Application software authorization method and system

Abstract

The present invention discloses an application software authorization method, comprising the following steps: when a hardware device is turned on, a preset security driver is loaded; when the application software is started on the hardware device, the application software and the security driver mutually verify whether the other party is credible according to preset rules, and if both parties are verified to be credible, the next step is executed; the application software reads the hardware unique identifier of the hardware device through the security driver; the hardware unique identifier obtained above is compared with the authorization file, and if they match, the hardware device obtains the authorization of the application software. In the scheme of the present invention, before the security driver obtains the hardware unique identifier, the security driver and the application software are mutually verified to be credible according to preset rules. On the one hand, it can prevent a third party from deceiving the application by tampering with and simulating the driver, so as to achieve the purpose of cracking the authorization verification. On the other hand, it can verify whether the application is credible, and prevent others from using illegal software to detect the security driver and crack the security driver rules, so as to achieve the purpose of cracking the authorization verification.

Description

Technical Field

[0001] The present invention relates to the field of software authorization, and in particular to an application software authorization method and system. Background Art

[0002] At present, the authorization of application software for hardware devices is generally done by identifying the hardware device through the unique hardware identification information such as Mac address and CPUID, and then authorizing by adding the device identification in the authorization file. However, the hardware identification information obtained by the "read hardware ID" operation of the Android system through the hardware device operating system layer can be easily forged, which poses a great threat to the authorization reliability of application software. For example, the hardware device ID information is tampered with and forged through the operating system layer or the hardware driver layer to obtain authorization, and an authorization file is used on multiple terminals in large quantities, causing serious economic losses to software developers. Especially when the user is offline, it is impossible to improve the authorization reliability through cloud authorization. In the case of offline authorization, it is more important for hardware device application software to improve security. Summary of the invention

[0003] In order to solve the above technical problems, the technical solution of the present invention is:

[0004] A method for authorizing application software comprises the following steps:

[0005] When the hardware device is turned on, the preset security driver is loaded;

[0006] When the application software is started on the hardware device, the application software and the security driver verify whether each other is trustworthy according to the preset rules. If both parties are verified to be trustworthy, the next step is executed;

[0007] The application software reads the hardware unique identifier of the hardware device through the security driver;

[0008] The unique hardware identifier obtained above is compared with the authorization file. If they match, the hardware device obtains authorization for the application software.

[0009] The application software and the security driver mutually verify whether the other party is trustworthy specifically as follows:

[0010] Verifying whether the application software is credible: the application software writes a first encrypted string into the security driver, the first encrypted string includes first encryption rule information, the security driver decrypts the first encrypted string into plain text information according to the first encryption rule, and determines whether the application software is credible by verifying whether the plain text information meets the preset requirements;

[0011] Verify whether the security driver is trustworthy: the application software reads the second encrypted string generated by the security driver, the second encrypted string contains second encryption rule information, the application software decrypts the second encrypted string into plain text information according to the second encryption rule, and determines whether the security driver is trustworthy by verifying whether the plain text information meets the preset requirements.

[0012] When the application software is verified to be credible, the security driver opens the valid function code to the application software for activation, otherwise, the valid function code is not opened;

[0013] When the security driver is verified to be credible, the application software opens the valid function code to the security driver for activation; otherwise, the valid function code is not opened.

[0014] The method by which the application software and the security driver verify each other's trustworthiness is as follows:

[0015] Pre-configure a rule table for security drivers and application software, wherein the rule table includes encryption type information and key information;

[0016] Verifying whether the application software is trustworthy, specifically, the application software randomly selects an encryption type and / or a key number from a rule table to form a first encryption rule and writes the first encryption rule into a security driver; encrypts the first encryption information according to the first encryption rule to generate a first encrypted string, and then writes the first encrypted string into the security driver; the security driver determines the encryption type and key number corresponding to the first encryption rule according to the rule table, calls a preset key to decrypt the first encrypted string into plain text, and then verifies whether the security driver is trustworthy by analyzing whether the decrypted plain text meets preset requirements;

[0017] Verify whether the security driver is trustworthy. Specifically, the security driver randomly selects an encryption type and / or a key number from a rule table to form a second encryption rule and writes it into the application software; encrypts the second encrypted information according to the second encryption rule to generate a second encrypted string, and then writes the second encrypted string into the application software; the application software determines the encryption type and key number corresponding to the second encryption rule according to the rule table, calls a preset key to decrypt the second encrypted string into plain text, and then verifies whether the application software is trustworthy by analyzing whether the decrypted plain text meets the preset requirements.

[0018] The authorization file is obtained online or pre-stored locally on the device. The online acquisition specifically includes reporting the unique hardware identifier of the device to the authorization cloud server to apply for sending the authorization file to the hardware device.

[0019] The unique identifier of the device hardware is the hardware Mac address information or CPUID information.

[0020] Wherein, the first encrypted information and the second encrypted information are a character string related to the current system time;

[0021] The verifying whether the security driver is credible by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the security driver is determined to be a credible driver;

[0022] The method of verifying whether the application software is trustworthy by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the application software is determined to be trustworthy.

[0023] The encryption type is symmetric encryption or asymmetric encryption.

[0024] An application software authorization system, comprising:

[0025] A trusted verification module is used to verify whether the application software and the security driver are mutually trustworthy when the application software is started on the hardware device;

[0026] The hardware unique identification reading module is used to enable the application software to read the hardware unique identification of the hardware device through the security driver when both the application software and the security driver are verified to be credible;

[0027] The authorization verification module is used to compare the hardware unique identifier obtained by the application software with the authorization file. If they match, the hardware device obtains authorization for the application software.

[0028] Different from the prior art, the present invention has the following beneficial effects:

[0029] The present invention develops a special security driver for an Android device, and then the application software obtains the hardware unique identifier of the Android device through the security driver, and then performs authorization and verification. In the scheme of the present invention, before the security driver obtains the hardware unique identifier, the security driver and the application software are mutually verified to be credible according to preset rules. On the one hand, it can prevent a third party from deceiving the application by tampering with and simulating the driver to achieve the purpose of cracking the authorization verification. On the other hand, it can verify whether the application is credible, prevent others from using illegal software to detect the security driver, crack the security driver rules, and achieve the purpose of cracking the authorization verification. In the scheme of the present invention, the ciphertext information used in the mutual verification process between the security driver and the application software is randomly generated, and the communication content is different each time, which effectively prevents others from deceiving the application software by forging the driver after monitoring the content; adopting a two-way verification mechanism, it is difficult for other applications to try to detect the driver verification behavior rules. Once a verification error occurs, the return values ​​of all interfaces will have abnormal values, making the violent detection and cracking methods invalid, thereby improving the reliability of offline authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flow chart of the application software authorization method of the present invention;

[0031] Figure 2 A schematic diagram of the real-time flow of application software and security driver in the application software authorization method in an embodiment of the present invention;

[0032] Figure 3 This is a structural block diagram of the application software authorization system of the present invention.

[0033] In the figure, 1- trusted verification module, 2- hardware unique identification reading module, 3- authorization verification module. DETAILED DESCRIPTION

[0034] The specific embodiments of the present invention are further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0035] According to an embodiment of the present invention, a method for authorizing application software is provided. Figure 1 As shown, the following steps are included:

[0036] S1: When the hardware device is turned on, the preset security driver is loaded;

[0037] In the above steps, a security driver is deployed in advance on the hardware device to be authorized, and the security driver can be distributed together with the application software.

[0038] The core function of the security driver is to read the ID of the hardware device. In the solution of the present invention, the ID of the hardware device is not read through the driver provided by the hardware device manufacturer, nor is it read through the operating system level, but the driver trusted by the software vendor reads the ID. The software to be protected directly interacts with the driver to confirm the authorization, ensuring one device, one ID, and one authorization, avoiding the modification of the device ID at the manufacturer's driver level and the manufacturer's operating system level, resulting in the duplication of the authorization and the loss of the software vendor.

[0039] S2: When the application software is started on the hardware device, the application software and the security driver verify whether each other is trustworthy according to the preset rules. If both parties are verified to be trustworthy, the next step is executed;

[0040] Bidirectional verification is a means to ensure that the driver and application are safe and reliable. In the above step S2, the application software and the security driver mutually verify whether the other party is reliable, specifically:

[0041] S21: Verify whether the application software is trustworthy: The application software writes a first encrypted string into the security driver, the first encrypted string includes first encryption rule information, the security driver decrypts the first encrypted string into plain text information according to the first encryption rule, and determines whether the application software is trustworthy by verifying whether the plain text information meets the preset requirements;

[0042] In one embodiment, when the application software is verified to be trustworthy, the security driver opens the valid function code to the application software for activation, otherwise, the valid function code is not opened; if the valid function code is not opened, the security driver cannot implement the hardware unique identification function of reading the hardware device, which will cause subsequent authorization failure.

[0043] S22: Verify whether the security driver is trustworthy: The application software reads the second encrypted string generated by the security driver, where the second encrypted string contains second encryption rule information. The application software decrypts the second encrypted string into plain text information according to the second encryption rule, and determines whether the security driver is trustworthy by verifying whether the plain text information meets preset requirements.

[0044] In one embodiment, when the security driver is verified to be credible, the application software opens the valid function code to the security driver for activation, otherwise, the valid function code is not opened. If the valid function code is not opened, the function of the application software cannot be called subsequently, that is, the authorization fails.

[0045] In the above step S2, the application software and the security driver can verify whether each other is trustworthy by another solution, specifically:

[0046] S21: the application software reads a second encrypted string generated by the security driver, the second encrypted string includes second encryption rule information, the application software decrypts the second encrypted string into plain text information according to the second encryption rule, and determines whether the security driver is credible by verifying whether the plain text information meets the preset requirements;

[0047] S22: Verify whether the application software is trustworthy: The application software writes a first encrypted string into the security driver, where the first encrypted string contains first encryption rule information. The security driver decrypts the first encrypted string into plain text information according to the first encryption rule, and determines whether the application software is trustworthy by verifying whether the plain text information meets preset requirements.

[0048] Furthermore, in step S2 of the present invention, the method for the application software and the security driver to mutually verify whether the other party is trustworthy is as follows:

[0049] Pre-configure a rule table for security drivers and application software, wherein the rule table includes encryption type information, key information, and encryption content type information;

[0050] Verify whether the application software is trustworthy, specifically, the application software randomly selects the encryption content type, encryption type number and / or key number from the rule table to form a first encryption rule and writes the first encryption rule into the security driver through the encryption rule interface of the security driver; encrypts the first encryption information according to the first encryption rule to generate a first encryption string, and then writes the first encryption string into the security driver through the verification encryption string interface of the security driver; the security driver determines the encryption type and key corresponding to the encryption type number and key number in the first encryption rule according to the rule table, calls the preset key to decrypt the first encryption string into plain text, and then verifies whether the application software is trustworthy by analyzing whether the decrypted plain text content meets the preset requirements, and the preset requirements are preset in the encryption content type;

[0051] If the verification is successful, the next step is executed; if the verification is unsuccessful, the subsequent functions of the security driver will not be opened;

[0052] Verify whether the security driver is trustworthy, specifically, the security driver randomly selects the encryption content type, encryption type and / or key number from the rule table to form a second encryption rule, and the application software reads the second encryption rule from the driver encryption rule interface of the security driver; encrypts the second encryption information according to the second encryption rule to generate a second encryption string, and then the application software reads the second encryption string information; the application software determines the encryption type and key number corresponding to the encryption type number and key number in the second encryption rule according to the rule table, calls the preset key to decrypt the second encrypted string into plain text, and then verifies whether the application software is trustworthy by analyzing whether the decrypted plain text meets the preset requirements, and the preset requirements are preset in the encryption content type.

[0053] If the verification fails, it is determined that the authorization has failed; if the verification succeeds, step S3 is executed.

[0054] In detail, the pre-configured rule table for the security driver and application software can be configured as follows: including multiple existing encryption types or selecting a new encryption type composed of any several existing encryption types, each encryption type is distinguished by a code, such as a number; similarly, the key information can be the number of the key pre-built into the security driver and application software; the encryption rule is the encryption type code and / or key number randomly selected from the rule table. In a specific embodiment, only the encryption type can be changed, and the key is a pre-built-in fixed key; only the key can be changed, and the encryption type is fixed; or, both the encryption type and the key are determined randomly. The random determination of the encryption rules can avoid the encryption method being fixed each time, prevent the encryption from being deciphered after being monitored, and thus prevent the communication information from being tampered with artificially, thereby affecting the authenticity of the trusted verification.

[0055] Specifically, in the above steps, the first encrypted information and the second encrypted information are a character string related to the current system time;

[0056] The verifying whether the security driver is credible by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the security driver is determined to be a credible driver;

[0057] The method of verifying whether the application software is trustworthy by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the application software is determined to be trustworthy.

[0058] In one embodiment, the first encrypted information uses a string containing the current system time information, which is at least accurate to the ms level. After the first encrypted information is restored to plain text in the security driver, the current system time of the security driver is taken, and the time difference is judged to be within a reasonable range as the basis for judging whether it is trustworthy. Generally speaking, the setting of this time difference is determined based on the time required for information reading, writing and decryption. If the other party does not know the encryption type and does not have the secret key, and does not know the encrypted content information, the time spent on decryption through brute force testing will inevitably be far beyond the reasonable range, and the application software can be judged to be unsafe and untrustworthy. Similarly, the second encrypted information is also the same.

[0059] Furthermore, the encryption type may be symmetric encryption or asymmetric encryption.

[0060] S3: The application software reads the hardware unique identifier of the hardware device through the security driver;

[0061] The unique identifier of the device hardware is the hardware Mac address information or CPUID information or the camera hardware ID.

[0062] S4: Compare the obtained unique hardware identifier with the authorization file. If they match, the hardware device obtains authorization for the application software.

[0063] The application software authorization method of the present invention can be used for online authorization or offline authorization. During online authorization, after the application software reads the hardware unique identifier of the hardware device through a security driver, it uses the hardware unique identifier to apply to the authorization cloud server to send the authorization file to the hardware device end and save it locally, and then compares the hardware unique identifier with the hardware identifier in the authorization file. If they match, authorization is allowed; for offline authorization, after obtaining the authorization file, it is copied to the local device through other means, or after the above-mentioned online authorization, the authorization file is stored locally on the device, and the offline authorization method can be used for subsequent authorization verification.

[0064] The hardware device of the present invention can be any device that can deploy the Linux operating system and has a hardware unique identifier that cannot be modified but can be read, such as a PC, a server, an embedded device (mobile phone, tablet, etc.).

[0065] See also Figure 3 The present invention also provides an application software authorization system, comprising:

[0066] Trusted verification module 1, used to verify whether the application software and the security driver are mutually trustworthy when the application software is started on the hardware device;

[0067] The hardware unique identification reading module 2 is used to enable the application software to read the hardware unique identification of the hardware device through the security driver when both the application software and the security driver are verified to be credible;

[0068] The authorization verification module 3 is used to compare the hardware unique identifier obtained by the application software with the authorization file. If they match, the hardware device obtains the authorization of the application software.

[0069] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A method for authorizing application software, characterized in that: The following steps are involved: When the hardware device is turned on, the preset security driver is loaded; When the application software is started on the hardware device, the application software and the security driver verify whether each other is trustworthy according to the preset rules. If both parties are verified to be trustworthy, the next step is executed; The application software reads the hardware unique identifier of the hardware device through the security driver; The obtained hardware unique identifier is compared with the authorization file. If they match, the hardware device obtains authorization for the application software; The application software and the security driver mutually verify whether the other party is trustworthy specifically as follows: Verifying whether the application software is credible: the application software writes a first encrypted string into the security driver, the first encrypted string includes first encryption rule information, the security driver decrypts the first encrypted string into plain text information according to the first encryption rule, and determines whether the application software is credible by verifying whether the plain text information meets the preset requirements; Verifying whether the security driver is credible: the application software reads a second encrypted string generated by the security driver, the second encrypted string includes second encryption rule information, the application software decrypts the second encrypted string into plain text information according to the second encryption rule, and determines whether the security driver is credible by verifying whether the plain text information meets preset requirements; The method by which the application software and the security driver verify each other's trustworthiness is as follows: Pre-configure a rule table for security drivers and application software, wherein the rule table includes encryption type information and key information; Verify whether the application software is credible, specifically, the application software randomly selects an encryption type and / or a key number from a rule table to form a first encryption rule and writes the first encryption rule into a secure drive; encrypts the first encryption information according to the first encryption rule to generate a first encryption string, and then writes the first encryption string into the secure drive; The security driver determines the encryption type and key number corresponding to the first encryption rule according to the rule table, calls the preset key to decrypt the first encrypted string into plain text, and then verifies whether the security driver is credible by analyzing whether the decrypted plain text meets the preset requirements; Verify whether the security driver is credible, specifically, the security driver randomly selects an encryption type and / or a key number from the rule table to form a second encryption rule and writes it into the application software; encrypts the second encryption information according to the second encryption rule to generate a second encryption string, and then writes the second encryption string into the application software; The application software determines the encryption type and key number corresponding to the second encryption rule according to the rule table, calls the preset key to decrypt the second encrypted string into plain text, and then verifies whether the application software is trustworthy by analyzing whether the decrypted plain text meets the preset requirements; The first encrypted information and the second encrypted information are a character string related to the current system time; The verifying whether the security driver is credible by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than a preset value, the security driver is determined to be a credible driver; The method of verifying whether the application software is trustworthy by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the application software is determined to be trustworthy.

2. An application software authorization method as claimed in claim 1, characterized in that: When the application software is verified to be trustworthy, the security driver opens the valid function code to the application software for activation. Otherwise, the valid function code is not opened. When the security driver is verified to be credible, the application software opens the valid function code to the security driver for activation; otherwise, the valid function code is not opened.

3. The method for authorizing application software according to claim 1, wherein: The authorization file is obtained online or pre-stored locally on the device. The online acquisition specifically includes reporting the unique hardware identifier of the device to the authorization cloud server to apply for sending the authorization file to the hardware device end.

4. The method for authorizing application software according to claim 1, wherein: The unique identifier of the device hardware is the hardware Mac address information or CPUID information.

5. The method for authorizing application software according to claim 1, wherein: The encryption type is symmetric encryption or asymmetric encryption.

6. An application software authorization system, comprising: A trusted verification module (1) is used to verify whether the application software and the security driver are mutually trustworthy when the application software is started on the hardware device; The hardware unique identification reading module (2) is used to enable the application software to read the hardware unique identification of the hardware device through the security driver when both the application software and the security driver are verified to be credible; An authorization verification module (3) is used to compare the hardware unique identifier obtained by the application software with the authorization file, and if they match, the hardware device obtains authorization for the application software; Trusted Verification Module (1): The application software and the security driver verify each other’s trustworthiness. The specific process is as follows: Verifying whether the application software is credible: the application software writes a first encrypted string into the security driver, the first encrypted string includes first encryption rule information, the security driver decrypts the first encrypted string into plain text information according to the first encryption rule, and determines whether the application software is credible by verifying whether the plain text information meets the preset requirements; Verifying whether the security driver is credible: the application software reads a second encrypted string generated by the security driver, the second encrypted string includes second encryption rule information, the application software decrypts the second encrypted string into plain text information according to the second encryption rule, and determines whether the security driver is credible by verifying whether the plain text information meets preset requirements; During the process, the application software and the security driver verify whether each other is trustworthy as follows: Pre-configure a rule table for security drivers and application software, wherein the rule table includes encryption type information and key information; Verify whether the application software is credible, specifically, the application software randomly selects an encryption type and / or a key number from a rule table to form a first encryption rule and writes the first encryption rule into a secure drive; encrypts the first encryption information according to the first encryption rule to generate a first encryption string, and then writes the first encryption string into the secure drive; The security driver determines the encryption type and key number corresponding to the first encryption rule according to the rule table, calls the preset key to decrypt the first encrypted string into plain text, and then verifies whether the security driver is credible by analyzing whether the decrypted plain text meets the preset requirements; Verify whether the security driver is credible, specifically, the security driver randomly selects an encryption type and / or a key number from the rule table to form a second encryption rule and writes it into the application software; encrypts the second encryption information according to the second encryption rule to generate a second encryption string, and then writes the second encryption string into the application software; The application software determines the encryption type and key number corresponding to the second encryption rule according to the rule table, calls the preset key to decrypt the second encrypted string into plain text, and then verifies whether the application software is trustworthy by analyzing whether the decrypted plain text meets the preset requirements; Wherein, the first encrypted information and the second encrypted information are a character string related to the current system time; The verifying whether the security driver is credible by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the security driver is determined to be a credible driver; The method of verifying whether the application software is trustworthy by analyzing whether the decrypted plaintext meets the preset requirements is specifically to restore the decrypted plaintext to time and compare it with the current system time. If the time difference is less than the preset value, the application software is determined to be trustworthy.

Images