A software authorization method, system and readable storage medium

Abstract

The present application provides a software authorization method, system and readable storage medium. The method includes: receiving an authorization application request, the authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client; in response to the authorization application request, using the user key to encrypt the authorization information to obtain encrypted authorization information; using the private key of the management end to sign the encrypted authorization information to obtain signature information; writing the encrypted authorization information and signature information into an empty file to obtain an initial file; encrypting and packaging the initial file to obtain a data packet; setting the content of the file header bytes of the data packet to a preset bytecode to obtain an obfuscated data packet; setting the format of the obfuscated data packet to a target format to obtain an authorization file. The present application uses a multi-level protection strategy to improve the security of authorization authentication and reduce the risk of authorization files being shared, cracked, and tampered with.

Description

Technical Field

[0001] The present application belongs to the field of software technology, and in particular, relates to a software authorization method, system and readable storage medium. Background Art

[0002] With the popularization and widespread application of software, it is necessary to carry out copyright protection and authorization management for distributed and sold software. The existing methods generally use serial numbers and key files to make users meet the usage conditions, or use authorization files of different levels to limit the use of functions, or limit the software usage period through expiration control to achieve copyright protection and authorization management.

[0003] However, these methods are easy to share, crack and tamper with, making copyright protection and authorization management of software and applications difficult. Summary of the invention

[0004] The embodiments of the present application provide a software authorization method, system and readable storage medium, which can solve the problem of difficulty in copyright protection and authorization management of software and applications.

[0005] In a first aspect, an embodiment of the present application provides a software authorization method, which is applied to a management end, including:

[0006] Receiving an authorization application request, wherein the authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client;

[0007] In response to the authorization application request, encrypt the authorization information using a user key to obtain encrypted authorization information;

[0008] Using the private key of the management terminal, signing the encrypted authorization information to obtain signature information;

[0009] Write the encrypted authorization information and signature information into an empty file to obtain an initial file;

[0010] Encrypting and packaging the initial file to obtain a data packet;

[0011] Setting the content of the file header bytes of the data packet to a preset bytecode to obtain an obfuscated data packet;

[0012] The format of the obfuscated data packet is set to a target format to obtain an authorization file.

[0013] In one embodiment, writing the encrypted authorization information and signature information into an empty file to obtain an initial file includes:

[0014] Determining a first target number of lines according to the first account information and a preset number of text lines of the empty file;

[0015] Determining a second target number of lines according to the first software version information and the preset number of text lines;

[0016] If the first target number of lines is different from the second target number of lines, in the empty file, the encrypted authorization information is written in the first target number of lines, the signature information is written in the second target number of lines, and a random character string is written in the remaining number of lines;

[0017] If the first target number of lines is the same as the second target number of lines, the second target number of lines is processed to obtain a third target number of lines, and in the empty file, the encrypted authorization information is written into the first target number of lines, the signature information is written into the third target number of lines, and the random character string is written into the remaining number of lines;

[0018] The authorization information includes the first account information and the first software version information of the client.

[0019] In one embodiment, the package password of the initial file includes the alias of the client and a random salt.

[0020] In a second aspect, an embodiment of the present application provides a software authorization method, which is applied to a client, including:

[0021] Receive the authorization file of the software to be authorized;

[0022] After restoring the contents of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file;

[0023] Obtaining encrypted authorization information and signature information from the initial file;

[0024] Using the public key of the management end, the signature information is verified to obtain the verification result;

[0025] If the signature verification result is verification passed, the encrypted authorization information is decrypted using the user key to obtain the authorization information.

[0026] In one embodiment, the step of obtaining the encrypted authorization information and the signature information from the initial file includes:

[0027] Determine the line number where the encrypted authorization information is located according to the second account information and the number of text lines of the initial file;

[0028] Determine the line number where the signature information is located according to the second software version information and the number of text lines of the initial file;

[0029] According to the number of the line where the encrypted authorization information is located, obtaining the encrypted authorization information from the initial file;

[0030] Obtain the signature information from the initial file according to the line number where the signature information is located;

[0031] The client stores the second account information and the second software version information.

[0032] In one embodiment, after obtaining the authorization information, the method further includes:

[0033] Compare the first basic information with the second basic information to obtain a first inspection result;

[0034] Compare the first software version information with the historical software version information to obtain a second inspection result;

[0035] Compare the authorization environment information with the configuration information to obtain a third inspection result;

[0036] Checking the authorization time to obtain a fourth checking result;

[0037] Comparing the authorized address information with the end address information to obtain a fifth check result;

[0038] If all inspection results are passed, the authorization information is stored;

[0039] Among them, the authorization information also includes the first basic information, the first software version information, the authorization environment information, the authorization time and the authorization address information, and the client stores the second basic information, the historical software version information, the configuration information and the terminal address information.

[0040] In one embodiment, after storing the authorization information, the method further includes:

[0041] After marking the authorization file, sending the authorization file to a file server, wherein the authorization file carries an identification;

[0042] After the client is restarted, the authorization file of the software to be authorized is obtained from the file server;

[0043] Determine whether the authorization document has the identification;

[0044] If the authorization file carries the identification, the process proceeds to the following step: after restoring the contents of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file.

[0045] In one embodiment, after receiving the authorization file of the software to be authorized, the method further includes:

[0046] Starting a timer, and obtaining a timing result of the timer at a first preset time interval;

[0047] Encrypting the timing result to obtain an encrypted timing result;

[0048] Storing the encrypted timing result in at least two storage points;

[0049] Obtaining the encryption timing result from each of the storage points at a second preset time interval;

[0050] Decrypting each of the encrypted timing results to obtain each of the timing results;

[0051] Determine the total authorization duration according to each of the timing results and the authorization time;

[0052] If the difference between the total authorized duration and the system time of the client is greater than a preset deviation threshold, a policy operation is executed.

[0053] In a third aspect, an embodiment of the present application provides a software authorization system, including a management terminal and at least one client:

[0054] The management terminal is used to receive an authorization application request, wherein the authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client;

[0055] Also used for, in response to the authorization application request, encrypting the authorization information using a user key to obtain encrypted authorization information;

[0056] It is also used to use the private key of the management end to sign the encrypted authorization information to obtain signature information;

[0057] It is also used to write the encrypted authorization information and signature information into an empty file to obtain an initial file;

[0058] It is also used to encrypt and package the initial file to obtain a data package;

[0059] It is also used to set the content of the file header bytes of the data packet to a preset byte code to obtain an obfuscated data packet;

[0060] It is also used to set the format of the obfuscated data packet to a target format to obtain an authorization file;

[0061] The target client is used to receive the authorization file of the software to be authorized;

[0062] It is also used to restore the content of the file header bytes of the authorization file to the initial byte code, and then decompress the authorization file to obtain the initial file;

[0063] Also used to obtain encrypted authorization information and signature information from the initial file;

[0064] It is also used to use the public key of the management end to verify the signature information and obtain the verification result;

[0065] It is also used to decrypt the encrypted authorization information using the user key to obtain the authorization information if the signature verification result is verified.

[0066] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the above-mentioned first aspects is implemented.

[0067] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0068] The embodiment of the present application receives an authorization application request, which includes authorization information of the software to be authorized, and the software to be authorized is installed on the client; in response to the authorization application request, the authorization information is encrypted using a user key to obtain encrypted authorization information; the encrypted authorization information is signed using a private key of the management end to obtain signature information; the encrypted authorization information and the signature information are written into an empty file to obtain an initial file; the initial file is encrypted and packaged to obtain a data packet; the content of the file header bytes of the data packet is set to a preset bytecode to obtain an obfuscated data packet; the format of the obfuscated data packet is set to a target format to obtain an authorization file, and a multi-level protection strategy is used to improve the security of authorization authentication and reduce the risk of the authorization file being shared, cracked, and tampered with.

[0069] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0071] Figure 1 This is a first flow chart of a software authorization method provided by an embodiment of the present application;

[0072] Figure 2a This is an example diagram of a component code before obfuscation provided by an embodiment of the present application;

[0073] Figure 2bThis is an example diagram of component code obfuscation provided by an embodiment of the present application;

[0074] Figure 3 is an example diagram of the initial text provided by an embodiment of the present application;

[0075] Figure 4a This is an example diagram of a file header before bytecode obfuscation provided by an embodiment of the present application;

[0076] Figure 4b This is an example diagram of a file header bytecode obfuscated according to an embodiment of the present application;

[0077] Figure 5 This is a second flow chart of the software authorization method provided in one embodiment of the present application;

[0078] Figure 6 It is a structural diagram of a software authorization system provided in one embodiment of the present application. DETAILED DESCRIPTION

[0079] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0080] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0081] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0082] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0083] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0084] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0085] In one embodiment, Figure 1 This is a first flow chart of a software authorization method provided by an embodiment of the present application. Figure 1 As shown, the method, applied to the management end, includes:

[0086] S11: Receive an authorization application request.

[0087] The authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client.

[0088] In one possible implementation, the management end is provided with role-based access control, and may also be provided with an approval ticket system, which supports users of different roles to apply for different resources for designated users, that is, the user's authorization information is customized according to the settings of the designated user. Users with management roles can modify or reject related authorization applications, and correspondingly, the authorization application request performs the following series of steps after the user with management role approves it. Among them, the designated user is the user of the client. The management end and the client are deployed in a distributed manner, which can be expanded horizontally, and the authorization information can be customized for designated users, so that it has good scalability, that is, different authorization permissions can be provided for different users on a client through customization, which can flexibly adapt to changes in software functions and provide a flexible authorization authentication.

[0089] In a possible implementation, the authorization information includes basic information, account information, role information, menu information and relationship, authorization time, effective time, expiration time, authorized address information, authorized environment information, software version information and preset deviation threshold. Among them, the authorized address information includes IP address (Internet protocol address) and MAC address (Media Access Control Address, physical address), and the basic information will be stored in the management end and the client.

[0090] For example, when a user with a sales role applies for resources for a specified user, an authorization application request is submitted for the specified user according to the negotiation content under the corresponding access control. This authorization application request includes the authorization information of the specified user, and can be customized for the number of accounts, permissions of different accounts, etc. Users with management roles can review the resources that can be used by the specified user (such as menus, buttons, tabs, etc.) through the approval ticket system. After the review is passed, the management end can perform multi-level protection operations on the authorization application request.

[0091] S12: In response to the authorization application request, the authorization information is encrypted using the user key to obtain encrypted authorization information.

[0092] In the application, the management end generates the keys of each client and obtains the user key. The user keys of each client are different. The user keys are synchronized to the client in advance. In a possible implementation, the RSA asymmetric encryption algorithm is used to generate the user public and private key pairs.

[0093] In a possible implementation, in response to an authorization application request, an encryption component is called, and the encryption component is used to encrypt authorization information using a user key to obtain encrypted authorization information.

[0094] The encryption component is a separate component package, which is set to be used only by the management end, so that only the management end has the encryption function. The management end can use the encryption component to implement the encryption function, simplifying the encryption implementation process, reducing the cost of development and maintenance, and improving the operating performance to ensure the user experience.

[0095] Among them, the encryption component can be obtained by using tools to obfuscate the code and then packaging it, which can ensure that the core logic of the encryption algorithm will not be leaked. Figure 2a This is an example diagram of a component code before obfuscation provided by an embodiment of the present application. Figure 2a As shown in the figure, this figure shows part of the code before the component code is obfuscated. Figure 2b This is an example diagram of component code obfuscation provided by an embodiment of the present application. Figure 2bAs shown in the figure, this figure shows part of the code after the component code is obfuscated.

[0096] S13: Use the private key of the management end to sign the encrypted authorization information to obtain signature information.

[0097] In a possible implementation, the management end generates a public and private key pair for each client using the RSA asymmetric encryption algorithm, and the public key of the management end is issued to each client in advance. The public and private key pair of the management end of each client is different.

[0098] In a possible implementation, an encryption component is used to sign the encrypted authorization information using a private key of the management end to obtain signature information.

[0099] S14: Write the encrypted authorization information and signature information into an empty file to obtain an initial file.

[0100] In the application, the encryption component is used to write the encrypted authorization information and signature information into an empty file to obtain the initial file.

[0101] In a possible implementation, the authorization information includes first account information and first software version information of the client.

[0102] Step S14 includes:

[0103] S141: Determine a first target number of lines according to the first account information and a preset number of text lines of the empty file.

[0104] In the application, the sum of the ASCII (American Standard Code for Information Interchange) code values ​​of the first account information is calculated to obtain the coded sum. The coded sum is modulo the preset number of text lines, and then 1 is added to the modulo result to obtain the first target number of lines.

[0105] The preset number of text lines represents the number of lines that can be written into the empty file.

[0106] S142: Determine a second target number of lines according to the first software version information and a preset number of text lines.

[0107] In the application, the version number is obtained from the first software version information, the version number is modulo the preset number of text lines, and 1 is added to the modulo result to obtain the second target number of lines.

[0108] S143: If the first target number of lines is different from the second target number of lines, in the empty file, the encrypted authorization information is written in the first target number of lines, the signature information is written in the second target number of lines, and the random character string is written in the remaining number of lines.

[0109] In the application, the first target number of lines is different from the second target number of lines, which means that the encrypted authorization information and the signature information are written in different lines, which will not affect each other and reduce the possibility of writing errors. Write the encrypted authorization information in the first target number of lines of the empty file, write the signature information in the second target number of lines of the empty file, and then write the random string in the remaining lines of the empty file.

[0110] The length of the written random character string can be set according to the length of the encrypted authorization information.

[0111] For example, the length of the random string to be written is set to be between three quarters and three quarters of the length of the encrypted authorization information. The random string can be set to randomly take a value from "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789#-=_+ / ", or it can be set to randomly take a value from other characters.

[0112] S144: If the first target number of lines is the same as the second target number of lines, the second target number of lines is processed to obtain the third target number of lines, and in the empty file, the encrypted authorization information is written in the first target number of lines, the signature information is written in the third target number of lines, and the random character string is written in the remaining number of lines.

[0113] In the application, the first target number of lines is the same as the second target number of lines, which means that writing the encryption authorization information and signature information in the same number of lines will affect each other and may cause writing errors. In this case, the value of the second target number of lines is added to the preset value to obtain the first number of lines after increase, and the first number of lines after increase is compared with the preset number of text lines. If the first number of lines after increase is greater than the preset number of text lines, the value of the second target number of lines is set to 1 to obtain the third target number of lines. If the first number of lines after increase is less than or equal to the preset number of text lines, the first number of lines after increase is determined to be the third target number of lines.

[0114] The encrypted authorization information is written into the first target number of lines in the empty file, the signature information is written into the third target number of lines in the empty file, and then the random character string is written into the remaining number of lines in the empty file.

[0115] Figure 3 is an example diagram of the initial text provided by an embodiment of the present application. Figure 3 As shown, the preset number of text lines is 3. After calculation, the first target number of lines is 1, and the second target number of lines is 2. The first line of the initial text is written with encrypted authorization information, the second line is written with signature information, and the remaining line is written with a random string.

[0116] S15: Encrypt and package the initial file to obtain a data package.

[0117] In the application, the encryption component is used to encrypt and package the initial file using the packaging password to obtain a data package.

[0118] In a possible implementation, the package password of the initial file includes the alias and random salt of the client. After the management end generates the alias and random salt, it is synchronized to the client in advance.

[0119] S16: Set the content of the file header bytes of the data packet to a preset bytecode to obtain an obfuscated data packet.

[0120] In the application, because the format is a data packet, the content of the file header byte is the initial byte code of the data packet. In order to improve security, the encryption component is used to obfuscate the content of the file header byte, and its content is set to a preset byte code to obtain an obfuscated data packet. The preset byte code can be an obfuscated code or an encrypted code.

[0121] Figure 4a This is an example diagram of a file header before bytecode obfuscation provided by an embodiment of the present application. Figure 4a As shown, the file header bytes of the data packet include the first three data in the first line. The content of the file header bytes before obfuscation is the initial byte code: 504b0304 1400. Figure 4b This is an example diagram of the file header bytecode obfuscation provided by an embodiment of the present application. Figure 4b As shown, the first three data are changed to the preset bytecode, the preset bytecode: 0000 0000 0000, and the content of the obfuscated file header bytes is obtained.

[0122] S17: The format of the obfuscated data packet is set to the target format to obtain the authorization file.

[0123] In a possible implementation, the suffix of the obfuscated data packet is modified to .license, so that the format of the obfuscated data packet is set to the target format.

[0124] It is understandable that through multi-level, complex encryption and obfuscation processing, the security of authorization files is improved, and a safe, reliable and efficient authorization authentication solution is provided, which makes it difficult for authorization files to be cracked, tampered with and reused, ensuring the availability, authenticity and integrity of authorization files, and improving protection capabilities, so that the legitimate rights and interests of software can be effectively protected in general network environments and in private network environments without public networks.

[0125] In addition, through file header bytecode obfuscation and signature technology, the integrity and non-tamperability of the authorization file are determined, so that any unauthorized modification will cause the authorization verification to fail, thus protecting the legal use of the software.

[0126] This embodiment receives an authorization application request, which includes authorization information of the software to be authorized, and the software to be authorized is installed on the client; in response to the authorization application request, the authorization information is encrypted using a user key to obtain encrypted authorization information; the encrypted authorization information is signed using a private key of the management end to obtain signature information; the encrypted authorization information and the signature information are written into an empty file to obtain an initial file; the initial file is encrypted and packaged to obtain a data packet; the content of the file header bytes of the data packet is set to a preset bytecode to obtain an obfuscated data packet; the format of the obfuscated data packet is set to a target format to obtain an authorization file, and a multi-level protection strategy is used to improve the security of authorization authentication and reduce the risk of the authorization file being shared, cracked, and tampered with.

[0127] In one embodiment, Figure 5 This is a second flow chart of the software authorization method provided by an embodiment of the present application. Figure 5 As shown, the method, applied to the client, includes:

[0128] S21: Receive the authorization file of the software to be authorized.

[0129] In the application, in a general network, the management end can send the authorization file to the client. In a private network environment without a public network, the user can upload the authorization file to the client.

[0130] S22: After restoring the contents of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file.

[0131] In the application, after receiving the authorization file, the client calls the decryption component. The decryption component is used to restore the contents of the file header bytes to the initial bytecode. Then the authorization file is decompressed using the packaging password to obtain the initial file.

[0132] For examples, please continue to refer to Figure 4a and 4b , change the preset byte code located in the file header byte: 0000 0000 0000 to the initial byte code: 504b 0304 1400.

[0133] Among them, the decryption component is a separate component package, which is set to be used only by the client, so that only the client has the decryption function. The client can use the decryption component to realize the decryption function, simplifying the decryption implementation process, reducing the cost of development and maintenance, and improving the operating performance to ensure the user experience.

[0134] Among them, the decryption component can be obtained by using tools to obfuscate the code and then packaging it, which can ensure that the core logic of the encryption algorithm will not be leaked.

[0135] S23: Obtain the encrypted authorization information and signature information from the initial file.

[0136] In the application, the decryption component is used to obtain the encrypted authorization information and signature information from the initial file.

[0137] In a possible implementation manner, the client stores the second account information and the second software version information.

[0138] Step S23 includes:

[0139] S231: Determine the line number where the encrypted authorization information is located according to the second account information and the number of text lines of the initial file.

[0140] In the application, obtain the number of text lines in the initial file. Calculate the sum of the ASCII code values ​​of the second account information to obtain the coded sum. Perform a modulus operation on the coded sum and the number of text lines in the initial file, and add 1 to the modulus result to obtain the number of lines where the encrypted authorization information is located.

[0141] S232: Determine the line number where the signature information is located according to the second software version information and the number of text lines of the initial file.

[0142] In the application, the version number is obtained from the second software version information. The version number is modulo the number of text lines of the initial file, and the modulo result is added by 1 to obtain the number of lines. If the number of lines is different from the number of lines where the encrypted authorization information is located, the number of lines is determined to be the number of lines where the signature information is located. If the number of lines is the same as the number of lines where the encrypted authorization information is located, the number of lines is added to the preset value to obtain the second increased number of lines, and the second increased number of lines is compared with the number of text lines of the initial file. If the second increased number of lines is greater than the number of text lines, the number of lines where the signature information is located is determined to be the first line. If the second increased number of lines is less than or equal to the preset number of text lines, the second increased number of lines is determined to be the number of lines where the signature information is located.

[0143] S233: Obtain the encryption authorization information from the initial file according to the line number where the encryption authorization information is located.

[0144] S234: Acquire the signature information from the initial file according to the line number where the signature information is located.

[0145] For examples, please continue to refer to Figure 3 , the number of text lines in the initial file is 3. After calculation, the encrypted authorization information is obtained as the first line, the signature information is obtained as the second line, and the remaining line is written with a random string. The encrypted authorization information is obtained from the first line, and the signature information is obtained from the second line.

[0146] S24: Use the public key of the management end to verify the signature information and obtain the verification result.

[0147] In the application, the decryption component is used to verify the signature information using the public key of the management end to obtain the verification result.

[0148] S25: If the signature verification result is verified, the encrypted authorization information is decrypted using the user key to obtain the authorization information.

[0149] In the application, the signature verification result is verification passed, indicating that the encrypted authorization information has not been tampered with. The encrypted authorization information is decrypted using the decryption component and the user key to obtain the authorization information.

[0150] It is understandable that providing a safe, reliable and efficient authorization and authentication solution can promptly detect whether the authorization file has been cracked, tampered with and reused, ensure the availability, authenticity and integrity of the authorization file, improve the protection capability, and effectively protect the legitimate rights and interests of the software in general network environments and in private network environments without public networks.

[0151] This embodiment restores the content of the file header bytes of the authorization file to the initial bytecode, decompresses the authorization file to obtain the initial file; obtains the encrypted authorization information and signature information from the initial file; uses the public key of the management end to verify the signature information to obtain the verification result; if the verification result is verified, the encrypted authorization information is decrypted using the user key to obtain the authorization information. Through a multi-level protection strategy, the designated user only implements authorization authentication on the target client, which can prevent the designated user from copying and pasting the authorization file to any client, thereby preventing illegal authorization behavior.

[0152] In one embodiment, after step S21: the following steps are further included:

[0153] S31: Start the timer, and obtain the timing result of the timer according to a first preset time interval.

[0154] In the application, after receiving the authorization file, the client starts the timer, which counts once according to the first preset time and then obtains the timing result.

[0155] Among them, the timer can be a multi-dimensional running timer.

[0156] S32: Encrypt the timing result to obtain an encrypted timing result.

[0157] S33: Storing the encrypted timing result in at least two storage points.

[0158] In the application, the encrypted timing results are stored in the cache, database, and specified files. By encrypting and storing them in multiple storage points, the security and reliability of the timing results are improved and the possibility of tampering is reduced.

[0159] S34: Obtain encryption timing results from each storage point according to a second preset time interval.

[0160] In the application, the encryption timing result is obtained from the cache, the database and the designated file according to the second preset time interval.

[0161] S35: Decrypt each encrypted timing result to obtain each timing result.

[0162] S36: Determine the total authorization duration according to each timing result and the authorization time.

[0163] In the application, the timing result with the largest time is obtained from each timing result. The timing result with the largest time is added to the authorization time to obtain the total authorization time. By obtaining the timing result with the largest time from each timing result, the accurate timer running time is obtained, and then the accurate authorization total time is obtained.

[0164] S37: If the difference between the total authorized duration and the client's system time is greater than a preset deviation threshold, a policy operation is executed.

[0165] In the application, if the client time is tampered with and is different from the real time, or if the client is down, has not been started for a long time, or has not been successfully started, resulting in the calculation of the running time, it is necessary to set a preset deviation threshold in advance.

[0166] When the difference between the total authorization time and the client's system time is greater than the preset deviation threshold, it indicates that there is a problem with the authorization file authentication. According to the preset policy, when the difference between the difference and the preset deviation threshold is greater than the first preset time, the execution policy operation is to pop up a prompt message. When the difference between the difference and the preset deviation threshold is greater than the second preset time, the execution policy operation is to pop up a warning message. When the difference between the difference and the preset deviation threshold is greater than the third preset time, the execution policy operation is resource degradation processing (some resources are unavailable).

[0167] This embodiment stores the encrypted timing results in at least two storage points; obtains the encrypted timing results from each storage point at a second preset time interval; decrypts each encrypted timing result to obtain each timing result; determines the total authorization time according to each timing result and the authorization time; if the difference between the total authorization time and the system time of the client is greater than a preset deviation threshold, executes a policy operation to promptly discover illegal authorization authentication of the client, thereby reminding the user and preventing illegal authorization authentication.

[0168] In one embodiment, the authorization information further includes first basic information, first software version information, authorization environment information, authorization time and authorization address information, and the client stores second basic information, historical software version information, configuration information and terminal address information. The historical software version information is stored in the memory.

[0169] After obtaining the authorization information, it also includes:

[0170] S41: Compare the first basic information with the second basic information to obtain a first inspection result.

[0171] In the application, when the first basic information is the same as the second basic information, the first check result is check passed. When the first basic information is different from the second basic information, the second check result is check failed.

[0172] S42: Compare the first software version information with the historical software version information to obtain a second inspection result.

[0173] In the application, when the first software version information is greater than the historical software version, the second check result is check passed. When the first software version information is less than or equal to the historical software version, the second check result is check failed.

[0174] S43: Compare the authorization environment information with the configuration information to obtain a third inspection result.

[0175] In the application, the current environment information of the client is obtained from the configuration information of the client. The authorization environment information is compared with the current environment information of the client. When the authorization environment information is the same as the current environment information, the third check result is that the check is passed. When the authorization environment information is different from the current environment information, the third check result is that the check is not passed.

[0176] S44: Check the authorization time to obtain a fourth check result.

[0177] In the application, when the authorization time does not exceed the effective time, the fourth check result is the check passed. When the authorization time exceeds the effective time, the fourth check result is the check failed.

[0178] S45: Compare the authorized address information with the end address information to obtain a fifth inspection result.

[0179] In the application, if the IP address and MAC address in the authorized address information are the same as the IP address and MAC address in the end address information, the fifth check result is passed. If the IP address and MAC address in the authorized address information are different from the IP address and MAC address in the end address information, the fifth check result is failed.

[0180] S46: If all inspection results are passed, the authorization information is stored.

[0181] In the application, all check results are passed, indicating that the authorization file has not been cracked or tampered with, and the authorization file can be used to store authorization information.

[0182] In one possible implementation, the authorization information can be stored in memory by maintaining a HashMap (Map is an abstract interface for Key-Value pair mapping, and HashMap is an important member of the Java Collection Framework) in the memory, with the authorized item as the key and the specific content as the value.

[0183] This embodiment uses multiple checking methods to timely check whether the authorization file has been cracked, tampered with, or reused, thereby ensuring the availability, authenticity, and integrity of the authorization file.

[0184] In one embodiment, after step S46, the method further includes:

[0185] S51: After marking the authorization file, send the authorization file to the file server, where the authorization file carries the identification.

[0186] S51: After the client is restarted, the authorization file of the software to be authorized is obtained from the file server.

[0187] S52: Determine whether the authorization file has an identification.

[0188] S53: If the authorization file carries an identifier, proceed to step: after restoring the contents of the file header bytes of the authorization file to the initial bytecode, decompress the authorization file to obtain the initial file.

[0189] In the application, the authorization file carries an identification, indicating that the file is a legal authorization file, and the authorization verification process can be carried out. If the authorization file does not carry an identification, it means that the file is an illegal authorization file and will not enter the authorization verification process.

[0190] This embodiment sends the authorization file to the file server after marking the authorization file, and the authorization file carries an identification; when the client is restarted, the authorization file of the file to be authorized is obtained from the file server; it is determined whether the authorization file has an identification; if the authorization file carries an identification, the steps are entered: after restoring the content of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file, thereby ensuring that a legal authorization file is obtained and preventing illegal authorization behavior.

[0191] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0192] Corresponding to the method described in the above embodiment, for the convenience of explanation, only the part related to the embodiment of the present application is shown.

[0193] In one embodiment, Figure 6 Schematic diagram of the structure of the software authorization system provided by an embodiment of the present application. Figure 6 As shown, the system includes a management terminal 10 and at least one client 11;

[0194] The management terminal 10 is used to receive an authorization application request, the authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client;

[0195] It is also used to encrypt the authorization information using the user key in response to the authorization application request to obtain the encrypted authorization information;

[0196] It is also used to use the private key of the management end to sign the encrypted authorization information and obtain the signature information;

[0197] It is also used to write the encrypted authorization information and signature information into an empty file to obtain the initial file;

[0198] It is also used to encrypt and package the initial file to obtain a data package;

[0199] It is also used to set the content of the file header bytes of the data packet to the preset bytecode to obtain the obfuscated data packet;

[0200] It is also used to set the format of the obfuscated data packet to the target format and obtain the authorization file.

[0201] The target client 11 is used to receive the authorization file of the software to be authorized;

[0202] It is also used to restore the contents of the file header bytes of the authorization file to the initial bytecode, and then decompress the authorization file to obtain the initial file;

[0203] It is also used to obtain encrypted authorization information and signature information from the initial file;

[0204] It is also used to use the public key of the management end to verify the signature information and obtain the verification result;

[0205] It is also used to decrypt the encrypted authorization information using the user key to obtain the authorization information if the signature verification result is verified.

[0206] In one embodiment, the management end is specifically used to determine a first target number of lines based on the first account information and a preset number of text lines in an empty file; determine a second target number of lines based on the first software version information and a preset number of text lines; if the first target number of lines is different from the second target number of lines, then in the empty file, encrypted authorization information is written in the first target number of lines, signature information is written in the second target number of lines, and a random string is written in the remaining number of lines; if the first target number of lines is the same as the second target number of lines, the second target number of lines is processed to obtain a third target number of lines, and in the empty file, encrypted authorization information is written in the first target number of lines, signature information is written in the third target number of lines, and a random string is written in the remaining number of lines; wherein the authorization information includes the first account information and the first software version information of the client.

[0207] In one embodiment, the client is specifically used to determine the line number where the encrypted authorization information is located based on the second account information and the number of text lines of the initial file; determine the line number where the signature information is located based on the second software version information and the number of text lines of the initial file; obtain the encrypted authorization information from the initial file based on the number of lines where the encrypted authorization information is located; obtain the signature information from the initial file based on the number of lines where the signature information is located; wherein the client stores the second account information and the second software version information.

[0208] In one embodiment, the client is also used to compare the first basic information with the second basic information to obtain a first check result; compare the first software version information with the historical software version information to obtain a second check result; compare the authorization environment information with the configuration information to obtain a third check result; check the authorization time to obtain a fourth check result; compare the authorization address information with the terminal address information to obtain a fifth check result; if all check results are passed, the authorization information is stored; wherein the authorization information also includes the first basic information, the first software version information, the authorization environment information, the authorization time and the authorization address information, and the client stores the second basic information, the historical software version information, the configuration information and the terminal address information.

[0209] In one embodiment, the client is also used to send the authorization file to the file server after marking the authorization file, and the authorization file carries an identifier; when the client is restarted, the authorization file of the file to be authorized is obtained from the file server; it is determined whether the authorization file has an identifier; if the authorization file carries an identifier, the step is entered: after restoring the content of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file.

[0210] In one embodiment, the client is also used to start the timer, obtain the timing result of the timer at a first preset time interval; encrypt the timing result to obtain an encrypted timing result; store the encrypted timing result in at least two storage points; obtain the encrypted timing result from each storage point at a second preset time interval; decrypt each encrypted timing result to obtain each timing result; determine the total authorization time for each timing result and the authorization time; if the difference between the total authorization time and the system time of the client is greater than a preset deviation threshold, execute the policy operation.

[0211] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0212] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0213] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0214] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0215] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some cases, the computer-readable medium cannot be an electric carrier signal and a telecommunication signal.

[0216] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0217] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0218] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0219] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0220] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A software authorization method, characterized in that: Applied to the management side, including: Receive an authorization application request, the authorization application request including authorization information of the software to be authorized, the software to be authorized is installed on the client, and the authorization information includes first account information and first software version information of the client; In response to the authorization application request, encrypt the authorization information using a user key to obtain encrypted authorization information; Using the private key of the management terminal, signing the encrypted authorization information to obtain signature information; Write the encrypted authorization information and signature information into an empty file to obtain an initial file; Encrypting and packaging the initial file to obtain a data packet; Setting the content of the file header bytes of the data packet to a preset bytecode to obtain an obfuscated data packet; Setting the format of the obfuscated data packet to a target format to obtain an authorization file; Wherein, the encrypted authorization information and signature information are written into an empty file to obtain an initial file, including: Calculate the sum of the ASCII code values ​​of the first account information to obtain a first coded sum; Performing a modulo operation on the first code and a preset number of text lines, adding 1 to the modulo result, to obtain a first target number of lines, where the preset number of text lines represents the number of lines of content written in the empty file; Obtaining a first version number from the first software version information; Performing a modulo operation on the first version number and the preset number of text lines, and adding 1 to the modulo result to obtain a second target number of lines; If the first target number of lines is different from the second target number of lines, in the empty file, the encrypted authorization information is written in the first target number of lines, the signature information is written in the second target number of lines, and a random character string is written in the remaining number of lines; If the first target number of lines is the same as the second target number of lines, the second target number of lines is processed to obtain the third target number of lines, and in the empty file, the encrypted authorization information is written in the first target number of lines, the signature information is written in the third target number of lines, and the random character string is written in the remaining number of lines.

2. The method according to claim 1, characterized in that: The package password of the initial file includes the alias of the client and a random salt.

3. A software authorization method, characterized in that: Applied to the client, including: Receive the authorization file of the software to be authorized; After restoring the contents of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file; Obtaining encrypted authorization information and signature information from the initial file; Using the public key of the management end, the signature information is verified to obtain the verification result; If the signature verification result is verified, the encrypted authorization information is decrypted using the user key to obtain the authorization information; Wherein, the client stores the second account information and the second software version information; The step of obtaining the encrypted authorization information and signature information from the initial file includes: Calculate the sum of the ASCII code values ​​of the second account information to obtain a second coded sum; Performing a modulo operation on the second code and the number of text lines in the initial file, adding 1 to the modulo result to obtain the line number where the encrypted authorization information is located; Obtaining a second version number from the second software version information; Perform a modulo operation on the second version number and the number of text lines of the initial file, then add 1 to the modulo result to obtain the number of lines; If the row number result is different from the row number where the encrypted authorization information is located, then determining the row number result to be the row number where the signature information is located; If the number of lines is the same as the number of lines where the encrypted authorization information is located, then the number of lines is added to a preset value to obtain a second increased number of lines, and the second increased number of lines is compared with the number of text lines in the initial file; If the second increased number of lines is greater than the number of text lines in the initial file, determining that the line where the signature information is located is the first line; If the second increased number of lines is less than or equal to the preset number of text lines, determining the second increased number of lines as the number of lines where the signature information is located; According to the number of the line where the encrypted authorization information is located, obtaining the encrypted authorization information from the initial file; The signature information is obtained from the initial file according to the line number where the signature information is located.

4. The method according to claim 3, characterized in that After obtaining the authorization information, it also includes: Compare the first basic information with the second basic information to obtain a first inspection result; Compare the first software version information with the historical software version information to obtain a second inspection result; Compare the authorization environment information with the configuration information to obtain a third inspection result; Checking the authorization time to obtain a fourth checking result; Comparing the authorized address information with the end address information to obtain a fifth check result; If all inspection results are passed, the authorization information is stored; Among them, the authorization information also includes the first basic information, the first software version information, the authorization environment information, the authorization time and the authorization address information, and the client stores the second basic information, the historical software version information, the configuration information and the terminal address information.

5. The method according to claim 4, characterized in that After storing the authorization information, the method further includes: After marking the authorization file, sending the authorization file to a file server, wherein the authorization file carries an identification; After the client is restarted, the authorization file of the software to be authorized is obtained from the file server; Determine whether the authorization document has the identification; If the authorization file carries the identification, the process proceeds to the following step: after restoring the contents of the file header bytes of the authorization file to the initial bytecode, the authorization file is decompressed to obtain the initial file.

6. The method according to claim 5, characterized in that After receiving the authorization file of the software to be authorized, the method further includes: Starting a timer, and obtaining a timing result of the timer at a first preset time interval; Encrypting the timing result to obtain an encrypted timing result; Storing the encrypted timing result in at least two storage points; Obtaining the encryption timing result from each of the storage points at a second preset time interval; Decrypting each of the encrypted timing results to obtain each of the timing results; Determine the total authorization duration according to each of the timing results and the authorization time; If the difference between the total authorized duration and the system time of the client is greater than a preset deviation threshold, a policy operation is executed.

7. A software authorization system, characterized in that: Includes a management terminal and at least one client: The management terminal is used to receive an authorization application request, wherein the authorization application request includes authorization information of the software to be authorized, and the software to be authorized is installed on the client; Also used for, in response to the authorization application request, encrypting the authorization information using a user key to obtain encrypted authorization information; It is also used to use the private key of the management end to sign the encrypted authorization information to obtain signature information; It is also used to calculate the sum of the ASCII code values ​​of the first account information to obtain a first coded sum; It is also used to perform a modulo operation on the first code and a preset number of text lines, and then add 1 to the modulo result to obtain a first target number of lines, wherein the preset number of text lines represents the number of lines of content written in the empty file; Also used to obtain a first version number from the first software version information; It is also used to perform a modulo operation on the first version number and the preset number of text lines, add 1 to the modulo result, and obtain a second target number of lines; Also used for writing the encrypted authorization information in the first target number of lines, writing the signature information in the second target number of lines, and writing random character strings in the remaining number of lines in the empty file if the first target number of lines is different from the second target number of lines; further configured to process the second target number of lines to obtain a third target number of lines if the first target number of lines is the same as the second target number of lines, and to write the encrypted authorization information into the first target number of lines, write the signature information into the third target number of lines, and write the random character string into the remaining number of lines in the empty file; It is also used to encrypt and package the initial file to obtain a data package; It is also used to set the content of the file header bytes of the data packet to a preset byte code to obtain an obfuscated data packet; It is also used to set the format of the obfuscated data packet to a target format to obtain an authorization file; A client, used for receiving the authorization file of the software to be authorized; It is also used to restore the content of the file header bytes of the authorization file to the initial byte code, and then decompress the authorization file to obtain the initial file; It is also used to calculate the sum of the ASCII code values ​​of the second account information to obtain a second coded sum; It is also used to perform a modulo operation on the second code and the number of text lines of the initial file, add 1 to the modulo result, and obtain the number of the line where the encrypted authorization information is located; Also used to obtain a second version number from the second software version information; It is also used to perform a modulo operation on the second version number and the number of text lines of the initial file, then add 1 to the modulo result to obtain the number of lines; Also used for determining that the row number result is the row number where the signature information is located if the row number result is different from the row number where the encrypted authorization information is located; Also used for, if the line number result is the same as the line number of the encrypted authorization information, adding the line number result and a preset value to obtain a second increased line number, and comparing the second increased line number with the text line number of the initial file; Also used for determining that the line number where the signature information is located is the first line if the second increased line number is greater than the number of text lines of the initial file; Also used for determining, if the second increased number of lines is less than or equal to the preset number of text lines, that the second increased number of lines is the number of lines where the signature information is located; Also used for obtaining the encrypted authorization information from the initial file according to the line number where the encrypted authorization information is located; Also used for obtaining the signature information from the initial file according to the line number where the signature information is located; It is also used to use the public key of the management end to verify the signature information and obtain the verification result; It is also used to decrypt the encrypted authorization information using the user key to obtain the authorization information if the signature verification result is verification passed; The authorization information includes the first account information and the first software version information of the client, and the client stores the second account information and the second software version information.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 2 or claims 3 to 6 is implemented.

Images