Software authorization method and equipment

Abstract

The invention discloses a software authorization method and equipment, and the method comprises the steps: encrypting terminal hardware fingerprint information according to pre-generated terminal encryption key information, and obtaining encrypted terminal hardware fingerprint information; combining the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal to obtain a terminal basic authorization file; generating terminal authorization file signature information according to the terminal encryption key information and the terminal basic authorization file; combining the terminal authorization file signature information and the terminal basic authorization file to obtain a terminal signature authorization file; encrypting the terminal signature authorization file according to the terminal encryption key information to obtain a terminal target authorization file; and sending the terminal target authorization file to the terminal, so that the terminal verifies the terminal target authorization file, and running the target software according to the basic authorization information of the terminal after the verification is passed. According to the software authorization method, the target software can be effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a software authorization method and device. Background Art

[0002] In order to protect intellectual property rights, in some scenarios, the software running in the terminal needs to be authorized and authenticated, and unauthenticated terminals are not allowed to run related software.

[0003] Currently, the terminal can be authorized and authenticated by providing a public key authorization file to the terminal.

[0004] However, in this method, the public key authorization file may be tampered with, causing unauthorized terminals to run the software, making it impossible to effectively protect the software. Summary of the invention

[0005] The present invention provides a software authorization method and device to solve the technical problem that the software cannot be effectively protected in the related art.

[0006] According to one aspect of the present invention, a software authorization method is provided, which is applied to a server and includes:

[0007] Encrypt the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information;

[0008] Merging the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal to obtain a terminal basic authorization file;

[0009] Generate terminal authorization file signature information according to the terminal encryption key information and the terminal basic authorization file;

[0010] Merging the terminal authorization file signature information and the terminal basic authorization file to obtain a terminal signature authorization file;

[0011] Encrypt the terminal signature authorization file according to the terminal encryption key information to obtain a terminal target authorization file;

[0012] The terminal target authorization file is sent to the terminal so that the terminal verifies the terminal target authorization file and runs the target software according to the basic authorization information of the terminal after the verification is passed.

[0013] According to one aspect of the present invention, there is provided a software authorization method, which is applied to a terminal and includes:

[0014] Decrypt the terminal target authorization file according to the pre-generated terminal decryption key information to obtain the terminal signature authorization file; wherein the terminal encryption key information and the terminal decryption key information form a key pair;

[0015] Splitting the terminal signature authorization file to obtain terminal authorization file signature information and terminal basic authorization file;

[0016] After the signature information of the terminal authorization file is verified, the terminal basic authorization file is split to obtain the basic authorization information of the terminal and the encrypted terminal hardware fingerprint information;

[0017] Decrypting the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information;

[0018] After the basic authorization information of the terminal is verified and the hardware fingerprint information of the terminal is verified, the target software is run according to the basic authorization information of the terminal.

[0019] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the software authorization method described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, wherein the computer program is used to enable a processor to implement the software authorization method described in any embodiment of the present invention when executed.

[0024] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the software authorization method described in any embodiment of the present invention.

[0025] The technical solution of the embodiment of the present invention, on the one hand, adds the terminal hardware fingerprint information when generating the terminal target authorization file, strengthens the control of the terminal, so that the terminals that can run the target software are all controlled terminals, and realizes the effective protection of the target software. On the other hand, when generating the terminal target authorization file, the terminal authorization file signature information and the terminal basic authorization file are merged to obtain the terminal signature authorization file, and the terminal signature authorization file is encrypted twice according to the terminal encryption key information to obtain the terminal target authorization file, which strengthens the data tamper-proof capability through data signature, increases the difficulty of cracking through secondary encryption, avoids the uncontrolled terminal from running the target software, and further realizes the effective protection of the target software.

[0026] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 is a flow chart of a software authorization method provided by an embodiment of the present invention;

[0029] Figure 2 is a flow chart of another software authorization method provided by an embodiment of the present invention;

[0030] Figure 3 is a flowchart of another software authorization method provided by an embodiment of the present invention;

[0031] Figure 4 is a flow chart of another software authorization method provided by an embodiment of the present invention;

[0032] Figure 5 It is a structural diagram of a software authorization device provided by an embodiment of the present invention;

[0033] Figure 6 is a schematic diagram of the structure of another software authorization device provided by an embodiment of the present invention;

[0034] Figure 7 It is a structural schematic diagram of an electronic device for implementing the software authorization method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the term "comprising" and any variation thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The acquisition, storage, use, processing, etc. of data in the embodiments of the present invention all comply with the relevant provisions of national laws and regulations.

[0037] Figure 1 1 is a flowchart of a software authorization method provided by an embodiment of the present invention. This embodiment can be applied to the scenario of authorizing software in a terminal. The method can be executed by a software authorization device, which can be implemented in the form of hardware and / or software. The software authorization device can be configured in a server. Figure 1 As shown, the method includes the following steps.

[0038] Step 101: Encrypt the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information.

[0039] Optionally, in this embodiment, a key generation algorithm with a high security level can be used to generate terminal encryption key information. Exemplarily, the key generation algorithm in this implementation can be an asymmetric encryption algorithm (such as RSA), a Data Encryption Standard (DES) algorithm, or an Advanced Encryption Standard (AES) algorithm.

[0040] In this embodiment, there is no restriction on the length of the terminal encryption key information. Optionally, the length of the terminal encryption key information can be 512 bytes, or 1024 bytes, etc. The longer the length of the terminal encryption key information, the higher the security of encryption using the terminal encryption key information, but correspondingly, the greater the pressure of encryption and decryption.

[0041] The terminal hardware fingerprint information in this embodiment refers to the hardware information that can uniquely identify the terminal. Optionally, the terminal hardware fingerprint information in this embodiment may include at least one of the following information: a central processing unit (CPU) identifier, a serial number, and a media access control address (MAC address). The terminal hardware fingerprint information is information obtained in advance from the terminal.

[0042] Optionally, in order to improve the security of encryption, the encryption process in step 101 can be: encrypting the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted initial terminal hardware fingerprint information; adding randomly generated interference data to the encrypted initial terminal hardware fingerprint information to obtain the encrypted terminal hardware fingerprint information.

[0043] Optionally, in order to further improve security, the server needs to verify its own authorization file before step 101. Before step 101, the software authorization method provided in this embodiment further includes the following steps 10a to 10f.

[0044] Step 10a: Receive the first server target authorization file.

[0045] The first server target authorization file may be a file generated by other servers or control devices.

[0046] Optionally, the generation process may be: according to the pre-generated first server encryption key information, encrypt the hardware fingerprint information of the server (for the sake of convenience of description, referred to as the hardware fingerprint information of the first server) to obtain the encrypted first server hardware fingerprint information; merge the encrypted first server hardware fingerprint information and the authorization information of the server (for the sake of convenience of description, referred to as the first server authorization information) to obtain the first server basic authorization file; according to the first server encryption key information and the first server basic authorization file, generate the first server authorization file signature information; merge the first server authorization file signature information and the first server basic authorization file to obtain the first server signed authorization file; encrypt the first server signed authorization file according to the first server encryption key information to obtain the first server target authorization file.

[0047] Step 10b: Decrypt the first server target authorization file according to the pre-generated first server decryption key information to obtain the first server signed authorization file.

[0048] The first server decryption key information and the first server encryption key information are a key pair, which can be generated by RSA, AES algorithm or DES algorithm.

[0049] Step 10c: Split the first server signature authorization file to obtain the first server authorization file signature information and the first server basic authorization file.

[0050] When merging the signature information of the first server authorization file and the first server basic authorization file, a certain merging algorithm can be used for merging. Optionally, the merging algorithm can be: inserting the signature information of the first server authorization file into a specific position in the first server basic authorization file according to a preset cross-merge rule. Alternatively, the merging algorithm can be: splitting the signature information of the first server authorization file into signature fragments, determining the corresponding position of each signature fragment in the first server basic authorization file; and inserting each signature fragment into its corresponding position in the first server basic authorization file.

[0051] When splitting the first server signature authorization file, the first server authorization file signature information and the first server basic authorization file can be split according to the inverse operation of the merging algorithm.

[0052] Step 10d: After the signature information of the first server authorization file is verified, the first server basic authorization file is split to obtain the first server authorization information and the encrypted hardware fingerprint information of the first server.

[0053] In order to ensure the integrity and security of the first server basic authorization file, the signature information of the first server authorization file is first verified. The verification process can be: generating the receiving end signature information according to the first server basic authorization file; comparing the receiving end signature information and the first server authorization file signature information; if the two are consistent, it means that the first server basic authorization file has not been modified, it is a complete and secure file, and the first server authorization file signature information verification is passed; if the two are inconsistent, it means that the first server basic authorization file has been modified during the transmission process, and the first server authorization file signature information verification has failed.

[0054] After the signature information of the first server authorization file is verified, the first server basic authorization file is split to obtain the first server authorization information and the encrypted hardware fingerprint information of the first server.

[0055] Step 10e: decrypt the encrypted first server hardware fingerprint information according to the first server decryption key information to obtain the first server hardware fingerprint information.

[0056] Step 10f: after the hardware fingerprint information of the first server is verified and the authorization information of the first server is verified, determine to execute step 101.

[0057] In order to ensure security, the hardware fingerprint information of the first server and the authorization information of the first server need to be verified.

[0058] Optionally, the verification process of the first server hardware fingerprint information may be: comparing whether the local hardware fingerprint information is consistent with the first server hardware fingerprint information; if they are consistent, determining that the first server hardware fingerprint information verification has passed; if they are inconsistent, determining that the first server hardware fingerprint information verification has failed.

[0059] Optionally, the verification process for the first server authorization information may be: comparing whether the pre-acquired authorization indication information matches the first server authorization information; if they match, determining that the first server authorization information verification has passed; if they do not match, determining that the first server authorization information verification has failed.

[0060] After the hardware fingerprint information of the first server is verified and the authorization information of the first server is verified, it indicates that the server is a controlled and secure server, thereby ensuring the security of the communication process between the server and the terminal.

[0061] Step 102: Merge the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal to obtain a terminal basic authorization file.

[0062] In step 102, a merging algorithm may be used to merge the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal. Optionally, the merging algorithm may be: inserting the encrypted terminal hardware fingerprint information into a specific position in the basic authorization information of the terminal according to a preset cross-merging rule. Alternatively, the merging algorithm may be: splitting the encrypted terminal hardware fingerprint information into fingerprint information fragments, determining the corresponding position of each fingerprint information fragment in the basic authorization information of the terminal; and inserting each fingerprint information fragment into its corresponding position in the basic authorization information of the terminal.

[0063] Optionally, the format of the terminal basic authorization file is generally a readable text format, for example, txt, xml, yaml, json, etc.

[0064] In this embodiment, the basic authorization information corresponding to each terminal can be adaptively determined according to the different functions or services undertaken by each terminal.

[0065] In this embodiment, the authorization information of the terminal includes basic authorization information of the terminal and detailed authorization information of the terminal. The difference between the two is that detailed authorization information can achieve more refined authorization. In this embodiment, basic authorization is first performed on the terminal according to the basic authorization information. The process of performing detailed authorization on the terminal will be described in detail in subsequent embodiments.

[0066] Step 103: Generate terminal authorization file signature information according to the terminal encryption key information and the terminal basic authorization file.

[0067] The signature information of the terminal authorization file is very important. During the subsequent signature verification, it can effectively detect whether the terminal basic authorization file has been changed.

[0068] In one implementation, when generating the terminal authorization file signature information, a digest algorithm may be used, for example, MD5 Message-Digest Algorithm (MD5 Message-Digest Algorithm, MD5 for short), Secure Hash Algorithm (SHA for short), Message Authentication Codes (MAC for short) algorithm.

[0069] In another implementation, when generating the terminal authorization file signature information, a digest algorithm can be used to obtain the original signature information. The original signature information is then encrypted according to the terminal encryption key information to obtain the terminal authorization file signature information. This implementation has a higher security level.

[0070] Step 104: Merge the terminal authorization file signature information and the terminal basic authorization file to obtain a terminal signature authorization file.

[0071] Similar to step 102, a merging algorithm may be used to merge the terminal authorization file signature information and the terminal basic authorization file. Optionally, the merging algorithm may be: inserting the terminal authorization file signature information into a specific position in the terminal basic authorization file according to a preset cross-merging rule. Alternatively, the merging algorithm may be: splitting the terminal authorization file signature information into signature information fragments, determining the corresponding position of each signature information fragment in the terminal basic authorization file; and inserting each signature information fragment into its corresponding position in the terminal basic authorization file.

[0072] Step 105: Encrypt the terminal signature authorization file according to the terminal encryption key information to obtain the terminal target authorization file.

[0073] In this embodiment, the terminal signature authorization file may be encrypted twice to improve the security of the authorization file and increase the difficulty of cracking.

[0074] Optionally, to further improve security, the implementation process of step 105 may include: encrypting the terminal signature authorization file according to the terminal encryption key information to obtain a terminal intermediate authorization file; adding randomly generated interference data to the terminal intermediate authorization file to obtain a terminal target authorization file.

[0075] Step 106: Send the terminal target authorization file to the terminal so that the terminal verifies the terminal target authorization file and runs the target software according to the basic authorization information of the terminal after the verification is passed.

[0076] After receiving the terminal target authorization file, the terminal may verify the terminal target authorization file. The specific verification process will be described in detail in subsequent embodiments.

[0077] After the terminal passes the verification, it runs the target software according to the basic authorization information of the terminal. The target software in this embodiment can be software that realizes certain business requirements, for example, software that realizes power equipment monitoring, software that realizes data collection, etc.

[0078] Optionally, the basic authorization information includes a license or activation code of the target software. After verification, the terminal can use the license or activation code to run the target software normally.

[0079] Optionally, the server of this embodiment can also generate target authorization files of other servers and send them to other servers. The generation process may include: encrypting the hardware fingerprint information of the second server according to the pre-generated encryption key information of the second server to obtain the encrypted hardware fingerprint information of the second server; merging the encrypted hardware fingerprint information of the second server and the authorization information of the second server to obtain the basic authorization file of the second server; generating the signature information of the second server authorization file according to the encryption key information of the second server and the basic authorization file of the second server; merging the signature information of the second server authorization file and the basic authorization file of the second server to obtain the signature authorization file of the second server; encrypting the signature authorization file of the second server according to the encryption key information of the second server to obtain the target authorization file of the second server; sending the target authorization file of the second server to the server corresponding to the hardware fingerprint information of the second server. The encryption process in the above generation process can be encrypted in combination with the randomly generated interference data. The merging process in the above generation process is similar to the merging process of step 102, which will not be repeated here.

[0080] Optionally, in order to meet the requirements of ultra-large-scale high-concurrency authorization requests, a distributed, high-availability architecture is adopted on the server side.

[0081] The software authorization method provided in this embodiment, on the one hand, adds the terminal hardware fingerprint information when generating the terminal target authorization file, strengthens the control of the terminal, so that the terminals that can run the target software are all controlled terminals, and realizes the effective protection of the target software. On the other hand, when generating the terminal target authorization file, the terminal authorization file signature information and the terminal basic authorization file are merged to obtain the terminal signature authorization file, and the terminal signature authorization file is encrypted again according to the terminal encryption key information to obtain the terminal target authorization file. The data anti-tampering capability is strengthened by means of data signature, and the cracking difficulty is increased by secondary encryption, which prevents the uncontrolled terminal from running the target software, and further realizes the effective protection of the target software.

[0082] Figure 2 is a flow chart of another software authorization method provided by an embodiment of the present invention. Figure 1 Based on the illustrated embodiment and various optional implementations, other steps included in the software authorization method are described in detail. Figure 2 As shown, the software authorization method provided in this embodiment also includes the following steps.

[0083] Step 201: Receive a detailed authorization request message sent by a terminal.

[0084] The detailed authorization request message is a message sent by the terminal when it is determined that it can communicate normally with the server. The detailed authorization request message is used to request the server to send an updated terminal target authorization file to obtain detailed authorization information of the terminal.

[0085] Step 202: The encrypted terminal hardware fingerprint information and the detailed authorization information of the terminal are combined to obtain a terminal detailed authorization file.

[0086] The implementation process and technical principle of step 202 are similar to step 102, and the difference between the two steps is that the authorization information in step 202 is the detailed authorization information of the terminal. The detailed authorization information of the terminal in this embodiment includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period, so as to achieve more refined software authorization.

[0087] Step 203: Generate updated terminal authorization file signature information according to the terminal encryption key information and the terminal detailed authorization file.

[0088] The implementation process and technical principle of step 203 are similar to those of step 103, and will not be repeated here.

[0089] Step 204: Merge the updated terminal authorization file signature information and the terminal detailed authorization file to obtain an updated terminal signature authorization file.

[0090] The implementation process and technical principle of step 204 are similar to those of step 104 and will not be repeated here.

[0091] Step 205: Encrypt the updated terminal signature authorization file according to the terminal encryption key information to obtain an updated terminal target authorization file.

[0092] The implementation process and technical principle of step 205 are similar to those of step 105 and will not be repeated here.

[0093] Step 206: Send the updated terminal target authorization file to the terminal, so that the terminal verifies the updated terminal target authorization file, and runs the target software according to the detailed authorization information of the terminal after the verification is passed.

[0094] The implementation process and technical principle of step 206 are similar to those of step 106, except that: in step 206, the terminal verifies the updated terminal target authorization file, and after the verification is passed, runs the target software according to the detailed authorization information of the terminal. Compared with the basic authorization information of the terminal, the detailed authorization information of the terminal can achieve more sophisticated management and authorization, so the terminal can further protect the target software by running the target software according to the detailed authorization information of the terminal.

[0095] Furthermore, in the scenario where the detailed authorization information of the terminal includes the terminal authorization period, the software authorization method further includes the following steps: receiving a re-authorization request sent by the terminal. The re-authorization request is sent by the terminal after the terminal authorization period expires. This implementation method realizes the automatic renewal of authorization information and has a high degree of intelligence.

[0096] Optionally, the software authorization method provided in this embodiment further includes steps 101 to 106.

[0097] The software authorization method provided in this embodiment can generate and send an updated terminal target authorization file when a detailed authorization request message sent by a terminal is received, thereby achieving more refined software authorization and further effectively protecting the target software.

[0098] Figure 3 1 is a flowchart of another software authorization method provided by an embodiment of the present invention. This embodiment can be applied to the scenario of authorizing software in a terminal. The method can be executed by a software authorization device, which can be implemented in the form of hardware and / or software. The software authorization device can be configured in a terminal. Figure 3 As shown, the method includes the following steps.

[0099] Step 301: Decrypt the terminal target authorization file according to the pre-generated terminal decryption key information to obtain the terminal signature authorization file.

[0100] The terminal encryption key information and the terminal decryption key information form a key pair.

[0101] This step is the reverse process of step 105 .

[0102] Optionally, the implementation process of step 301 may include: deleting interference data in the terminal target authorization file to obtain a terminal intermediate authorization file; decrypting the terminal intermediate authorization file according to the terminal decryption key information to obtain a terminal signature authorization file.

[0103] Step 302: Split the terminal signature authorization file to obtain the terminal authorization file signature information and the terminal basic authorization file.

[0104] This step is the reverse process of step 104. The terminal signature authorization file is split using a splitting algorithm corresponding to the merging algorithm to obtain the terminal authorization file signature information and the terminal basic authorization file.

[0105] Optionally, the splitting algorithm may be: according to a preset cross-merge rule, the terminal authorization file signature information is obtained from a specific position of the terminal authorization file, and the terminal authorization file after the terminal authorization file signature information is taken out is the terminal basic authorization file. Alternatively, the splitting algorithm may be: obtaining signature information fragments from each specific position of the terminal authorization file, merging the signature information fragments into the terminal authorization file signature information, and the terminal authorization file after the terminal authorization file signature information is taken out is the terminal basic authorization file.

[0106] Step 303: After the signature information of the terminal authorization file is verified, the terminal basic authorization file is split to obtain the basic authorization information of the terminal and the encrypted terminal hardware fingerprint information.

[0107] The terminal authorization file signature information verification process can be: the terminal generates the receiving end signature information based on the terminal basic authorization file; compares the receiving end signature information and the received terminal authorization file signature information; if the two are consistent, it is determined that the terminal authorization file signature information verification has passed; if the two are inconsistent, it is determined that the terminal authorization file signature information verification has failed.

[0108] The splitting process of step 303 is the reverse process of step 102. The splitting process is similar to the implementation process of step 302, and will not be repeated here.

[0109] Step 304: decrypt the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information.

[0110] This step is the reverse process of step 101 .

[0111] Step 305: After the basic authorization information of the terminal is verified and the terminal hardware fingerprint information is verified, the target software is run according to the basic authorization information of the terminal.

[0112] Optionally, the verification process of the terminal hardware fingerprint information may be: comparing the local hardware fingerprint information with the received terminal hardware fingerprint information to verify whether they are consistent; if they are consistent, determining that the terminal hardware fingerprint information verification has passed; if they are inconsistent, determining that the terminal hardware fingerprint information verification has failed.

[0113] Optionally, the verification process for the basic authorization information of the terminal can be: comparing whether the pre-acquired authorization indication information matches the received basic authorization information of the terminal; if they match, determining that the basic authorization information verification of the terminal has passed; if they do not match, determining that the basic authorization information verification of the terminal has failed.

[0114] Optionally, the basic authorization information includes a license or activation code of the target software. After verification, the terminal can use the license or activation code to run the target software normally.

[0115] Optionally, the terminal may save basic authorization information locally so that it can operate normally even when disconnected from the server.

[0116] Optionally, the terminal may send a heartbeat packet to the server to indicate its online status.

[0117] The software authorization method provided in this embodiment, on the one hand, adds the terminal hardware fingerprint information to the terminal target authorization file, strengthens the control of the terminal, so that the terminals that can run the target software are all controlled terminals, and realizes the effective protection of the target software. On the other hand, when verifying the terminal target authorization file, the integrity of the terminal basic authorization file is verified through the terminal authorization file signature information, and the basic authorization information of the terminal is obtained after secondary decryption. The terminal target authorization file has strong anti-tampering ability and high cracking difficulty, which prevents the uncontrolled terminal from running the target software, and further realizes the effective protection of the target software.

[0118] Figure 4 is a flowchart of another software authorization method provided by an embodiment of the present invention. Figure 3 Based on the illustrated embodiment and various optional implementations, the steps of how to run the target software are described in detail. Figure 4 As shown, after the basic authorization information of the terminal is verified and the terminal hardware fingerprint information is verified, the implementation process of running the target software according to the basic authorization information of the terminal includes the following steps.

[0119] Step 3051: Determine whether normal communication with the server is possible.

[0120] The terminal can determine whether it can communicate normally with the server by sending a test packet.

[0121] Step 3052: If normal communication with the server is possible, a detailed authorization request message is sent to the server, and the updated terminal target authorization file sent by the server is received.

[0122] Step 3052 corresponds to step 201. The generation process of the updated terminal target authorization file is as follows: Figure 2 As shown in the embodiments, no further details will be given here.

[0123] Step 3053: Decrypt the updated terminal target authorization file according to the terminal decryption key information to obtain an updated terminal signature authorization file.

[0124] Step 3053 is similar to step 301 and will not be repeated here.

[0125] Step 3054: Split the updated terminal signature authorization file to obtain the updated terminal authorization file signature information and the terminal detailed authorization file.

[0126] Step 3054 is similar to step 302 and will not be described again here.

[0127] Step 3055: After the updated terminal authorization file signature information is verified, the terminal detailed authorization file is split to obtain the terminal detailed authorization information and the encrypted terminal hardware fingerprint information.

[0128] Step 3055 is similar to step 303 and will not be described again here.

[0129] Step 3056: Decrypt the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information.

[0130] Step 3056 is similar to step 304 and will not be repeated here.

[0131] Step 3057: After the detailed authorization information of the terminal is verified and the terminal hardware fingerprint information is verified, the target software is run according to the detailed authorization information of the terminal.

[0132] Step 3057 is similar to step 305 and will not be repeated here.

[0133] Step 3058: If normal communication with the server is not possible, the target software is run according to the basic authorization information of the terminal.

[0134] Optionally, the detailed authorization information of the terminal includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period. Correspondingly, in step 3057, the process of running the target software according to the detailed authorization information of the terminal includes: determining the authorized function of the terminal in the target software according to the terminal function authorization information; determining the authorized data of the terminal in the target software according to the terminal data authorization information; and running the functions in the target software that meet the authorized functions of the terminal and using the data in the target software that meet the authorization data of the terminal within the terminal authorization period. It can be understood that this implementation method can achieve more sophisticated software authorization.

[0135] Furthermore, after the terminal authorization period expires, a re-authorization request is sent to the server to achieve automatic renewal of the authorization information.

[0136] The terminal may cyclically execute steps 3051 to 3058 at a preset frequency to automatically update the authorization information.

[0137] Optionally, the terminal may send a re-authorization request to the server. After receiving the re-authorization request, the server may perform steps 101 to 106. After receiving the updated permission information, the terminal may integrate it with the locally stored authorization information and operate according to the integrated authorization information.

[0138] The software authorization method provided in this embodiment can receive an updated terminal target authorization file when determining that communication with the server is normal. After verifying the updated terminal target authorization file, the target software is run according to the detailed authorization information of the terminal, thereby achieving more refined software authorization and further effectively protecting the target software.

[0139] Figure 5 1 is a schematic diagram of the structure of a software authorization device provided by an embodiment of the present invention. The software authorization device is arranged in a server. Figure 5 As shown, the software authorization device provided in this embodiment includes the following modules: a first encryption module 51 , a first merging module 52 , a first signature module 53 , a second merging module 54 , a second encryption module 55 and a sending module 56 .

[0140] The first encryption module 51 is used to encrypt the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information.

[0141] The first merging module 52 is used to merge the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal to obtain a terminal basic authorization file.

[0142] The first signature module 53 is used to generate terminal authorization file signature information according to the terminal encryption key information and the terminal basic authorization file.

[0143] The second merging module 54 is used to merge the terminal authorization file signature information and the terminal basic authorization file to obtain a terminal signature authorization file.

[0144] The second encryption module 55 is used to encrypt the terminal signature authorization file according to the terminal encryption key information to obtain a terminal target authorization file.

[0145] The sending module 56 is used to send the terminal target authorization file to the terminal, so that the terminal verifies the terminal target authorization file and runs the target software according to the basic authorization information of the terminal after the verification is passed.

[0146] In one embodiment, the device further includes: a receiving module, a third merging module, a second signing module, a fourth merging module and a third encryption module.

[0147] The receiving module is used to receive the detailed authorization request message sent by the terminal.

[0148] The third merging module is used to merge the encrypted terminal hardware fingerprint information and the detailed authorization information of the terminal to obtain a terminal detailed authorization file.

[0149] The second signature module is used to generate updated terminal authorization file signature information according to the terminal encryption key information and the terminal detailed authorization file.

[0150] The fourth merging module is used to merge the updated terminal authorization file signature information and the terminal detailed authorization file to obtain an updated terminal signature authorization file.

[0151] The third encryption module is used to encrypt the updated terminal signature authorization file according to the terminal encryption key information to obtain an updated terminal target authorization file.

[0152] The sending module 56 is further used to send the updated terminal target authorization file to the terminal, so that the terminal verifies the updated terminal target authorization file and runs the target software according to the detailed authorization information of the terminal after the verification.

[0153] In one embodiment, the detailed authorization information of the terminal includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period. The receiving module is further configured to receive a re-authorization request sent by the terminal. The re-authorization request is sent by the terminal after the terminal authorization period expires.

[0154] In one embodiment, the receiving module is further used to receive the first server target authorization file. The device also includes: a first decryption module, a first splitting module, a second splitting module, a second decryption module and a determination module.

[0155] The first decryption module is used to decrypt the first server target authorization file according to the pre-generated first server decryption key information to obtain the first server signature authorization file.

[0156] The first splitting module is used to split the first server signature authorization file to obtain the first server authorization file signature information and the first server basic authorization file.

[0157] The second splitting module is used to split the first server basic authorization file after the signature information of the first server authorization file is verified, to obtain the first server authorization information and the encrypted first server hardware fingerprint information.

[0158] The second decryption module is used to decrypt the encrypted first server hardware fingerprint information according to the first server decryption key information to obtain the first server hardware fingerprint information.

[0159] The determination module is used to determine the steps to be executed by the first encryption module 51 after the hardware fingerprint information of the first server is verified and the authorization information of the first server is verified.

[0160] In one embodiment, the device further includes: a fourth encryption module, a fifth merging module, a third signature module, a sixth merging module and a fifth encryption module.

[0161] The fourth encryption module is used to encrypt the second server hardware fingerprint information according to the pre-generated second server encryption key information to obtain the encrypted second server hardware fingerprint information.

[0162] The fifth merging module is used to merge the encrypted second server hardware fingerprint information and the second server authorization information to obtain a second server basic authorization file.

[0163] The third signature module is used to generate the second server authorization file signature information according to the second server encryption key information and the second server basic authorization file.

[0164] The sixth merging module is used to merge the signature information of the second server authorization file and the second server basic authorization file to obtain a second server signed authorization file.

[0165] The fifth encryption module is used to encrypt the second server signature authorization file according to the second server encryption key information to obtain the second server target authorization file.

[0166] The sending module 56 is further configured to send the second server target authorization file to the server corresponding to the second server hardware fingerprint information.

[0167] The software authorization device provided in the embodiment of the present invention can execute the software authorization method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0168] Figure 6 FIG. 1 is a schematic diagram of the structure of another software authorization device provided by an embodiment of the present invention. The software authorization device is arranged in a terminal. Figure 6 As shown, the software authorization device provided in this embodiment includes the following modules: a first decryption module 61 , a first splitting module 62 , a second splitting module 63 , a second decryption module 64 and an operation module 65 .

[0169] The first decryption module 61 is used to decrypt the terminal target authorization file according to the pre-generated terminal decryption key information to obtain the terminal signature authorization file.

[0170] The terminal encryption key information and the terminal decryption key information are a key pair.

[0171] The first splitting module 62 is used to split the terminal signature authorization file to obtain the terminal authorization file signature information and the terminal basic authorization file.

[0172] The second splitting module 63 is used to split the terminal basic authorization file after the signature information of the terminal authorization file is verified, to obtain the basic authorization information of the terminal and the encrypted terminal hardware fingerprint information.

[0173] The second decryption module 64 is used to decrypt the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information.

[0174] The running module 65 is used to run the target software according to the basic authorization information of the terminal after the basic authorization information of the terminal and the hardware fingerprint information of the terminal are verified.

[0175] In one embodiment, the operation module 65 is specifically used to: determine whether it can communicate with the server normally; if it can communicate with the server normally, send a detailed authorization request message to the server, and receive the updated terminal target authorization file sent by the server; decrypt the updated terminal target authorization file according to the terminal decryption key information to obtain an updated terminal signature authorization file; split the updated terminal signature authorization file to obtain the updated terminal authorization file signature information and the terminal detailed authorization file; after the updated terminal authorization file signature information is verified, split the terminal detailed authorization file to obtain the terminal detailed authorization information and the encrypted terminal hardware fingerprint information; decrypt the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information; after the detailed authorization information of the terminal is verified and the terminal hardware fingerprint information is verified, run the target software according to the detailed authorization information of the terminal; if it cannot communicate with the server normally, run the target software according to the basic authorization information of the terminal.

[0176] In one embodiment, the detailed authorization information of the terminal includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period. In terms of running the target software according to the detailed authorization information of the terminal, the running module 65 is specifically used to: determine the authorized function of the terminal in the target software according to the terminal function authorization information; determine the authorized data of the terminal in the target software according to the terminal data authorization information; and run the functions in the target software that meet the authorized functions of the terminal and use the data in the target software that meet the authorization data of the terminal within the terminal authorization period.

[0177] In one embodiment, the device further comprises a sending module, configured to send a re-authorization request to a server after the authorization period of the terminal expires.

[0178] The software authorization device provided in the embodiment of the present invention can execute the software authorization method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0179] Figure 7Schematic diagram of the structure of an electronic device that implements the software authorization method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0180] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0181] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0182] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a software authorization method.

[0183] In some embodiments, the software authorization method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the software authorization method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the software authorization method in any other appropriate manner (e.g., by means of firmware).

[0184] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0185] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0186] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0187] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0188] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0189] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0190] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the software authorization method provided by any embodiment of the present invention.

[0191] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0192] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0193] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A software authorization method, characterized in that: Applicable to servers, including: Encrypt the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information; Merging the encrypted terminal hardware fingerprint information and the basic authorization information of the terminal to obtain a terminal basic authorization file; Generate terminal authorization file signature information according to the terminal encryption key information and the terminal basic authorization file; Merging the terminal authorization file signature information and the terminal basic authorization file to obtain a terminal signature authorization file; Encrypt the terminal signature authorization file according to the terminal encryption key information to obtain a terminal target authorization file; The terminal target authorization file is sent to the terminal so that the terminal verifies the terminal target authorization file and runs the target software according to the basic authorization information of the terminal after the verification is passed.

2. The method according to claim 1, characterized in that: The method further comprises: Receiving a detailed authorization request message sent by the terminal; Combining the encrypted terminal hardware fingerprint information and the detailed authorization information of the terminal to obtain a terminal detailed authorization file; Generate updated terminal authorization file signature information based on the terminal encryption key information and the terminal detailed authorization file; Merging the updated terminal authorization file signature information and the terminal detailed authorization file to obtain an updated terminal signature authorization file; Encrypting the updated terminal signature authorization file according to the terminal encryption key information to obtain an updated terminal target authorization file; The updated terminal target authorization file is sent to the terminal, so that the terminal verifies the updated terminal target authorization file, and after the verification is passed, runs the target software according to the detailed authorization information of the terminal.

3. The method according to claim 2, characterized in that The detailed authorization information of the terminal includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period; The method further comprises at least one of the following: A re-authorization request is received from the terminal; wherein the re-authorization request is sent by the terminal after the authorization period of the terminal expires.

4. The method according to any one of claims 1 to 3, characterized in that: Before encrypting the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information, the method further includes: receiving a first server target authorization file; Decrypt the first server target authorization file according to the pre-generated first server decryption key information to obtain the first server signed authorization file; Splitting the first server signature authorization file to obtain the first server authorization file signature information and the first server basic authorization file; After the signature information of the first server authorization file is verified, the first server basic authorization file is split to obtain the first server authorization information and the encrypted hardware fingerprint information of the first server; Decrypting the encrypted first server hardware fingerprint information according to the first server decryption key information to obtain the first server hardware fingerprint information; After the first server hardware fingerprint information is verified and the first server authorization information is verified, determine to execute the step of "encrypting the terminal hardware fingerprint information according to the pre-generated terminal encryption key information to obtain the encrypted terminal hardware fingerprint information".

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Encrypting the second server hardware fingerprint information according to the pre-generated second server encryption key information to obtain the encrypted second server hardware fingerprint information; Combining the encrypted second server hardware fingerprint information and the second server authorization information to obtain a second server basic authorization file; Generate second server authorization file signature information according to the second server encryption key information and the second server basic authorization file; Merging the second server authorization file signature information and the second server basic authorization file to obtain a second server signature authorization file; Encrypt the second server signature authorization file according to the second server encryption key information to obtain a second server target authorization file; The second server target authorization file is sent to the server corresponding to the second server hardware fingerprint information.

6. A software authorization method, characterized in that: Applied to terminals, including: Decrypt the terminal target authorization file according to the pre-generated terminal decryption key information to obtain the terminal signature authorization file; wherein the terminal encryption key information and the terminal decryption key information form a key pair; Splitting the terminal signature authorization file to obtain terminal authorization file signature information and terminal basic authorization file; After the signature information of the terminal authorization file is verified, the terminal basic authorization file is split to obtain the basic authorization information of the terminal and the encrypted terminal hardware fingerprint information; Decrypting the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information; After the basic authorization information of the terminal is verified and the hardware fingerprint information of the terminal is verified, the target software is run according to the basic authorization information of the terminal.

7. The method according to claim 6, characterized in that After the basic authorization information of the terminal is verified and the hardware fingerprint information of the terminal is verified, running the target software according to the basic authorization information of the terminal includes: Determining whether normal communication with the server is possible; If the communication with the server is normal, a detailed authorization request message is sent to the server, and an updated terminal target authorization file is received from the server; Decrypting the updated terminal target authorization file according to the terminal decryption key information to obtain an updated terminal signature authorization file; Splitting the updated terminal signature authorization file to obtain updated terminal authorization file signature information and terminal detailed authorization file; After the updated terminal authorization file signature information is verified, the terminal detailed authorization file is split to obtain the terminal detailed authorization information and the encrypted terminal hardware fingerprint information; Decrypting the encrypted terminal hardware fingerprint information according to the terminal decryption key information to obtain the terminal hardware fingerprint information; After the detailed authorization information of the terminal is verified and the hardware fingerprint information of the terminal is verified, running the target software according to the detailed authorization information of the terminal; If normal communication with the server is not possible, the target software is run according to the basic authorization information of the terminal.

8. The method according to claim 7, characterized in that The detailed authorization information of the terminal includes at least one of the following: terminal function authorization information, terminal data authorization information, and terminal authorization period; The running of the target software according to the detailed authorization information of the terminal includes: Determining the authorized function of the terminal in the target software according to the terminal function authorization information; Determining the authorization data of the terminal in the target software according to the terminal data authorization information; During the authorization period of the terminal, functions in the target software that are consistent with the authorized functions of the terminal are run, and data in the target software that are consistent with the authorized data of the terminal are used.

9. The method according to claim 8, characterized in that The method further comprises: After the terminal authorization period expires, a re-authorization request is sent to the server.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the software authorization method according to any one of claims 1 to 9.

Images