Equipment authorization method and system for protecting authorization time
By starting the authorized timing service in the device, timing the authorized time and modifying the authorization status when the authorization deadline arrives, the problem of device authorization method being deceived is solved, ensuring the accuracy of authorization time and the security of the device are protected The interests and data security of the equipment developers.
Patent Information
- Application Number
- CN202310807237.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-30
- Publication Date
- 2024-12-31
AI Technical Summary
The existing equipment authorization methods have the problem of fraudulent authorization. The user can modify the equipment system time to enable the equipment to be used normally after the authorization expires, which harms the interests of the equipment developer and poses a risk of sensitive data leakage.
By obtaining the device authorization code, authorization period and authorization start time in the authorization file, start the authorization time, time the authorization time, and modify the device authorization status to the unauthorized status when the authorization deadline arrives, ensuring that the authorization time is not subject to the device system The impact of time.
It effectively prevents the authorization time from being deceived, protects the interests and intellectual property rights of the equipment developers, ensures that the equipment cannot be used normally after the authorization expires, and avoids sensitive data leakage.
Smart Images
Figure CN119227045A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a device authorization method and system for protecting authorization time, belonging to the field of network security protocols. Background Art
[0002] At present, some equipment authorization methods are one-time permanent authorization, and some equipment authorization methods have an expiration date, and the equipment will not be able to be used normally after the authorization expires. However, since some equipment has no protection for the authorization time, after the authorization validity period expires, the user can deceive the authorization by modifying the device system time, making the device think that it is still within the authorization validity period, so that it can work normally. This not only damages the legitimate interests of the device developer, but also infringes on the intellectual property rights of the device developer, and there is a risk of sensitive data leakage of the device user. If the equipment is not damaged after retirement and can still be used normally, there is a risk of leakage of sensitive data in the equipment. If the equipment in some important scenarios such as substations, hospitals, military, government affairs, etc. causes sensitive data leakage, the consequences will be disastrous. Summary of the invention
[0003] The purpose of the present invention is to provide a device authorization method and system for protecting the authorization time, so as to solve the problem of cheating authorization by modifying the device system time.
[0004] To achieve the above object, the solution of the present invention includes:
[0005] A device authorization method for protecting authorization time comprises the following steps:
[0006] 1) Obtain the authorization document fed back after the application is successful. The authorization document at least includes the device authorization code and authorization period;
[0007] 2) Complete device authorization through the device authorization code, record the time of completing authorization as the authorization start time, start the authorization timing service, and count the authorized time; also calculate the authorization deadline based on the authorization period and the authorization start time;
[0008] 3) The authorization service calculates the authorized available time period based on the authorization start time and the authorization end time. When the authorized time is greater than the authorized available time period, the device authorization state is changed to the unauthorized state.
[0009] When the authorization starts, the invention starts the authorization timing service to time the authorized time. This method is not affected by the device system time. Even if the system time is modified, the device cannot be used normally after the device authorization expires.
[0010] Furthermore, in step 2), the authorized time is measured in the following manner: the authorization timing service is started after the device is authorized and each subsequent time it is powered on; the authorization timing service saves the authorized time once at set time intervals; each time the device is powered on, the authorization timing service reads the last saved authorized time before shutdown, and also reads the power-off time recorded by the device's RTC module, and adds the power-off time to the last saved authorized time before shutdown to obtain the current authorized time.
[0011] By setting the interval time through the authorized timing service to save the authorized time, and combining it with the power off time recorded by RTC after shutdown, the authorized time of the current time can be obtained, so that the authorized time will not be affected by device shutdown or system modification.
[0012] Furthermore, in step 1), the authorization file also includes the authorization file issuance time and the valid authorization time; in step 2), if the authorization is successfully performed through the device authorization code within the valid authorization time after the authorization issuance time, the device authorization is completed.
[0013] Furthermore, the authorization file also includes an authorization file hash value. The hash value of the authorization file imported into the device is calculated and compared with the authorization file hash value in the authorization file. If the hash values are different, the authorization is terminated.
[0014] By comparing the device's authorization file hash value with the hash value in the authorization file, it is possible to determine whether the authorization file has been tampered with, thereby quickly determining whether the authorization has been terminated.
[0015] Furthermore, the authorization application includes the following steps: generating an authorization application document, the authorization application document including the device identification, the application authorization period, and the applicant information; if the authorization conditions are met, generating the authorization document according to the device identification.
[0016] Furthermore, the authorization application file also includes an authorization application file hash value. The hash value of the authorization application file imported into the device is calculated and compared with the authorization file hash value in the authorization application file. If they are consistent, the authorization condition is met.
[0017] By comparing the hash value of the device's authorization application file with the hash value in the authorization application file, it is possible to determine whether the authorization application file has been tampered with, thereby quickly determining whether the authorization conditions are met.
[0018] A device authorization system for protecting authorization time includes a processor, wherein the processor is used to execute a device authorization method for protecting authorization time. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 A device authorization method and system flow chart for protecting authorization time;
[0020] Figure 2 This is a flow chart for determining authorization expiration when the device is turned on again after authorization;
[0021] Figure 3 The invention discloses a device authorization method and a system diagram for protecting authorization time. DETAILED DESCRIPTION
[0022] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.
[0023] An embodiment of a device authorization method for protecting authorization time:
[0024] like Figure 1 An embodiment of a device authorization method for protecting authorization time is shown. In this embodiment, the person applying for authorization must first obtain an authorization file, wherein the authorization file is exported by the person applying for authorization filling in application information on the device management tool and generating an authorization application file and then handed over to the authorization management personnel. The application information includes device identification, application authorization period, applicant information and authorization application file hash value. The device identification is automatically obtained through a private protocol after the management tool connects to the device and cannot be edited. The application authorization period is 1 year, 3 years, 5 years, or permanent, which is filled in according to actual conditions.
[0025] The authorization manager starts the authorization server client to connect to the server, and imports the authorization application file through the client to apply. After receiving the authorization file, the server calculates the hash value of the authorization application file and compares it with the hash value in the authorization application file. If they are inconsistent, it means that the file has been tampered with and the application for authorization file fails, indicating that the authorization application file is damaged and the authorization process ends. If they are consistent, it means that the application file has not been tampered with, and an authorization file is generated according to the device identification. The authorization manager gives the generated authorization file to the person applying for authorization.
[0026] The authorization file obtained by the person applying for authorization contains the device authorization code, authorization period, authorization file issuance time, valid authorization time and the hash value of the authorization file. The valid authorization time is 30 minutes, that is, the valid authorization time is within 30 minutes after the authorization file is issued.
[0027] It should be noted that the person applying for authorization also needs to import the authorization file into the device through the device management tool. The authorization service in the device calculates the hash value of the authorization file and compares it with the hash value in the authorization file to confirm whether the file has been tampered with. If the file has been tampered with, it will prompt that the authorization file is damaged, the authorization fails, and the authorization process ends.
[0028] If the above files are confirmed to be intact and not tampered with, the device system time is read and compared to see whether it is within the valid authorization time calculated from the issuance time of the authorization file read in the authorization file. If it exceeds the valid authorization time, it will prompt that the authorization file has expired. Please reapply for the authorization file and the authorization process is over.
[0029] If the device system time is not up to the time when the authorization file was issued, a prompt will appear to confirm whether the device time is correct, and the authorization process ends.
[0030] If it is within the valid authorization time, the device authorization code is used for authorization. If the authorization fails, a prompt will be displayed asking you to contact the authorization manager and the authorization will end. If the authorization is successful, the authorization service reads the system time as the authorization success time, and the authorization timing service is started, using a second timer to count the authorized time.
[0031] The authorization deadline is calculated based on the authorization success time and the authorization deadline. The authorization service calculates the device authorization available time period based on the authorization success time and the authorization deadline. The authorization service compares the authorized time with the authorized available time period. When the authorized time reaches the authorized available time period, the device authorization expires, and the device authorization status is changed to unauthorized status. The device cannot be used normally, and a prompt is displayed indicating that the authorization has expired and requires re-authorization.
[0032] Both the authorization service and the authorization timing service are protected as processes. They cannot be disabled or deleted, and the service processes are hidden. The authorization service starts at each boot, and the authorization timing service starts after the first successful authorization, and then starts at each subsequent boot. Figure 2 As shown, the authorization timing service saves the authorized time once per second. Each time the device is powered on, the authorization timing service reads the last saved authorized time, reads the power-off time recorded by the device's RTC (Real Time Clock) module and adds it to obtain the new authorized time, updates the authorized time, and compares the authorized time with the available time period to determine whether the device authorization has expired.
[0033] If the authorization deadline needs to be extended, the applicant fills out a new authorization application. After the application is successful, the new authorization file is imported into the device. After the authorization service verifies the authorization file, it updates the authorization deadline and the difference between the authorization deadline and the authorization success time.
[0034] The invention can calculate the authorized time of the device relatively accurately and is not affected by modifying the device system time. Even if the device system time is modified, the device will not be able to be used normally after the device authorization expires, thereby protecting the legitimate interests of the device developer, protecting the intellectual property rights of the device developer, and protecting the sensitive data of the user of the device from being leaked after it expires and is retired.
[0035] An embodiment of a device authorization system for protecting authorization time:
[0036] A system for protecting authorized time, such as Figure 3 As shown, it includes authorization service, authorization timing service, and RCT module. The authorization service determines whether the authorization has expired by obtaining the authorization file. If the authorization is successful, the authorization timing service is started. The authorization timing service is used to time the authorized time, read the power-off time of the RTC module, and calculate the authorized time. The RTC module is used to record the duration of the power-off to calculate the authorized time.
[0037] The authorization file obtained by the authorization service is first filled in by the authorization applicant on the device configuration tool. The application information includes device identification, application authorization period, applicant information and authorization application file hash value. The device identification is automatically obtained after the management tool connects to the device and cannot be edited. The application authorization period is 1 year, 3 years, 5 years, or permanent, which should be filled in according to the actual situation.
[0038] The person applying for authorization will export the generated authorization application file and submit it to the authorization manager. The authorization manager will start the authorization server client to connect to the server and import the authorization application file through the client to apply. After receiving the authorization file, the authorization server will calculate the file hash value and compare it with the hash value in the file. If they are inconsistent, it means that the file has been tampered with and the application for authorization file fails, indicating that the authorization application file is damaged and the authorization process ends. If they are consistent, it means that the application file has not been tampered with. The authorization file is generated according to the device identification. The authorization manager will hand over the generated authorization file to the person applying for authorization. The person applying for authorization also needs to import the authorization file into the device through the device management tool.
[0039] The authorization service in the device calculates the authorization file hash value and compares it with the hash value in the authorization file to confirm whether the file has been tampered with. If the file has been tampered with, it will prompt that the authorization file is damaged, the authorization fails, and the authorization process ends.
[0040] If the above files are confirmed to be intact and not tampered with, the device system time is read and compared to see whether it is within the valid authorization time calculated from the issuance time of the authorization file read in the authorization file. If it exceeds the valid authorization time, it will prompt that the authorization file has expired. Please reapply for the authorization file and the authorization process is over.
[0041] If the device system time is not up to the time when the authorization file was issued, a prompt will appear to confirm whether the device time is correct, and the authorization process ends.
[0042] If it is within the valid authorization time, the device authorization code is used for authorization. If the authorization fails, a prompt will be displayed asking you to contact the authorization manager and the authorization will end. If the authorization is successful, the authorization service reads the system time as the authorization success time, and the authorization timing service is started, using a second timer to count the authorized time.
[0043] The authorization deadline is calculated based on the authorization success time and the authorization deadline. The authorization service calculates the device authorization available time period based on the authorization success time and the authorization deadline. The authorization service compares the authorized time with the authorized available time period. When the authorized time reaches the authorized available time period, the device authorization expires, and the device authorization status is changed to unauthorized status. The device cannot be used normally, and a prompt is displayed indicating that the authorization has expired and requires re-authorization.
[0044] Both the authorization service and the authorization timing service are protected as processes. They cannot be disabled or deleted, and the service processes are hidden. The authorization service starts at each boot, and the authorization timing service starts after the first successful authorization, and then starts at each subsequent boot. Figure 2 As shown, the authorization timing service saves the authorized time once per second. Each time the device is powered on, the authorization timing service reads the last saved authorized time, reads the power-off time recorded by the device's RTC (Real Time Clock) module and adds it to obtain the new authorized time, updates the authorized time, and compares the authorized time with the available time period to determine whether the device authorization has expired.
[0045] If the authorization deadline needs to be extended, the applicant fills out a new authorization application. After the application is successful, the new authorization file is imported into the device. After the authorization service verifies the authorization file, it updates the authorization deadline and the difference between the authorization deadline and the authorization success time.
[0046] The invention can calculate the authorized time of the device relatively accurately and is not affected by modifying the device system time. Even if the device system time is modified, the device will not be able to be used normally after the device authorization expires, thereby protecting the legitimate interests of the device developer, protecting the intellectual property rights of the device developer, and protecting the sensitive data of the user of the device from being leaked after it expires and is retired.
Claims
1. A device authorization method for protecting authorization time, characterized in that: The steps include: 1) Obtain the authorization document fed back after the application is successful, and the authorization document at least includes the device authorization code and authorization period; 2) completing device authorization through the device authorization code, recording the time of completing authorization as the authorization start time, starting the authorization timing service, and timing the authorized time; and calculating the authorization end time according to the authorization period and the authorization start time; 3) The authorization service calculates the authorized available time period according to the authorization start time and the authorization end time, and when the authorized time is greater than the authorized available time period, the device authorization state is changed to the unauthorized state.
2. The device authorization method for protecting authorization time according to claim 1, characterized in that: In step 2), the authorized time is measured in the following manner: the authorization timing service is started after the device is authorized and each subsequent time it is powered on; the authorization timing service saves the authorized time once at set time intervals; each time the device is powered on, the authorization timing service reads the last saved authorized time before shutdown, and also reads the power-off time recorded by the device's RTC module, and adds the power-off time to the last saved authorized time before shutdown to obtain the current authorized time.
3. The device authorization method for protecting authorization time according to claim 1, characterized in that: In step 1), the authorization file also includes the authorization file issuance time and the effective authorization time; in step 2), if the device authorization code is successfully authorized within the effective authorization time after the authorization issuance time, the device authorization is completed.
4. The device authorization method for protecting authorization time according to claim 1, characterized in that: In step 1), the authorization file also includes an authorization file hash value. The hash value of the authorization file imported into the device is calculated and compared with the authorization file hash value in the authorization file. If the hash values are different, the authorization is terminated.
5. The device authorization method for protecting authorization time according to claim 1, characterized in that: The authorization application includes the following steps: generating an authorization application document, the authorization application document including a device identification, an application authorization period, and applicant information; if the authorization conditions are met, generating an authorization document according to the device identification.
6. The device authorization method for protecting authorization time according to claim 5, characterized in that ,The authorization application file also includes the authorization application file hash value. The hash value of the authorization application file imported into the device is calculated and compared with the authorization file hash value in the authorization application file. If they are consistent, the authorization conditions are met.
7. A device authorization system for protecting authorization time, comprising a processor, characterized in that: The processor is used to execute a device authorization method for protecting authorization time as described in any one of claims 1-4.