Off-line authorization verification method and system of application program, terminal and storage medium

Abstract

The invention relates to the technical field of computers, and particularly provides an off-line authorization verification method and system for an application program, a terminal and a storage medium, and the method comprises the steps: receiving an authorization request, generating a key pair containing a public key and a private key based on the authorization request, and extracting a machine code from the authorization request; generating authorization information based on the machine code, wherein the authorization information comprises an authorization deadline, an authorization code and authority information; using system time as authorization time, and encrypting the authorization information and the authorization time by using a private key to obtain an authorization certificate; and issuing the public key and the authorization certificate to a client which sends the authorization request, and appointing a storage directory of the authorization certificate in the client. According to the invention, by introducing the timed task, authorization management is more flexible, and changeable market requirements can be met.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to an offline authorization verification method, system, terminal and storage medium for an application. Background Art

[0002] In the context of the digital age, copyright protection of computer software is of vital importance. Currently, software authorization verification mostly relies on online servers. Although this method is effective, it is limited by the stability and security of network connections. In addition, centralized authorization servers may become targets of attacks, and the authorization process may involve the transmission of user privacy data, which poses a potential risk of leakage. Therefore, the development of an offline authorization verification system that does not rely on network connections, has higher security, and can protect user privacy has become an important demand for the development of technology in this field.

[0003] In the prior art, a commonly used method is to generate authorization codes based on timestamps and hardware feature codes. This method can achieve offline authorization to a certain extent, but it has several shortcomings: first, the authorization code may be easily cracked, especially when the encryption algorithm is not complex enough; second, if the user replaces the hardware, the original authorization code will no longer be valid, resulting in authorization verification failure; finally, the generation and verification process of the authorization code may involve the processing of user privacy data, increasing the risk of privacy leakage. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention provides an offline authorization verification method, system, terminal and storage medium for an application program to solve the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides an offline authorization method for an application, comprising: receiving an authorization request, generating a key pair including a public key and a private key based on the authorization request, and extracting a machine code from the authorization request; Generate authorization information based on the machine code, the authorization information including authorization period, authorization code and authority information; Using the system time as the authorization time, encrypting the authorization information and the authorization time with a private key to obtain an authorization certificate; The public key and the authorization certificate are sent to the client that sends the authorization request, and the storage directory of the authorization certificate on the client is specified.

[0006] In an optional implementation, authorization information is generated based on the machine code, and the authorization information includes an authorization period, an authorization code, and permission information, including: Querying the user information matching the machine code from the user database; And generate corresponding authorization code and authority information based on the user information.

[0007] In an optional implementation, the system time is used as the authorization time, and the authorization information and the authorization time are encrypted using a private key to obtain an authorization certificate, including: Encrypting the authorization information and the system time based on the private key using an asymmetric encryption algorithm to obtain an encrypted file; The encrypted file is encrypted using the Caesar encryption algorithm to obtain an authorization file.

[0008] In a second aspect, the present invention provides an offline authorization verification method for an application, comprising: Reading the authorization certificate from the storage directory, and decrypting the authorization certificate using the public key to obtain authorization information and authorization time; Obtaining system time, and verifying the system time using the authorization time and the authorization period in the authorization information; If the system time passes the verification, an actual machine code is generated based on the hardware information, and the actual machine code is verified using the machine code in the authorization information; If the actual machine code passes the verification, the control interceptor cancels the interception of the user request; if the actual machine code fails the verification, the control interceptor intercepts all user requests.

[0009] In an optional embodiment, the method further comprises: Based on the pre-set timed tasks, time verification and machine code verification are performed regularly.

[0010] In an optional implementation, generating an actual machine code based on the hardware information and verifying the actual machine code using the machine code in the authorization information includes: Collect hardware information, including CPU serial number, motherboard serial number, hard disk serial number and network card MAC address; Integrate the hardware information into a string; The character string is encrypted using a hash algorithm to obtain an actual machine code; The consistency of the machine code and the actual machine code is compared, and if the two are consistent, it is determined that the verification has passed.

[0011] In a third aspect, the present invention provides an offline authorization system for an application, comprising: A request receiving module, used to receive an authorization request, generate a key pair including a public key and a private key based on the authorization request, and extract a machine code from the authorization request; An authorization generation module, used to generate authorization information based on the machine code, wherein the authorization information includes an authorization period, an authorization code and permission information; The certificate generation module is used to use the system time as the authorization time, encrypt the authorization information and the authorization time using a private key, and obtain an authorization certificate; The certificate issuing module is used to issue the public key and the authorization certificate to the client that sends the authorization request, and specify the storage directory of the authorization certificate on the client.

[0012] In an optional implementation, the certificate generation module includes: A first encryption unit, configured to encrypt the authorization information and the system time using an asymmetric encryption algorithm based on the private key to obtain an encrypted file; The second encryption unit is used to encrypt the encrypted file using the Caesar encryption algorithm to obtain an authorization file.

[0013] In a fourth aspect, a terminal is provided, including: A memory, used for storing an offline authorization program of an application; The processor is used to implement the steps of the offline authorization method for the application as provided in the first aspect when executing the offline authorization procedure of the application.

[0014] In a fifth aspect, a computer-readable storage medium is provided, on which an offline authorization program for an application is stored. When the offline authorization program for the application is executed by a processor, the steps of the offline authorization method for the application provided in the first aspect are implemented.

[0015] The beneficial effects of the present invention are that the offline authorization method, system, terminal and storage medium of the application provided by the present invention adopt an asymmetric encryption algorithm, and realize the secure and reliable encryption of authorization information through the generation and application of key pairs; and completely get rid of the dependence on network connection, effectively avoid the security risks of centralized authorization servers, and minimize the exposure of user privacy data during the authorization process, thereby enhancing the protection of user privacy; in addition, the present invention makes authorization management more flexible by introducing scheduled tasks, and can adapt to changing market demands.

[0016] In addition, the invention has a reliable design principle, a simple structure and a very broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention.

[0019] Figure 2 is another schematic flow chart of a method according to an embodiment of the present invention.

[0020] Figure 3 is a schematic block diagram of a system according to an embodiment of the present invention.

[0021] Figure 4 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0024] The offline authorization method for an application provided in the embodiment of the present invention is executed by a computer device, and accordingly, the offline authorization system for an application runs in the computer device.

[0025] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention. Figure 1 The execution subject may be an offline authorization system of an application. According to different requirements, the order of the steps in the flow chart may be changed, and some may be omitted.

[0026] like Figure 1 As shown, the method includes: S1. Receive an authorization request, generate a key pair including a public key and a private key based on the authorization request, and extract a machine code from the authorization request.

[0027] Receive authorization request: The system first receives the authorization request from the client. This request usually contains basic information of the client, such as device ID, application ID, etc., as well as the specific content of the authorization request.

[0028] Generate a key pair: After receiving the authorization request, the system uses the built-in key generation algorithm (such as RSA, ECC, etc.) to generate a key pair containing a public key and a private key. The public key will be used for subsequent information encryption and verification, while the private key is used for signing and decryption.

[0029] Extract the machine code: Extract the client's machine code from the authorization request. The machine code is usually a unique identifier obtained by reading the client's hardware information (such as the CPU serial number, motherboard serial number, hard disk serial number, or network card MAC address, etc.) and processing it with a specific algorithm.

[0030] S2. Generate authorization information based on the machine code, the authorization information including authorization period, authorization code and authority information.

[0031] Generate authorization period: Set a validity period for the authorization based on business needs. This period can be a fixed period of time or a dynamic period triggered by certain conditions.

[0032] Generate an authorization code: An authorization code is a unique code used to verify the validity of an authorization. It can be a randomly generated string or a value processed by a specific algorithm.

[0033] Set permission information: According to the client's request and the system's permission settings, add corresponding permission information to the authorization information. This permission information may include the permission to access specific resources, the permission to perform specific operations, etc.

[0034] S3. Using the system time as the authorization time, encrypting the authorization information and the authorization time with a private key to obtain an authorization certificate.

[0035] Record authorization time: Before generating the authorization certificate, the system needs to record the current system time as the authorization time. This time will be used to verify whether the authorization has expired.

[0036] Encryption: Use the private key to encrypt the authorization information (including authorization period, authorization code and permission information) and authorization time. The encrypted data will serve as the main content of the authorization certificate.

[0037] Generate an authorization certificate: Encapsulate the encrypted data and necessary metadata (such as certificate format, version number, etc.) into a complete authorization certificate.

[0038] S4. Send the public key and the authorization certificate to the client that sends the authorization request, and specify the storage directory of the authorization certificate on the client.

[0039] Send public key: Send the generated public key to the client. The client will use this public key to verify the authenticity and integrity of the authorization certificate.

[0040] Issue authorization certificate: Issue the generated authorization certificate to the client. The client needs to keep this certificate properly for use in subsequent authorization verification.

[0041] Specify a storage directory: When issuing an authorization certificate, the system can also specify a storage directory, and recommends that the client save the certificate in this directory. This helps the client better manage the certificate and prevent the certificate from being lost or stolen.

[0042] In one embodiment of the present invention, authorization information is generated based on the machine code, and the authorization information includes an authorization period, an authorization code and permission information, including: querying user information matching the machine code from a user database; and generating corresponding authorization codes and permission information based on the user information.

[0043] In a specific example, there is a user database that stores the user's personal information, purchased software or service information, and their corresponding machine codes (these machine codes are generated when the user first installs the software or registers for the service). Now, a user requests to authorize the software on his new device.

[0044] Receive authorization request and machine code: The user sends an authorization request through the software interface or command line tool, which contains the machine code of the new device.

[0045] Query the user database: After receiving the request, the system first uses the provided machine code to query the user database. This query is intended to find user records that match the machine code. Possible query logic includes: Check if the machine code exists directly in a field of the user record.

[0046] If the machine code is generated by a specific algorithm, the algorithm outputs are calculated and compared.

[0047] In some cases, additional information (such as a user-provided email address or username) may also need to be verified to further confirm identity.

[0048] Verify user information: Once a matching user record is found, the system will further verify the validity of the user information. This may include checking the status of the user account (whether it is active, expired, etc.) and any related security verification (such as password, SMS verification code, etc.).

[0049] Generate an authorization code: If the user information is successfully verified, the system will generate a unique authorization code. This authorization code can be a randomly generated string or a hash value based on the user information and the current timestamp. It is important that the authorization code should be difficult to guess and unique to ensure its security.

[0050] Determine the permissions information: Based on the purchase information or service level stored in the user database, the system will determine the appropriate permission information for the user. Permission information may include: The software module or service functionality to which access is permitted.

[0051] Read and write permissions for a specific resource.

[0052] The number of concurrent users allowed (if applicable).

[0053] Any other restrictions or conditions associated with the authorization.

[0054] To set the authorization period: The system will also set a licensing period for the user. This can be a fixed period of time (such as one year, one month, etc.) or a dynamic period based on certain conditions (such as the expiration date of the user's subscription).

[0055] Generate authorization information: Finally, the system combines all the above information (authorization period, authorization code, permission information) into a structured authorization information object. This object may be a JSON, XML or custom format document for passing to the client in subsequent steps.

[0056] In one embodiment of the present invention, the preferred method of step S3 includes: using an asymmetric encryption algorithm to encrypt the authorization information and system time based on the private key to obtain an encrypted file; using a Caesar encryption algorithm to encrypt the encrypted file to obtain an authorization file.

[0057] The authorization information is encrypted using a private key to generate an authorization file. To enhance security, an asymmetric encryption algorithm is first used for encryption, and then the Caesar encryption algorithm is used for secondary encryption. On this basis, this system adopts an enhanced Caesar encryption algorithm, which uses a predefined integer array KAISER_KEY to store multiple displacement values ​​instead of a single number. This design significantly improves the security of encryption, because the encryption of each character depends on the displacement values ​​at different positions in the array, avoiding the single fixed displacement limitation of traditional Caesar encryption. During the encryption process, the system selects the displacement amount at the corresponding position in the KAISER_KEY array for dynamic displacement encryption for each character of the authorization information according to its position in the information. This position-based dynamic displacement mechanism ensures that the encryption result of each character is unique, greatly improving the security of encrypted data.

[0058] In a specific example, suppose there is already a string containing authorization information, which contains key data such as authorization period, authorization code, and permission information. Now, we need to encrypt this string to ensure its security.

[0059] Initial encryption using a private key and an asymmetric encryption algorithm: First, we encrypt the authorization information string using the RSA private key. RSA is a widely used asymmetric encryption algorithm that uses a public key for encryption and a private key for decryption. But in this scenario, we use the private key for encryption, and decryption will be performed using the public key when verifying the authorization.

[0060] Use enhanced Caesar encryption algorithm for secondary encryption: Next, the initially encrypted data is re-encrypted using an enhanced Caesar encryption algorithm, which uses a predefined integer array KAISER_KEY to store multiple displacement values.

[0061] The encrypted data is encapsulated into a complete authorization file format together with other metadata (such as file header, checksum, etc.). Through the above steps, a double-encrypted authorization information string is obtained, which can be safely stored in the authorization file and decrypted and verified when needed.

[0062] The present invention also provides a verification method, which specifically comprises: Based on the pre-set scheduled tasks, time verification and machine code verification are performed regularly: To ensure the validity and security of the authorization certificate, the system can set a scheduled task that will automatically perform time verification and machine code verification at predetermined time intervals (such as daily, weekly, or monthly). The following are the detailed steps of the process: 1. Read the authorization certificate and public key Read the authorization certificate from the storage directory: The system will automatically search and read the authorization certificate stored in the previously specified storage directory.

[0063] Decrypt the authorization certificate using the public key: Use the public key previously issued to the client to decrypt the authorization certificate. The decrypted data will contain the authorization information and authorization time.

[0064] 2. Time verification Get system time: When executing a verification task, the system will first get the current system time.

[0065] Verify using authorization time and authorization period: Compare the decrypted authorization time with the current system time, and check the authorization period in the authorization information. If the current time is within the authorization period, the time verification passes; otherwise, the time verification fails.

[0066] 3. Machine code verification Collect hardware information: The system needs to collect the client's hardware information, including the CPU serial number, motherboard serial number, hard disk serial number and network card MAC address. This information is the basis for generating machine code.

[0067] Integrate hardware information into a string: Integrate the collected hardware information into a string according to certain rules. This string should be able to uniquely identify the client's hardware environment.

[0068] Use a hash algorithm to encrypt the string to get the actual machine code: Use a predetermined hash algorithm (such as SHA-256) to encrypt the integrated string to get the actual machine code.

[0069] Compare the consistency between the machine code and the actual machine code: Compare the decrypted machine code (stored in the authorization information) with the actual machine code. If the two are consistent, the machine code verification passes; otherwise, the machine code verification fails.

[0070] 4. Control Interceptor If the actual machine code passes the verification: If both the time verification and the machine code verification pass, the system considers the client to be legitimate and valid. At this point, the system will control the interceptor to cancel the interception of the user's request, allowing the user to access the protected resources or services normally.

[0071] If the actual machine code fails to pass the verification: If the time verification or machine code verification fails, the system believes that the client may be illegal or has been changed. At this time, the system will control the interceptor to intercept all user requests to prevent illegal access or potential security risks.

[0072] To facilitate understanding of the present invention, the offline authorization method for an application provided by the present invention is further described below based on the principle of the offline authorization method for an application of the present invention and in combination with the process of offline authorization of an application in an embodiment.

[0073] The technical solution of the present invention mainly includes the following key components: Encryption tool class: This class is one of the core components of the system. It is responsible for generating asymmetric key pairs, including a public key and a private key, as well as authorization files generated based on these keys. Using the private key, the system can encrypt the authorization information, generate authorization files, and ensure the security of the authorization information during storage and transmission. To enhance security, this class also uses the Caesar encryption algorithm to perform secondary encryption on the encrypted data, thereby providing an additional security layer for the authorization information.

[0074] Authorization tool class: This class uses the public key to decrypt the information in the authorization file and verify the validity of the authorization information. It checks whether the authorization information meets the preset conditions, such as the authorization period, user hardware information, etc., to ensure the legitimacy of the authorization.

[0075] Controller: The controller is a component in the encryption tool that provides a set of HTTP interfaces that allow users to apply for authorization and verification through these interfaces. These interfaces allow the authorization process to be remotely triggered and monitored.

[0076] Interceptor: Interceptor is a component in the authorization tool, usually provided in the form of SDK. The authorization tool SDK is integrated in the application that requires offline encryption. It is responsible for intercepting these requests and performing authorization verification before the user requests to access restricted resources. If the user fails the authorization verification, the request will be rejected, thereby protecting the restricted resources from unauthorized access.

[0077] System time record: To address the problem of system time being tampered with during offline authorization verification, the authorization tool class of the present invention includes a system time record module. When generating an encrypted file, the authorization time is used as the system time, which is encrypted and recorded in the authorization file. This time is used as the system time benchmark to compare the authorization period, effectively avoiding authorization verification problems caused by device time being modified. The authorization tool class also includes a scheduled task. After the application is started, the scheduled task is started and the system time in the authorization file is updated in real time at a fixed frequency to ensure the accuracy and timeliness of the authorization verification.

[0078] For details, please refer to Figure 2 , the offline authorization verification methods of the application include: The authorization application process is described in detail as follows: Generate a key pair: During the system initialization phase, the encryption tool class uses the RSA algorithm to generate a pair of asymmetric keys for each application that requires offline authorization. The generated key pair includes a public key and a private key. The public key will be distributed to the user, and the private key will be stored in the server's encrypted storage system.

[0079] Generate authorization information: The system specifies the application on the authorized device through the machine code (the machine code is usually the user's hardware information, etc.). Based on the user's request and hardware information, the system generates a set of authorization information, including the authorization period, authorization code, and other permission information that needs to be encrypted (such as the number of authorizations, the scope of accessible functions, etc.).

[0080] Encrypted authorization information: Use the private key to encrypt the authorization information and generate an authorization file. To enhance security, first encrypt using an asymmetric encryption algorithm, and then use the Caesar encryption algorithm for secondary encryption. On this basis, this system uses an enhanced Caesar encryption algorithm that uses a predefined integer array KAISER_KEY to store multiple displacement values ​​instead of a single number. This design significantly improves the security of encryption because the encryption of each character depends on the displacement values ​​at different positions in the array, avoiding the single fixed displacement limitation of traditional Caesar encryption. During the encryption process, the system selects the displacement amount at the corresponding position in the KAISER_KEY array for dynamic displacement encryption for each character of the authorization information according to its position in the information. This position-based dynamic displacement mechanism ensures that the encryption result of each character is unique, greatly improving the security of encrypted data.

[0081] Storing authorization files: Distribute the encrypted authorization files and public keys to users and place them in a specified directory for authorization verification of user encrypted applications.

[0082] The authorization verification process is described in detail as follows: Read the authorization file: The authorization tool class is integrated into the application that needs to be encrypted in the form of SDK, and an interceptor is used to intercept all functions that require permissions. The application system reads the stored authorization file when it starts or when needed. After the interceptor intercepts the request, it queries the public key and authorization file in the specified directory. If it does not exist, query the machine code of this device and provide it to the technician to generate the authorization file; if it exists, enter the decryption process. The machine code is generally obtained by obtaining a variety of system hardware information, including CPU ID, motherboard serial number, BIOS version number and other coding combinations.

[0083] Decrypt authorization information: Use the public key to decrypt the information in the authorization file. First, use an asymmetric encryption algorithm to decrypt, and then apply the inverse process of the Caesar encryption algorithm for secondary decryption.

[0084] Verify authorization information: The system verifies the decrypted authorization information, including whether the authorization period has expired, whether the hardware information matches, and other permission information that needs to be verified.

[0085] Authorization result: Based on the verification result, the system decides whether to allow the user to access the application system. If the authorization verification passes, the user can continue to use the application; if the verification fails, the user's access request is denied.

[0086] The above method has the following beneficial effects: Enhanced security: By combining asymmetric encryption technology and Caesar encryption algorithm, the system greatly enhances the security of authorization information. This method effectively prevents unauthorized access and potential network attacks, protecting software applications and user data from infringement.

[0087] Offline authorization capability: This system can complete authorization verification in a completely offline environment, solving the limitation that traditional online authorization systems cannot work in a network-free environment. This allows users to use the software normally even without a network connection, improving the usability and flexibility of the software.

[0088] Anti-tampering: The design of the system time recording module effectively prevents attacks that bypass authorization verification by tampering with the system time, ensuring the accuracy and reliability of the authorization period.

[0089] Protect copyright interests: By ensuring that only legally authorized users can access and use the software, this system effectively protects the copyright interests of software developers and reduces the risk of piracy and illegal copying.

[0090] Reduce maintenance costs: Since the system design reduces dependence on centralized authorization servers, it reduces maintenance costs and potential server attack risks, while also reducing server load.

[0091] In some embodiments, the offline authorization system for the application may include multiple functional modules composed of computer program segments. The computer programs of the various program segments in the offline authorization system for the application may be stored in a memory of a computer device and executed by at least one processor to perform (see Figure 1 Description) The offline authorization function of the application.

[0092] In this embodiment, the offline authorization system of the application can be divided into multiple functional modules according to the functions it performs, such as Figure 3As shown. The functional modules of the system 300 may include: a request receiving module 310, an authorization generating module 320, a certificate generating module 330 and a certificate issuing module 340. The module referred to in the present invention refers to a series of computer program segments that can be executed by at least one processor and can complete fixed functions, which are stored in a memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0093] A request receiving module, used to receive an authorization request, generate a key pair including a public key and a private key based on the authorization request, and extract a machine code from the authorization request; An authorization generation module, used to generate authorization information based on the machine code, wherein the authorization information includes an authorization period, an authorization code and permission information; The certificate generation module is used to use the system time as the authorization time, encrypt the authorization information and the authorization time using a private key, and obtain an authorization certificate; The certificate issuing module is used to issue the public key and the authorization certificate to the client that sends the authorization request, and specify the storage directory of the authorization certificate on the client.

[0094] Optionally, as an embodiment of the present invention, the certificate generation module includes: A first encryption unit, configured to encrypt the authorization information and the system time using an asymmetric encryption algorithm based on the private key to obtain an encrypted file; The second encryption unit is used to encrypt the encrypted file using the Caesar encryption algorithm to obtain an authorization file.

[0095] Figure 4 This is a schematic diagram of the structure of a terminal 400 provided in an embodiment of the present invention. The terminal 400 can be used to execute the offline authorization method of the application provided in an embodiment of the present invention.

[0096] The terminal 400 may include: a processor 410, a memory 420 and a communication unit 430. These components communicate via one or more buses. Those skilled in the art will appreciate that the server structure shown in the figure does not limit the present invention, and it may be a bus structure or a star structure, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0097] The memory 420 can be used to store the execution instructions of the processor 410, and the memory 420 can be implemented by any type of volatile or non-volatile storage terminal or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. When the execution instructions in the memory 420 are executed by the processor 410, the terminal 400 can perform some or all of the steps in the following method embodiments.

[0098] The processor 410 is the control center of the storage terminal, and uses various interfaces and lines to connect various parts of the entire electronic terminal. It runs or executes software programs and / or modules stored in the memory 420, and calls data stored in the memory to perform various functions of the electronic terminal and / or process data. The processor can be composed of an integrated circuit (IC), for example, it can be composed of a single packaged IC, or it can be composed of multiple packaged ICs with the same or different functions. For example, the processor 410 can include only a central processing unit (CPU). In the embodiment of the present invention, the CPU can be a single computing core or multiple computing cores.

[0099] The communication unit 430 is used to establish a communication channel so that the storage terminal can communicate with other terminals, receive user data sent by other terminals or send user data to other terminals.

[0100] The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment provided by the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0101] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention, in essence or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes, including several instructions for enabling a computer terminal (which can be a personal computer, a server, or a second terminal, a network terminal, etc.) to execute all or part of the steps of the methods described in each embodiment of the present invention.

[0102] In this specification, the same or similar parts between the various embodiments can be referred to each other. In particular, for the terminal embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0103] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or modules, which can be electrical, mechanical or other forms.

[0104] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0106] Although the present invention has been described in detail with reference to the accompanying drawings and in combination with the preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, a person of ordinary skill in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and these modifications or substitutions shall be within the scope of the present invention. Any person of ordinary skill in the art may easily think of changes or substitutions within the technical scope disclosed by the present invention, and these shall be within the scope of protection of the present invention.

Claims

1. An offline authorization method for an application, characterized in that: include: receiving an authorization request, generating a key pair including a public key and a private key based on the authorization request, and extracting a machine code from the authorization request; Generate authorization information based on the machine code, the authorization information including authorization period, authorization code and authority information; Using the system time as the authorization time, encrypting the authorization information and the authorization time with a private key to obtain an authorization certificate; The public key and the authorization certificate are sent to the client that sends the authorization request, and the storage directory of the authorization certificate on the client is specified.

2. The method according to claim 1, characterized in that: Generate authorization information based on the machine code, the authorization information including authorization period, authorization code and authority information, including: Querying the user information matching the machine code from the user database; And generate corresponding authorization code and authority information based on the user information.

3. The method according to claim 1, characterized in that The system time is used as the authorization time, and the authorization information and the authorization time are encrypted using a private key to obtain an authorization certificate, including: Encrypting the authorization information and the system time based on the private key using an asymmetric encryption algorithm to obtain an encrypted file; The encrypted file is encrypted using the Caesar encryption algorithm to obtain an authorization file.

4. An offline authorization verification method for an application, based on the method described in any one of claims 1 to 3, characterized in that: include: Reading the authorization certificate from the storage directory, and decrypting the authorization certificate using the public key to obtain authorization information and authorization time; Obtaining system time, and verifying the system time using the authorization time and the authorization period in the authorization information; If the system time passes the verification, an actual machine code is generated based on the hardware information, and the actual machine code is verified using the machine code in the authorization information; If the actual machine code passes the verification, the control interceptor cancels the interception of the user request; if the actual machine code fails the verification, the control interceptor intercepts all user requests.

5. The method according to claim 4, characterized in that The method further comprises: Based on the pre-set timed tasks, time verification and machine code verification are performed regularly.

6. The method according to claim 4, characterized in that Generating an actual machine code based on the hardware information, and verifying the actual machine code using the machine code in the authorization information, including: Collect hardware information, including CPU serial number, motherboard serial number, hard disk serial number and network card MAC address; Integrate the hardware information into a string; The character string is encrypted using a hash algorithm to obtain an actual machine code; The consistency of the machine code and the actual machine code is compared, and if the two are consistent, it is determined that the verification has passed.

7. An offline authorization system for an application, characterized in that: include: A request receiving module, used to receive an authorization request, generate a key pair including a public key and a private key based on the authorization request, and extract a machine code from the authorization request; An authorization generation module, used to generate authorization information based on the machine code, wherein the authorization information includes an authorization period, an authorization code and permission information; The certificate generation module is used to use the system time as the authorization time, encrypt the authorization information and the authorization time using a private key, and obtain an authorization certificate; The certificate issuing module is used to issue the public key and the authorization certificate to the client that sends the authorization request, and specify the storage directory of the authorization certificate on the client.

8. The system according to claim 7, characterized in that The certificate generation module includes: A first encryption unit, configured to encrypt the authorization information and the system time using an asymmetric encryption algorithm based on the private key to obtain an encrypted file; The second encryption unit is used to encrypt the encrypted file using the Caesar encryption algorithm to obtain an authorization file.

9. A terminal, characterized in that: include: A memory, used for storing an offline authorization program of an application; A processor is used to implement the steps of the offline authorization method for the application as described in any one of claims 1-3 when executing the offline authorization program of the application.

10. A computer-readable storage medium storing a computer program, characterized in that: The readable storage medium stores an offline authorization program of an application, and when the offline authorization program of the application is executed by a processor, the steps of the offline authorization method of the application as claimed in any one of claims 1 to 3 are implemented.

Images