A permission control method, device, equipment and non-volatile storage medium

Abstract

The present invention relates to the technical field of software rights management, and specifically discloses a rights control method, apparatus, device, and non-volatile storage medium. In response to a call command from a user device to a secondary development tool, before loading the execution file of the target tool, the server certificate and user certificate of the target tool are first queried, and the user device's permission to use the target tool is verified through the device unique identifier and device time. If the query is not found or the verification fails, the call command is prohibited from being executed, thereby achieving control over the use rights of the secondary development tool. By using a method of matching and verifying the first device unique identifier of the user device, the device unique identifier recorded in the server certificate, and the user certificate, and a method of matching and verifying the local time of the user device, the authorized time range recorded in the server certificate, and the usage time recorded in the user certificate, the difficulty of cracking is increased, thereby achieving effective maintenance of the rights of the secondary development tool.

Description

Technical Field

[0001] The present invention relates to the technical field of software rights management, and in particular to a rights control method, apparatus, device and non-volatile storage medium. Background Art

[0002] With the advancement of technology, various industries have released feature-rich software, which users can access by purchasing and installing on their devices. To achieve this richer functionality, many software programs offer open secondary development interfaces, allowing other software developers to conduct secondary development based on their needs. However, this has led to issues with managing the permissions of secondary development tools. Because many software programs, while offering secondary development interfaces, lack permission management interfaces, the intellectual property rights of secondary development tools cannot be effectively protected. Once installed on a user's device, users can easily crack or copy the tools to illegally and permanently access them.

[0003] How to implement permission control on secondary development tools of software is a technical problem that those skilled in the art need to solve. Summary of the Invention

[0004] The purpose of the present invention is to provide a permission control method, device, equipment and non-volatile storage medium for implementing permission control on secondary development tools of software.

[0005] To solve the above technical problems, the present invention provides a permission control method, comprising:

[0006] In response to a call command from a user device to a target tool, querying a server certificate and a user certificate of the target tool;

[0007] Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through a unique device identifier and device time;

[0008] If the first device unique identifier of the user device is found in both the server certificate and the user certificate, determining that the user device has passed the verification of the device unique identifier; otherwise, determining that the user device has failed the verification of the device unique identifier;

[0009] If the authorized time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the device time verification; otherwise, it is determined that the user device has failed the device time verification;

[0010] If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, executing the call command is prohibited;

[0011] Wherein, the target tool is a secondary development tool for the original software.

[0012] On the one hand, verifying the user device by using the unique device identifier includes:

[0013] Obtaining a user authorization information list in the server certificate, and reading a second device unique identifier of an authorized user of the target tool from the user authorization information list;

[0014] matching the first device unique identifier obtained from the user device with each of the second device unique identifiers; if a match is successful, determining that the user device has passed the verification of the device unique identifier of the server certificate; if no match is found, determining that the user device has failed the verification of the device unique identifier of the server certificate;

[0015] comparing the first device unique identifier with the third device unique identifier recorded in the user certificate; if they are consistent, determining that the user device has passed the verification of the device unique identifier in the user certificate; if they are inconsistent, determining that the user device has failed the verification of the device unique identifier in the user certificate;

[0016] If the user device passes the verification of the device unique identifier of the server certificate and the user device passes the verification of the device unique identifier of the user certificate, it is determined that the user device passes the verification of the device unique identifier; otherwise, it is determined that the user device fails the verification of the device unique identifier.

[0017] On the other hand, verifying the user device by using the device time includes:

[0018] Obtaining a valid time list in the server certificate, and reading an authorized time range of the authorized user of the target tool from the valid time list;

[0019] If it is determined according to the first device unique identifier that the user device is an authorized user recorded in the server certificate, querying from the valid time list to obtain a first authorized time range corresponding to the first device unique identifier;

[0020] If the local time of the user device is within the first authorized time range and the local time of the user device is later than the last call time of the user device to the target tool recorded in the user certificate, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time.

[0021] On the other hand, it also includes:

[0022] Receive the updated server certificate, and use the updated server certificate to replace the server certificate in the tool set server folder path of the original software;

[0023] The updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to an update of the local time of the authorized user device of the authorized user.

[0024] On the other hand, it also includes:

[0025] Upon receiving a menu hook command or an access tool server authority control command, reclaiming the user device's authority to use the target tool;

[0026] The menu hook command and the access tool server authority control command are commands issued by the server corresponding to the target tool when the number of times the target tool is prohibited from executing the call command reaches a threshold number of illegal accesses.

[0027] On the other hand, it also includes:

[0028] Before using the server certificate and the user certificate to perform authority verification on the call command, decrypting the server certificate using a first key and decrypting the user certificate using a second key to obtain the decrypted server certificate and the decrypted user certificate;

[0029] If the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited;

[0030] Wherein, the server certificate and the user certificate are both generated by irreversible encryption.

[0031] On the other hand, querying the server certificate of the target tool from the file path corresponding to the original software includes:

[0032] Obtaining a first server certificate from the tool set server folder path of the original software;

[0033] Query the server certificate from the current user environment variable path of the original software;

[0034] If the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate;

[0035] If the server certificate is found in the current user environment variable path, decrypting the server certificate using the first key to obtain the decrypted server certificate;

[0036] Compare the version number of the decrypted server certificate with the version number of the toolset server change record table. If they are inconsistent, replace the server certificate in the current user environment variable path with the first server certificate.

[0037] Querying the user directory of the user device for the user certificate of the target tool includes:

[0038] Querying the user certificate from the user home directory environment variable path of the user device;

[0039] Verifying the user device by using the unique device identifier includes:

[0040] comparing and matching the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier; if a match is achieved between the three device unique identifiers, determining that the user device has passed the verification of the device unique identifier; otherwise, determining that the user device has failed the verification of the device unique identifier;

[0041] Verifying the user device by using the device time includes:

[0042] The authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the target tool by the user device recorded in the user certificate, and the local time of the user device are compared and matched. If the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time.

[0043] To solve the above technical problems, the present invention further provides a permission control device, comprising:

[0044] an authority control loading unit, configured to query a server certificate and a user certificate of a target tool in response to a call command from a user device to the target tool;

[0045] an authority verification unit, configured to verify the user device's permission to use the target tool by using the server certificate and the user certificate through the device unique identifier and the device time; if the first device unique identifier of the user device is queried from both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier; if the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time;

[0046] an authority control execution unit, configured to prohibit execution of the call command if the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time;

[0047] Wherein, the target tool is a secondary development tool for the original software.

[0048] To solve the above technical problems, the present invention further provides a permission control device, comprising:

[0049] Memory for storing computer programs;

[0050] A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the permission control method as described in any one of the above items are implemented.

[0051] To solve the above technical problems, the present invention further provides a non-volatile storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the permission control method as described in any one of the above items are implemented.

[0052] The permission control method provided by the present invention has the beneficial effect of responding to a call command of a secondary development tool by a user device, and before loading the executable file of the target tool, first querying the server certificate and user certificate of the target tool, and verifying the user device's permission to use the target tool through the device unique identifier and device time. If the query is not found or the verification fails, the call command is prohibited from executing, thereby realizing permission control over the use of the secondary development tool. When verifying through the device unique identifier, a matching verification method is used to match the first device unique identifier of the user device, the server certificate, and the device unique identifier recorded in the user certificate. When verifying through the device time, a matching verification method is used to match the local time of the user device, the authorized time range recorded in the server certificate, and the usage time recorded in the user certificate. This effectively prevents users from cracking the target tool by stealing certificates or modifying device time, thereby realizing effective maintenance of the permissions of the secondary development tool.

[0053] The authority control device, equipment and non-volatile storage medium provided by the present invention have the above-mentioned beneficial effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 A flowchart of a permission control method provided by an embodiment of the present invention;

[0056] Figure 2 A tool authority management interface provided by an embodiment of the present invention;

[0057] Figure 3 A flow chart of certificate management provided by an embodiment of the present invention;

[0058] Figure 4 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention;

[0059] Figure 5 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The core of the present invention is to provide a permission control method, device, equipment and non-volatile storage medium for implementing permission control on the use of secondary development tools of software.

[0061] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0062] Figure 1 A flowchart of a permission control method provided by an embodiment of the present invention.

[0063] like Figure 1 As shown, an embodiment of the present invention provides a permission control method including:

[0064] S101: In response to a call command from a user device to a target tool, query the server certificate and user certificate of the target tool;

[0065] S102: Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through the device's unique identifier and device time;

[0066] S103: If the first device unique identifier of the user device is found in both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier;

[0067] S104: If the authorized time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, then it is determined that the user device has passed the device time verification; otherwise, it is determined that the user device has failed the device time verification;

[0068] S105: If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, the call command is prohibited from being executed.

[0069] Among them, the target tool is a secondary development tool for the original software.

[0070] In a specific implementation, the permission control method provided by the embodiment of the present invention is applied to a user device. The permission control method provided by the embodiment of the present invention can be installed on the user device in the form of an executable file and forced to be loaded before the target tool is loaded. The target tool is allowed to be loaded only after the user device passes the permission to use the target tool.

[0071] In addition, it is necessary to manage all authorized users of the target tool through the server. The permission control method provided in the embodiment of the present invention can be applied to a system including a server and a user device. The number of user devices can be one or more, and in addition to the user devices of authorized users, it may also include user devices of unauthorized users. The permission control method provided in the embodiment of the present invention is used to authorize the user devices of authorized users to use the target tool, and restrict the use of the target tool by the user devices of unauthorized users.

[0072] In the embodiments of the present invention, "original software" refers to software that provides a secondary development interface, and "target tool" refers to a secondary development tool for the original software. For example, the original software may be printed circuit board (PCB) design software, such as Cadence, and the target tool may be a PCB design-aided tool developed using a skill language.

[0073] Regarding S101, responding to a call command of the user device to the target tool may include: monitoring an interface call command of the original software to call an interface of the target tool.

[0074] Server certificates and user certificates can be constructed and maintained through the server certificate module and the user certificate module respectively.

[0075] The server certificate module can be denoted as ToolslicenseModule. The unique address of the authorized user's second device is entered into a list. The unique device identifier used in this embodiment of the present invention can be a Media Access Control Address (MAC). The list of unique addresses of the authorized user's second devices in the server certificate can be denoted as a user authorization information list LicensedList = {mac1, mac2, mac3, ...} and declared as a global private variable. The server certificate must also include the authorization time range for each authorized user. In some optional implementations of this embodiment of the present invention, the authorization time range can be represented by the last valid time, i.e., the authorized user's authorization expiration time. A list of valid times for each authorized user to load the target tool can be added to the server certificate. This list can be denoted as usedeadlineTimeList = {(mac1 UserDeadLine1), (mac2 UserDeadLine2), (mac3 UserDeadLine3), ...}, and each last valid time (DeadLine) can be declared as a global private variable. To maintain updates to the server certificate, the server certificate module must also maintain the server certificate version number (ver).

[0076] In order to manage changes in server certificates, a toolset server change record table can also be provided in the server certificate module, which can be recorded as licenseupdate.XML. The toolset server change record table can include records of each administrator operation, such as the addition of a second device unique address of an authorized user, the expiration of an existing second device unique address, the update time, changes in the version number of the server certificate, etc.

[0077] The user certificate module, referred to as UserlicenseModule, is responsible for generating and maintaining user certificates for authorized users. The user certificate may include the last valid time the authorized user can use the target tool (UserDeadLine, declared as a global private variable), the last time the installed user device called the target tool (ueserlastTime), and the unique identifier of the authorized user's second device (licenseID).

[0078] In order to further improve the security of the target tool and prevent the code from being copied and used, the permission control method provided by the embodiment of the present invention may also include: before using the server certificate and the user certificate to verify the permission of the calling command, using the first key to decrypt the server certificate, and using the second key to decrypt the user certificate to obtain the decrypted server certificate and the decrypted user certificate; if the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; wherein, the server certificate and the user certificate are both generated using irreversible encryption.

[0079] An encryption module (which can be denoted as EncryptModule) can be used to encrypt the server certificate and the user certificate. The server certificate and the user certificate are encrypted using the first key and the second key respectively. After decryption using the key, the server certificate and the user certificate are still in non-plaintext form, further increasing the difficulty for users to crack them.

[0080] The permission control method provided by an embodiment of the present invention may further include: if a server certificate and a user certificate are found, and the user device passes verification of the device's unique identifier and device time, determining that the user of the user device is an authorized user; decrypting the target tool's executable file using a third key to obtain a decrypted executable file; and running the decrypted executable file to execute the call command; wherein the executable file is generated using irreversible encryption. Similarly, an encryption module may also be used to encrypt the target tool's executable file using irreversible encryption to prevent users from cracking the target tool's executable file.

[0081] In order to enable administrators to operate the server certificate module and the user certificate module from the server background, a tool permission management interface can be designed. Figure 2 A tool authority management interface provided by an embodiment of the present invention. Figure 2 As shown, the tool authority management interface provided to the administrator may include a valid unique device identifier entry button, an invalid unique device identifier entry button, an authorized user's authorized usage time entry button, a target tool effective time entry button, etc.

[0082] Figure 3 A flow chart of certificate management provided by an embodiment of the present invention.

[0083] like Figure 3 As shown, in the tool permission management interface, the button entry logic for the server certificate module may include: after clicking the entry button, the code executable file of the server available certificate module (ToolslicenseModule) is automatically generated, where the user authorization information list LicensedList = {mac1, mac2, mac3, ...} is the valid MAC address entered by the administrator, and each entry is added to the list. If an invalid MAC address entry has a value recorded as invalidMax, the corresponding MAC address information equal to invalidMax in the user authorization information list (LicensedList) and the valid time list (LastTimeList) is removed. If no MAC address is found, a prompt is displayed to indicate that the administrator has not found the invalid MAC address, preventing the administrator from entering incorrect information.

[0084] The target tool's validity period can be calculated using the last valid time (DeadLine) and included in the Deadline variable. This variable is updated with each administrator entry to ensure the target tool's validity period is up-to-date and controllable. The last valid time list (usedeadlineTimeList) records the currently entered valid usage time of each MAC address as the UserDeadLine. For example, (mac1 UserDeadLine1) is appended to the last valid time list (usedeadlineTimeList). The version number (ver) is incremented by 1. The initial value can be V1. For example, if the system is modified twice, the version number ver = V1 + 1 = V2.

[0085] In the tool permission management interface, the logic of the button entry of the user certificate module may include: after clicking the entry, the code executable file of the user available certificate module (UserlicenseModule) is automatically generated, where the valid MAC address is counted in the third device unique identifier (licenseID) variable, the current entry time is counted in the last call time (ueserlastTime), and the user's valid usage time is counted in the last valid time (UserDeadLine) variable.

[0086] Update the toolset server change log table (licenseupdate.XML) of the server license module (ToolslicenseModule).

[0087] Call the EncryptModule to encrypt the generated executable code files for the ToolslicenseModule and the UserlicenseModule, using the password pw. The encrypted files are labeled ToolslicenseModuleJM and UserlicenseModuleJM, respectively. The ToolslicenseModuleJM file is automatically placed in the toolset server folder, and the administrator provides the UserlicenseModuleJM to authorized users.

[0088] Based on this, when the user uses the original software through the user device and calls the target tool in the corresponding structure of the original software, the permission control method provided by the embodiment of the present invention can call the permission control module (TimeandMacOFFlinecontrol) to verify the user device. First, the server certificate and user certificate of the target tool are queried, and the user device's permission to use the target tool is verified through the device unique identifier and device time. If the query is not found or the verification fails, the call command is prohibited from being executed, thereby realizing the control of the use permission of the secondary development tool. When verifying through the device unique identifier, the first device unique identifier of the user device, the server certificate, and the device unique identifier recorded in the user certificate are used for matching verification. When verifying through the device time, the local time of the user device, the authorized time range recorded in the server certificate, and the usage time recorded in the user certificate are used for matching verification. This effectively prevents users from cracking the target tool by stealing certificates or modifying device time, thereby realizing the effective maintenance of the permissions of the secondary development tool.

[0089] Based on the above embodiment, the embodiment of the present invention further describes the steps of verifying the user equipment through the unique device identifier.

[0090] In an embodiment of the present invention, verifying the user device through the device unique identifier may include: obtaining a user authorization information list in the server certificate, and reading the second device unique identifier of the authorized user of the target tool from the user authorization information list; matching the first device unique identifier obtained from the user device with each second device unique identifier, and if the match is successful, it is determined that the user device has passed the verification of the device unique identifier of the server certificate; if both fail to match, it is determined that the user device has not passed the verification of the device unique identifier of the server certificate; comparing the first device unique identifier with the third device unique identifier recorded in the user certificate, and if they are consistent, it is determined that the user device has passed the verification of the device unique identifier of the user certificate; if they are inconsistent, it is determined that the user device has not passed the verification of the device unique identifier of the user certificate; if the user device passes the verification of the device unique identifier of the server certificate and the user device passes the verification of the device unique identifier of the user certificate, it is determined that the user device passes the verification of the device unique identifier, otherwise it is determined that the user device has not passed the verification of the device unique identifier.

[0091] In a specific implementation, after obtaining the server certificate, the server certificate can be opened with the first key. After obtaining the user certificate, the user certificate can be opened with the second key.

[0092] The MAC address of the user's device is obtained and compared with the MAC address in the LicensedList in the server certificate. If there is no match, it means that the user does not have permission to use the target tool and is prompted to contact the administrator to activate the permission. If there is a match, the MAC address of the user's device is compared with the MAC address in the user's certificate. If they are equal, the user's device has passed the device unique identification verification. If they are not equal, it means that the certificate used by the user is not their own and they cannot use the target tool.

[0093] Based on the above embodiment, the embodiment of the present invention further describes the steps of verifying the user equipment through the equipment time.

[0094] In an embodiment of the present invention, verifying the user device through device time may include: obtaining a valid time list in the server certificate, and reading the authorized time range of the authorized user of the target tool from the valid time list; if the user device is determined to be an authorized user recorded in the server certificate based on the first device unique identifier, then querying from the valid time list to obtain the first authorized time range corresponding to the first device unique identifier; if the local time of the user device is within the first authorized time range and the local time of the user device is later than the most recent call time of the user device to the target tool recorded in the user certificate, then it is determined that the user device has passed the device time verification, otherwise it is determined that the user device has not passed the device time verification.

[0095] In a specific implementation, after obtaining the server certificate, the server certificate can be opened with the first key. After obtaining the user certificate, the user certificate can be opened with the second key.

[0096] Obtain the user's device's local time (currentTime) and compare it with the last valid time (DeadLine) matched in the user's authorized information list (LicensedList). If the local time is later than the corresponding DeadLine, the user is prompted that the current target tool has been discontinued. If the local time is earlier than the corresponding DeadLine but less than the last call time (ueserlastTime) in the user's certificate, it indicates that the user has tampered with the local time, and the user is prompted that the computer time is incorrect.

[0097] If the local time of the user device is later than the valid usage time (UserDeadLine) of the MAC address corresponding to the server certificate or later than the last call time (ueserlastTime) of the user certificate, the user is prompted that the permission to use the target tool has expired and needs to reapply.

[0098] If the user device passes the device unique identifier and device time verification, the target tool's executable file can be loaded and the last call time (ueserlastTime) in the user certificate is updated to the current time of the user device, while other variables remain unchanged. After the modification, the encryption module (EncryptModule) is called to encrypt the updated user certificate and replace the user certificate in the user directory.

[0099] Based on the above embodiments, the permission control method provided by the embodiments of the present invention may also include: reclaiming the user device's permission to use the target tool when receiving a menu hang-up command or an access tool server permission control command; wherein, the menu hang-up command and the access tool server permission control command are commands issued by the server corresponding to the target tool when the number of prohibited execution call commands for the target tool reaches the illegal access number threshold.

[0100] In an embodiment of the present invention, if the server detects multiple illegal calls to the target tool, i.e., issues a certain number of prohibition commands, this indicates that multiple attempts to infringe the target tool have occurred. To improve the security of the target tool, permissions can be revoked from all authorized users through menu manipulation or by setting access control permissions on the tool server.

[0101] After all user permissions are revoked, the permission verification rules of the target tool can be reset to increase the difficulty for illegal users to crack the target tool. In some optional implementations of the embodiments of the present invention, when the server reissues the permission verification rules of the target tool, it can issue an updated authorized usage time and configure the user device of the authorized user to change the local time to adapt to the updated authorized time.

[0102] The permission control method provided by the embodiment of the present invention may also include: receiving an updated server certificate, and using the updated server certificate to replace the server certificate under the tool set server folder path of the original software; wherein, the updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to the update of the local time of the authorized user's authorized user device.

[0103] The server may update the authorization time range of the authorized user when the number of times the call command is prohibited from being executed reaches a threshold of the number of illegal accesses, or may update the time range periodically.

[0104] On the basis of the above embodiments, in the permission control method provided by the embodiments of the present invention, querying the server certificate of the target tool in S101 may include: obtaining a first server certificate from the toolset server folder path of the original software; querying the server certificate from the current user environment variable path of the original software; if the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate; if the server certificate is found in the current user environment variable path, the server certificate is decrypted using the first key to obtain the decrypted server certificate; the version number of the decrypted server certificate is compared with the version number of the toolset server change record table, and if they are inconsistent, the first server certificate is used to replace the server certificate under the current user environment variable path.

[0105] Querying the user certificate of the target tool in S101 may include querying the user certificate from a user home directory environment variable path of the user device.

[0106] Verifying the user device through the device unique identifier may include: comparing and matching the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier. If a match is achieved between the three device unique identifiers, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier.

[0107] Verifying the user device through device time can include: comparing and matching the authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the user device to the target tool recorded in the user certificate, and the local time of the user device. If the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the device time verification; otherwise, it is determined that the user device has failed the device time verification.

[0108] In the specific implementation, taking the original software as PCB design software and the target tool as a PCB auxiliary design tool as an example, the toolset server folder path is obtained, the server certificate (ToolslicenseModuleJM) is obtained, and it is determined whether the server certificate module exists under the cdsroot environment variable path of the current user. If not, the server certificate under the toolset server folder path is placed under the cdsroot environment variable path of the user. If so, the server certificate is opened with the first key, and the version number of the server certificate is compared with the version number of the toolset server change record table (licenseupdate.XML). If they are inconsistent, the server certificate under the cdsroot environment variable path of the user is automatically replaced with the server certificate in the current toolset server folder path.

[0109] The user places the user certificate (UserlicenseModuleJM) for authorized users using the PCB design tool after the administrator has activated it into the home environment variable path configured by the user. The user certificate is then decrypted using the second key.

[0110] For the remaining steps, please refer to the description of the above embodiment.

[0111] It should be noted that in the embodiments of the permission control method of the present invention, some of the steps or features may be ignored or not executed. The hardware or software functional modules divided for the convenience of description are not the only implementation form of the permission control method provided by the embodiment of the present invention.

[0112] The above describes in detail various embodiments corresponding to the permission control method. On this basis, the present invention also discloses a permission control device, equipment, non-volatile storage medium and computer program product corresponding to the above method.

[0113] Figure 4 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention.

[0114] like Figure 4 As shown, the permission control device provided by the embodiment of the present invention includes:

[0115] The permission control loading unit 401 is used to query the server certificate and user certificate of the target tool in response to the call command of the user device to the target tool;

[0116] The authority verification unit 402 is configured to verify the user device's authority to use the target tool using the server certificate and the user certificate, using the device's unique identifier and the device time; if the first device unique identifier of the user device is found in both the server certificate and the user certificate, the user device is determined to have passed the device unique identifier verification; otherwise, the user device is determined to have failed the device unique identifier verification; if the authorized time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, the user device is determined to have passed the device time verification; otherwise, the user device is determined to have failed the device time verification;

[0117] The permission control execution unit 403 is configured to prohibit execution of the call command if the server certificate or user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time;

[0118] Among them, the target tool is a secondary development tool for the original software.

[0119] The permission control device provided by an embodiment of the present invention may also include a first receiving unit for receiving an updated server certificate and using the updated server certificate to replace the server certificate under the tool set server folder path of the original software; wherein, the updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to the update of the local time of the authorized user's authorized user device.

[0120] The permission control device provided by an embodiment of the present invention may also include a second receiving unit, which is used to reclaim the user device's permission to use the target tool when receiving a menu hang-up command or an access tool server permission control command; wherein, the menu hang-up command and the access tool server permission control command are commands issued by the server corresponding to the target tool when the number of times the execution of the call command for the target tool is prohibited reaches the illegal access number threshold.

[0121] The permission control device provided by an embodiment of the present invention may further include: a decryption unit, which is used to decrypt the server certificate using a first key and decrypt the user certificate using a second key before using the server certificate and the user certificate to perform permission verification on the calling command, to obtain a decrypted server certificate and a decrypted user certificate; if the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; wherein, the server certificate and the user certificate are both generated using an irreversible encryption method.

[0122] It should be noted that in each implementation of the authority control device provided by the embodiment of the present invention, the division of units is only a logical functional division, and other division methods can be adopted. The connection method between different units can adopt electrical, mechanical or other connection methods. The separated units can be located in the same physical location or distributed on multiple network nodes. Each unit can be implemented in the form of hardware or in the form of a software functional unit. That is, according to actual needs, some or all of the units provided in the embodiment of the present invention can be selected and the corresponding connection method or integration method can be adopted to achieve the purpose of the embodiment of the present invention.

[0123] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, and they will not be repeated here.

[0124] Figure 5 A schematic diagram of the structure of a permission control device provided by an embodiment of the present invention.

[0125] like Figure 5 As shown, the permission control device provided by an embodiment of the present invention includes: a memory 510 for storing a computer program 511; a processor 520 for executing the computer program 511, and when the computer program 511 is executed by the processor 520, the steps of the permission control method provided in any of the above embodiments are implemented.

[0126] The processor 520 may include one or more processing cores, such as a 3-core processor or an octa-core processor. The processor 520 may be implemented in at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 520 may also include a main processor and a coprocessor. The main processor is used to process data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 520 may integrate a graphics processing unit (GPU), which is responsible for rendering and drawing content required to be displayed on the display screen. In some embodiments, the processor 520 may also include an artificial intelligence (AI) processor, which is used to handle computational operations related to machine learning.

[0127] The memory 510 may include one or more non-volatile storage media, which may be non-transitory. The memory 510 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 510 is at least used to store the following computer program 511, wherein, after the computer program 511 is loaded and executed by the processor 520, it can implement the relevant steps in the permission control method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 510 may also include an operating system 512 and data 513, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 512 may be Windows or other types of operating systems. The data 513 may include but is not limited to the data involved in the above method.

[0128] In some embodiments, the permission control device may further include a display screen 530 , a power supply 540 , a communication interface 550 , an input / output interface 560 , a sensor 570 , and a communication bus 580 .

[0129] Those skilled in the art will understand that Figure 5 The structure shown in the figure does not constitute a limitation on the permission control device, and may include more or fewer components than shown in the figure.

[0130] The permission control device provided in an embodiment of the present invention includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the steps of the permission control method provided in the above embodiment, and the effect is the same as above.

[0131] An embodiment of the present invention provides a non-volatile storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the permission control method provided in any one of the above embodiments can be implemented.

[0132] The non-volatile storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program code.

[0133] For an introduction to the non-volatile storage medium provided in the embodiment of the present invention, please refer to the above method embodiment, and the effect thereof is the same as the permission control method provided in the embodiment of the present invention, and the present invention will not elaborate on it here.

[0134] An embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the permission control method provided in any one of the above embodiments.

[0135] For an introduction to the computer program product provided by the embodiment of the present invention, please refer to the above method embodiment, and the effect thereof is the same as the permission control method provided by the embodiment of the present invention, and the present invention will not elaborate on it here.

[0136] The above is a detailed introduction to the permission control method, device, equipment and non-volatile storage medium provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the devices, equipment, non-volatile storage media and computer program products disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the present invention.

[0137] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A permission control method, characterized in that: include: In response to a call command from a user device to a target tool, querying a server certificate and a user certificate of the target tool; Using the server certificate and the user certificate, verifying the user device's permission to use the target tool through a unique device identifier and device time; If the first device unique identifier of the user device is found in both the server certificate and the user certificate, determining that the user device has passed the verification of the device unique identifier; otherwise, determining that the user device has failed the verification of the device unique identifier; If the authorized time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the device time verification; otherwise, it is determined that the user device has failed the device time verification; If the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time, executing the call command is prohibited; Wherein, the target tool is a secondary development tool for the original software.

2. The permission control method according to claim 1, characterized in that: Verifying the user device by using the unique device identifier includes: Obtaining a user authorization information list in the server certificate, and reading a second device unique identifier of an authorized user of the target tool from the user authorization information list; matching the first device unique identifier obtained from the user device with each of the second device unique identifiers; if a match is successful, determining that the user device has passed the verification of the device unique identifier of the server certificate; if no match is found, determining that the user device has failed the verification of the device unique identifier of the server certificate; comparing the first device unique identifier with the third device unique identifier recorded in the user certificate; if they are consistent, determining that the user device has passed the verification of the device unique identifier in the user certificate; if they are inconsistent, determining that the user device has failed the verification of the device unique identifier in the user certificate; If the user device passes the verification of the device unique identifier of the server certificate and the user device passes the verification of the device unique identifier of the user certificate, it is determined that the user device passes the verification of the device unique identifier; otherwise, it is determined that the user device fails the verification of the device unique identifier.

3. The permission control method according to claim 1, characterized in that: Verifying the user device by using the device time includes: Obtaining a valid time list in the server certificate, and reading an authorized time range of the authorized user of the target tool from the valid time list; If it is determined according to the first device unique identifier that the user device is an authorized user recorded in the server certificate, querying from the valid time list to obtain a first authorized time range corresponding to the first device unique identifier; If the local time of the user device is within the first authorized time range and the local time of the user device is later than the last call time of the user device to the target tool recorded in the user certificate, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time.

4. The permission control method according to claim 1, wherein: Also includes: Receive the updated server certificate, and use the updated server certificate to replace the server certificate in the tool set server folder path of the original software; The updated content of the updated server certificate is an update of the authorized time range of the authorized user, and the update of the authorized time range of the authorized user corresponds to an update of the local time of the authorized user device of the authorized user.

5. The permission control method according to claim 1, wherein: Also includes: Upon receiving a menu hook command or an access tool server authority control command, reclaiming the user device's authority to use the target tool; The menu hook command and the access tool server authority control command are commands issued by the server corresponding to the target tool when the number of times the target tool is prohibited from executing the call command reaches a threshold number of illegal accesses.

6. The permission control method according to claim 1, characterized in that: Also includes: Before using the server certificate and the user certificate to perform authority verification on the call command, decrypting the server certificate using a first key and decrypting the user certificate using a second key to obtain the decrypted server certificate and the decrypted user certificate; If the server certificate and the user certificate cannot be decrypted, the execution of the calling command is prohibited; Wherein, the server certificate and the user certificate are both generated by irreversible encryption.

7. The permission control method according to claim 1, characterized in that: Querying the server certificate of the target tool from the file path corresponding to the original software includes: Obtaining a first server certificate from the tool set server folder path of the original software; Query the server certificate from the current user environment variable path of the original software; If the server certificate is not found in the current user environment variable path, the first server certificate is placed in the current user environment variable path as the server certificate; If the server certificate is found in the current user environment variable path, decrypting the server certificate using the first key to obtain the decrypted server certificate; Compare the version number of the decrypted server certificate with the version number of the toolset server change record table. If they are inconsistent, replace the server certificate in the current user environment variable path with the first server certificate. Querying the user directory of the user device for the user certificate of the target tool includes: Querying the user certificate from the user home directory environment variable path of the user device; Verifying the user device by using the unique device identifier includes: comparing and matching the second unique identifier of the authorized user recorded in the user authorization information list in the server certificate, the third unique identifier in the user certificate, and the first device unique identifier; if a match is achieved between the three device unique identifiers, determining that the user device has passed the verification of the device unique identifier; otherwise, determining that the user device has failed the verification of the device unique identifier; Verifying the user device by using the device time includes: The authorized time range of the authorized user recorded in the valid time list in the server certificate, the last call time of the target tool by the user device recorded in the user certificate, and the local time of the user device are compared and matched. If the local time is within the authorized time range and the local time is later than the last call time, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time.

8. A permission control device, characterized in that: include: an authority control loading unit, configured to query a server certificate and a user certificate of a target tool in response to a call command from a user device to the target tool; an authority verification unit, configured to verify the user device's authority to use the target tool by using the server certificate and the user certificate and through a unique device identifier and device time; If the first device unique identifier of the user device is queried from both the server certificate and the user certificate, it is determined that the user device has passed the verification of the device unique identifier; otherwise, it is determined that the user device has failed the verification of the device unique identifier; if the authorization time range corresponding to the first device unique identifier recorded in the server certificate, the usage time corresponding to the first device unique identifier recorded in the user certificate, and the local time of the user device match, it is determined that the user device has passed the verification of the device time; otherwise, it is determined that the user device has failed the verification of the device time; an authority control execution unit, configured to prohibit execution of the call command if the server certificate or the user certificate is not found, or the user device fails to pass the verification of the device unique identifier, or the user device fails to pass the verification of the device time; Wherein, the target tool is a secondary development tool for the original software.

9. A permission control device, characterized in that: include: memory for storing computer programs; A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the permission control method according to any one of claims 1 to 7 are implemented.

10. A non-volatile storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the permission control method according to any one of claims 1 to 7 are implemented.

Images