A system and method for generating tamper-proof authorization documents for an energy management system

Abstract

The present invention belongs to the technical field of file information security, and discloses a system and method for generating tamper-proof authorization files for an energy management system; the method comprises: obtaining system key data when the system receives the authorization file, the system key data comprising the number of equipment points, a function menu, a machine code, a valid time and an authorization file identifier; based on the system key data, customizing the storage format of the data of the authorization file to generate file storage information; encrypting the system key data by an asymmetric algorithm to generate data encryption information; based on the system key data, generating an encrypted authorization file, the encrypted authorization file is generated; executing an activation instruction on the encrypted authorization file; executing a complete detection instruction on the encrypted authorization file, and improving the security of the authorization file.

Description

Technical Field

[0001] The present invention relates to the field of file information security technology, and more specifically, to a system and method for generating tamper-proof authorization files for an energy management system. Background Art

[0002] With the development of social economy, energy shortage and environmental pollution problems are becoming increasingly prominent. All walks of life pay more and more attention to efficient energy management, and the utilization rate of energy management related systems is also increasing. However, due to the increasing prominence of network security and pirated software, the legitimate rights and interests of energy management system developers are infringed and industry rules are undermined.

[0003] The existing publication number CN117171810A provides a low-carbon energy data access system and method for industrial parks, which belongs to the technical field of data access systems. The present invention includes a data collection system, a data management system, a central processing unit and an anti-theft system. The present invention ensures the validity of low-carbon energy data, and promptly corrects missing or tampered data, thereby ensuring the integrity of the data, preventing the data from being arbitrarily tampered or stolen, affecting the normal management of low-carbon energy data, avoiding data loss, further ensuring the integrity of the data, avoiding the risk of theft and destruction of low-carbon energy data due to network security risks, and ensuring the security of low-carbon energy data.

[0004] The existing technology still has the following problems:

[0005] At present, there is a typical method of cracking authorization files, which is to modify and replace the authorization files. For example, a user purchases a one-year energy management system software license. The energy management system manufacturer generates an authorization file based on the time and provides it to the user. After receiving the file, the user backs it up. When the original file authorization expires and cannot be used after one year, the original backup authorization file replaces the existing file, so as to continue to obtain the software authorization; resulting in the security of the authorization file needs to be further improved.

[0006] In view of this, the present invention proposes a system and method for generating tamper-proof authorization files for an energy management system to solve the above problems. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a method for generating a tamper-proof authorization file for an energy management system, comprising:

[0008] Obtaining key system data when the system receives the authorization file, the key system data including the number of device points, function menu, machine code, validity period, and authorization file identifier;

[0009] Based on the key data of the system, the storage format of the data of the authorization file is customized to generate file storage information;

[0010] Encrypt key system data through an asymmetric algorithm to generate data encryption information;

[0011] Generate an encrypted authorization file based on system key data, file storage information and data encryption information;

[0012] Execute activation instructions on the encrypted authorization file;

[0013] Execute the complete detection instruction on the encrypted authorization file.

[0014] Furthermore, the method for customizing the storage format of the data of the authorization file includes:

[0015] Design a file storage information table; the file storage information includes a message header, message length, message body, cyclic redundancy check (CRC) and message tail; the message header and message tail are both fixed values ​​60; the field length of the message length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the message body includes the number of devices, function menu length, function menu, machine code length, machine code and valid time; the field length of the number of devices is 4Byte, the corresponding data type is int32, and the corresponding storage method is the little end mode; the field length of the function menu length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the function The field length of the function menu is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the machine code length is 2Bytes, the corresponding data type is int16, and the corresponding storage method is little-endian mode; the field length of the machine code is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the valid time is 4Bytes, the corresponding data type is int32, and the corresponding storage method is little-endian mode; the field length of the authorization mark is 1Byte, and the corresponding data type is Byte; the field length of the CRC is 4Bytes.

[0016] Furthermore, the complete detection instruction includes:

[0017] Step N1: After the system is started, check whether the authorization file exists. If not, terminate the system operation; if it exists, execute step N2;

[0018] Step N2: Verify whether the machine code of the server where the system is located is consistent with the authorization file. If the machine code of the server where the system is located is inconsistent with the machine code of the authorization file, terminate the system operation; if they are consistent, execute step N3;

[0019] Step N3: Use the RSA private key to decrypt the authorization file content to detect whether the authorization file has been tampered with. If yes, terminate the system operation; if not, execute step N4;

[0020] Step N4: Detect the number of valid device points configured in the system per unit time. If the number of device points in the system is greater than the number of devices in the authorization file, terminate the system operation; if the number of device points in the system is less than or equal to the number of devices in the authorization file, execute step N5;

[0021] Step N5, detecting the access link corresponding to the content in the function menu of the system every unit time, comparing whether the function menu of the system is consistent with the function menu of the authorization file, if they are inconsistent, terminating the system operation; if they are consistent, executing step N6;

[0022] Step N6, check the effective time in the authorization file every unit time; if the effective time is 0 minutes, terminate the system operation; if the effective time is greater than 0 minutes, allow the system to continue to maintain normal operation.

[0023] Furthermore, the data encryption information includes:

[0024] Step M1: Generate a public key and a private key pair through RSA, use the public key to encrypt the key data of the system, and store the private key information;

[0025] Step M2: When verifying the authorization file, use the stored private key to decrypt the data.

[0026] Furthermore, the method for generating the encrypted authorization file includes:

[0027] Step B1: Based on the key data of the system, the maximum number of device points of the encrypted authorization file is set;

[0028] Step B2, generating a function menu;

[0029] Step B3, obtaining the machine code;

[0030] Step B4: Obtain the validity period of the authorization file, and store the validity period in the encrypted authorization file;

[0031] Step B5, adding a unique mark of the authorization file; the unique mark of the authorization file is the authorization file identifier in the system key data;

[0032] Step B6: Based on the file storage information and the data encryption information, double data encryption of the authorized file is implemented;

[0033] Step B7: Generate an encrypted authorization file.

[0034] Furthermore, the method for obtaining the function menu includes:

[0035] Step A1: Process the content of the function menu by using a hash algorithm to generate a hash value of a fixed length, and record the hash value of the fixed length as a first conversion result;

[0036] Step A2, further converting the first conversion result into Hex format (hexadecimal format), where each byte is represented by 2 hexadecimal characters, to generate a second conversion result;

[0037] Step A4: store the second conversion result as a standard Hex format string, record it as a function menu, and store it in the function menu field of the authorization file.

[0038] Furthermore, the activation instruction includes:

[0039] Step P1: When the system is started for the first time, the authorization file information is stored in other locations of the local operating system and in the registry, wherein the authorization file information includes the authorization file identifier of the authorization file and the corresponding authorization time;

[0040] Step P2: If the authorization file information already exists in the local operating system directory or registry, compare the authorization file information to see if they are consistent. If they are consistent, execute step P3; if they are inconsistent, terminate the system operation and issue a warning to the system administrator to indicate possible tampering behavior;

[0041] Step P3: when the system is running, the authorized file is opened exclusively;

[0042] Step P4: Add a daemon process to the system through the operating system port.

[0043] Furthermore, the system is an energy management system; the number of device points is the maximum number of devices supported by the system; the function menu is the function link allowed to be accessed in the system; the machine code is the machine code of the system running server; and the valid time is the remaining valid minutes value of the authorization file.

[0044] A system for generating tamper-proof authorization files for an energy management system, implementing a method for generating tamper-proof authorization files for an energy management system, comprising:

[0045] A data acquisition module, used to acquire key system data when the system receives the authorization file, wherein the key system data includes the number of device points, function menu, machine code, effective time and authorization file identification;

[0046] The first encryption module customizes the storage format of the data of the authorization file based on the key data of the system and generates file storage information;

[0047] Double encryption module, which encrypts key system data through an asymmetric algorithm to generate data encryption information;

[0048] A file generation module generates an encrypted authorization file based on system key data, file storage information and data encryption information;

[0049] File activation module, executes activation instructions on the encrypted authorization file;

[0050] The detection module executes complete detection instructions on the encrypted authorization file.

[0051] The technical effects and advantages of the energy management system tamper-proof authorization file generation system and method of the present invention are as follows:

[0052] For typical authorization file cracking methods, such as replacing backup files or tampering with effective time, the present invention provides all-round protection by integrating static and dynamic verification mechanisms, covering the entire life cycle of authorization files (generation, activation, and runtime detection); first, by doubly encrypting the authorization file, it effectively prevents the authorization file from being illegally tampered with or copied to run on unauthorized devices; then generates the encrypted authorization file; finally, executes the complete detection instruction for dynamic verification, including machine code verification, effective time management, real-time detection of device points and function menus. When it is detected that the authorization file is replaced or tampered with, the system can terminate the operation in time and alarm, thereby improving the security of the authorization file and further protecting the rights and interests of the manufacturer.

[0053] The generation and verification logic of the authorization file in the present invention is decoupled from the core functional modules of the energy management system, and authorization management is implemented through interface calls without modifying the core logic of the energy management system. Furthermore, since the daemon process runs as an independent process when executing file activation instructions, it will not interfere with the normal operation of the energy management system. There is no intrusion into the energy management system, which effectively improves the independence of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a schematic diagram of a system for generating tamper-proof authorization files for an energy management system according to Embodiment 1 of the present invention;

[0055] Figure 2 This is a flow chart of a method for generating a tamper-proof authorization file for an energy management system according to Embodiment 2 of the present invention;

[0056] Figure 3 This is a schematic diagram of a file storage information table in Example 1 of the present invention;

[0057] Figure 4 This is a complete detection instruction flow chart of Example 1 of the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] Example 1

[0060] See also Figure 1 As shown, the energy management system tamper-proof authorization file generation system described in this embodiment includes: a data acquisition module, a single encryption module, a double encryption module, a file generation module, a file activation module and a detection module, and each module is connected by wired and / or wireless connection.

[0061] The data acquisition module is used to obtain the key system data when the system receives the authorization file, and the key system data includes the number of equipment points, function menu, machine code, effective time and authorization file identifier; the system is an energy management system; the number of equipment points is the maximum number of equipment supported by the system; the function menu is the function link allowed to be accessed in the system; the machine code is the machine code of the system running server; the effective time is the remaining valid minutes of the authorization file; the authorization file identifier is a unique mark of the authorization file to prevent the same authorization file from being reused.

[0062] The method for obtaining the function menu includes:

[0063] Step A1: Process the content of the function menu (such as the name of the function module or the code string) through a hash algorithm to generate a hash value of a fixed length, and record the hash value of the fixed length as a first conversion result.

[0064] Step A2: further convert the first conversion result into Hex format (hexadecimal format), where each byte is represented by 2 hexadecimal characters, to generate a second conversion result.

[0065] Step A4: store the second conversion result as a standard Hex format string, record it as a function menu, and store it in the function menu field of the authorization file, so as to serve as a unique identifier of the function menu, ensuring the immutability and consistency of the function menu content.

[0066] The machine code and effective time are obtained through the system interface when the system is running; the device point number, function menu and authorization file identifier are obtained when the authorization file is generated.

[0067] The first encryption module customizes the storage format of the authorization file data based on the system key data and generates file storage information.

[0068] The methods for customizing the storage format of the authorization file data include:

[0069] See also Figure 3 , design a file storage information table; the file storage information includes a message header, a message length, a message body, a cyclic redundancy check (CRC) and a message tail; the message header and the message tail are both fixed values ​​60; the field length of the message length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the message body includes the number of devices, the length of the function menu, the function menu, the machine code length, the machine code and the effective time; the field length of the number of devices is 4Byte, the corresponding data type is int32, and the corresponding storage method is the little end mode; the field length of the function menu length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the function The field length of the function menu is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the machine code length is 2Bytes, the corresponding data type is int16, and the corresponding storage method is little-endian mode; the field length of the machine code is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the valid time is 4Bytes, the corresponding data type is int32, and the corresponding storage method is little-endian mode; the field length of the authorization mark is 1Byte, and the corresponding data type is Byte; the field length of the CRC is 4Bytes.

[0070] The message header is used to mark the beginning of the authorization file, so that the parsing program can identify the beginning of the authorization file and ensure that the data is parsed from the correct position; the message tail is used to mark the end of the authorization file, so that the parsing program knows the end position of the authorization file and avoids reading extra data; the message length is the byte length of the entire message subject part, which is convenient for the system to identify the range of data and ensure that the complete data packet is read; the number of devices is the number of devices supported in the authorization file, which is used to limit the number of valid devices in the authorization file, for example, an authorization file can only be applied to 100 devices; the function menu length is the number of bytes of the function menu content, which is convenient for correct parsing; the function menu is used It is used to record the specific function list of authorization, such as which function modules are supported, and is used to control the functions that users can use in the system; the machine code length identifies the content length of the subsequent machine code, which is convenient for accurate parsing; the machine code is the unique identification code of the recording device, which is used to bind the authorization file to a specific device to prevent it from being copied to other devices and illegally used; the effective time is the validity period of the recorded authorization file, usually expressed in the form of a timestamp, which is used to determine whether the authorization file is within the validity period; the authorization mark marks the status of the authorization file, such as whether it is activated or whether it is a test version; CRC is a hash value for verifying the body of the message, which is used to verify whether the authorization file data is complete and has not been tampered with.

[0071] It should be noted that byte length indicates the size of the storage space occupied by a data, and the unit is byte; field length indicates the defined length of a field in the data structure, and the unit is also byte; field length can be dynamic, while byte length is the actual, fixed storage size.

[0072] The double encryption module encrypts the system's key data through an asymmetric algorithm to generate data encryption information.

[0073] The data encryption information includes:

[0074] Step M1: Generate a public key and a private key pair through RSA, use the public key to encrypt system key data, and store the private key information.

[0075] Step M2: When verifying the authorization file, use the stored private key to decrypt the data.

[0076] The file generation module generates an encrypted authorization file based on system key data, file storage information and data encryption information.

[0077] The method for generating an encrypted authorization file comprises:

[0078] Step B1: Based on the key data of the system, the maximum number of device points of the encrypted authorization file is set.

[0079] Step B2: Generate a function menu.

[0080] Step B3: Get the machine code.

[0081] Step B4: Obtain the validity period of the authorization file, and store the validity period in the encrypted authorization file.

[0082] Step B5: Add a unique mark of the authorization file; the unique mark of the authorization file is the authorization file identifier in the system key data.

[0083] Step B6: Based on the file storage information and the data encryption information, double data encryption of the authorized file is implemented.

[0084] Step B7: Generate an encrypted authorization file.

[0085] By double encrypting the data of the authorization file, the integrity and non-tamperability of the file data are ensured; by combining the machine code and the authorization file identifier, the file copying or illegal dissemination is prevented; at the same time, the present invention supports flexible configuration of the function menu and the number of device points to meet the needs of different authorization files, so that the present invention has dynamic adaptability; by generating the encrypted authorization file according to the structure of the file storage information, the message structure is standardized and clear, ensuring that the authorization file can be correctly parsed and used in different system environments.

[0086] The file activation module executes the activation instruction on the encrypted authorization file.

[0087] The activation instruction includes:

[0088] Step P1: When the system is started for the first time, the authorization file information is stored in other locations of the local operating system and in the registry, wherein the authorization file information includes the authorization file identifier of the authorization file and the corresponding authorization time.

[0089] Step P2: If the authorization file information already exists in the local operating system directory or registry, compare the authorization file information to see if it is consistent. If it is consistent, execute step P3; if it is inconsistent, stop the system operation and send a warning to the system administrator to prompt possible tampering.

[0090] Step P3: When the system is running, the authorization file is opened exclusively so that the authorization file cannot be modified from outside during the system operation.

[0091] Step P4: Add a daemon process to the system to prevent malicious suspension of system services.

[0092] The detection module executes complete detection instructions on the encrypted authorization file.

[0093] See also Figure 4 , the complete detection instruction includes:

[0094] Step N1: After the system is started, check whether the authorization file exists. If not, terminate the system operation; if it exists, execute step N2.

[0095] Step N2: Verify whether the machine code of the server where the system is located is consistent with the authorization file. It is prohibited to run on unauthorized machines. If the machine code of the server where the system is located is inconsistent with the machine code of the authorization file, terminate the system operation; if they are consistent, execute step N3.

[0096] Step N3: Use the RSA private key to decrypt the authorization file content and detect whether the authorization file has been tampered with. If yes, terminate the system operation; if not, execute step N4.

[0097] Step N4: Detect the number of valid device points configured in the system per unit time. If the number of device points in the system is greater than the number of devices in the authorization file, the system has exceeded the authorization scope and the system operation is terminated; if the number of device points in the system is less than or equal to the number of devices in the authorization file, execute step N5.

[0098] Step N5, detect the access link corresponding to the content in the system function menu every unit time, compare whether the system function menu is consistent with the function menu of the authorization file, if not, terminate the system operation; if consistent, execute step N6.

[0099] Step N6, check the effective time in the authorization file every unit time; if the effective time is 0 minutes, terminate the system operation; if the effective time is greater than 0 minutes, allow the system to continue to maintain normal operation.

[0100] Example 2

[0101] See also Figure 2 As shown, this embodiment provides a method for generating a tamper-proof authorization file for an energy management system, comprising:

[0102] Obtaining key system data when the system receives the authorization file, the key system data including the number of device points, function menu, machine code, validity period, and authorization file identifier;

[0103] Based on the key data of the system, the storage format of the data of the authorization file is customized to generate file storage information;

[0104] Encrypt key system data through an asymmetric algorithm to generate data encryption information;

[0105] Generate an encrypted authorization file based on system key data, file storage information and data encryption information;

[0106] Execute activation instructions on the encrypted authorization file;

[0107] Execute the complete detection instruction on the encrypted authorization file.

[0108] Example 3

[0109] The electronic device of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps in the embodiment of the method for generating a tamper-proof authorization file of an energy management system are implemented, such as Figure 2 Alternatively, when the processor executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented, for example Figure 1 Functionality of the modules shown.

[0110] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the terminal device.

[0111] Those skilled in the art will appreciate that these are merely examples of electronic devices and do not constitute a limitation of the electronic device. The electronic device may include more or fewer components than those shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0112] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0113] The memory may be an internal storage unit of the terminal device, such as a hard disk or memory of the terminal device. The memory may also be an external storage device of the terminal device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device. Furthermore, the memory may include both an internal storage unit and an external storage device of the terminal device. The memory is used to store the computer program and other programs and data required by the terminal device. The memory may also be used to temporarily store data that has been output or is to be output.

[0114] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0116] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiment when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0118] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for generating tamper-proof authorization files for an energy management system, characterized in that: include: Obtaining key system data when the system receives the authorization file, the key system data including the number of device points, function menu, machine code, validity period, and authorization file identifier; Based on the key data of the system, the storage format of the data of the authorization file is customized to generate file storage information; Encrypt key system data through an asymmetric algorithm to generate data encryption information; Generate an encrypted authorization file based on system key data, file storage information and data encryption information; Execute activation instructions on the encrypted authorization file; Execute the complete detection instruction on the encrypted authorization file.

2. The method for generating an energy management system tamper-proof authorization file according to claim 1, characterized in that: The methods for customizing the storage format of the authorization file data include: Design a file storage information table; the file storage information includes a message header, message length, message body, cyclic redundancy check (CRC) and message tail; the message header and message tail are both fixed values ​​60; the field length of the message length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the message body includes the number of devices, function menu length, function menu, machine code length, machine code and valid time; the field length of the number of devices is 4Byte, the corresponding data type is int32, and the corresponding storage method is the little end mode; the field length of the function menu length is 2Byte, the corresponding data type is int16, and the corresponding storage method is the little end mode; the function The field length of the function menu is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the machine code length is 2Bytes, the corresponding data type is int16, and the corresponding storage method is little-endian mode; the field length of the machine code is a dynamic Byte number, the corresponding data type is string (UTF-8 format), and the corresponding storage method is little-endian mode; the field length of the valid time is 4Bytes, the corresponding data type is int32, and the corresponding storage method is little-endian mode; the field length of the authorization mark is 1Byte, and the corresponding data type is Byte; the field length of the CRC is 4Bytes.

3. The method for generating an energy management system tamper-proof authorization file according to claim 2, characterized in that: The complete detection instructions include: Step N1: After the system is started, check whether the authorization file exists. If not, terminate the system operation; if it exists, execute step N2; Step N2: Verify whether the machine code of the server where the system is located is consistent with the authorization file. If the machine code of the server where the system is located is inconsistent with the machine code of the authorization file, terminate the system operation; if they are consistent, execute step N3; Step N3: Use the RSA private key to decrypt the authorization file content to detect whether the authorization file has been tampered with. If yes, terminate the system operation; if not, execute step N4; Step N4: Detect the number of valid device points configured in the system per unit time. If the number of device points in the system is greater than the number of devices in the authorization file, terminate the system operation; if the number of device points in the system is less than or equal to the number of devices in the authorization file, execute step N5; Step N5, detecting the access link corresponding to the content in the function menu of the system every unit time, comparing whether the function menu of the system is consistent with the function menu of the authorization file, if they are inconsistent, terminating the system operation; if they are consistent, executing step N6; Step N6, check the effective time in the authorization file every unit time; if the effective time is 0 minutes, terminate the system operation; if the effective time is greater than 0 minutes, allow the system to continue to maintain normal operation.

4. The method for generating an energy management system tamper-proof authorization file according to claim 1, characterized in that: The data encryption information includes: Step M1: Generate a public key and a private key pair through RSA, use the public key to encrypt the key data of the system, and store the private key information; Step M2: When verifying the authorization file, use the stored private key to decrypt the data.

5. The method for generating an energy management system tamper-proof authorization file according to claim 1, characterized in that: The method for generating an encrypted authorization file comprises: Step B1: Based on the key data of the system, the maximum number of device points of the encrypted authorization file is set; Step B2, generating a function menu; Step B3, obtaining the machine code; Step B4: Obtain the validity period of the authorization file, and store the validity period in the encrypted authorization file; Step B5, adding a unique mark of the authorization file; the unique mark of the authorization file is the authorization file identifier in the system key data; Step B6: Based on the file storage information and the data encryption information, double data encryption of the authorized file is implemented; Step B7: Generate an encrypted authorization file.

6. The method for generating tamper-proof authorization files for an energy management system according to claim 1, characterized in that: The method for obtaining the function menu includes: Step A1: Process the content of the function menu by using a hash algorithm to generate a hash value of a fixed length, and record the hash value of the fixed length as a first conversion result; Step A2, further converting the first conversion result into Hex format (hexadecimal format), where each byte is represented by 2 hexadecimal characters, to generate a second conversion result; Step A4: store the second conversion result as a standard Hex format string, record it as a function menu, and store it in the function menu field of the authorization file.

7. The method for generating tamper-proof authorization files for an energy management system according to claim 1, characterized in that: The activation instruction includes: Step P1: When the system is started for the first time, the authorization file information is stored in other locations of the local operating system and in the registry, wherein the authorization file information includes the authorization file identifier of the authorization file and the corresponding authorization time; Step P2: If the authorization file information already exists in the local operating system directory or registry, compare the authorization file information to see if they are consistent. If they are consistent, execute step P3; if they are inconsistent, terminate the system operation and issue a warning to the system administrator to indicate possible tampering behavior; Step P3: when the system is running, the authorized file is opened exclusively; Step P4: Add a daemon process to the system through the operating system port.

8. The method for generating tamper-proof authorization files for an energy management system according to claim 1, characterized in that: The system is an energy management system; the number of device points is the maximum number of devices supported by the system; the function menu is the function link allowed to be accessed in the system; the machine code is the machine code of the system running server; and the validity time is the remaining valid minutes value of the authorization file.

9. A system for generating tamper-proof authorization files for an energy management system, implementing a method for generating tamper-proof authorization files for an energy management system as claimed in any one of claims 1 to 8, characterized in that: include: A data acquisition module, used to acquire key system data when the system receives the authorization file, wherein the key system data includes the number of device points, function menu, machine code, effective time and authorization file identification; The first encryption module customizes the storage format of the data of the authorization file based on the key data of the system and generates file storage information; Double encryption module, which encrypts key system data through an asymmetric algorithm to generate data encryption information; A file generation module generates an encrypted authorization file based on system key data, file storage information and data encryption information; File activation module, executes activation instructions on the encrypted authorization file; The detection module executes complete detection instructions on the encrypted authorization file.

Images