A software license security control method based on a domestic cryptographic algorithm

Abstract

This invention relates to a software license security control method based on domestically developed cryptographic algorithms, belonging to the field of software security technology. It solves the problems of low security and inflexible security control in existing encryption algorithms. The method includes: obtaining the runtime environment machine code based on a security control module; obtaining the application software's general authorization attributes and application control attributes as authorization objects; encrypting the authorization objects and runtime environment machine code using SM2, SM3, and SM4 to generate an encrypted public key string, a hexadecimal string of the runtime environment machine code, and a signature object string; concatenating these to obtain an authorization code, which is then written to a license file; loading the license file; and having the security control module read and verify the license file, including verifying signature validity, runtime environment machine code consistency, and the matching of general authorization attributes in the authorization objects. If any verification fails, subsequent verifications stop; if all verifications pass, the authorization objects are cached in memory. This achieves secure control over the application software.

Description

Technical Field

[0001] This invention relates to the field of software security technology, and in particular to a software license security control method based on domestically developed cryptographic algorithms. Background Technology

[0002] With the development of computer technology and the widespread use of computer software in work and daily life, companies are increasingly demanding software license management. Furthermore, with the advancement of cryptography and computer technology, common encryption algorithms used in the domestic cryptography field face serious security challenges.

[0003] Currently, the most common security controls for application software use registration codes and license files. Registration codes are usually fixed-length, while license files are typically generated from text templates in Properties or XML format, containing both plaintext and encrypted content, which poses a significant risk of being cracked. Some systems involve binding to IP addresses, making it easy for multiple people to reuse the license, thus failing to provide effective control.

[0004] Existing encryption methods typically employ popular symmetric encryption algorithms or a single algorithm, making them vulnerable to unauthorized cracking. Furthermore, current technologies lack reasonable management methods for the generation and management of registration codes and license files, resulting in a significant need for manpower to control the security of thousands of applications. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a software license security control method based on domestic cryptographic algorithms, in order to solve the problems of low security and inflexible security control of existing encryption algorithms.

[0006] On one hand, embodiments of the present invention provide a software license security control method based on domestically developed cryptographic algorithms, comprising the following steps:

[0007] Based on the security control module integrated in the application software, obtain the machine code of the runtime environment;

[0008] Obtain the general authorization attributes and application control attributes of the application software as the authorization object. Based on the preset symmetric encryption key, use the domestic cryptographic algorithms SM2, SM3 and SM4 to encrypt the authorization object and the runtime environment machine code to generate the encrypted public key string, the runtime environment machine code hexadecimal string and the signature object string. After connecting them sequentially using a fixed delimiter, the authorization code is obtained and written into the license file.

[0009] The security control module loads the license file, reads and verifies it, including verifying the signature's legality using SM4 and SM2, verifying the consistency of the runtime environment's machine code using SM3, and verifying the matching of common authorization attributes in the authorized object. If any verification fails, subsequent verifications are stopped. If all verifications pass, the authorized object is cached in memory for application control.

[0010] Based on a further improvement of the above method, the security control module is a standalone JAR file, including:

[0011] The license registration interface displays the application software's license status and runtime environment machine code, allows users to submit the license code, and upload the license file.

[0012] The runtime environment machine code acquisition unit extracts a 16-bit string from one or more MAC addresses of the runtime environment and displays it in the license registration interface.

[0013] The license file reading and verification unit is used to retrieve the license file from the path configured in the JVM parameters or the preset default path, and then verify the authorization code in the license file.

[0014] The timed check unit is used to periodically trigger the license file reading and verification unit to perform the operation of reading and verifying the license file.

[0015] Based on the above method, the process of generating the encrypted public key string includes:

[0016] Use SM2 to generate a key pair, which includes the original public key and the original private key;

[0017] Based on the preset symmetric encryption key, the generated key pair is encrypted a second time using SM4 to generate an encrypted key string, including the encrypted public key string and private key string.

[0018] Based on the further improvement of the above method, the process of generating the hexadecimal string of the runtime environment machine code includes: encrypting the runtime environment machine code using SM3 to obtain a hash value, converting the hash value into a hexadecimal string, and obtaining the hexadecimal string of the runtime environment machine code.

[0019] Based on further improvements to the above method, the process of generating the signature object string includes:

[0020] The obtained authorization object is constructed into a JSON string;

[0021] Encode the JSON string using UTF-8 and compress it into a binary byte array;

[0022] The binary byte array is signed using the original private key and the SM2 algorithm to obtain the signature string;

[0023] Convert the binary byte array to hexadecimal to obtain the hexadecimal string of the authorized object;

[0024] The authorized object hexadecimal string and the signature string are combined using a fixed separator to form a new string, which is then converted to hexadecimal to obtain the new authorized object hexadecimal string. The signature object string is obtained by encrypting the new authorized object hexadecimal string using SM4 with the runtime environment hexadecimal string as the private key.

[0025] Based on a further improvement of the above method, loading the license file includes:

[0026] Place the license file in the application software's compilation directory, and configure the path to the license file in the JVM startup parameters via extended parameters; or,

[0027] On the license registration interface of the security control module, enter the authorization code from the license file, or upload the license file.

[0028] Based on the above method, further improvements are made to verify signature validity using SM4 and SM2, including:

[0029] The authorization code is segmented according to a fixed delimiter to obtain the encrypted public key string, the runtime environment machine code hexadecimal string, and the signature object string;

[0030] Use SM4 to decrypt the public key string and the signature object string to obtain a new hexadecimal string of the original public key and the authorization object;

[0031] Convert the new hexadecimal string of the authorization object into a text string, and then separate it according to a fixed delimiter to obtain the signature string and the hexadecimal string of the authorization object respectively;

[0032] The SM2 algorithm is used to verify the validity of the signature by combining the original public key and the signature string.

[0033] Based on the above method, a further improvement is made to use SM3 to verify the consistency of the runtime environment machine code, including:

[0034] The hexadecimal string of the authorized object obtained during the process of verifying the validity of the signature using SM4 and SM2 is converted into a binary byte array, and then decompressed to obtain the JSON string of the authorized object;

[0035] Identify whether the authorization type in the JSON string is a formal authorization. If it is a formal authorization, obtain the runtime environment machine code again. Based on the generation process of the runtime environment machine code hexadecimal string, obtain a new runtime environment machine code hexadecimal string and compare it with the runtime environment machine code hexadecimal string in the authorization code to ensure consistency.

[0036] If it is a temporary authorization, there is no need to compare consistency; it will be considered consistent by default.

[0037] Further improvements to the above method include verifying the matching of common authorization attributes in the authorization object, including:

[0038] Extract the operating system type, number of CPUs, and license expiration time from the JSON string of the decompressed authorized object, and compare them with the actual obtained operating system type, number of CPUs, and current time for matching.

[0039] A further improvement to the above method involves stopping subsequent checks when any check fails, including:

[0040] When the security control module reads and verifies the license file when the application software starts, if any verification fails, an error message is displayed, the current process is terminated, and the application software fails to start.

[0041] When the security control module periodically performs the task of reading and verifying the license file, if any verification fails, an error message is displayed, subsequent verifications are stopped, and the application software operation is not affected. When the application software restarts, an error message is displayed, the current process is terminated, and the application software restart fails.

[0042] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0043] 1. It comprehensively adopts multiple domestically developed cryptographic algorithms, resulting in high security and reliability;

[0044] 2. Avoid using a single MAC address. The security control module obtains the runtime environment machine code based on the actual target machine, making it difficult to steal or crack, thus improving security control capabilities.

[0045] 3. Based on the business needs of the application software, the application control attribute encryption was added to the license content, which increased the applicable scenarios of security control, improved the scalability of the application software, and strengthened the security control of the application software.

[0046] 4. It supports both authorization codes and license files, and provides a graphical interface for easy software license updates. The security control module has a built-in timed check function, which enables the license content to take effect dynamically without restarting the application software, reducing the workload of deployment personnel.

[0047] 5. The security control module is used as a standalone JAR file, which can be added to any Java-based application software, making it highly reusable.

[0048] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0049] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0050] Figure 1 This is a flowchart of a software license security control method based on domestic cryptographic algorithms in an embodiment of the present invention;

[0051] Figure 2 This is a flowchart illustrating the software license file generation process in an embodiment of the present invention.

[0052] Figure 3 This is a flowchart illustrating the software license file loading and verification process in an embodiment of the present invention. Detailed Implementation

[0053] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0054] A specific embodiment of the present invention discloses a software license security control method based on domestically developed cryptographic algorithms, such as... Figure 1 As shown, it includes the following steps:

[0055] S11: Obtain the runtime environment machine code based on the security control module integrated in the application software;

[0056] S12: Obtain the general authorization attributes and application control attributes of the application software as the authorization object. Based on the preset symmetric encryption key, use the domestic cryptographic algorithms SM2, SM3 and SM4 to encrypt the authorization object and the runtime environment machine code, generate the encrypted public key string, the runtime environment machine code hexadecimal string and the signature object string, connect them sequentially using a fixed delimiter to obtain the authorization code, and write the authorization code into the license file.

[0057] S13: Load the license file. The security control module reads and verifies the license file, including verifying the signature validity using SM4 and SM2, verifying the consistency of the runtime environment machine code using SM3, and verifying the matching of common authorization attributes in the authorized object. If any verification fails, subsequent verifications are stopped. If all verifications pass, the authorized object is cached in memory for application control.

[0058] During implementation, the process is divided into two parts: generating a license and using a license. During license generation, the security control module obtains the runtime environment machine code in real time based on the target machine being deployed. Using domestic cryptographic algorithms SM2, SM3, and SM4, it encrypts the runtime environment machine code and other authorization information of the application software into an authorization code, which is then written into the license file. During license usage, the security control module reads the license file and decrypts the authorization code in the license file using domestic cryptographic algorithms SM2, SM3, and SM4. It then sequentially verifies the signature validity, consistency, and matching of the license. After all verifications pass, the decrypted authorization object is cached in memory for subsequent application software business control.

[0059] Compared with existing technologies, the software license security control method based on domestic cryptographic algorithms provided in this embodiment comprehensively adopts multiple domestic cryptographic algorithms, resulting in high security and reliability. It avoids the use of a single MAC address, instead having the security control module obtain the runtime environment machine code based on the actual target machine, making it difficult to steal or crack, thus improving security control capabilities. Furthermore, by combining the business needs of the application software, it adds application control attributes to the encrypted content of the license, expanding the applicable scenarios for security control, improving the scalability of the application software, and increasing the security control strength of the application software.

[0060] It should be noted that the security control module in step S11 is a standalone JAR file, which is integrated into the application software by default. For example, it can be added to the application software system via Maven dependency, or the JAR file can be directly placed in the JAR directory that the application software depends on.

[0061] The security control module can be added to any Java-based application, offering high reusability. Furthermore, other techniques, including dependency management and startup detection, prevent the security control module from being illegally removed or tampered with. For example, if other functions in the application depend on the security control module, removing it will cause compilation failures and errors in the application.

[0062] Specifically, the security control module includes:

[0063] The license registration interface displays the application software's license status and runtime environment machine code, allows users to submit the license code, and upload the license file.

[0064] The runtime environment machine code acquisition unit extracts a 16-bit string from one or more MAC addresses of the runtime environment and displays it in the license registration interface.

[0065] For example, first identify the number of MAC addresses of the target machine to be deployed. If there is only one, extract 16 characters from the beginning as the runtime environment machine code. If there are two MAC addresses, extract 8 characters from each and concatenate them together as the runtime environment machine code. If there are three or more MAC addresses, select up to three MAC addresses, extract them according to a certain number, and concatenate them together as the runtime environment machine code.

[0066] The license file reading and verification unit is used to retrieve the license file from the path configured in the JVM parameters or the preset default path, and then verify the authorization code in the license file.

[0067] The timed check unit is used to periodically trigger the license file reading and verification unit to perform the operation of reading and verifying the license file.

[0068] For example, by extending the JVM startup parameters and using -D to set the frequency of timed checks, the trigger time is recorded and updated in memory, and the timed check unit performs the operation of reading and verifying the license file according to the trigger time.

[0069] Preferably, the timing framework used by the application software, such as Quartz or XXL-Job, can be used to initialize the license verification timed task and configure the scheduling frequency through the timing framework.

[0070] In step S12, domestically developed cryptographic algorithms SM2, SM3, and SM4 are used to generate a license file. SM2 is an asymmetric key algorithm with a 256-bit encryption strength. SM3 is a cryptographic hash algorithm, a type of hash (digest) algorithm, with a 256-bit hash value. SM4 is a symmetric encryption algorithm with a 128-bit encryption strength. Figure 2 As shown, step S12 can be further refined into the following steps:

[0071] S121: Obtain the general authorization attributes and application control attributes of the application software as the authorization object.

[0072] It should be noted that application software licenses include temporary licenses and formal licenses. Temporary licenses are generally applicable to non-production environments such as trial and testing. A temporary license can be applied in multiple operating environments. The use of the application software is restricted by the license expiration time, or by limiting the number of times a temporary license can be applied for for an application software in terms of license management. Formal licenses are generally applicable to production environments. A formal license can only be applied in one operating environment. The legality of the license is verified through multiple processes, and the use of the application software is restricted through various attributes to prevent the formal license from being illegally stolen and abused.

[0073] General application software licensing attributes include: operating system type, number of CPUs, license expiration time, and license type; application control attributes include: application software category name, application software category code, maximum number of concurrent users, maximum number of middleware thread pools, maximum number of database connection pools, and authorized functional components. Both of these pieces of information are used together as the licensing object.

[0074] Preferably, for formal authorization, the general authorization attribute is required, and the application control attribute can be set according to the control requirements of the actual application software and the verification function implemented corresponding to the control attribute.

[0075] S122: Generate the encrypted public key string using SM2 and SM4.

[0076] Specifically, first, a key pair is generated using SM2, which includes the original public key and the original private key; then, based on the preset symmetric encryption key, the generated key pair is encrypted a second time using SM4 to generate an encrypted key string, which includes the encrypted public key string and the private key string.

[0077] Preferably, the preset symmetric encryption key is usually alphanumeric characters with underscores, excluding special characters. If not preset, a string is randomly generated.

[0078] S123: Use SM3 to generate a hexadecimal string of machine code for the runtime environment.

[0079] It is worth noting that for formal authorization, the runtime environment machine code must be obtained through the security control module. For temporary authorization, since only the license expiration time is verified, the runtime environment machine code does not need to be obtained. Instead, a unique 16-bit string is randomly generated during the encryption process as the runtime environment machine code.

[0080] Specifically, the process of generating a hexadecimal string from the runtime environment includes:

[0081] The runtime environment machine code is encrypted using SM3 to obtain a hash value, which is then converted into a hexadecimal string to obtain the runtime environment machine code hexadecimal string.

[0082] S124: Generate a signature object string using SM2 and SM4.

[0083] Specifically, the process of generating the signature object string includes:

[0084] The obtained authorization object is constructed into a JSON string;

[0085] Encode the JSON string using UTF-8 and compress it into a binary byte array byte[].

[0086] The binary byte array is signed using the original private key obtained in step S122 and the SM2 algorithm to obtain the signature string.

[0087] Convert the binary byte array to hexadecimal to obtain the hexadecimal string of the authorized object;

[0088] Combine the hexadecimal string of the authorization object with the signature string using a fixed separator to form a new string, and convert it to hexadecimal to obtain a new hexadecimal string of the authorization object. Use the hexadecimal string of the runtime environment machine code obtained in step S123 as the private key, and encrypt the new hexadecimal string of the authorization object using SM4 to obtain the signature object string.

[0089] It should be noted that the delimiter should remain consistent during encryption and decryption. For example, a fixed delimiter is "-".

[0090] S125: Generate license file content and write it into the license file.

[0091] The encrypted public key string obtained in step S122, the hexadecimal string of the runtime environment machine code obtained in step S123, and the signature object string obtained in step S124 are concatenated sequentially using a fixed delimiter to obtain the authorization code, which is then written into the license file.

[0092] Preferably, the license file is output according to a preset filename.

[0093] Compared with existing technologies, this technology comprehensively adopts multiple domestic cryptographic algorithms, and the content of the license document is all encrypted, resulting in high security and reliability.

[0094] Preferably, step S12 can be achieved through a software license management system, which promotes the interaction between various functional modules in the system through business process automation, centrally manages the application, generation, renewal and termination of software licenses, reduces manpower and improves management efficiency.

[0095] Preferably, the software license management system includes at least the following functional modules:

[0096] The license application module allows personnel with license configuration roles to enter the general authorization attributes, application control attributes, and runtime environment machine code of the application software in a visual interface, initiate the application, and record the applicant's relevant information.

[0097] The license approval module is used by personnel with license management roles to review license applications; if the approval is granted, the license document is returned to the applicant; if the approval is denied, the reason is explained and the document is returned to the applicant.

[0098] The license management module is used to view and query information related to application software license applications submitted by users. It displays license application details by application software, including application time, expiration time, license type, and license document.

[0099] The license generation component is used to call domestic cryptographic algorithm components to encrypt the content of approved license applications and generate license files.

[0100] The license reminder component periodically checks the expiration status of license documents and reminds the corresponding license applicant and application software manager based on the preset number of expiration reminder days.

[0101] In step S13, the license file is loaded, and the license file is decrypted and verified using domestic cryptographic algorithms SM2, SM3, and SM4. For example... Figure 3 As shown, step S13 can be further refined into the following steps:

[0102] S131: Load license file.

[0103] Specifically, loading the license file includes: placing the license file in the application software's compilation directory, configuring the license file's path in the JVM startup parameters via extended parameters; or, entering the authorization code from the license file or uploading the license file in the security control module's license registration interface.

[0104] It should be noted that the security control module first identifies whether the path to the license file has been configured in the JVM startup parameters. If it has been configured, the configured path will be used as the file loading path; if it has not been configured, the default path will be used as the file loading path.

[0105] Based on the file loading path and preset filename, obtain the license file. If the license file can be obtained, overwrite the original license file with the entered authorization code, or overwrite the original license file with the uploaded license file. If the license file is not found, write the entered authorization code into the default license file and place the default license file in the configured path, or place the uploaded license file in the configured path.

[0106] The security control module supports both authorization codes and license files, and provides a user-friendly interface for easy software license updates.

[0107] S132: The security control module reads the license file.

[0108] It should be noted that when the application software starts up or the security control module checks the license periodically, it first checks whether the JVM startup parameters contain specific extended parameters and whether the path to the license file is configured. If the path is configured, the license file is retrieved based on the path. If the file does not exist, an exception message is displayed. If the file exists, the contents of the license file are read to obtain the authorization code. If the specific extended parameters do not exist, a license file with a default name is retrieved from the default directory. If the file does not exist, an exception message is displayed. If the file exists, the contents of the license file are read to obtain the authorization code.

[0109] S133: Use SM4 and SM2 to verify the validity of the signature.

[0110] Specifically, the signature validity verification process includes:

[0111] The authorization code is segmented according to a fixed delimiter to obtain the encrypted public key string, the runtime environment machine code hexadecimal string, and the signature object string;

[0112] The public key string and the signature object string are decrypted using SM4 to obtain the original public key and a new hexadecimal string of the authorization object. It should be noted that SM4 is a symmetric encryption method; the key used for encryption is also the key needed for decryption. Therefore, based on the preset symmetric encryption key, the encrypted public key string is decrypted to obtain the original public key; the signature object string is then decrypted using the runtime environment's machine code hexadecimal string to obtain a new hexadecimal string of the authorization object.

[0113] Convert the new hexadecimal string of the authorization object into a text string, and then separate it according to a fixed delimiter to obtain the signature string and the hexadecimal string of the authorization object respectively;

[0114] The SM2 algorithm is used to verify the validity of the signature by combining the original public key and the signature string.

[0115] S134: Use SM3 to verify the consistency of machine code in the runtime environment.

[0116] Specifically, the process of verifying the consistency of machine code in the runtime environment includes:

[0117] The hexadecimal string of the authorized object obtained in step S133 during the process of verifying the legality of the signature using SM4 and SM2 is converted into a binary byte array and then decompressed to obtain the JSON string of the authorized object;

[0118] The system identifies whether the authorization type in the JSON string is a formal authorization. If it is a formal authorization, it retrieves the runtime environment machine code again and obtains a new runtime environment machine code hexadecimal string based on the generation process of the runtime environment machine code hexadecimal string. This new hexadecimal string is then compared with the runtime environment machine code hexadecimal string in the authorization code to ensure consistency. If it is a temporary authorization, no consistency comparison is needed, and consistency is assumed to be met by default.

[0119] S135: Verify the matching of common authorization attributes in the authorization object.

[0120] Specifically, the operating system type, number of CPUs, and license expiration time are obtained from the JSON string of the authorized object decompressed in step S134, and their matching is compared with the actual obtained operating system type, number of CPUs, and current time.

[0121] S136: If any verification fails, stop subsequent verifications. If all verifications pass, cache the authorized object in memory for application control.

[0122] It should be noted that when executing steps S133-S135, if the security control module reads and verifies the license file when the application software starts, an error message will be displayed and the current process will be terminated if any verification fails, resulting in the application software failing to start.

[0123] If the security control module periodically performs the task of reading and verifying the license file, then if any verification fails, an error message will be displayed, subsequent verifications will be stopped, and the application software will not be affected. When the application software restarts, an error message will be displayed, the current process will be terminated, and the application software will fail to restart.

[0124] For example, during the periodic checks of the security control module, if the license file is found to be expired based on the license expiration time, an error message indicating that the license file has expired will be displayed. However, the application software can still be used until the next time the application software is restarted, when the expired license file is detected, an error message is displayed, and the startup process is interrupted, making the application software unusable.

[0125] In either case, if all verifications pass, the authorized object is cached in memory for further control by the application software.

[0126] Preferably, the security access control module encapsulates general-purpose tool methods to facilitate the extraction of attribute values ​​from the JSON string of the authorized object, thereby enabling business control. For example, it can identify whether the current number of users exceeds the maximum number of concurrent users in the license file, and obtain the functional components that the user can access based on the authorized functional components in the license file.

[0127] For example, the CommonSecurityUtil.getValue(String key) method is provided, where key is the attribute key in the JSON string, and the value of the attribute value in the JSON string is obtained.

[0128] The security control module's timed check function enables the license content to take effect dynamically when the license is updated, without requiring the application software to be restarted, thus reducing the workload of deployment personnel.

[0129] For example, when updating license authorization information, the maximum number of concurrent users is modified. After updating the license file or authorization code, if all verifications pass during the periodic checks of the security control module, the JSON string of the new authorized object will be cached in memory. The application control can directly obtain the latest authorized object without restarting the application software.

[0130] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0131] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A software license security control method based on domestically developed cryptographic algorithms, characterized in that, Includes the following steps: Based on the security control module integrated in the application software, obtain the machine code of the runtime environment; Obtain the general authorization attributes and application control attributes of the application software as the authorization object. Based on the preset symmetric encryption key, use the domestic cryptographic algorithms SM2, SM3 and SM4 to encrypt the authorization object and the runtime environment machine code to generate the encrypted public key string, the runtime environment machine code hexadecimal string and the signature object string. After connecting them sequentially using a fixed delimiter, the authorization code is obtained. The authorization code is written into the license file. The security control module loads the license file, reads and verifies the license file, including using SM4 and SM2 to verify the signature legality, using SM3 to verify the consistency of the runtime environment machine code, and verifying the matching of common authorization attributes in the authorized object. If any verification fails, subsequent verifications are stopped. If all verifications pass, the authorized object is cached in memory for application control. The process of generating the encrypted public key string includes: generating a key pair using SM2, the key pair including the original public key and the original private key; and using SM4 to perform secondary encryption on the generated key pair according to a preset symmetric encryption key to generate an encrypted key string, including the encrypted public key string and the private key string. The process of generating the signature object string includes: constructing the obtained authorization object into a JSON string; encoding the JSON string using UTF-8 and compressing it into a binary byte array; signing the binary byte array using the original private key through the SM2 algorithm to obtain a signature string; converting the binary byte array into hexadecimal to obtain an authorization object hexadecimal string; combining the authorization object hexadecimal string and the signature string using a fixed separator to form a new string, and converting it into hexadecimal to obtain a new authorization object hexadecimal string; using the runtime environment machine code hexadecimal string as the private key, encrypting the new authorization object hexadecimal string through SM4 to obtain the signature object string.

2. The software license security control method based on domestically developed cryptographic algorithms according to claim 1, characterized in that, The security control module is a standalone JAR file, comprising: The license registration interface displays the application software's license status and runtime environment machine code, allows users to submit the license code, and upload the license file. The runtime environment machine code acquisition unit, wherein the runtime environment machine code is a 16-bit string, extracts a 16-bit string as the runtime environment machine code based on one or more MAC addresses of the runtime environment and displays it in the license registration interface; The license file reading and verification unit is used to retrieve the license file from the path configured in the JVM parameters or the preset default path, and then verify the authorization code in the license file. The timed check unit is used to periodically trigger the license file reading and verification unit to perform the operation of reading and verifying the license file.

3. The software license security control method based on domestic cryptographic algorithms according to claim 2, characterized in that, The process of generating the machine code hexadecimal string in the operating environment includes: The runtime environment machine code is encrypted using SM3 to obtain a hash value, which is then converted into a hexadecimal string to obtain the runtime environment machine code hexadecimal string.

4. The software license security control method based on domestically developed cryptographic algorithms according to any one of claims 1-3, characterized in that, The loaded license file includes: Place the license file in the application software's compilation directory, and configure the path to the license file in the JVM startup parameters via extended parameters; or, On the license registration interface of the security control module, enter the authorization code from the license file, or upload the license file.

5. The software license security control method based on domestic cryptographic algorithms according to claim 4, characterized in that, The use of SM4 and SM2 to verify signature validity includes: The authorization code is segmented according to a fixed delimiter to obtain an encrypted public key string, a hexadecimal string of the runtime environment machine code, and a signature object string; Use SM4 to decrypt the public key string and the signature object string to obtain a new hexadecimal string of the original public key and the authorization object; Convert the new hexadecimal string of the authorization object into a text string, and then separate it according to a fixed delimiter to obtain the signature string and the hexadecimal string of the authorization object respectively; The SM2 algorithm is used to verify the validity of the signature by combining the original public key and the signature string.

6. The software license security control method based on domestically developed cryptographic algorithms according to claim 5, characterized in that, Use SM3 to verify the consistency of machine code in the runtime environment, including: The hexadecimal string of the authorized object obtained during the process of verifying the legality of the signature using SM4 and SM2 is converted into a binary byte array, and then decompressed to obtain the JSON string of the authorized object; Identify whether the authorization type in the JSON string is a formal authorization. If it is a formal authorization, obtain the runtime environment machine code again. Based on the generation process of the runtime environment machine code hexadecimal string, obtain a new runtime environment machine code hexadecimal string and compare it with the runtime environment machine code hexadecimal string in the authorization code to ensure consistency. If it is a temporary authorization, there is no need to compare consistency; it will be considered consistent by default.

7. The software license security control method based on domestically developed cryptographic algorithms according to claim 6, characterized in that, The verification of the matching of general authorization attributes in the authorization object includes: Extract the operating system type, number of CPUs, and license expiration time from the JSON string of the decompressed authorized object, and compare them with the actual obtained operating system type, number of CPUs, and current time for matching.

8. The software license security control method based on domestically developed cryptographic algorithms according to claim 7, characterized in that, The step of stopping subsequent checks when any check fails includes: When the security control module reads and verifies the license file when the application software starts, if any verification fails, an error message is displayed, the current process is terminated, and the application software fails to start. When the security control module periodically performs the task of reading and verifying the license file, if any verification fails, an error message is displayed, subsequent verifications are stopped, and the application software operation is not affected. When the application software restarts, an error message is displayed, the current process is terminated, and the application software restart fails.

Images