Permission verification method and device for application software, equipment and storage medium

Abstract

The invention discloses a permission verification method, device and equipment for application software and a storage medium, and the method comprises the steps: responding to a software starting instruction for an application software client, and detecting whether a target authorization file for authorizing the application software client is stored under a virtual machine system directory or not; if yes, sending the target authorization file to an authorization management center for authority verification; if a verification passing response fed back by the authorization management center is received, the application software client is normally started to provide an application software service; in the running process of the application software client, a heartbeat data packet is sent to the authorization management center regularly, so that the authorization management center performs authority monitoring on the application software client according to timestamp information or IP address information in the heartbeat data packet; the authorized application software mirror image is prevented from being copied to an external field environment by a client user for random use, and legitimate rights and interests of software developers are maintained.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and storage medium for verifying the permissions of application software. Background Art

[0002] At present, in order to safeguard the legitimate rights and interests of software developers and prevent users of application software from obtaining the right to use the application software in illegal ways, it is usually necessary to verify the permissions of the application software.

[0003] In the prior art, permission verification of application software is usually performed through hardware information of the physical device on which the application software is currently running or a smart password key (ie, a physical Ukey).

[0004] However, since the virtual machine allows users to copy and modify the virtual machine's hardware information, client users can easily create multiple virtual machine copies with the same hardware characteristics, thereby copying the authorized application software image to the virtual machine copy for arbitrary use, which seriously infringes on the legitimate rights and interests of application software developers. Secondly, since the physical Ukey is originally designed to be bound to physical hardware and cannot be simply integrated into the virtual machine architecture, it is difficult for the physical Ukey to verify the permissions of application software installed in the virtual environment. Summary of the invention

[0005] The present invention provides an application software permission verification method, device, equipment and storage medium, which can prevent authorized application software images from being copied by client users to an external environment for arbitrary use, thereby safeguarding the legitimate rights and interests of software developers.

[0006] In a first aspect, an embodiment of the present invention provides a method for verifying the permissions of an application software, which is executed by an application software client installed in a virtual machine, and the method includes:

[0007] In response to a software startup instruction for the application software client, detecting whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory;

[0008] If yes, the target authorization file is sent to the authorization management center for authorization verification;

[0009] If a verification pass response is received from the authorization management center, the application software client is started normally to provide application software services;

[0010] During the operation of the application software client, a heartbeat data packet is periodically sent to the authorization management center so that the authorization management center can monitor the permissions of the application software client based on the timestamp information or IP address information in the heartbeat data packet.

[0011] Optionally, after detecting whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory, it also includes: if not, generating a client user requirement description interface for display, so that the client user can input and submit the requirement description information; requesting hardware identification information from the virtual machine, and building an authorization request based on the requirement description information and the hardware identification information fed back by the virtual machine, and sending the authorization request to an authorization management center; upon receiving the target authorization file fed back by the authorization management center in response to the authorization request, verifying the target authorization file; after the verification is passed, starting the application software client normally to provide application software services, and storing the target authorization file in the virtual machine system directory.

[0012] Optionally, verifying the target authorization file includes: extracting the hardware identification information to be verified in the target authorization file, requesting the actual hardware identification information from the virtual machine, and comparing the hardware identification information to be verified with the actual hardware identification information; and before storing the target authorization file in the virtual machine system directory, also includes: setting the client user's operating permissions for the target authorization file to prohibit access and prohibit modification.

[0013] In a second aspect, an embodiment of the present invention further provides a method for verifying the permissions of application software, which is executed by an authorization management center, and the method includes:

[0014] Upon receiving a permission verification request sent by a target application software client to be verified, extracting target hardware identification information of a virtual machine to which the target application software client belongs and a target authorization file contained in the permission verification request;

[0015] Extracting the hardware identification information to be verified from the target authorization file, and comparing the hardware identification information to be verified with the target hardware identification information;

[0016] If the comparison is successful, a verification success response is fed back to the target application software client, so that the target application software client can normally start the application software client to provide application software services;

[0017] The target application software client periodically receives the heartbeat data packets sent periodically during operation, and performs permission monitoring on the target application software client according to the timestamp information or IP address information in the heartbeat data packets.

[0018] Optionally, permission monitoring is performed on the target application software client based on the timestamp information in the heartbeat data packet, including: regularly obtaining each first heartbeat data packet belonging to the target application software client based on the hardware identification information contained in the heartbeat data packet, and obtaining the timestamp information in each first heartbeat data packet; if it is determined that the timestamp information in the first heartbeat data packet currently obtained is earlier than the timestamp information of any historical first heartbeat data packet, then sending a time anomaly prompt message to the target application software client to which the first heartbeat data packet currently obtained belongs.

[0019] Optionally, the target application software client is monitored for permissions based on the IP address information in the heartbeat data packet, including: obtaining each monitoring heartbeat data packet received within a preset monitoring period; obtaining each second heartbeat data packet belonging to the target application software client based on the hardware identification information contained in the monitoring heartbeat data packet, and obtaining the IP address information in each second heartbeat data packet; if it is determined that each IP address information contains multiple different IP addresses, obtaining the target IP address corresponding to the second heartbeat data packet received earliest within the monitoring time; among the multiple different IP addresses, obtaining abnormal IP addresses other than the target IP address; and sending a stop operation control instruction to each target application software client pointed to by each abnormal IP address to shut down each target application software client pointed to by each abnormal IP address.

[0020] In a third aspect, an embodiment of the present invention further provides a permission verification device for application software, which is configured in an application software client in a virtual machine, and the device includes:

[0021] An authorization file detection module is used to detect whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory in response to a software startup instruction for the application software client;

[0022] The authorization file sending module is used to send the target authorization file to the authorization management center for authority verification;

[0023] The application service startup module is used to normally start the application software client to provide application software services if a verification pass response fed back by the authorization management center is received;

[0024] The periodic verification module is used to periodically send heartbeat data packets to the authorization management center during the operation of the application software client, so that the authorization management center can monitor the permissions of the application software client based on the timestamp information or IP address information in the heartbeat data packet.

[0025] In a fourth aspect, an embodiment of the present invention further provides a permission verification device for application software, which is configured in an authorization management center, and the device includes:

[0026] The information receiving module is used to extract the target hardware identification information of the virtual machine to which the target application software client belongs and the target authorization file contained in the permission verification request when receiving the permission verification request sent by the target application software client to be verified;

[0027] An information comparison module is used to extract the hardware identification information to be verified from the target authorization file, and compare the hardware identification information to be verified with the target hardware identification information;

[0028] The verification result feedback module is used to feedback a verification result response to the target application software client if the comparison is passed, so that the target application software client can normally start the application software client to provide application software services;

[0029] The permission monitoring module is used to periodically receive heartbeat data packets sent periodically by the target application software client during operation, and monitor the permissions of the target application software client based on the timestamp information or IP address information in the heartbeat data packets.

[0030] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the permission verification method for the application software provided by any embodiment of the present invention.

[0031] In a sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the permission verification method for application software provided by any embodiment of the present invention when executed.

[0032] The technical solution provided by the embodiment of the present invention solves the problem that the hardware information of the virtual machine can be easily modified or copied, which causes the existing method of verifying permissions through the hardware information of the physical device to fail, and the authorized application software image can be copied by the client user to the field environment for arbitrary use, by sending the target authorization file to the authorization management center for permission verification, thereby safeguarding the legitimate rights and interests of the application software developer. Secondly, by regularly sending heartbeat data packets to the authorization management center, the authorization management center can monitor the permissions of the application software client according to the timestamp information or IP address information in the heartbeat data packet, and the permission of the running application software client can be monitored, further enhancing the protection capability of software authorization.

[0033] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 is a flowchart of a method for verifying the permissions of application software provided in accordance with Embodiment 1 of the present invention;

[0036] Figure 2 is a schematic diagram of interaction between an application software client and an authorization management center provided according to an embodiment of the present invention;

[0037] Figure 3 is a flowchart of a method for verifying the permissions of application software provided according to Embodiment 2 of the present invention;

[0038] Figure 4 is a schematic diagram of the structure of an authorization management center provided according to an embodiment of the present invention;

[0039] Figure 5 This is a schematic diagram of the structure of a permission verification device for application software provided according to Embodiment 3 of the present invention;

[0040] Figure 6 This is a schematic diagram of the structure of a permission verification device for application software provided according to a fourth embodiment of the present invention;

[0041] Figure 7 It is a schematic diagram of the structure of an electronic device provided by Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] Embodiment 1

[0045] Figure 1 It is a flowchart of a method for verifying the permissions of an application software provided according to the first embodiment of the present invention. This embodiment is applicable to the situation where permissions are verified for an application software client installed in a virtual machine. The method can be executed by a permission verification device for the application software. The permission verification device for the application software can be implemented in the form of hardware and / or software. The permission verification device for the application software can be configured in an electronic device such as a computer.

[0046] like Figure 1 As shown, a permission verification method for application software disclosed in this embodiment is executed by an application software client installed in a virtual machine, and the method includes:

[0047] S110 . In response to a software startup instruction for an application software client, detecting whether a target authorization file for authorizing the application software client is stored in a system directory of the virtual machine.

[0048] The application software client may be a software client that needs to be authenticated. The target authorization file may include hardware identification information of the virtual machine and authorization timestamp, etc. Specifically, the authorization timestamp may be a timestamp generated when the authorization management center first authorizes the application software client.

[0049] In this step, specifically, after receiving the software startup instruction for the application software client, it can be detected whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory.

[0050] S120: If a target authorization file for authorizing the application software client is stored in the virtual machine system directory, the target authorization file is sent to the authorization management center for authority verification.

[0051] In this step, specifically, the target authorization file can be encrypted and transmitted to the authorization management center through a secure channel. There can be multiple encryption protocols used in the target authorization file transmission process, such as Secure Socket Layer (SSL) protocol.

[0052] In an optional implementation of an embodiment of the present invention, after detecting whether a target authorization file for authorizing an application software client is stored in the system directory of the virtual machine, it also includes: if the target authorization file for authorizing the application software client is not stored in the system directory of the virtual machine, generating a client user requirement description interface for display, so that the client user can input and submit the requirement description information; requesting hardware identification information from the virtual machine, and constructing an authorization request based on the requirement description information and the hardware identification information fed back by the virtual machine, and sending the authorization request to an authorization management center; upon receiving the target authorization file fed back by the authorization management center in response to the authorization request, verifying the target authorization file; after the verification is passed, starting the application software client normally to provide application software services, and storing the target authorization file in the system directory of the virtual machine.

[0053] The client user requirement description interface may include at least one requirement description item that the client user can fill in or select. The requirement description information may include user name, user role, application time, application permission, contact information, and application reason. The hardware identification information may include the virtual machine's Media Access Control Address (MAC address) and hard disk serial number.

[0054] Specifically, the requirement description item can be filled in or selected on the client user requirement description interface to obtain the requirement description information. Then, after sending an authorization request to the authorization management center based on the requirement description information and the hardware identification information, it can be determined whether the target authorization file fed back by the authorization management center has been received. If the target authorization file fed back by the authorization management center is not received within the timeout period, the authorization failure prompt message is displayed to the client user, and the client user requirement description interface is displayed to the client user again, so that the client user can re-apply for authorization. If the target authorization file fed back by the authorization management center in response to the authorization request is received, the target authorization file is decrypted using a pre-stored key to obtain the hardware identification information to be verified, the authorization status, the authorization start time, and the authorization end time in the target authorization file. Then, the actual hardware identification information can be requested from the virtual machine, and the validity of the target authorization file can be verified based on the hardware identification information to be verified, the actual hardware identification information, the authorization status, the authorization start time, and the authorization end time.

[0055] Exemplarily, if the hardware identification information to be verified is consistent with the actual hardware identification information, and the authorization status is authorized, and the current time is between the authorization start time and the authorization end time, and the difference between the current time and the authorization end time is less than or equal to the upper limit of the remaining authorization time, then the target authorization file is determined to be valid. If the hardware identification information to be verified is inconsistent with the actual hardware identification information, or the authorization status is unauthorized, or the current time is not between the authorization start time and the authorization end time, or the difference between the current time and the authorization end time is greater than the upper limit of the remaining authorization time, then the application software client is stopped from starting, and an abnormal prompt is displayed to the client user.

[0056] Optionally, before storing the target authorization file in the virtual machine system directory, the method further includes: setting the client user's operation permission on the target authorization file to prohibit access and prohibit modification.

[0057] Specifically, the client user's operation authority for the target authorization file can be set to prohibit access and prohibit modification through the application programming interface (Application Programming Interface, API) of the operating system on the virtual machine.

[0058] The above technical solution, by setting the client user's operating permissions for the target authorization file to prohibit access and prohibit modification, can prevent the client user from modifying the hardware description information of the virtual machine according to the hardware identification information to be verified in the target authorization file, or modifying the target authorization file according to the hardware description information of the virtual machine, thereby avoiding the unlimited copying and use of a single authorized application software client.

[0059] Optionally, the Network Time Protocol (NTP) can be used to synchronize the time of the application software client with the time of the authorization management center to ensure the accuracy of the time of the application software client. Then, the current application software client time and the historical application software client time can be compared regularly. If the current application software client time is less than the historical application software client time, it is considered that the time of the application software client is dialed back, and the application software service can be stopped to the client user.

[0060] The above technical solution can ensure the time accuracy of the software running environment and the time validity of the target authorization file by synchronizing the time of the application software client with the time of the authorization management center. Secondly, by regularly checking the time of the application software client, it prevents the client user from extending the trial period or validity period of the application software client by adjusting the time of the application software client, thus safeguarding the legitimate rights and interests of the application software developer.

[0061] S130: If a verification pass response is received from the authorization management center, the application software client is started normally to provide application software services.

[0062] In this step, specifically, after the target authorization file is sent to the authorization management center for authority verification, if a verification pass response fed back by the authorization management center is received, the application software client is normally started to provide application software services.

[0063] S140. During the operation of the application software client, a heartbeat data packet is periodically sent to the authorization management center, so that the authorization management center can monitor the authority of the application software client according to the timestamp information or IP address information in the heartbeat data packet.

[0064] In this step, specifically, the timestamp information and IP address information of the application software client can be monitored in real time, and a heartbeat data packet containing the timestamp information and / or IP address information can be sent to the authorization management center at regular intervals.

[0065] Figure 2 FIG. 1 is a schematic diagram of an application software client interacting with an authorization management center according to an embodiment of the present invention. Figure 2 As shown, the relationship between the application software client and the authorization management center can be many-to-one, that is, one authorization management center can perform authorization and authority verification on multiple application software clients.

[0066] The technical solution of this embodiment detects whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory in response to a software startup instruction to the application software client; if so, the target authorization file is sent to the authorization management center for permission verification; if a verification pass response is received from the authorization management center, the application software client is started normally to provide application software services; during the operation of the application software client, a heartbeat data packet is periodically sent to the authorization management center for the authorization management center to monitor the application software client's permissions based on the timestamp information or IP address information in the heartbeat data packet. This technical means solves the problem that the hardware information of the virtual machine can be easily modified or copied, resulting in the failure of the existing method of performing permission verification through the hardware information of the physical device, and the authorized application software image can be copied by the client user to the external environment for arbitrary use, thereby safeguarding the legitimate rights and interests of the application software developer.

[0067] Embodiment 2

[0068] Figure 3It is a flowchart of a method for verifying the permissions of an application software provided according to the second embodiment of the present invention. This embodiment is applicable to the situation where permissions are verified for an application software client installed in a virtual machine. The method can be executed by a permission verification device for the application software. The permission verification device for the application software can be implemented in the form of hardware and / or software. The permission verification device for the application software can be configured in an electronic device such as a computer.

[0069] like Figure 3 As shown, the present embodiment discloses a method for verifying the permissions of application software, which is executed by an authorization management center. The method includes:

[0070] S210: When receiving a permission verification request sent by a target application software client to be verified, extract the target hardware identification information of the virtual machine to which the target application software client belongs and the target authorization file contained in the permission verification request.

[0071] In this embodiment, the target hardware identification information may include a target MAC address and a target hard disk serial number of a virtual machine to which the target application software client belongs.

[0072] S220: extract the hardware identification information to be verified from the target authorization file, and compare the hardware identification information to be verified with the target hardware identification information.

[0073] Exemplarily, the MAC address to be verified and the hard disk serial number to be verified in the hardware identification information to be verified can be obtained, and the target MAC address is compared with the MAC address to be verified, and the target hard disk serial number is compared with the hard disk serial number to be verified.

[0074] S230: If the comparison is successful, a verification success response is fed back to the target application software client, so that the target application software client can normally start the application software client to provide application software services.

[0075] Specifically, if the comparison fails, a verification failure response is fed back to the target application software client, so that the target application software client stops starting.

[0076] Continuing with the above example, if the target MAC address is the same as the MAC address to be verified, and the target hard disk serial number is the same as the hard disk serial number to be verified, it can be considered that the comparison is successful, and a verification success response can be fed back to the target application software client.

[0077] Optionally, when receiving an authorization request sent by a target application software client, a target authorization file can be generated according to the requirement description information in the authorization request, the hardware identification information fed back by the virtual machine, and the timestamp information generated in real time (i.e., the authorization timestamp). Then, the target authorization file can be encrypted by a preset encryption algorithm, and the encrypted target authorization file can be sent to the target application software client. There can be multiple preset encryption algorithms, such as a block encryption algorithm.

[0078] The above technical solution generates a target authorization file through the authorization request sent by the target application software client, which can provide a basis for the subsequent permission verification when the target application software client is started. Secondly, the target authorization file is encrypted by a preset encryption algorithm to ensure the physical isolation and logical security of the key. Finally, the key exposure risk can be reduced by randomly generating, regularly rotating and securely destroying the key used to encrypt the target authorization file.

[0079] S240, regularly receiving heartbeat data packets regularly sent by the target application software client during operation, and monitoring the permissions of the target application software client according to the timestamp information or IP address information in the heartbeat data packets.

[0080] In this step, specifically, hardware identification information, timestamp information and IP address information can be extracted from each heartbeat data packet belonging to the target application software client. Then, the target application software client can be monitored for permissions based on the comparison results of different timestamp information. Alternatively, each IP address information corresponding to the same hardware identification information can be obtained, and the permission monitoring of the target application software client can be achieved by comparing the IP addresses in the above IP address information.

[0081] In an optional implementation of an embodiment of the present invention, permission monitoring is performed on a target application software client based on the timestamp information in a heartbeat data packet, including: regularly obtaining each first heartbeat data packet belonging to the target application software client based on the hardware identification information contained in the heartbeat data packet, and obtaining the timestamp information in each first heartbeat data packet; if it is determined that the timestamp information in the first heartbeat data packet currently obtained is earlier than the timestamp information of any historical first heartbeat data packet, then sending a time anomaly prompt message to the target application software client to which the first heartbeat data packet currently obtained belongs.

[0082] Specifically, the timestamp information in the currently acquired first heartbeat data packet can be compared with the timestamp information of any historical first heartbeat data packet. If it is determined that the timestamp information in the currently acquired first heartbeat data packet is earlier than the timestamp information of any historical first heartbeat data packet, then the provision of application software services to the target application software client to which the currently acquired first heartbeat data packet belongs can be stopped.

[0083] The above technical solution can respond to any time tampering behavior in a timely manner and protect the timeliness of the target authorization file by comparing the timestamp information in the first heartbeat data packet.

[0084] In another optional implementation of the embodiment of the present invention, permission monitoring is performed on the target application software client based on the IP address information in the heartbeat data packet, including: obtaining each monitoring heartbeat data packet received within a preset monitoring period; obtaining each second heartbeat data packet belonging to the target application software client based on the hardware identification information contained in the monitoring heartbeat data packet, and obtaining the IP address information in each second heartbeat data packet; if it is determined that each IP address information contains multiple different IP addresses, obtaining the target IP address corresponding to the second heartbeat data packet received earliest within the monitoring time; among the multiple different IP addresses, obtaining abnormal IP addresses other than the target IP address; and sending a stop operation control instruction to each target application software client pointed to by each abnormal IP address to shut down each target application software client pointed to by each abnormal IP address.

[0085] The second heartbeat data packet may be a monitoring heartbeat data packet containing the same hardware identification information. The abnormal IP address may be an IP address corresponding to an unauthorized target application software client.

[0086] Specifically, the hardware identification information of the target application software client can be compared with the hardware identification information contained in the monitoring heartbeat data packet to determine the second heartbeat data packet belonging to the target application software client. Then, the IP addresses corresponding to the second heartbeat data packets can be obtained, and when the IP addresses are inconsistent, a stop operation control instruction is sent to each target application software client pointed to by the abnormal IP address in each IP address.

[0087] For example, assuming that the preset monitoring period is 10 seconds, and two second heartbeat signal packets are received within 10 seconds, and two different IP addresses are extracted from the above two second heartbeat signal packets, the IP address received later can be used as an abnormal IP address, and a stop operation control instruction can be sent to each target application software client pointed to by the abnormal IP address to shut down each target application software client pointed to by each abnormal IP address.

[0088] The above technical scheme, since the IP addresses of the target application software clients installed in different virtual machines are different, the technical scheme of this embodiment monitors the permissions of the target application software clients through the IP address information in the heartbeat data packet, prevents multiple IP accesses under the same authorization information, avoids the situation where an authorized application software client is illegally copied by the client user to the external environment for arbitrary use, and protects the legitimate rights and interests of the software developer.

[0089] The technical solution of this embodiment is to extract the target hardware identification information of the virtual machine to which the target application software client belongs and the target authorization file contained in the authorization verification request when receiving the authorization verification request sent by the target application software client to be verified; extract the hardware identification information to be verified in the target authorization file, and compare the hardware identification information to be verified with the target hardware identification information; if the comparison is passed, feedback the verification pass response to the target application software client so that the target application software client can normally start the application software client to provide application software services; regularly receive the heartbeat data packet regularly sent by the target application software client during operation, and perform the technical means of authority monitoring on the target application software client according to the timestamp information or IP address information in the heartbeat data packet, which solves the problem that the hardware information of the virtual machine can be easily modified or copied, resulting in the failure of the existing method of authority verification through the hardware information of the physical device, and the authorized application software image can be copied by the client user to the field environment for arbitrary use. Secondly, by monitoring the authority of the target application software client according to the timestamp information or IP address information in the heartbeat data packet, the authority of the running application software client can be monitored, further enhancing the protection capability of software authorization.

[0090] Figure 4 It is a structural diagram of an authorization management center provided according to an embodiment of the present invention.

[0091] Based on the above embodiments, the present invention also provides a schematic diagram of the structure of an authorization management center for implementing the above embodiments. Figure 4 As shown, the authorization management center includes a dynamic authorization generation subsystem, an encryption processing and key management subsystem, a real-time monitoring and response subsystem, a permission verification subsystem, an intelligent decision-making and automated execution subsystem, and an audit and log management subsystem. Specifically, the dynamic authorization generation subsystem is used to receive the authorization request sent by the application software client, extract the requirement description information and hardware identification information in the authorization request, and generate the target authorization file according to the requirement description information, hardware identification information, authorization timestamp and authorization menu. Among them, the authorization menu includes the authorization status, authorization start time, authorization end time and functional permissions corresponding to the requirement description information. The encryption processing and key management subsystem can be used to encrypt the target authorization file using a block encryption algorithm, and store the key used to encrypt the target authorization file in an encryption database to ensure the physical isolation and logical security of the key. The real-time monitoring and response subsystem is used to regularly receive the heartbeat data packet regularly sent by the target application software client during operation, and monitor the permissions of the target application software client according to the timestamp information or IP address information in the heartbeat data packet.

[0092] The permission verification subsystem is used to extract the target hardware identification information of the virtual machine to which the target application software client belongs and the target authorization file contained in the permission verification request when receiving the permission verification request sent by the target application software client to be verified. Then, according to the comparison result of the hardware identification information to be verified and the target hardware identification information in the target authorization file, a verification pass response or a verification fail response can be fed back to the application software client. The intelligent decision-making and automated execution subsystem includes a decision logic engine and an automated executor. Among them, the decision logic engine is used to comprehensively evaluate the authorization verification results, time verification status and network behavior according to preset rules, and automatically generate security response decision instructions according to the comprehensive evaluation results. The automated executor is used to realize the non-delayed execution of security response decision instructions to improve response speed and management efficiency. The above-mentioned security response decision instructions include authorization approval, permission upgrade and downgrade, and emergency blockade. The audit and log management subsystem includes a log collector and an audit analysis tool. Among them, the log collector is used to record all authorization-related events to ensure data integrity. The above-mentioned authorization-related events include authorization application, verification process, exception handling and system operation. The audit analysis tool is used to provide authorized management center users with log query, data analysis, and report generation options, providing a basis for historical tracing, compliance checking, and security auditing.

[0093] Embodiment 3

[0094] Figure 5 FIG. 1 is a schematic diagram of a structure of an application software permission verification device according to Embodiment 3 of the present invention. Figure 5 As shown, the device is configured in the application software client in the virtual machine, including: an authorization file detection module 51, an authorization file sending module 52, an application service startup module 53 and a periodic verification module 54, wherein:

[0095] The authorization file detection module 51 is used to detect whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory in response to a software startup instruction for the application software client;

[0096] The authorization file sending module 52 is used to send the target authorization file to the authorization management center for authority verification;

[0097] The application service startup module 53 is used to normally start the application software client to provide application software services if a verification pass response fed back by the authorization management center is received;

[0098] The periodic verification module 54 is used to periodically send heartbeat data packets to the authorization management center during the operation of the application software client, so that the authorization management center can monitor the permissions of the application software client according to the timestamp information or IP address information in the heartbeat data packets.

[0099] The technical solution in this embodiment, through the mutual cooperation of the authorization file detection module, the authorization file sending module, the application service startup module and the periodic verification module, solves the problem that the hardware information of the virtual machine can be easily modified or copied, resulting in the failure of the existing method of verifying permissions through the hardware information of the physical device, and the authorized application software image can be copied by the client user to the off-site environment for arbitrary use, thereby safeguarding the legitimate rights and interests of the application software developers.

[0100] Optionally, the device further includes an authorization request module, which is used to:

[0101] If not, a client user demand description interface is generated for display so that the client user can input and submit the demand description information; the hardware identification information is requested from the virtual machine, and an authorization request is constructed based on the demand description information and the hardware identification information fed back by the virtual machine, and the authorization request is sent to the authorization management center; upon receiving the target authorization file fed back by the authorization management center in response to the authorization request, the target authorization file is verified; after the verification is passed, the application software client is started normally to provide application software services, and the target authorization file is stored in the virtual machine system directory.

[0102] Optionally, verifying the target authorization file includes: extracting the hardware identification information to be verified in the target authorization file, requesting the actual hardware identification information from the virtual machine, and comparing the hardware identification information to be verified with the actual hardware identification information; and before storing the target authorization file in the virtual machine system directory, also includes: setting the client user's operating permissions for the target authorization file to prohibit access and prohibit modification.

[0103] The permission verification device for application software provided in the embodiment of the present invention can execute the permission verification method for application software provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not described in detail in this embodiment, reference can be made to the description in any method embodiment of this application.

[0104] Embodiment 4

[0105] Figure 6 FIG. 4 is a schematic diagram of a structure of an application software permission verification device according to a fourth embodiment of the present invention. Figure 6 As shown, the device is configured in the authorization management center, including: an information receiving module 61, an information comparison module 62, a verification result feedback module 63 and an authority monitoring module 64, wherein:

[0106] The information receiving module 61 is used to extract the target hardware identification information of the virtual machine to which the target application software client belongs and the target authorization file contained in the permission verification request when receiving the permission verification request sent by the target application software client to be verified;

[0107] An information comparison module 62 is used to extract the hardware identification information to be verified from the target authorization file, and compare the hardware identification information to be verified with the target hardware identification information;

[0108] The verification result feedback module 63 is used to feedback a verification result response to the target application software client if the comparison is passed, so that the target application software client can normally start the application software client to provide application software services;

[0109] The authority monitoring module 64 is used to periodically receive heartbeat data packets periodically sent by the target application software client during operation, and monitor the authority of the target application software client according to the timestamp information or IP address information in the heartbeat data packets.

[0110] The technical solution in this embodiment, through the mutual cooperation of the information receiving module, the information comparison module, the verification result feedback module and the permission monitoring module, solves the problem that the hardware information of the virtual machine can be easily modified or copied, resulting in the failure of the existing method of permission verification through the hardware information of the physical device, and the authorized application software image can be copied by the client user to the off-site environment for arbitrary use. It can monitor the permissions of the running application software client, further enhancing the protection capability of software authorization.

[0111] Optionally, the authority monitoring module 64 includes:

[0112] A timestamp information acquisition unit, used to periodically acquire each first heartbeat data packet belonging to the target application software client according to the hardware identification information contained in the heartbeat data packet, and acquire the timestamp information in each first heartbeat data packet;

[0113] A timestamp information comparison unit is used to send time anomaly prompt information to the target application software client to which the currently acquired first heartbeat data packet belongs if it is determined that the timestamp information in the currently acquired first heartbeat data packet is earlier than the timestamp information of any historical first heartbeat data packet;

[0114] A monitoring heartbeat data packet acquisition unit, used to acquire each monitoring heartbeat data packet received within a preset monitoring period;

[0115] An IP address information acquisition unit, used to acquire each second heartbeat data packet belonging to the target application software client according to the hardware identification information contained in the monitoring heartbeat data packet, and acquire the IP address information in each second heartbeat data packet;

[0116] A target IP address acquisition unit, for acquiring a target IP address corresponding to the second heartbeat data packet received earliest within the monitoring time if it is determined that each IP address information contains a plurality of different IP addresses;

[0117] An abnormal IP address acquisition unit is used to acquire abnormal IP addresses other than the target IP address from a plurality of different IP addresses;

[0118] The stop operation instruction sending unit is used to send a stop operation control instruction to each target application software client pointed to by each abnormal IP address, so as to shut down each target application software client pointed to by each abnormal IP address.

[0119] The permission verification device for application software provided in the embodiment of the present invention can execute the permission verification method for application software provided in any embodiment 2 of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not described in detail in this embodiment, reference can be made to the description in any method embodiment of this application.

[0120] Embodiment 5

[0121] Figure 7 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown.

[0122] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0123] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0124] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the permission verification method of the application software.

[0125] In some embodiments, the permission verification method of the application software may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the permission verification method of the application software described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the permission verification method of the application software in any other appropriate manner (e.g., by means of firmware).

[0126] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0127] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0128] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0129] To provide interaction with a client user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the client user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the client user can provide input to the electronic device. Other types of devices may also be used to provide interaction with a client user; for example, the feedback provided to the client user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the client user may be received in any form (including acoustic input, voice input, or tactile input).

[0130] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a client user computer with a graphical client user interface or a web browser through which a client user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0131] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0132] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0133] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for verifying the permissions of application software, characterized in that: The method is executed by an application software client installed in a virtual machine, and includes: In response to a software startup instruction for an application software client, detecting whether a target authorization file for authorizing the application software client is stored in a virtual machine system directory; If yes, the target authorization file is sent to the authorization management center for authority verification; If a verification pass response is received from the authorization management center, the application software client is started normally to provide application software services; During the operation of the application software client, a heartbeat data packet is periodically sent to the authorization management center, so that the authorization management center can monitor the authority of the application software client according to the timestamp information or IP address information in the heartbeat data packet.

2. The method according to claim 1, characterized in that After detecting whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory, the method further includes: If not, a client user requirement description interface is generated for display, so that the client user can input and submit the requirement description information; Requesting hardware identification information from the virtual machine, constructing an authorization request according to the requirement description information and the hardware identification information fed back by the virtual machine, and sending the authorization request to the authorization management center; Upon receiving the target authorization file fed back by the authorization management center in response to the authorization request, verifying the target authorization file; After the verification is passed, the application software client is started normally to provide application software services, and the target authorization file is stored in the virtual machine system directory.

3. The method according to claim 2, characterized in that Verifying the target authorization file includes: Extracting the hardware identification information to be verified from the target authorization file, requesting the actual hardware identification information from the virtual machine, and comparing the hardware identification information to be verified with the actual hardware identification information; And, before storing the target authorization file in the virtual machine system directory, it also includes: Set the client user's operation permissions on the target authorization file to prohibit access and prohibit modification.

4. A method for verifying the permissions of application software, characterized in that: Executed by an authorization management center, the method includes: Upon receiving a permission verification request sent by a target application software client to be verified, extracting target hardware identification information of a virtual machine to which the target application software client belongs and a target authorization file contained in the permission verification request; Extracting the hardware identification information to be verified from the target authorization file, and comparing the hardware identification information to be verified with the target hardware identification information; If the comparison is successful, a verification success response is fed back to the target application software client, so that the target application software client can normally start the application software client to provide application software services; The heartbeat data packets sent periodically by the target application software client during operation are received regularly, and the authority of the target application software client is monitored according to the timestamp information or IP address information in the heartbeat data packets.

5. The method according to claim 4, characterized in that According to the timestamp information in the heartbeat data packet, the target application software client is monitored for permissions, including: According to the hardware identification information contained in the heartbeat data packet, regularly obtain each first heartbeat data packet belonging to the target application software client, and obtain the timestamp information in each first heartbeat data packet; If it is determined that the timestamp information in the currently acquired first heartbeat data packet is earlier than the timestamp information of any historical first heartbeat data packet, time anomaly prompt information is sent to the target application software client to which the currently acquired first heartbeat data packet belongs.

6. The method according to claim 4, characterized in that According to the IP address information in the heartbeat data packet, the target application software client is monitored for permissions, including: Obtain each monitoring heartbeat data packet received within a preset monitoring period; According to the hardware identification information contained in the monitoring heartbeat data packet, obtain each second heartbeat data packet belonging to the target application software client, and obtain the IP address information in each second heartbeat data packet; If it is determined that each IP address information contains multiple different IP addresses, then obtain the target IP address corresponding to the second heartbeat data packet received earliest within the monitoring time; Among the multiple different IP addresses, obtaining abnormal IP addresses except the target IP address; A stop operation control instruction is sent to each target application software client pointed to by each abnormal IP address, so as to close each target application software client pointed to by each abnormal IP address.

7. A permission verification device for application software, characterized in that: An application software client configured in a virtual machine, the device comprising: An authorization file detection module is used to detect whether a target authorization file for authorizing the application software client is stored in the virtual machine system directory in response to a software startup instruction for the application software client; An authorization file sending module is used to send the target authorization file to an authorization management center for authority verification; An application service startup module, configured to normally start the application software client to provide application software services if a verification pass response fed back by the authorization management center is received; The periodic verification module is used to periodically send heartbeat data packets to the authorization management center during the operation of the application software client, so that the authorization management center can monitor the permissions of the application software client according to the timestamp information or IP address information in the heartbeat data packets.

8. A permission verification device for application software, characterized in that: Configured in the authorization management center, the device includes: An information receiving module, configured to extract, upon receiving a permission verification request sent by a target application software client to be verified, target hardware identification information of the virtual machine to which the target application software client belongs and a target authorization file contained in the permission verification request; An information comparison module, used to extract the hardware identification information to be verified from the target authorization file, and compare the hardware identification information to be verified with the target hardware identification information; A verification result feedback module is used to feedback a verification result response to the target application software client if the comparison is passed, so that the target application software client can normally start the application software client to provide application software services; The permission monitoring module is used to periodically receive the heartbeat data packets periodically sent by the target application software client during operation, and perform permission monitoring on the target application software client according to the timestamp information or IP address information in the heartbeat data packets.

9. An electronic device, characterized in that: The electronic device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the permission verification method for the application software described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the permission verification method for application software described in any one of claims 1 to 7 when executed.

Images