A method, device and storage medium for authorization protection

Abstract

The present invention relates to the field of computer security protection technology, and specifically to an authorization protection method, device and storage medium, the method comprising the following steps: S1, after the power-on authorization device is inserted into the main device, verify the legitimacy of the signature of the other party; S2, after the main device is verified, generate a first negotiation key and reply to the confirmation information; S3, after the power-on authorization device receives the confirmation information, generate a second negotiation key; then transform it with the first negotiation key to obtain the key; S4, make the power-on authorization device encrypt the first key stored locally with the transformed key and send it to the main device; make the main device decrypt the received first key with the transformed key, obtain the first key plaintext, and then synthesize the first key with the second key stored locally into a power-on key; S5, make the main device decrypt the loading file through the power-on key, run the loading file, and enter the working state. The present invention can greatly improve the security of the device.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security protection, and in particular to an authorization protection method, device and storage medium. Background Art

[0002] With the development of society, more and more affairs are completed with the help of equipment. Due to the particularity of the affairs handled by certain equipment, the equipment is only allowed to be operated by specific people. In order to prevent the equipment from being operated by unauthorized people, one method is for authorized personnel to physically keep the equipment. However, many devices are large in size, and it is inconvenient to move or keep them separately. Another method is to add a power-on authorization device to the equipment. The power-on authorization device generally has the characteristics of small size, light weight, and low power consumption. Each time the equipment is turned on, the correct power-on authorization device needs to be inserted. After the authorization is successful, the equipment will start and run normally. The authorized personnel will then physically keep the power-on authorization device separately.

[0003] One design method of the power-on authorization device is to put some special identity information in the power-on authorization device. The main device identifies whether the identity information in the power-on authorization device is legal. If it is legal, the power-on is successful, and if it is not legal, the power-on fails. When the main device is turned on and the power-on authorization device is inserted, the main device and the power-on authorization device exchange identity information. The commonly used information exchange methods are relatively simple, and many are transmitted in the open transmission method. It is easy for others to crack the power-on authorization device by intercepting the transmitted information. Summary of the invention

[0004] One of the purposes of the present invention is to provide an authorization protection method, which can significantly improve the security of the device and avoid the problem of cracking the power-on authorization device by intercepting the transmission information in the prior art.

[0005] In order to achieve the above object, an authorization protection method is provided, comprising the following steps:

[0006] S1. After the power-on authorization device is inserted into the main device, the power-on authorization device and the main device verify the legitimacy of each other's signature;

[0007] S2. After the main device passes the verification, it generates a first negotiated key and replies with confirmation information;

[0008] S3. After the power-on authorization device receives the confirmation information, a second negotiated key is generated; the first negotiated key and the second negotiated key are transformed to obtain a key;

[0009] S4, causing the power-on authorization device to encrypt the first key stored locally with the transformed key and send the encrypted key to the main device; causing the main device to decrypt the received first key with the transformed key to obtain the first key plaintext, and then synthesize the first key and the second key stored locally into a power-on key;

[0010] S5. The main device decrypts the loading file through the power-on key, runs the loading file, and enters the working state.

[0011] Furthermore, the verification of the legitimacy of the signature of the other party in step S1 specifically includes the following steps:

[0012] S101, after the power-on authorization device is inserted into the main device, a set of temporary random number pairs is generated, and the temporary random number pairs are used as the first temporary public key and the first temporary secret key respectively, and then the first temporary public key is sent to the main device, and a reply from the main device is waited;

[0013] S102, after receiving the first temporary public key, the main device generates a temporary random number pair of the main end, and uses the temporary random number pair as the second temporary public key and the second temporary key respectively; generates first signature data through the second temporary key, and sends the second temporary public key and the first signature data to the power-on authorization device;

[0014] S103, after the power-on authorization device receives the second temporary public key and the first signature data sent by the main device, it verifies the correctness of the first signature data. After the verification is correct, it generates the second signature data by using the first temporary key and sends it to the main device;

[0015] S104, the main device verifies the second signature data received from the power-on authorization device, and after the verification is correct, executes step S2.

[0016] Furthermore, in steps S101 and S102, the temporary random number pairs are generated based on local storage information.

[0017] Furthermore, in step S101, if the power-on authorization device does not receive a reply from the main device within a set time threshold, a set of temporary random number pairs is regenerated and sent to the main device.

[0018] The second object of the present invention is to provide an authorization protection device, which uses the above-mentioned authorization protection method, including a power-on authorization device and a main device. The power-on authorization device needs to be inserted into the main device to establish a communication connection for use.

[0019] A third object of the present invention is to provide a computer-readable storage medium, characterized in that: the computer-readable storage medium includes an authorization protection program, and when the authorization protection program is executed by a processor, the steps of an authorization protection method as described above are implemented.

[0020] Principles and advantages:

[0021] This solution is designed with four layers of encryption verification, which can greatly increase security.

[0022] The first layer: Both parties verify the legitimacy of each other's signature. When the power-on authorization device exchanges key information with the main device, a random number is generated based on the locally stored information. The data for each interaction is different. Even if others intercept the interaction information, they cannot extract the key information from it.

[0023] The second layer: the power-on authorization device and the main device obtain the first negotiated key and the second negotiated key respectively, and transform the first negotiated key and the second negotiated key again; the key used to encrypt the first key is obtained by transforming the first negotiated key and the second negotiated key of the power-on authorization device and the main device, which can be conveniently added with random rules, and is different each time, further increasing the difficulty of cracking.

[0024] The third layer: The power-on key is split into two parts, including the first key and the second key, which are stored in the power-on authorization device and the main device respectively; if the key used to encrypt the first key cannot be obtained through the second layer, the main device will not get the complete power-on key, thus further increasing the difficulty of cracking.

[0025] The fourth layer: The local loading files of the main device are encrypted and stored, and need the third layer of power-on key to decrypt. If others obtain the main device but do not obtain the power-on authorization device, they will not be able to pass the first three layers, and will not be able to obtain the power-on key, and thus will not be able to crack the loading files from the main device. It achieves unbreakability and greatly improves the security of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The present invention is a flowchart of an authorization protection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following is further described in detail through specific implementation methods:

[0028] Example

[0029] An authorization protection method and device, basically as follows Figure 1 As shown, the following steps are included:

[0030] S1. After the power-on authorization device is inserted into the main device, the main device is powered on. The power-on authorization device and the main device verify the legitimacy of each other's signature respectively. The verification of the legitimacy of the signature of the other party in step S1 specifically includes the following steps:

[0031] S101. After the power-on authorization device is inserted into the main device, a set of temporary random number pairs is generated, and the temporary random number pairs are used as the first temporary public key and the first temporary secret key respectively, and then the first temporary public key is sent to the main device, and the main device is waited for a reply; the temporary random number pairs are generated based on local storage information. In step S101, if the power-on authorization device does not receive a reply from the main device within a set time threshold, a set of temporary random number pairs is regenerated and sent to the main device.

[0032] S102. After the main device receives the first temporary public key, it generates a temporary random number pair on the main end, and uses the temporary random number pair as the second temporary public key and the second temporary secret key respectively; generates the first signature data through the second temporary key, and sends the second temporary public key and the first signature data to the power-on authorization device; the temporary random number pairs are all generated based on the locally stored information.

[0033] S103, after the power-on authorization device receives the second temporary public key and the first signature data sent by the main device, it verifies the correctness of the first signature data. After the verification is correct, it generates the second signature data by using the first temporary key and sends it to the main device;

[0034] S104, the main device verifies the second signature data received from the power-on authorization device, and after the verification is correct, executes step S2.

[0035] S2. After the main device passes the verification, it generates a first negotiated key and replies with confirmation information;

[0036] S3. After the power-on authorization device receives the confirmation information, a second negotiated key is generated; the first negotiated key and the second negotiated key are transformed to obtain a key; in this embodiment, the first negotiated key and the second negotiated key are transformed by staggering to obtain the key.

[0037] S4, causing the power-on authorization device to encrypt the first key stored locally with the transformed key and send the encrypted key to the main device; causing the main device to decrypt the received first key with the transformed key to obtain the first key plaintext, and then synthesize the first key and the second key stored locally into a power-on key;

[0038] S5. The main device decrypts the loading file through the power-on key, runs the loading file, and enters the working state.

[0039] An authorization protection device, which uses the authorization protection method as described above, includes a power-on authorization device and a main device. The power-on authorization device needs to be inserted into the main device, and is used when the main device is powered on and connected for communication. The power-on authorization device generates a random number pair based on local storage information, and uses the temporary random number pair as a first temporary public key and a first temporary secret key respectively; it also stores an identity ID, a second temporary public key sent by the main device, and a first secret key constituting a power-on key;

[0040] The main device generates a random number pair based on local storage information, and uses the temporary random number pair as a first temporary public key and a first temporary secret key respectively; it also stores an identity ID, a first temporary public key sent by a power-on authorization device, and a second secret key constituting a power-on key.

[0041] After the main device is turned on, if the power-on authorization device is not inserted to authorize its power-on, the main device is in a state of waiting for power-on authorization and cannot enter a normal working state or perform other operations.

[0042] After the power-on authorization device is inserted, the main device exchanges key information with the power-on authorization device to confirm that the power-on authorization device is legal. After it is legal, the power-on authorization device encrypts the local first key and sends it to the main device. The main device combines the received first key with the local second key to synthesize the power-on key, decrypt the locally stored loading file, and enter the working state after the loading is successful.

[0043] A computer-readable storage medium includes an authorization protection program. When the authorization protection program is executed by a processor, the steps of the authorization protection method described above are implemented.

[0044] Those skilled in the art can understand that all or part of the processes in the above-mentioned authorization protection method can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the various embodiments of the above-mentioned authorization protection method. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0045] The above is only an embodiment of the present invention. The common sense such as the known specific structure and characteristics in the scheme is not described in detail here. The ordinary technicians in the relevant field know all the common technical knowledge in the technical field of the invention before the application date or priority date, can obtain all the existing technologies in the field, and have the ability to apply the conventional experimental means before that date. The ordinary technicians in the relevant field can improve and implement this scheme in combination with their own abilities under the enlightenment given by this application. Some typical known structures or known methods should not become obstacles for ordinary technicians in the relevant field to implement this application. It should be pointed out that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can be made, which should also be regarded as the protection scope of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent. The protection scope required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. An authorization protection method, characterized in that: The following steps are involved: S1. After the power-on authorization device is inserted into the main device, the power-on authorization device and the main device verify the legitimacy of each other's signature; S2. After the main device passes the verification, it generates a first negotiated key and replies with confirmation information; S3. After the power-on authorization device receives the confirmation information, a second negotiation key is generated; Then transform the first negotiated key and the second negotiated key to obtain a key; S4, causing the power-on authorization device to encrypt the first key stored locally with the transformed key and send the encrypted key to the main device; The main device uses the transformed key to decrypt the received first key to obtain the first key plaintext, and then combines the first key with the second key stored locally to form a power-on key; S5. The main device decrypts the loading file through the power-on key, runs the loading file, and enters the working state.

2. The authorization protection method according to claim 1, characterized in that: Verifying the legitimacy of the signature of the other party in step S1 specifically includes the following steps: S101, after the power-on authorization device is inserted into the main device, a set of temporary random number pairs is generated, and the temporary random number pairs are used as the first temporary public key and the first temporary secret key respectively, and then the first temporary public key is sent to the main device, and a reply from the main device is waited; S102, after receiving the first temporary public key, the main device generates a temporary random number pair of the main end, and uses the temporary random number pair as the second temporary public key and the second temporary key respectively; generates first signature data through the second temporary key, and sends the second temporary public key and the first signature data to the power-on authorization device; S103, after the power-on authorization device receives the second temporary public key and the first signature data sent by the main device, it verifies the correctness of the first signature data. After the verification is correct, it generates the second signature data by using the first temporary key and sends it to the main device; S104, the main device verifies the second signature data received from the power-on authorization device, and after the verification is correct, executes step S2.

3. The authorization protection method according to claim 2, characterized in that: In the steps S101 and S102, the temporary random number pairs are generated based on the locally stored information.

4. The authorization protection method according to claim 3, characterized in that: In step S101, if the power-on authorization device does not receive a reply from the main device within a set time threshold, a set of temporary random number pairs is regenerated and sent to the main device.

5. An authorization protection device, characterized in that: The authorization protection method as described in any one of claims 1 to 4 above is used, including a power-on authorization device and a main device, and the power-on authorization device needs to be inserted into the main device to establish a communication connection for use.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes an authorization protection program, and when the authorization protection program is executed by a processor, the steps of an authorization protection method as described in any one of claims 1 to 4 are implemented.

Images