key and the encrypted container disk image file is encrypted by the first encryption key; executing the encrypted container disk image to start the encrypted container; and starting the working software when the encrypted container is instructed to determine that the local authorization file in the encrypted container disk image is valid. In this way, the software execution method provided by the embodiment of the present disclosure includes the encrypted working software and the encrypted container disk image. Before starting the working software, the working software is decrypted in the encrypted memory of the encrypted container. After starting the encrypted container, when the encrypted container is used to determine that the local authorization file corresponding to the working software is valid, the working software is started in the encrypted container, so that the working software always runs in the encrypted memory of the encrypted container. It can be seen that the software running method provided by the embodiment of the present disclosure is protected by encryption before running, which can prevent the instructions of the working software from being directly obtained by skipping authorization; after the boot program is started and decrypted, it is stored in the encrypted memory pre-allocated for the encrypted container. Subject to the access restriction of the encrypted memory, it can still prevent the instructions of the working software from being directly obtained by skipping authorization; after the working software is started, the working software runs in the secure environment of the encrypted container, and the reading of instructions and data requires encryption and decryption with the key corresponding to the encrypted container, which can also prevent the instructions and data of the working software from being directly obtained by skipping authorization. Therefore, the software running method provided by the embodiment of the present disclosure can prevent instructions from being obtained and then reversed and cracked, whether before or during the running of the working software, and can improve the anti-piracy ability of the software. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are merely embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0057] FIG1 is a schematic diagram of a software instruction;

[0058] Figure 2 is a schematic diagram of the software flow;

[0059] FIG3 is a schematic diagram of obtaining a released software file;

[0060] FIG4 is a schematic diagram of a software operation method;

[0061] FIG5 is a schematic diagram of a process for obtaining software files provided by an embodiment of the present disclosure;

[0062] FIG6 is a structural diagram of a computer system running a software file provided by an embodiment of the present disclosure;

[0063] FIG7 is a schematic diagram of another process for obtaining software files provided by an embodiment of the present disclosure;

[0064] FIG8 is a flowchart of a software operation method provided by an embodiment of the present disclosure; and

[0065] FIG9 is a structural block diagram of a software running device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0066] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present disclosure.

[0067] Software is an ordered collection of computer code, stored in a specific format on a disk or CD, forming a software file. From the perspective of a computer CPU, software is a set of CPU instructions that form complex processing logic, including authorization function logic (authorization function) and business function logic (Business Function 1 and Business Function 2). For details, please refer to Figure 1, which is a schematic diagram of software instructions. Both logics are represented in software as a set of CPU instructions.

[0068] Business function 1 can be understood as an instruction that can be directly displayed for free without authorization, and business function 2 can be understood as an instruction that can be displayed only after authorization. Instructions with authorization functions are set between the two.

[0069] Of course, in other embodiments, all business functions may be required to be authorized before being displayed. Then, in the software execution logic, the authorization function is placed before all business functions.

[0070] Reverse analysis technology refers to obtaining the software's CPU instructions by disassembling the software image file, and then analyzing the logical functions corresponding to the instructions, so that authorized functions can be skipped during the software execution process.

[0071] As shown in Figure 2, software process ① is the workflow of normal software, which verifies the legality of use through the authorization function. Among them, software process ② is the workflow of cracked software, which skips the authorization function, so that it can be copied indefinitely and used without authorization.

[0072] In order to prevent the software from being reverse analyzed, in one solution, please refer to Figure 3, which shows a schematic diagram of obtaining a released software file. Before the software is released, the working software of the software file is encrypted, and then the encrypted software image file is released. As shown in the figure, the working software is first encrypted using a key to obtain the encrypted working software, and then the encrypted working software and the unencrypted boot program are merged into a released software file, which is generally a software disk image file.

[0073] When it is necessary to start the working software, please refer to Figure 4. Figure 4 is a schematic diagram of a software running method. The operating system (i.e., the CPU in the figure) first obtains a startup request to start the working software, obtains the software disk image file from the disk, and then starts the boot program. The boot program obtains the encrypted working software from the software disk image file, decrypts it, and stores it in the memory, and then executes the decrypted software instructions.

[0074] It can be seen that the published software files obtained by the above method encrypt the working software to obtain encrypted working software. Therefore, when the encrypted working software is in a static, unexecuted state, there is no way to obtain CPU instructions through static disassembly and other technologies. However, when the working software is in the process of execution, it is stored in the memory in plain text. Therefore, by using the instructions and data of the runtime working software in the memory, the CPU instructions can be extracted and the runtime business logic can be analyzed, thereby achieving cracking.

[0075] Based on this, the embodiments of the present disclosure provide a software file, a software running method, and related devices thereof. The software running method is applicable to an operating system and includes:

[0076] Obtaining a startup request for the working software to start the software file;

[0077] Starting the boot program of the software file according to the startup request, and allocating encrypted memory to the encrypted container corresponding to the software file;

[0078] Instructing the secure processor, through the boot program, to obtain a first decryption key for the encrypted container disk image file of the software file and sending the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and the working software stored in the encrypted memory, wherein the first decryption key corresponds to the first encryption key, and the encrypted container disk image file is encrypted by the first encryption key;

[0079] When the encrypted container is instructed to determine that the local authorization file in the encrypted container disk image is legal, the working software is started.

[0080] It can be seen that the software running method provided by the embodiment of the present disclosure is protected by encryption before running, which can prevent the instructions of the working software from being directly obtained by skipping authorization; after the boot program is started and decrypted, it is stored in the encrypted memory pre-allocated for the encrypted container. Subject to the access restriction of the encrypted memory, it can still prevent the instructions of the working software from being directly obtained by skipping authorization; after the working software is started, the working software runs in the secure environment of the encrypted container, and the reading of instructions and data requires encryption and decryption with the key corresponding to the encrypted container, which can also prevent the instructions and data of the working software from being directly obtained by skipping authorization. Therefore, the software running method provided by the embodiment of the present disclosure can prevent instructions from being obtained and then reversed and cracked, whether before or during the running of the working software, and can improve the anti-piracy ability of the software.

[0081] For ease of understanding, the software files provided by the present disclosure are first described. Please refer to FIG5 , which is a schematic diagram of the process of obtaining the software files provided by an embodiment of the present disclosure.

[0082] As shown in the figure, in a specific implementation, the software files provided by the embodiment of the present disclosure include:

[0083] An encrypted container disk image file 1, encrypted by a first encryption key 3, includes an encrypted container disk image 11 packaged with working software 12;

[0084] The boot program 2 is used to instruct the security processor to obtain a first decryption key corresponding to the first encryption key, so that the encrypted container decrypts the encrypted container disk image file 1 according to the first decryption key to obtain the encrypted container disk image 11 and the working software 12 stored in the encrypted memory of the encrypted container, wherein the encrypted container is the container corresponding to the encrypted container disk image.

[0085] It is easy to understand that the software files described in this article are files for release. As shown in the figure, before release, the encrypted container disk image 11 packaged with the working software 12 is encrypted using the first encryption key 3, and then the boot program 2 in plain text is released together.

[0086] It should be noted that the boot program 2 of the software file provided in the embodiment of the present disclosure instructs the security processor to obtain the first decryption key corresponding to the first encryption key, and after causing the encrypted container to decrypt the encrypted container disk image file 1, the decrypted encrypted container disk image 11 and working software 12 are stored in the encrypted memory of the encrypted container.

[0087] To facilitate understanding of the encrypted container and its encrypted memory, please refer to FIG6 , which is a structural diagram of a computer system running the software file provided in an embodiment of the present disclosure.

[0088] As shown in the figure, the computer system includes a memory, a memory controller, a processor, a security processor, a main operating system and an encryption container, wherein the encryption container includes encryption container 1, encryption container 2 and encryption container 3.

[0089] When initializing an encrypted container, the host operating system allocates corresponding encrypted memory to each encrypted container through the memory controller. As shown in the figure, encrypted container 1 is allocated corresponding encrypted memory 1, encrypted container 2 is allocated corresponding encrypted memory 2, and encrypted container 3 is allocated corresponding encrypted memory 3. The host operating system also instructs the cryptographic coprocessor of the memory controller through the security processor to allocate keys to each encrypted container. As shown in the figure, encrypted container 1 is allocated key 1, encrypted container 2 is allocated key 2, and encrypted container 3 is allocated key 3. When the encrypted container is running, the hardware uses the vmid (cryptographic container identifier) ​​to mark all code and data within the container. The vmid indicates which container the data belongs to. During operation, the vmid remains unchanged within the SOC, ensuring that the container data is correctly identified and cannot be read by other system software (including other containers). Each key corresponds to the vmid of the encrypted container.

[0090] Vmid is used to protect the container data inside the SOC. The built-in cryptographic coprocessor in the memory controller protects the container data in the memory. When data is written to / read from the memory, the cryptographic coprocessor uses the key corresponding to vmid to encrypt / decrypt the data, thereby achieving data protection.

[0091] Of course, the encrypted container itself can set part of its memory to non-encrypted ordinary memory and use the non-encrypted ordinary memory to interact with peripherals or the host.

[0092] In this disclosure, we use the encrypted memory of the encrypted container. The key and the vmid of the encrypted container are used to read and write data to achieve data protection. That is, the processor's secure virtual machine and memory encryption technology are used to implement container encryption. Based on hardware virtualization, the encrypted container provides a more secure memory encryption function, so that each running encrypted container runs in its own independent encrypted memory.

[0093] It should be noted that the first encryption key 3 and the first decryption key described in this article correspond to each other, which means that after encryption using the first encryption key 3, decryption can be achieved using the first decryption key, including the case where the two are the same, and the case where the two are different but can be decrypted after decryption operation.

[0094] In a specific embodiment, if the first encryption key and the first decryption key are the only keys for encryption and decryption, in order to achieve encryption using the first encryption key during publication, and to be able to successfully decrypt using the first decryption key during use, that is, the user can successfully obtain the first decryption key, the first encryption key includes the first public key, and the first decryption key includes the first private key.

[0095] However, directly encrypting with the first public key and decrypting with the first private key results in a large workload for encryption and decryption and low efficiency. Therefore, in another specific implementation, please refer to Figure 7, which is another schematic diagram of the acquisition process of the software file provided by the embodiment of the present disclosure. The software file provided by the embodiment of the present disclosure also includes: a key ciphertext 5 of the first encryption key, the key ciphertext 5 is obtained by encrypting the first encryption key 3 with the second encryption key 4; the boot program 2 is used to instruct the security processor to decrypt the key ciphertext 5 according to the second decryption key 4 to obtain the first encryption key 3 and the first decryption key, and send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file 1 according to the first decryption key to obtain the encrypted container disk image 11 and the working software 12 stored in the encrypted memory of the encrypted container, wherein the first encryption key 3 corresponds to the first decryption key, and the second decryption key 4 corresponds to the second encryption key.

[0096] It will be readily understood that in this embodiment, the first encryption key 3 corresponds to the first decryption key. Thus, when the key ciphertext 5 is decrypted using the second decryption key 4 to obtain the first encryption key 3, the first decryption key can be obtained. Of course, the correspondence between the first encryption key 3 and the first decryption key described herein includes both the case where the first encryption key 3 and the first decryption key are identical, and the case where the first encryption key 3 and the first decryption key are different but can still be decrypted after a decryption operation.

[0097] The second encryption key 4 described in this article corresponds to the second decryption key, which means that after encryption using the second encryption key 4, decryption can be achieved using the second decryption key, including both the case where the two are the same and the case where the two are different but can be decrypted after decryption operation.

[0098] In a specific embodiment, the second encryption key includes a second public key, and the second decryption key includes a second private key. In this way, it is very convenient to obtain the first decryption key, and then to obtain the working software.

[0099] When the key ciphertext 5 of the first encryption key 3 is set, and the second encryption key includes a second public key, and the second decryption key includes a second private key, the second public key can be used only to encrypt the first encryption key 3, which is less affected by the encryption efficiency. Using the first encryption key 3 to encrypt the encrypted container disk image 11 and the working software 12 can also ensure higher encryption efficiency. Similarly, higher decryption efficiency can also be guaranteed, thereby ensuring computing efficiency and improving user experience on the basis of achieving security.

[0100] It is easy to understand that in other embodiments, more layers of encryption keys may be included, but in order to conveniently implement decryption needs, the outermost encryption key is the public key, and the corresponding outermost decryption key is the private key.

[0101] It can be seen that the software files provided by the embodiments of the present disclosure are protected by encryption in the static storage stage, which can prevent the instructions of the working software from being directly obtained by skipping authorization; in the software use stage, after the boot program is started and decrypted, it is stored in the encrypted memory pre-allocated for the encrypted container. Due to the access restriction of the encrypted memory, it can still prevent the instructions of the working software from being directly obtained by skipping authorization; after the working software is started, the working software runs in the secure environment of the encrypted container, and the reading of instructions and data requires encryption and decryption with the key corresponding to the encrypted container, which can also prevent the instructions and data of the working software from being directly obtained by skipping authorization. Therefore, the software files provided by the embodiments of the present disclosure can prevent instructions from being obtained and then reversed and cracked, whether before or during the operation of the working software, and can improve the anti-piracy ability of the software.

[0102] For ease of understanding, this document further illustrates the software operation method provided in the embodiment of the present disclosure. Please refer to FIG8 , which is a flowchart of the software operation method provided in the embodiment of the present disclosure.

[0103] As shown in the figure, the software running method provided by the embodiment of the present disclosure includes:

[0104] Step S11: The operating system obtains a startup request of the working software of the startup software file.

[0105] When the user needs to run the software, the operating system will obtain a startup request to start the working software described in any of the above embodiments through the startup input of the interactive interface.

[0106] In a specific embodiment, the specific startup request may be a request to start a boot program of a software file.

[0107] Step S12: The operating system starts the boot program of the software file according to the startup request, and allocates encrypted memory to the encrypted container corresponding to the software file.

[0108] After receiving the startup request, the operating system starts the boot program and, at the same time, allocates encrypted memory for the encrypted container corresponding to the encrypted container disk image in the software file.

[0109] It is easy to understand that at this stage, the encrypted container has not yet been started, and encrypted memory is allocated for it in advance.

[0110] Step S13: The operating system sends an instruction to the security processor through the boot program to obtain a first decryption key of the encrypted container disk image file of the software file.

[0111] After the boot program is started and the encrypted memory is allocated, the operating system sends an instruction to obtain the first decryption key to the security processor through the boot program, so as to decrypt the encrypted container disk image file and perform subsequent operations.

[0112] Step S14: The security processor obtains a first decryption key of the encrypted container disk image file of the software file.

[0113] In one specific embodiment, when an encrypted container disk image file is obtained by encrypting an encrypted container disk image packaged with working software using a first encryption key, and there is only one encryption key layer, namely, the first encryption key is a first public key, the first decryption key obtained by the security processor is the first private key. Then, the encrypted container disk image file can be decrypted using the corresponding first private key to obtain the encrypted container disk image and working software. This makes encryption and decryption simple.

[0114] In another specific embodiment, when the software file also includes a key ciphertext obtained by encrypting the first encryption key using a second encryption key, to obtain the first decryption key, it is necessary to first obtain a second decryption key corresponding to the second encryption key, then decrypt the key ciphertext to obtain the first encryption key and a first decryption key corresponding to the first encryption key (e.g., the same as the first encryption key). The first decryption key is then used to decrypt the encrypted container disk image file to obtain the encrypted container disk image and the working software. This ensures operational efficiency while maintaining security and improving the user experience.

[0115] It is easy to understand that in a scheme with only two layers of encryption and decryption keys (that is, the first encryption key is only encrypted by the second encryption key to obtain the key ciphertext, and the second encryption key is not encrypted again), in order to obtain the second decryption key, the second decryption key includes the second private key, and the corresponding second encryption key includes the second public key. Therefore, when the key ciphertext is decrypted using the second private key, the first encryption key, that is, the first decryption key, can be obtained, and further decrypted using the first decryption key.

[0116] It should be noted that, in a specific implementation, in order to further improve security, the validity of the key ciphertext may be determined before decrypting the key ciphertext.

[0117] Of course, if more layers of encryption and decryption keys are included, the second encryption key may not be the second public key, and the second decryption key may not be the second private key, but the outermost encryption key and decryption key may be the public key and private key respectively.

[0118] As mentioned above, the first encryption key and the first decryption key correspond to each other, including the case where they are the first public key and the first private key respectively, and the case where the first encryption key and the first decryption key are equal; similarly, the second encryption key and the second decryption key correspond to each other, including the case where they are the second public key and the second private key respectively, and the case where the second encryption key and the second decryption key are equal.

[0119] Step S15: The security processor sends the first decryption key to the encryption container.

[0120] After obtaining the first decryption key, the security processor injects the first decryption key into the encryption container.

[0121] Step S16: The encrypted container receives the first decryption key, decrypts the encrypted container disk image file, and obtains the encrypted container disk image and working software stored in the encrypted memory.

[0122] After obtaining the first decryption key, the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software. To ensure the security of the software, the encrypted container disk image and working software are saved to the encrypted memory of the encrypted container.

[0123] It is easy to understand that in order to start the working software, ensure the smooth operation of the working software, and prevent instructions from being stolen, the working software needs to run in a secure environment. To this end, the encryption container needs to be started before starting the working software. Therefore, before decryption, the security processor also initializes the encryption container.

[0124] After completing the initialization of the encrypted container, the operating system runs the encrypted container disk image to start the encrypted container.

[0125] Of course, the startup of the encrypted container only needs to be completed before decrypting the encrypted container disk image file.

[0126] Step S17: The encrypted container determines whether the local authorization file in the encrypted container disk image is legal. If so, step S22 is executed; if not, step S18 is executed.

[0127] As mentioned above, the operation of genuine working software requires authorization.

[0128] For ease of understanding, the present disclosure describes the software authorization function before the business function, and therefore the authorization status is confirmed first.

[0129] In a specific implementation, the authorization status may be confirmed by determining whether the local authorization file in the encrypted container disk image is legal.

[0130] Specifically, whether the local authorization document is legal includes: whether the local authorization document is within the validity period and / or whether it is within the trial period?

[0131] If the local authorization file is legal, the working software is started. If it is not legal, further confirmation is required.

[0132] It can be seen that the software running method provided by the embodiment of the present disclosure is protected by encryption before running, which can prevent the instructions of the working software from being directly obtained by skipping authorization; after the boot program is started and decrypted, it is stored in the encrypted memory pre-allocated for the encrypted container. Subject to the access restriction of the encrypted memory, it can still prevent the instructions of the working software from being directly obtained by skipping authorization; after the working software is started, the working software runs in the secure environment of the encrypted container, and the reading of instructions and data requires encryption and decryption with the key corresponding to the encrypted container, which can also prevent the instructions and data of the working software from being directly obtained by skipping authorization. Therefore, the software running method provided by the embodiment of the present disclosure can prevent instructions from being obtained and then reversed and cracked, whether before or during the running of the working software, and can improve the anti-piracy ability of the software.

[0133] In another specific implementation, when further obtaining an authorization response is required, the software operation method provided by the embodiment of the present disclosure may further include:

[0134] Step S18: The encrypted container sends an authorization request to the software server.

[0135] When the local authorization file is illegal, the working software cannot be started. Then the encrypted container obtains a new authorization file from the software server, so that when the new authorization file is legal, the working software can be started, avoiding the problem of not being able to start the working software directly due to failure to update the local authorization file in time.

[0136] Specifically, to enable the encrypted container to send an authorization request to the software server, you can execute:

[0137] First, the encrypted container obtains the software authorization feature information of the working software, including the network card MAC (Media Access Control) number, disk serial number, operating system version, etc. of the local computer environment that starts the working software.

[0138] After obtaining the software authorization feature information, the encrypted container also needs to obtain the software authorization code.

[0139] It is easy to understand that the software authorization code is obtained after the user completes the registration and payment process on the software vendor's website using the software authorization feature information. That is, the encrypted container will receive the software authorization code entered by the user.

[0140] Then, the encrypted container sends the software authorization feature information and the software authorization code to the software server of the working software, completes sending the authorization request, and requests the software server to authorize.

[0141] Through the above steps, the sending of the authorization request can be realized conveniently and timely, so that even if the local authorization text is illegal, the working software can be started, meeting the needs of users and protecting the interests of software service providers.

[0142] Step S19: The software server obtains an authorization response.

[0143] After receiving the authorization request, the software server determines the payment status, validity period and other information based on the software authorization feature information and the software authorization code information, and then determines the authorization response.

[0144] Step S20: The software server returns an authorization response to the encrypted container.

[0145] After confirming the authorization response, the software server returns the authorization response to the encrypted container.

[0146] Step S21: Determine whether the authorization reply is legal. If so, execute step S22; if not, execute step S23.

[0147] If the authorization reply is legal, that is, when a legal authorization reply is received, the working software is started; if an illegal authorization reply is received, the encrypted container is abnormally exited, and the working software will not be started.

[0148] Step S22: The encrypted container starts the working software.

[0149] Step S23: The encrypted container exits abnormally.

[0150] In this way, by obtaining the authorization response from the software server, even if the local authorization file is illegal, the probability of using the working software can be increased by obtaining the latest authorization response in a timely manner. At the same time, the interests of the software service provider can be guaranteed when an illegal authorization response is received.

[0151] In another specific implementation, in order to facilitate the subsequent startup of the working software, the newly obtained authorization legal response can also be saved in the encrypted container disk image, so that the next time the working software is started again, there is no need to obtain the authorization response again.

[0152] However, when the encrypted container is connected to the software server of the working software, there is a possibility that the encrypted container cannot connect to the software server. To improve the user experience, in this case, the working software can be launched in a trial state. This can both protect the rights of the software vendor and maximize user convenience.

[0153] To solve the aforementioned problems, the embodiments of the present disclosure also provide a software running device. The software running device described below can be considered as a functional module required to be set up by the operating system to implement the software running method provided by the embodiments of the present disclosure; the content of the software running device described below can be referenced in correspondence with the content of the method described above.

[0154] In an optional implementation, FIG9 shows a structural diagram of a software running device provided in an embodiment of the present disclosure. The software running device can be applied to an operating system. The software includes the software files as described in any of the above embodiments. As shown in FIG9 , the software running device may include:

[0155] A startup request obtaining unit 100 is adapted to obtain a startup request for starting the working software of the software file;

[0156] The encrypted memory allocation unit 110 is adapted to start the boot program of the software file according to the startup request and allocate encrypted memory to the encrypted container corresponding to the software file;

[0157] The encrypted container disk image and working software obtaining unit 120 is adapted to instruct the security processor, through the boot program, to obtain a first decryption key of the encrypted container disk image file of the software file and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software stored in the encrypted memory, wherein the first decryption key corresponds to the first encryption key, and the encrypted container disk image file is encrypted by the first encryption key;

[0158] The working software starting unit 130 is adapted to start the working software when the encrypted container is instructed to determine that the local authorization file in the encrypted container disk image is legal.

[0159] In an optional example, it also includes: an authorization reply acquisition unit 140, which is suitable for instructing the encrypted container to obtain an authorization reply from the software server corresponding to the working software when the encrypted container determines that the local authorization file of the working software is illegal, so that the working software can be started when the encrypted container obtains the authorization legality reply.

[0160] In an optional example, the authorization reply acquisition unit 140 is also suitable for instructing the encrypted container to obtain an authorization reply from the software server corresponding to the working software when the encrypted container is instructed to determine that the local authorization file of the working software is illegal, so that the encrypted container exits abnormally when it obtains an illegal authorization reply.

[0161] In an optional example, the authorization response obtaining unit 140 is adapted to instruct the encrypted container to obtain an authorization response from the software server corresponding to the working software, including:

[0162] Instructing the encrypted container to obtain software authorization feature information of the working software and a software authorization code obtained according to the software authorization feature information;

[0163] The encrypted container is instructed to send the software authorization feature information and the software authorization code to the software server of the working software to obtain the authorization response.

[0164] In an optional example, the working software starting unit 130 is further adapted to start the working software in a trial state when the encrypted container is instructed to connect to the software server of the working software and the encrypted container cannot connect to the software server.

[0165] In an optional example, the software file further includes a key ciphertext obtained by encrypting the first encryption key using a second encryption key. The encrypted container disk image and working software acquisition unit 120 is adapted to instruct the security processor through the boot program to obtain the first decryption key of the encrypted container disk image file of the software file and send it to the encrypted container so that the encrypted container decrypts the encrypted container disk image file. The encrypted container further includes:

[0166] instructing the security processor, through the boot program, to obtain a second decryption key for the key ciphertext, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key, wherein the second decryption key corresponds to the second encryption key;

[0167] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0168] In an optional example, the second encryption key includes a second public key, and the second decryption key includes a second private key. The encrypted container disk image and working software acquisition unit 120 is adapted to instruct the security processor, through the boot program, to acquire the first decryption key of the encrypted container disk image file of the software file and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file. The method further includes:

[0169] instructing the security processor to obtain the second private key through the boot program, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key;

[0170] The secure processor is instructed to send the first decryption key to the encrypted container, so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

[0171] The present disclosure also provides an operating system that can execute a program that implements the software operation method described in any of the above embodiments. Detailed descriptions can be found in the corresponding sections above and will not be further elaborated here.

[0172] The present disclosure also provides a computer system including an operating system capable of executing a program that implements the software operation method described in any of the aforementioned embodiments. For details, please refer to the corresponding description above and will not be further elaborated here.

[0173] Although the embodiments of the present disclosure are disclosed above, the present disclosure is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present disclosure. Therefore, the scope of protection of the present disclosure shall be based on the scope defined by the claims.

Claims

1. A software file, comprising: An encrypted container disk image file, encrypted by a first encryption key, includes an encrypted container disk image packaged with working software; A boot program is used to instruct the security processor to obtain a first decryption key corresponding to the first encryption key, so that the encrypted container decrypts the encrypted container disk image file according to the first decryption key to obtain the encrypted container disk image and the working software stored in the encrypted memory of the encrypted container, wherein the encrypted container is a container corresponding to the encrypted container disk image.

2. The software file according to claim 1, further comprising a key ciphertext of the first encryption key, wherein: The key ciphertext is obtained by encrypting the first encryption key with the second encryption key; the boot program is used to instruct the security processor to decrypt the key ciphertext according to the second decryption key to obtain the first encryption key and the first decryption key, so that the encrypted container decrypts the encrypted container disk image file according to the first decryption key to obtain the encrypted container disk image and the working software stored in the encrypted memory of the encrypted container, wherein the first encryption key corresponds to the first decryption key, and the second decryption key corresponds to the second encryption key.

3. The software file according to claim 2, wherein: The second encryption key includes a second public key, and the second decryption key includes a second private key.

4. The software file according to any one of claims 1 to 3, wherein: The first encryption key includes a first public key, and the first decryption key includes a first private key.

5. A software running method, applicable to an operating system, wherein: The software includes the software file according to any one of claims 1 to 4, and the software running method includes: Obtaining a start request for starting working software of the software file; Starting the boot program of the software file according to the start request, and allocating encrypted memory to the encrypted container corresponding to the software file; Instructing the security processor to obtain a first decryption key of the encrypted container disk image file of the software file through the boot program, and sending the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software stored in the encrypted memory, wherein the first decryption key corresponds to the first encryption key, and the encrypted container disk image file is encrypted by the first encryption key; When the encrypted container is instructed to determine that the local authorization file in the encrypted container disk image is legitimate, the working software is started.

6. The software running method according to claim 5, further comprising: When the encrypted container is instructed to determine that the local authorization file of the working software is illegal, the encrypted container is instructed to obtain an authorization reply from the software server corresponding to the working software, so that when the encrypted container obtains the legal authorization reply, the working software is started.

7. The software running method according to claim 6, further comprising: When the encryption container is instructed to determine that the local authorization file of the working software is illegal, the encryption container is instructed to obtain an authorization reply from the software server corresponding to the working software, so that the encryption container exits abnormally when obtaining an illegal authorization reply.

8. The software running method according to claim 6 or 7, wherein: The instructing the encrypted container to obtain an authorization reply from the software server corresponding to the working software includes: Instructing the encrypted container to obtain software authorization feature information of the working software and a software authorization code obtained according to the software authorization feature information; Instruct the encrypted container to send the software authorization feature information and the software authorization code to the software server of the working software to obtain the authorization reply.

9. The software running method according to any one of claims 5 to 8, further comprising: When the encrypted container is instructed to connect to the software server of the working software, and the encrypted container cannot connect to the software server, the working software is started in a trial state.

10. The software running method according to any one of claims 5 to 9, wherein: The software file also includes a key ciphertext obtained by encrypting the first encryption key by using a second encryption key, and the boot program instructs the security processor to obtain a first decryption key of the encrypted container disk image file of the software file and sends it to the encrypted container so that the encrypted container decrypts the encrypted container disk image file, and further includes: instructing the security processor to obtain a second decryption key of the key ciphertext through the boot program, decrypting the key ciphertext to obtain the first encryption key and the first decryption key corresponding to the first encryption key, wherein the second decryption key corresponds to the second encryption key; The security processor is instructed to send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

11. The software running method according to claim 10, wherein: The second encryption key includes a second public key, the second decryption key includes a second private key, and the boot program instructs the security processor to obtain the first decryption key of the encrypted container disk image file of the software file and decrypt the encrypted container disk image file, further comprising: Instructing the security processor to obtain the second private key through the boot program, decrypt the key ciphertext, and obtain the first encryption key and the first decryption key corresponding to the first encryption key; The security processor is instructed to send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

12. A software running device, suitable for an operating system, wherein: The software includes the software file according to any one of claims 1 to 4, and the software running device includes: A startup request obtaining unit, adapted to obtain a startup request for starting the working software of the software file; an encrypted memory allocation unit, adapted to start the boot program of the software file according to the startup request, and allocate encrypted memory to the encrypted container corresponding to the software file; an encrypted container disk image and working software acquisition unit, adapted to instruct the security processor through the boot program to acquire a first decryption key of the encrypted container disk image file of the software file, and send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file to obtain the encrypted container disk image and working software stored in the encrypted memory, wherein the first decryption key corresponds to a first encryption key, and the encrypted container disk image file is encrypted by the first encryption key; The working software starting unit is adapted to start the working software when instructing the encrypted container to determine that the local authorization file in the encrypted container disk image is legal.

13. The software running device according to claim 12, further comprising: The authorization reply acquisition unit is adapted to instruct the encrypted container to obtain an authorization reply from the software server corresponding to the working software when the encrypted container is instructed to determine that the local authorization file of the working software is illegal, so that the working software can be started when the encrypted container obtains the authorization legal reply.

14. The software running device according to claim 13, wherein: The authorization reply acquisition unit is also suitable for instructing the encrypted container to obtain an authorization reply from the software server corresponding to the working software when instructing the encrypted container to determine that the local authorization file of the working software is illegal, so that the encrypted container will exit abnormally when obtaining an illegal authorization reply.

15. The software running device according to claim 13 or 14, wherein: The authorization reply obtaining unit is adapted to instruct the encrypted container to obtain an authorization reply from the software server corresponding to the working software, including: Instructing the encrypted container to obtain software authorization feature information of the working software and a software authorization code obtained according to the software authorization feature information; Instruct the encrypted container to send the software authorization feature information and the software authorization code to the software server of the working software to obtain the authorization reply.

16. The software running device according to any one of claims 12 to 15, wherein: The working software starting unit is further adapted to start the working software in a trial state when the encrypted container is instructed to connect to a software server of the working software and the encrypted container cannot connect to the software server.

17. The software running device according to any one of claims 12 to 16, wherein: The software file also includes a key ciphertext obtained by encrypting the first encryption key by using a second encryption key. The encrypted container disk image and working software acquisition unit is adapted to instruct the security processor to acquire the first decryption key of the encrypted container disk image file of the software file through the boot program, and send it to the encrypted container so that the encrypted container decrypts the encrypted container disk image file, and further includes: instructing the security processor to obtain a second decryption key of the key ciphertext through the boot program, decrypting the key ciphertext to obtain the first encryption key and the first decryption key corresponding to the first encryption key, wherein the second decryption key corresponds to the second encryption key; The security processor is instructed to send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

18. The software running device according to claim 17, wherein: The second encryption key includes a second public key, the second decryption key includes a second private key, the encrypted container disk image and working software acquisition unit is adapted to instruct the security processor to acquire the first decryption key of the encrypted container disk image file of the software file through the boot program, and decrypt the encrypted container disk image file, and further includes: The boot program instructs the security processor to obtain the second private key, Decrypting the ciphertext to obtain the first encryption key and the first decryption key corresponding to the first encryption key; The security processor is instructed to send the first decryption key to the encrypted container so that the encrypted container decrypts the encrypted container disk image file using the first decryption key.

19. An operating system, wherein: The operating system can execute a program that implements the software running method described in any one of claims 5-11.

20. A computer system comprising: An operating system, wherein the operating system is executable to implement a program of the software running method described in any one of claims 5 to 11.

Images