Authority control method, device and equipment and nonvolatile storage medium

Abstract

The invention relates to the technical field of software permission management, and particularly discloses a permission control method, device and equipment and a nonvolatile storage medium, in response to a calling command of user equipment to a secondary development tool, before an executive file of a target tool is loaded, a server certificate and a user certificate of the target tool are queried, and the executive file of the target tool is loaded; and verifying the use permission of the user equipment to the target tool through the equipment unique identifier and the equipment time, and if the use permission is not queried or the verification is not passed, prohibiting the execution of the calling command, thereby realizing the use permission control of the secondary development tool. The method comprises the following steps: performing matching verification on a first equipment unique identifier of user equipment, a server certificate and an equipment unique identifier recorded by a user certificate, and performing matching verification on local time of the user equipment, an authorization time range recorded by the server certificate and use time recorded by the user certificate; and the cracking difficulty is enhanced, so that effective maintenance of the authority of the secondary development tool is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of software authority management, and in particular to an authority control method, device, equipment and non-volatile storage medium. Background Art

[0002] With the development of science and technology, various industries have launched feature-rich software, and users can use the software functions by purchasing and installing it on user devices. In order to obtain richer functions, many software provide open secondary development interfaces so that other software developers can conduct secondary development according to usage needs, but this brings about the problem of permission management of secondary development tools. Because many software provide secondary development interfaces but do not provide permission management interfaces, the intellectual property rights of secondary development tools cannot be effectively protected. Once installed on user devices, users can easily use secondary development tools illegally and permanently by cracking or copying.

[0003] How to achieve permission control over secondary development tools for software is a technical problem that those skilled in the art need to solve. Summary of the invention

[0004] The purpose of the present invention is to provide a permission control method, device, equipment and non-volatile storage medium for implementing permission control on secondary development tools of software.

[0005] In order to solve the above technical problems, the present invention provides a permission control method, comprising: In response to a call command from a user device to a target tool, query a server certificate and a user certificate of the target tool; Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through a unique device identifier and device time; If the first device unique identifier of the user device is found in both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has not passed the verification of the device unique identifier; If the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time; If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, the execution of the calling command is prohibited; Wherein, the target tool is a secondary development tool for the original software.

[0006] On the one hand, verifying the user equipment by using the unique identification of the equipment includes: Obtaining a user authorization information list in the server certificate, and reading a second device unique identifier of an authorized user of the target tool from the user authorization information list; Matching the first device unique identifier obtained from the user device with each of the second device unique identifiers, and if a match is successful, determining that the user device has passed the verification of the device unique identifier of the server certificate; if a match is not found, determining that the user device has failed to pass the verification of the device unique identifier of the server certificate; Comparing the first device unique identifier with the third device unique identifier recorded in the user certificate, if they are consistent, determining that the user device has passed the verification of the device unique identifier of the user certificate; if they are inconsistent, determining that the user device has not passed the verification of the device unique identifier of the user certificate; If the user device passes the verification of the device unique identifier of the server certificate and the user device passes the verification of the device unique identifier of the user certificate, it is determined that the user device passes the verification of the device unique identifier, otherwise it is determined that the user device fails to pass the verification of the device unique identifier.

[0007] On the other hand, verifying the user device by using the device time includes: Obtaining a valid time list in the server certificate, and reading an authorized time range of an authorized user of the target tool from the valid time list; If it is determined according to the first device unique identifier that the user device is an authorized user recorded in the server certificate, then querying from the valid time list to obtain a first authorized time range corresponding to the first device unique identifier; If the local time of the user device is within the first authorization time range and the local time of the user device is later than the last call time of the user device to the target tool recorded in the user certificate, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time.

[0008] On the other hand, it also includes: Receive the updated server certificate, and use the updated server certificate to replace the server certificate in the tool set server folder path of the original software; The updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to an update of the local time of the authorized user device of the authorized user.

[0009] On the other hand, it also includes: When receiving a menu hook command or an access tool server authority control command, reclaiming the user device's authority to use the target tool; The menu mounting command and the access tool server authority control command are commands issued by the server corresponding to the target tool when the number of times the execution of the call command is prohibited for the target tool reaches a threshold of the number of illegal accesses.

[0010] On the other hand, it also includes: Before using the server certificate and the user certificate to perform authority verification on the call command, decrypt the server certificate using a first key and decrypt the user certificate using a second key to obtain the decrypted server certificate and the decrypted user certificate; If the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; Wherein, the server certificate and the user certificate are both generated by irreversible encryption.

[0011] On the other hand, querying the server certificate of the target tool from the file path corresponding to the original software includes: Obtaining a first server certificate from the tool set server folder path of the original software; Query the server certificate from the current user environment variable path of the original software; If the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate; If the server certificate is found in the current user environment variable path, decrypt the server certificate using the first key to obtain the decrypted server certificate; Compare the version number of the decrypted server certificate with the version number of the toolset server change record table, and if they are inconsistent, replace the server certificate under the current user environment variable path with the first server certificate; Querying the user certificate of the target tool from the user directory of the user device includes: Querying the user certificate from the user home directory environment variable path of the user device; Verifying the user device by using the unique device identifier includes: Compare and match the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier; if a match is achieved between the three device unique identifiers, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier; Verifying the user device by using the device time includes: The authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the target tool by the user device recorded in the user certificate, and the local time of the user device are compared and matched; if the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time.

[0012] In order to solve the above technical problems, the present invention further provides a permission control device, comprising: The permission control loading unit is used to query the server certificate and user certificate of the target tool in response to the calling command of the user device to the target tool; The authority verification unit is used to verify the user device's permission to use the target tool by using the server certificate and the user certificate through the device unique identifier and the device time; if the first device unique identifier of the user device is queried from both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier, otherwise it is determined that the user device has not passed the verification of the device unique identifier; if the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time, otherwise it is determined that the user device has not passed the verification of the device time; an authority control execution unit, configured to prohibit execution of the calling command if the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time; Wherein, the target tool is a secondary development tool for the original software.

[0013] In order to solve the above technical problems, the present invention further provides a permission control device, comprising: Memory for storing computer programs; A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the permission control method as described in any one of the above items are implemented.

[0014] In order to solve the above technical problems, the present invention also provides a non-volatile storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the permission control method as described in any one of the above items are implemented.

[0015] The authority control method provided by the present invention has the beneficial effect that in response to the call command of the user device to the secondary development tool, before loading the execution file of the target tool, the server certificate and user certificate of the target tool are queried, and the user device's authority to use the target tool is verified through the device unique identifier and device time. If the query is not found or the verification fails, the call command is prohibited to implement the control of the use authority of the secondary development tool. When verifying through the device unique identifier, the first device unique identifier of the user device, the server certificate and the device unique identifier recorded in the user certificate are used for matching verification. When verifying through the device time, the local time of the user device, the authorized time range recorded in the server certificate and the use time recorded in the user certificate are used for matching verification, which effectively prevents users from cracking the target tool by stealing certificates and modifying device time, thereby effectively maintaining the authority of the secondary development tool.

[0016] The authority control device, equipment and non-volatile storage medium provided by the present invention have the above-mentioned beneficial effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A flowchart of a permission control method provided by an embodiment of the present invention; Figure 2 A tool authority management interface provided by an embodiment of the present invention; Figure 3 A certificate management flow chart provided for an embodiment of the present invention; Figure 4 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention; Figure 5 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The core of the present invention is to provide a permission control method, device, equipment and non-volatile storage medium for implementing permission control on secondary development tools of software.

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Figure 1 A flowchart of a permission control method provided by an embodiment of the present invention.

[0022] like Figure 1 As shown, a permission control method provided by an embodiment of the present invention includes: S101: In response to a call command from a user device to a target tool, query a server certificate and a user certificate of the target tool; S102: Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through the device's unique identifier and device time; S103: If the first device unique identifier of the user device is found in both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has not passed the verification of the device unique identifier; S104: If the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device passes the device time verification; otherwise, it is determined that the user device fails the device time verification; S105: If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, the execution of the call command is prohibited.

[0023] Among them, the target tool is a secondary development tool for the original software.

[0024] In a specific implementation, the permission control method provided by the embodiment of the present invention is applied to a user device. The permission control method provided by the embodiment of the present invention can be installed in the user device in the form of an executable file, and forced to be loaded before the target tool is loaded, and the target tool is allowed to be loaded only after the user device passes the use permission verification of the target tool.

[0025] In addition, it is necessary to manage all authorized users of the target tool through the server. The permission control method provided in the embodiment of the present invention can be applied to a system including a server and a user device. The number of user devices can be one or more, and in addition to the user devices of authorized users, user devices of unauthorized users may also be included. The permission control method provided in the embodiment of the present invention is used to authorize the user devices of authorized users to use the target tool, and restrict the use of the target tool by the user devices of unauthorized users.

[0026] In the embodiment of the present invention, "original software" refers to software that provides a secondary development interface, and "target tool" refers to a secondary development tool for the original software. For example, the original software may be a printed circuit board (PCB) design software, such as Cadence, and the target tool may be a PCB auxiliary design tool developed using a skill language.

[0027] For S101, responding to the calling command of the target tool by the user equipment may include: monitoring the interface calling command of the original software calling the interface of the target tool.

[0028] Server certificates and user certificates can be constructed and maintained by the server certificate module and the user certificate module respectively.

[0029] The server certificate module can be recorded as ToolslicenseModule, and the unique address of the second device of the authorized user is added to the list. The unique device identifier used in the embodiment of the present invention can be a media access control address (MAC). The list of the unique addresses of the second devices of the authorized users in the server certificate can be recorded as a user authorization information list LicensedList={mac1, mac2, mac3, ...}, and declared as a global private variable. The server certificate must also include the authorization time range of each authorized user. In some optional implementations of the embodiments of the present invention, the authorization time range can be represented by the last valid time, that is, the authorization expiration time of the authorized user. Then, the latest valid time list allowed to load the target tool for each authorized user can be added to the server certificate, which can be recorded as usedeadlineTimeList={(mac1 UserDeadLine1), (mac2 UserDeadLine2), (mac3UserDeadLine3), ...}, and each last valid time (DeadLine) is declared as a global private variable. In order to maintain the update of the server certificate, the server certificate module also needs to maintain the version number (ver) of the server certificate.

[0030] In order to manage changes in server certificates, a toolset server change record table can also be provided in the server certificate module, which can be recorded as licenseupdate.XML. The toolset server change record table can include records of each administrator operation, such as the addition of a second device unique address of an authorized user, the expiration of an existing second device unique address, update time, changes in the version number of the server certificate, etc.

[0031] The user certificate module can be recorded as UserlicenseModule, which is used to generate and maintain the user certificate of the authorized user. The user certificate can include the last valid time (UserDeadLine, declared as a global private variable) of the corresponding authorized user to use the target tool, the last call time (ueserlastTime) of the installed user device to the target tool, and the second device unique identifier (licenseID) of the corresponding authorized user.

[0032] In order to further improve the security of the target tool and prevent the code from being copied and used, the permission control method provided by the embodiment of the present invention may also include: before using the server certificate and the user certificate to verify the permission of the calling command, using the first key to decrypt the server certificate, and using the second key to decrypt the user certificate to obtain the decrypted server certificate and the decrypted user certificate; if the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; wherein, the server certificate and the user certificate are both generated using irreversible encryption.

[0033] An encryption module (which can be recorded as EncryptModule) can be used to encrypt the server certificate and the user certificate. The server certificate and the user certificate are encrypted using the first key and the second key respectively. After decryption using the key, the server certificate and the user certificate are still in non-plaintext form, further increasing the difficulty for users to crack them.

[0034] The permission control method provided by the embodiment of the present invention may also include: if the server certificate and the user certificate are queried, and the user device passes the verification of the device unique identifier and the verification of the device time, then the user of the user device is determined to be an authorized user; the execution file of the target tool is decrypted using a third key to obtain a decrypted execution file; the decrypted execution file is run to execute the call command; wherein the execution file is generated using an irreversible encryption method. Similarly, an encryption module may be used to encrypt the execution file of the target tool, using an irreversible encryption method to prevent users from cracking the execution file of the target tool.

[0035] In order to enable the administrator to operate the server certificate module and the user certificate module from the server background, a tool permission management interface can be designed. Figure 2 A tool authority management interface is provided in an embodiment of the present invention. Figure 2 As shown, the tool authority management interface provided to the administrator may include a valid unique device identification entry button, an invalid unique device identification entry button, an authorized user's authorized usage time entry button, a target tool effective time entry button, etc.

[0036] Figure 3 A flow chart of certificate management provided by an embodiment of the present invention.

[0037] like Figure 3 As shown, in the tool permission management interface, the button entry logic of the server certificate module may include: after clicking the entry, the code executable file of the server available certificate module (ToolslicenseModule) is automatically generated, where the user authorization information list LicensedList = {mac1, mac2, mac3, ...} is the valid MAC address entered by the administrator, and each entry is added to the list. If the invalid MAC address entry has a value recorded as invalidMax, the corresponding MAC address information equal to invalidMax in the user authorization information list (LicensedList) and the valid time list (LastTimeList) is removed. If it is not found, it will prompt that the administrator has not found the invalid MAC address to prevent the administrator from entering errors.

[0038] The effective time of the target tool can be the last effective time (DeadLine), which is counted in the DeadLine variable. The variable is updated every time the administrator enters it to ensure that the effective time of the target tool is the latest and controllable. The last effective time list (usedeadlineTimeList) is used to record the effective use time currently entered for each MAC address as UserDeadLine, such as (mac1 UserDeadLine1) is appended to the last effective time list (usedeadlineTimeList). At the same time, the version number (ver) is increased by 1 on the original basis, and the initial value can be defaulted to V1. For example, if it is changed twice, the version number ver=V1+1=V2.

[0039] In the tool permission management interface, the logic of the button entry of the user certificate module may include: after clicking the entry, the code executable file of the user available certificate module (UserlicenseModule) is automatically generated, wherein the valid MAC address is counted in the third device unique identifier (licenseID) variable, the current entry time is counted in the last call time (ueserlastTime), and the user's valid use time is counted in the last valid time (UserDeadLine) variable.

[0040] Update the toolset server change log table (licenseupdate.XML) of the server available license module (ToolslicenseModule).

[0041] Call the encryption module (EncryptModule) to encrypt the generated server license module (ToolslicenseModule) and the user license module (UserlicenseModule) code executable files. The password can be recorded as pw. The encrypted files can be recorded as ToolslicenseModuleJM and UserlicenseModuleJM respectively. The ToolslicenseModuleJM file is automatically placed in the toolset server folder, and the administrator provides the UserlicenseModuleJM to the authorized user.

[0042] Based on this, when the user uses the original software through the user device and calls the target tool in the corresponding structure of the original software, the permission control method provided by the embodiment of the present invention can call the permission control module (TimeandMacOFFlinecontrol) to verify the user device. First, the server certificate and user certificate of the target tool are queried, and the user device's permission to use the target tool is verified through the device unique identifier and device time. If it is not queried or the verification fails, the call command is prohibited to implement the permission control of the secondary development tool. When verifying through the device unique identifier, the first device unique identifier of the user device, the server certificate and the device unique identifier recorded in the user certificate are used for matching verification. When verifying through the device time, the local time of the user device, the authorized time range recorded in the server certificate and the usage time recorded in the user certificate are used for matching verification. This effectively prevents users from cracking the target tool by stealing certificates and modifying device time, thereby effectively maintaining the permissions of the secondary development tool.

[0043] On the basis of the above embodiment, the embodiment of the present invention further describes the steps of verifying the user equipment through the unique identification of the equipment.

[0044] In an embodiment of the present invention, verifying a user device through a device unique identifier may include: obtaining a user authorization information list in a server certificate, and reading a second device unique identifier of an authorized user of a target tool from the user authorization information list; matching a first device unique identifier obtained from the user device with each second device unique identifier, and if the match is successful, determining that the user device has passed the verification of the device unique identifier of the server certificate; if both fail to match, determining that the user device has not passed the verification of the device unique identifier of the server certificate; comparing the first device unique identifier with a third device unique identifier recorded in the user certificate, and if they are consistent, determining that the user device has passed the verification of the device unique identifier of the user certificate; if they are inconsistent, determining that the user device has not passed the verification of the device unique identifier of the user certificate; if the user device has passed the verification of the device unique identifier of the server certificate and the user device has passed the verification of the device unique identifier of the user certificate, determining that the user device has passed the verification of the device unique identifier, otherwise determining that the user device has not passed the verification of the device unique identifier.

[0045] In a specific implementation, after obtaining the server certificate, the server certificate may be opened with the first key. After obtaining the user certificate, the user certificate may be opened with the second key.

[0046] Get the MAC address of the user's device and compare it with the MAC address in the user authorization information list (LicensedList) in the server certificate. If there is no match, it means that the user does not have permission to use the target tool, and the user is prompted to contact the administrator to open the permission. If there is a match, compare the MAC address of the user's device with the MAC address in the user's certificate. If they are equal, it is determined that the user's device has passed the verification of the device's unique identifier. If they are not equal, it means that the certificate used by the user is not his own and he cannot use the target tool.

[0047] Based on the above embodiment, the embodiment of the present invention further describes the step of verifying the user equipment through the equipment time.

[0048] In an embodiment of the present invention, verifying the user device through device time may include: obtaining a valid time list in the server certificate, and reading an authorized time range of an authorized user of the target tool from the valid time list; if the user device is determined to be an authorized user recorded in the server certificate based on the first device unique identifier, then querying from the valid time list to obtain a first authorized time range corresponding to the first device unique identifier; if the local time of the user device is within the first authorized time range and the local time of the user device is later than the most recent call time of the user device to the target tool recorded in the user certificate, then it is determined that the user device has passed the device time verification, otherwise it is determined that the user device has not passed the device time verification.

[0049] In a specific implementation, after obtaining the server certificate, the server certificate may be opened with the first key. After obtaining the user certificate, the user certificate may be opened with the second key.

[0050] Get the local time (currentTime) of the user's device and compare it with the last valid time (DeadLine) matched in the user's authorized information list (LicensedList). If the local time is later than the corresponding last valid time, the user is prompted that the current target tool has been discontinued. If the local time is earlier than the corresponding last valid time, but less than the last call time (ueserlastTime) in the user certificate, it means that the user has tampered with the local time by himself, and the user is prompted that the time on the computer is incorrect.

[0051] If the local time of the user's device is later than the effective usage time (UserDeadLine) of the MAC address corresponding to the server certificate or later than the last call time (ueserlastTime) of the user's certificate, the user is prompted that the permission to use the target tool has expired and needs to reapply.

[0052] If the user device passes the verification of the device unique identifier and the device time, the target tool's executable file can be loaded, and the last call time (ueserlastTime) in the user certificate is updated to the current time of the user device, and other variables remain unchanged. After the modification, the encryption module (EncryptModule) is continued to be called to encrypt the updated user certificate and replace the user certificate in the user directory.

[0053] Based on the above embodiments, the permission control method provided by the embodiments of the present invention may also include: when receiving a menu hang command or an access tool server permission control command, reclaiming the user device's permission to use the target tool; wherein the menu hang command and the access tool server permission control command are commands issued by the server corresponding to the target tool when the number of prohibited execution call commands for the target tool reaches a threshold number of illegal accesses.

[0054] In the embodiment of the present invention, if the server detects multiple illegal calls to the target tool, that is, if it issues a certain number of prohibition calls, it indicates that there are multiple infringing cracking behaviors on the target tool. At this time, in order to improve the security of the target tool, the permissions of all authorized users can be revoked by menu hooking or setting the access tool server permission control.

[0055] After all user permissions are reclaimed, the permission verification rules of the target tool can be reset to increase the difficulty for illegal users to crack the target tool. In some optional implementations of the embodiments of the present invention, when the server re-issues the permission verification rules of the target tool, it can issue an updated authorized usage time and configure the user device of the authorized user to change the local time to adapt to the updated authorized time.

[0056] The permission control method provided by the embodiment of the present invention may also include: receiving an updated server certificate, and using the updated server certificate to replace the server certificate under the tool set server folder path of the original software; wherein the updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to the update of the local time of the authorized user's authorized user device.

[0057] The server may update the authorization time range of the authorized user when the number of times the call command is prohibited from being executed reaches a threshold of the number of illegal accesses, or may update the time range periodically.

[0058] On the basis of the above embodiments, in the permission control method provided in the embodiments of the present invention, querying the server certificate of the target tool in S101 may include: obtaining a first server certificate from the toolset server folder path of the original software; querying the server certificate from the current user environment variable path of the original software; if the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate; if the server certificate is found in the current user environment variable path, the server certificate is decrypted using the first key to obtain the decrypted server certificate; the version number of the decrypted server certificate is compared with the version number of the toolset server change record table, and if they are inconsistent, the first server certificate is used to replace the server certificate under the current user environment variable path.

[0059] Querying the user certificate of the target tool in S101 may include: querying the user certificate from a user home directory environment variable path of the user device.

[0060] Verifying the user device through the device unique identifier may include: comparing and matching the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier; if a match is achieved between the three device unique identifiers, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has not passed the verification of the device unique identifier.

[0061] Verifying the user device through device time can include: comparing and matching the authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the target tool by the user device recorded in the user certificate, and the local time of the user device; if the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the device time verification; otherwise, it is determined that the user device has not passed the device time verification.

[0062] In the specific implementation, take the original software as PCB design software and the target tool as PCB auxiliary design tool as an example. Get the toolset server folder path, get the server certificate (ToolslicenseModuleJM), determine whether there is a server certificate module under the cdsroot environment variable path of the current user, if not, place the server certificate under the toolset server folder path to the user's cdsroot environment variable path, if yes, use the first key to open the server certificate, compare the version number of the server certificate with the version number of the toolset server change record table (licenseupdate.XML), if they are inconsistent, automatically replace the server certificate under the user's cdsroot environment variable path with the server certificate of the current toolset server folder path.

[0063] The user places the user certificate (UserlicenseModuleJM) for using the PCB auxiliary design tool provided by the administrator to the home environment variable path configured by the user. Use the second key to open the user certificate and obtain the decrypted user certificate.

[0064] For the remaining steps, please refer to the description of the above embodiment.

[0065] It should be noted that in the embodiments of the permission control method of the present invention, some of the steps or features may be ignored or not executed. The hardware or software functional modules divided for the convenience of description are not the only implementation form of the permission control method provided in the embodiments of the present invention.

[0066] The above describes in detail various embodiments corresponding to the permission control method. On this basis, the present invention also discloses a permission control device, equipment, non-volatile storage medium and computer program product corresponding to the above method.

[0067] Figure 4 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention.

[0068] like Figure 4 As shown, the permission control device provided by the embodiment of the present invention includes: The permission control loading unit 401 is used to query the server certificate and user certificate of the target tool in response to the call command of the user device to the target tool; The authority verification unit 402 is used to verify the user device's permission to use the target tool by using the server certificate and the user certificate through the device unique identifier and the device time; if the first device unique identifier of the user device is queried from both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier, otherwise it is determined that the user device has not passed the verification of the device unique identifier; if the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time, otherwise it is determined that the user device has not passed the verification of the device time; The authority control execution unit 403 is used to prohibit the execution of the call command if the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time; Among them, the target tool is a secondary development tool for the original software.

[0069] The permission control device provided by an embodiment of the present invention may also include a first receiving unit, which is used to receive an updated server certificate and use the updated server certificate to replace the server certificate under the tool set server folder path of the original software; wherein the updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to the update of the local time of the authorized user's authorized user device.

[0070] The permission control device provided by an embodiment of the present invention may further include a second receiving unit, which is used to reclaim the user device's permission to use the target tool when a menu hang-up command or an access tool server permission control command is received; wherein the menu hang-up command and the access tool server permission control command are commands issued by the server corresponding to the target tool when the number of prohibited execution call commands for the target tool reaches a threshold number of illegal accesses.

[0071] The permission control device provided by the embodiment of the present invention may also include: a decryption unit, which is used to decrypt the server certificate using a first key and decrypt the user certificate using a second key before using the server certificate and the user certificate to verify the permission of the calling command, so as to obtain a decrypted server certificate and a decrypted user certificate; if the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; wherein, the server certificate and the user certificate are both generated using an irreversible encryption method.

[0072] It should be noted that in each implementation of the permission control device provided in the embodiment of the present invention, the division of units is only a logical functional division, and other division methods can be adopted. The connection method between different units can be electrical, mechanical or other connection methods. The separated units can be located in the same physical location or distributed on multiple network nodes. Each unit can be implemented in the form of hardware or in the form of a software functional unit. That is, part or all of the units provided in the embodiment of the present invention can be selected according to actual needs and the corresponding connection method or integration method can be adopted to achieve the purpose of the embodiment of the present invention.

[0073] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

[0074] Figure 5 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention.

[0075] like Figure 5 As shown, the permission control device provided in an embodiment of the present invention includes: a memory 510, used to store a computer program 511; a processor 520, used to execute the computer program 511, and when the computer program 511 is executed by the processor 520, the steps of the permission control method provided in any of the above embodiments are implemented.

[0076] Among them, the processor 520 may include one or more processing cores, such as a 3-core processor, an 8-core processor, etc. The processor 520 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 520 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 520 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 520 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0077] The memory 510 may include one or more non-volatile storage media, which may be non-transitory. The memory 510 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 510 is at least used to store the following computer program 511, wherein the computer program 511, after being loaded and executed by the processor 520, can implement the relevant steps in the permission control method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 510 may also include an operating system 512 and data 513, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 512 may be Windows or other types of operating systems. Data 513 may include, but is not limited to, the data involved in the above method.

[0078] In some embodiments, the permission control device may further include a display screen 530 , a power supply 540 , a communication interface 550 , an input / output interface 560 , a sensor 570 , and a communication bus 580 .

[0079] Those skilled in the art will understand that Figure 5 The structure shown in the figure does not constitute a limitation on the permission control device, and may include more or fewer components than those shown in the figure.

[0080] The permission control device provided in the embodiment of the present invention includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the steps of the permission control method provided in the above embodiment, and the effect is the same as above.

[0081] An embodiment of the present invention provides a non-volatile storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the permission control method provided in any one of the above embodiments can be implemented.

[0082] The non-volatile storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0083] For an introduction to the non-volatile storage medium provided in the embodiment of the present invention, please refer to the above method embodiment, and the effect thereof is the same as the permission control method provided in the embodiment of the present invention, and the present invention will not elaborate on it here.

[0084] An embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the permission control method provided in any one of the above embodiments.

[0085] For an introduction to the computer program product provided by the embodiment of the present invention, please refer to the above method embodiment, and the effect thereof is the same as the permission control method provided by the embodiment of the present invention, and the present invention will not elaborate on it here.

[0086] The above is a detailed introduction to a permission control method, device, equipment and non-volatile storage medium provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the devices, equipment, non-volatile storage media and computer program products disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the present invention.

[0087] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A permission control method, characterized in that: include: In response to a call command from a user device to a target tool, query a server certificate and a user certificate of the target tool; Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through a unique device identifier and device time; If the first device unique identifier of the user device is found in both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has not passed the verification of the device unique identifier; If the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time; If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, the execution of the calling command is prohibited; Wherein, the target tool is a secondary development tool for the original software.

2. The permission control method according to claim 1, characterized in that: Verifying the user device by using the unique device identifier includes: Obtaining a user authorization information list in the server certificate, and reading a second device unique identifier of an authorized user of the target tool from the user authorization information list; Matching the first device unique identifier obtained from the user device with each of the second device unique identifiers, and if a match is successful, determining that the user device has passed the verification of the device unique identifier of the server certificate; if a match is not found, determining that the user device has failed to pass the verification of the device unique identifier of the server certificate; Comparing the first device unique identifier with the third device unique identifier recorded in the user certificate, if they are consistent, determining that the user device has passed the verification of the device unique identifier of the user certificate; if they are inconsistent, determining that the user device has not passed the verification of the device unique identifier of the user certificate; If the user device passes the verification of the device unique identifier of the server certificate and the user device passes the verification of the device unique identifier of the user certificate, it is determined that the user device passes the verification of the device unique identifier, otherwise it is determined that the user device fails to pass the verification of the device unique identifier.

3. The permission control method according to claim 1, characterized in that: Verifying the user device by using the device time includes: Obtaining a valid time list in the server certificate, and reading an authorized time range of an authorized user of the target tool from the valid time list; If it is determined according to the first device unique identifier that the user device is an authorized user recorded in the server certificate, then querying from the valid time list to obtain a first authorized time range corresponding to the first device unique identifier; If the local time of the user device is within the first authorization time range and the local time of the user device is later than the last call time of the user device to the target tool recorded in the user certificate, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time.

4. The permission control method according to claim 1, characterized in that: Also includes: Receive the updated server certificate, and use the updated server certificate to replace the server certificate in the tool set server folder path of the original software; The updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to an update of the local time of the authorized user device of the authorized user.

5. The permission control method according to claim 1, characterized in that: Also includes: When receiving a menu hook command or an access tool server authority control command, reclaiming the user device's authority to use the target tool; The menu mounting command and the access tool server authority control command are commands issued by the server corresponding to the target tool when the number of times the execution of the call command is prohibited for the target tool reaches a threshold of the number of illegal accesses.

6. The permission control method according to claim 1, characterized in that: Also includes: Before using the server certificate and the user certificate to perform authority verification on the call command, decrypt the server certificate using a first key and decrypt the user certificate using a second key to obtain the decrypted server certificate and the decrypted user certificate; If the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; Wherein, the server certificate and the user certificate are both generated by irreversible encryption.

7. The permission control method according to claim 1, characterized in that: Querying the server certificate of the target tool from the file path corresponding to the original software includes: Obtaining a first server certificate from the tool set server folder path of the original software; Query the server certificate from the current user environment variable path of the original software; If the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate; If the server certificate is found in the current user environment variable path, decrypt the server certificate using the first key to obtain the decrypted server certificate; Compare the version number of the decrypted server certificate with the version number of the toolset server change record table, and if they are inconsistent, replace the server certificate under the current user environment variable path with the first server certificate; Querying the user certificate of the target tool from the user directory of the user device includes: Querying the user certificate from the user home directory environment variable path of the user device; Verifying the user device by using the unique device identifier includes: Compare and match the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier; if a match is achieved between the three device unique identifiers, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier; Verifying the user device by using the device time includes: The authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the target tool by the user device recorded in the user certificate, and the local time of the user device are compared and matched; if the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has not passed the verification of the device time.

8. A permission control device, characterized in that: include: The permission control loading unit is used to query the server certificate and user certificate of the target tool in response to the calling command of the user device to the target tool; An authority verification unit, used to verify the use authority of the user device to the target tool by using the server certificate and the user certificate through a unique device identifier and device time; If the first device unique identifier of the user device is queried from both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier, otherwise it is determined that the user device has not passed the verification of the device unique identifier; if the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time, otherwise it is determined that the user device has not passed the verification of the device time; an authority control execution unit, configured to prohibit execution of the calling command if the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time; Wherein, the target tool is a secondary development tool for the original software.

9. A permission control device, characterized in that: include: Memory for storing computer programs; A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the permission control method as claimed in any one of claims 1 to 7 are implemented.

10. A non-volatile storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the permission control method as claimed in any one of claims 1 to 7 are implemented.

Images