License authorization management method for software platform

Abstract

The invention discloses a license authorization management method for a software platform, which comprises the following steps of: storing files or data by adopting a multi-way tree type storage structure, granting a user permission of a corresponding node level according to different nodes of the multi-way tree type storage structure, generating a unique machine code according to the user permission and server hardware information, and storing the unique machine code into a server; performing digital signature on the machine code to generate a legal authorization file; finally, when the user accesses the corresponding node, performing authorization file verification, and judging whether the authorization file verification is passed or not; and the effect of browsing, viewing or modifying hierarchical management aiming at users with different permissions is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of data management, and in particular, relates to a software platform license authorization management method. Background Art

[0002] With the development of the software industry, the importance of software authorization management has become increasingly prominent. Traditional authorization management methods usually rely on symmetric encryption or simple authentication mechanisms, which face problems such as easy cracking and unclear authorization scope. In modern cloud computing and distributed systems, the requirements for the security, effectiveness and flexibility of authorization files have become more stringent. Therefore, there is an urgent need for a license authorization mechanism based on high-intensity encryption technology that can support multiple authorization levels and provide efficient management.

[0003] The defect in the prior art is that there is a lack of a license authorization management method with different levels, clear permissions and high flexibility for users with different permissions to browse, view or modify files or data in a distributed storage system. Summary of the invention

[0004] Aiming at the problem that the existing software platform license authorization method lacks the ability to browse, view or modify hierarchical levels for users with different permissions, the present invention provides a software platform license authorization management method.

[0005] In order to achieve the above technical objectives, the technical solution adopted by the present invention is as follows: A software platform license authorization management method comprises the following steps: S1. An authorized administrator creates a multi-tree storage structure for files or data. The multi-tree storage directory structure, main nodes, and branch nodes are all preset with key-value pairs; S2. Authorize user rights of corresponding levels according to different nodes of the storage structure of the file or data. The user rights information includes authorization level, validity period, number of forms, number of users and user ID; S3, generating a unique machine code according to the corresponding level of user authority and server hardware information; S4, using an asymmetric encryption algorithm to digitally sign the authorization level in the machine code to obtain a first digital signature, and then interleaving and splicing other character strings in the machine code except the authorization level to obtain a second digital signature; The string interleaving is a dynamic programming method, which randomly arranges the strings in the machine code except the authorization level within a preset period; The authorization administrator packages the initial random string sequence of the first digital signature and the second digital signature as a public key to generate a LIC authorization file and sends it to the user end, and the period is stored as a private key on the authorization administrator end.

[0006] Furthermore, it also includes authorization file verification, and the detailed steps of authorization file verification include: S5. When a user accesses a file or data node created by an authorized administrator, the authorization file is verified and it is determined whether the authorization file verification is passed. If it is passed, the process proceeds to step S6; if it is not passed, the process proceeds to step S7; S6. Allows users to access authorized administrators to create files or data nodes; S7. The user chooses to give up access to the authorized administrator to create files or data nodes, or submits a permission activation application to the user authority personnel and authorized administrator of the upper level of the multi-tree storage structure; S8. Based on the joint authorization of the upper-level user authority personnel and the authorized administrator, return to step S3 and perform a second authorization file verification.

[0007] Furthermore, the detailed steps for generating a unique machine code for the corresponding level of user permissions are as follows: The authorization level is the product of all authorization levels of the next node. The authorization level is a key-value pair preset in the multi-tree storage directory structure, main node and branch node; the authorization level value is a prime number.

[0008] Convert the authorization level, validity period, number of forms, number of users, and user ID into strings; Concatenate the authorization level, validity period, number of forms, number of users, and user ID strings.

[0009] Furthermore, the server hardware information includes hardware ID, authorization period, IP address and MAC address; Detailed steps to generate a unique machine code from server hardware information: Convert hardware ID, authorization period, IP address and MAC address into strings; Concatenate the converted strings of hardware ID, authorization period, IP address, and MAC address.

[0010] Furthermore, the specific steps of the string interleaving method as a dynamic programming method are as follows: The validity period, number of forms, number of users, user ID, hardware ID, authorization period, IP address, and MAC address strings are randomly arranged and concatenated; A cycle is preset to randomly arrange the above randomly arranged character strings again; The initial random permutation string sequence is sent to the user end as a public key, and the period is stored as a private key on the authorized administrator end.

[0011] Furthermore, the multitree storage structure of files or data is divided into a multitree storage structure of files and a multitree storage structure of data; The multitree storage structure of the file includes the file name, the multitree storage directory structure and the file storage path or storage relationship; The multi-tree storage structure of data includes the index directions of the main node, branch node and child node; The data or data table to be stored is stored in the corresponding multi-tree storage directory structure, main node and branch node.

[0012] Furthermore, the detailed steps of step S2 include: S201, traverse one level upward or downward and one node upward or downward according to the node file storage path or storage relationship of the multi-tree storage directory structure and the node position where the branch node is located, and use the node and branch node storage files or data of the current multi-tree storage directory structure as the object that can be queried, modified and deleted; S202, authorizing corresponding levels according to the node depth corresponding to the nodes and branch nodes of the multi-tree storage directory structure; S203. The corresponding level authorization needs to match the corresponding user authority information, and the user authority information includes the authorization level, validity period, number of forms, number of users and user ID.

[0013] Furthermore, the detailed steps of using an asymmetric encryption algorithm to digitally sign the authorization level in the machine code are as follows: Randomly select corresponding prime numbers to assign p and q to the preset key-value pair with the lowest node level in the authorization level; Calculate the public modulus of other key-value pairs in the multitree storage directory structure, main node and branch node higher than the lowest level one by one. The public modulus calculation formula is: n=p*q, n is the public modulus, p and q are the preset key-value pairs of the lowest node level in the authorization level, which are two random prime numbers; Convert the public modulus into binary code; Calculate the Euler function. The calculation formula of the Euler function is: , is the number of positive integers less than or equal to n that are coprime with n; Calculate the public key: , the value of e is a positive integer, e and are mutually prime; Calculate the private key: e*d % m = 1, where , get: public key = (e, n), private key = (d, n); The private key calculation is to find a d such that e*d % m = 1, which is equivalent to e*d-1=y*m (y is an integer); To get d, we actually solve the quadratic equation of two variables e*xm*y=1, where e and m are known quantities, and we need to find x and y. The above equation can be solved using the extended Euclidean algorithm to obtain the public key = (e, n), the private key = (d, n); Encryption generates ciphertext: , C is the ciphertext, M is the plaintext; Decryption generates plaintext: , C is the ciphertext and M is the plaintext.

[0014] Furthermore, the string interleaving method is a dynamic programming method, and its specific steps are: The validity period, number of forms, number of users, user ID, hardware ID, authorization period, IP address, and MAC address strings are randomly arranged and concatenated; A cycle is preset to randomly arrange the above randomly arranged character strings again; The initial random permutation string sequence is sent to the user end as a public key, and the period is stored as a private key on the authorized administrator end.

[0015] Furthermore, when the second digital signature is verified, the second digital signature is performed only after the first digital signature is successfully verified; the second digital signature verification steps are: First, verify whether the initial random string sequence in the packaged LIC authorization file is completely matched. If it is matched, it will proceed to the next step. If it is not matched, a second digital signature verification error will be sent; The authorized administrator sends the private key period and initial signature time to the user; The user end calculates the result value of the number of times the initial random permutation string sequence is changed, and returns it to the authorized administrator end to verify whether the result value of the number of times the initial random permutation string sequence is changed is correct. If it is correct, the second digital signature verification is successful.

[0016] Compared with the prior art, the present invention has the following beneficial effects: By using a multi-tree storage structure to store files or data, granting user permissions of the corresponding node level according to the different nodes of the multi-tree storage structure, and then generating a unique machine code based on the user permissions and server hardware information, and then digitally signing the machine code to generate a legal authorization file; the hierarchical management function of browsing, viewing or modifying for users with different permissions is realized. At the same time, an asymmetric encryption algorithm and a dynamic programming method are used to realize digital signatures, and the first digital signature and the second digital signature are obtained, which improves the security and convenience of browsing, viewing or modifying the authorization file. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is an overall flow chart of a software platform license authorization management method in an embodiment of the present invention; Figure 2 Detailed step flow chart of step S2 in the embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to facilitate the understanding of those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings. The contents mentioned in the implementation modes are not intended to limit the present invention.

[0019] like Figure 1 As shown, a software platform license authorization management method includes the following steps: S1. An authorized administrator creates a multi-tree storage structure for files or data. The multi-tree storage directory structure, main nodes, and branch nodes are all preset with key-value pairs; S2. Authorize user rights of corresponding levels according to different nodes of the storage structure of the file or data. The user rights information includes authorization level, validity period, number of forms, number of users and user ID; S3, generating a unique machine code according to the corresponding level of user authority and server hardware information; S4. Use an asymmetric encryption algorithm to digitally sign the authorization level in the machine code to obtain a first digital signature, and then interleave and splice other strings in the machine code except the authorization level to obtain a second digital signature; the asymmetric encryption algorithm is the RSA algorithm. The RSA algorithm is used to improve the security of encryption.

[0020] String interleaving is a dynamic programming method, which randomly arranges the strings in the machine code except the authorized level within a preset period; the interleaving algorithm and rules are preset by the authorized administrator, and can be modified by the upper-level user authority personnel at a later time, but the modification of the interleaving algorithm and rules must be determined jointly by the authorized administrator and the upper-level user authority personnel.

[0021] The authorization administrator packages the initial random string sequence of the first digital signature and the second digital signature as a public key to generate a LIC authorization file and sends it to the user end, and the period is stored as a private key on the authorization administrator end.

[0022] It also includes authorization file verification. The detailed steps of authorization file verification include: S5. When a user accesses a file or data node created by an authorized administrator, the authorization file is verified and it is determined whether the authorization file verification passes. If it passes, the process proceeds to step S6; if it fails, the process proceeds to step S7.

[0023] S6. Allows users to access authorized administrators to create files or data nodes; S7. The user chooses to give up access to the authorized administrator to create files or data nodes, or submits a permission activation application to the user authority personnel and authorized administrator of the upper level of the multi-tree storage structure; S8. Based on the joint authorization of the upper-level user authority personnel and the authorized administrator, return to step S3 and perform secondary authorization file verification. For users with changed authority, secondary authorization and secondary verification are used to improve the flexibility of authorization.

[0024] Detailed steps to generate a unique machine code for the corresponding level of user permissions: The authorization level is the product of all authorization levels of the next node. The authorization level is a key-value pair preset in the multi-tree storage directory structure, main node and branch node; the authorization level value is a prime number.

[0025] Convert the authorization level, validity period, number of forms, number of users, and user ID into strings; Concatenate the authorization level, validity period, number of forms, number of users, and user ID strings.

[0026] Server hardware information includes hardware ID, authorization period, IP address and MAC address; Detailed steps to generate a unique machine code from server hardware information: Convert hardware ID, authorization period, IP address and MAC address into strings; Concatenate the converted strings of hardware ID, authorization period, IP address, and MAC address.

[0027] The specific steps of the string interleaving method as a dynamic programming method are as follows: The validity period, number of forms, number of users, user ID, hardware ID, authorization period, IP address, and MAC address strings are randomly arranged and concatenated; A cycle is preset to randomly arrange the above randomly arranged character strings again; The initial random permutation string sequence is sent to the user end as a public key, and the period is stored as a private key on the authorized administrator end.

[0028] The multitree storage structure of files or data is divided into a multitree storage structure of files and a multitree storage structure of data; The multitree storage structure of a file includes the file name, multitree storage directory structure and file storage path or storage relationship; the file storage path or storage relationship facilitates direct location of the file storage location and hierarchical relationship in the multitree storage directory structure. The storage depth represents the length and depth of the file storage path; the current node file storage path can only query or modify the nodes under its own node branch, but cannot query or modify the data in other node files at the same level of its own node, let alone query the data or permission information in the previous node file.

[0029] The multi-tree storage structure of data includes the index directions of the main node, branch node and child node; the index direction of the child node helps to verify and determine the subsequent relationship between the child node's upper navigation data storage table and the lower detailed index child node index detailed data storage table, that is, the relationship between the upper and lower level data storage index tables of the current node.

[0030] The data or data table to be stored is stored in the corresponding multi-tree storage directory structure, main node and branch node; The multitree storage directory structure, main nodes and branch nodes are preset with key-value pairs.

[0031] like Figure 2 As shown, the detailed steps of step S2 include: S201, traverse one level upward or downward and one node upward or downward according to the node file storage path or storage relationship of the multi-tree storage directory structure and the node position where the branch node is located, and use the node and branch node storage files or data of the current multi-tree storage directory structure as the object that can be queried, modified and deleted; S202, authorizing corresponding levels according to the node depth corresponding to the nodes and branch nodes of the multi-tree storage directory structure; S203, the corresponding level authorization needs to match the corresponding user authority information, and the user authority information includes the authorization level, validity period, number of forms, number of users and user ID. The corresponding authority files and data are managed by level, and the authority is clear.

[0032] Detailed steps for digitally signing the authorization level in the machine code using an asymmetric encryption algorithm: Randomly select corresponding prime numbers for assigning p and q to the preset key-value pairs with the lowest node level in the authorization level; at least two preset key-value pairs with the lowest level are composed, and according to the actual situation, three or more key-value pairs may also be composed; Calculate the public modulus of other key-value pairs in the multitree storage directory structure, main node and branch node higher than the lowest level one by one. The public modulus calculation formula is: n=p*q, n is the public modulus, p and q are the preset key-value pairs of the lowest node level in the authorization level, which are two random prime numbers; Convert the public modulus into binary code; Calculate the Euler function. The calculation formula of the Euler function is: , is the number of positive integers less than or equal to n that are coprime with n; Calculate the public key: , the value of e is a positive integer, e and are mutually prime; Calculate the private key: e*d % m = 1, where , get: public key = (e, n), private key = (d, n); The private key calculation is to find a d such that e*d % m = 1, which is equivalent to e*d-1=y*m (y is an integer).

[0033] To get d, we actually need to solve the linear equation of two variables e*xm*y=1, where e and m are known quantities, and we need to find x and y.

[0034] The above equation can be solved using the extended Euclidean algorithm to obtain the public key = (e, n), the private key = (d, n).

[0035] Encryption generates ciphertext: , C is the ciphertext, M is the plaintext; Decryption generates plaintext: , C is the ciphertext and M is the plaintext.

[0036] The string interleaving method is a dynamic programming method, and its specific steps are: The validity period, number of forms, number of users, user ID, hardware ID, authorization period, IP address, and MAC address strings are randomly arranged and concatenated; A cycle is preset to randomly arrange the above randomly arranged character strings again; The initial random string sequence is sent to the user as a public key, and the period is stored as a private key on the authorized administrator side. The dynamic programming method for randomly arranging the string sequence within the period is fixed. When the second digital signature is subsequently verified, it is fed back to the authorized administrator side according to the time. The authorized administrator side then verifies according to the periodic change law (random string sequence).

[0037] During the verification process, the first digital signature and the second digital signature will also include a time range comparison method to determine whether the current clock is within the validity period and the authorization period.

[0038] When the second digital signature is verified, the second digital signature is performed only after the first digital signature is successfully verified; the second digital signature verification steps are: First, verify whether the initial random string sequence in the packaged LIC authorization file is completely matched. If it is matched, it will proceed to the next step. If it is not matched, a second digital signature verification error will be sent; The authorized administrator sends the private key period and initial signature time to the user; The user end calculates the result value of the number of times the initial random permutation string sequence is changed, and returns it to the authorized administrator end to verify whether the result value of the number of times the initial random permutation string sequence is changed is correct. If it is correct, the second digital signature verification is successful.

[0039] The dynamic programming method is a bottom-up solution that avoids repeated calculations by splitting the problem into sub-problems and saving the results of the sub-problems. For the interleaved string problem, a two-dimensional array dp can be used to save the results of the sub-problems, where dp[i][j] indicates whether the first i characters of s1 and the first j characters of s2 can be interleaved to form the first i+j characters of s3. The implementation steps of the dynamic programming method are as follows: Initialize dp = True, indicating that two empty strings can be interleaved to form an empty string.

[0040] Traverse each character of s1 and s2 and update the value of the dp array.

[0041] Finally, dp[m][n] is returned, where m and n are the lengths of s1 and s2 respectively.

[0042] Code example: The following is a Kotlin code example that uses dynamic programming to implement interleaving: fun isInterleave(s1: String, s2: String, s3: String): Boolean { val m = s1.length val n = s2.length val l = s3.length if (m + n != l) { return false } val dp = Array(m + 1) { Array(n + 1) { false}} dp = true for (i in 0..m) { for (j in 0..n) { if (i > 0) { dp[i][j] = dp[i][j] || (dp[i - 1][j] && s1[i - 1] == s3[i + j - 1]) } if (j > 0) { dp[i][j] = dp[i][j] || (dp[i][j - 1] && s2[j - 1] == s3[i + j - 1]) } } } return dp[m][n] }.

[0043] Compared with the prior art, the present invention has the following beneficial effects: By using a multi-tree storage structure to store files or data, granting user permissions of the corresponding node level according to the different nodes of the multi-tree storage structure, and then generating a unique machine code based on the user permissions and server hardware information, and then digitally signing the machine code to generate a legal authorization file; the hierarchical management function of browsing, viewing or modifying for users with different permissions is realized. At the same time, an asymmetric encryption algorithm and a dynamic programming method are used to realize digital signatures, and the first digital signature and the second digital signature are obtained, which improves the security and convenience of browsing, viewing or modifying the authorization file.

[0044] The string interleaving method is set as a dynamic programming method to prevent the initial random permutation string order from being intercepted, resulting in the risk of initial random permutation string leakage.

[0045] The above is a detailed introduction to a software platform license authorization management method provided by the present application. The description of the specific embodiment is only used to help understand the method and its core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A software platform license authorization management method, characterized in that: Includes steps: S1. An authorized administrator creates a multi-tree storage structure for files or data. The multi-tree storage directory structure, main nodes, and branch nodes are all preset with key-value pairs; S2. Authorize user rights of corresponding levels according to different nodes of the storage structure of files or data. User rights include authorization level, validity period, number of forms, number of users and user ID; S3, generating a unique machine code according to the corresponding level of user authority and server hardware information; S4, using an asymmetric encryption algorithm to digitally sign the authorization level in the machine code to obtain a first digital signature, and then interleaving and splicing other character strings in the machine code except the authorization level to obtain a second digital signature; The string interleaving is a dynamic programming method, which randomly arranges the strings in the machine code except the authorization level within a preset period; The authorization administrator packages the initial random string sequence of the first digital signature and the second digital signature as a public key to generate a LIC authorization file and sends it to the user end, and the period is stored as a private key on the authorization administrator end.

2. A software platform license authorization management method according to claim 1, characterized in that: It also includes authorization file verification. The detailed steps of authorization file verification include: S5. When a user accesses a file or data node created by an authorized administrator, the authorization file is verified and it is determined whether the authorization file verification is passed. If it is passed, the process proceeds to step S6; if it is not passed, the process proceeds to step S7; S6. Allows users to access authorized administrators to create files or data nodes; S7. The user chooses to give up access to the authorized administrator to create files or data nodes, or submits a permission activation application to the user authority personnel and authorized administrator of the upper level of the multi-tree storage structure; S8. Based on the joint authorization of the upper-level user authority personnel and the authorized administrator, return to step S3 and perform a second authorization file verification.

3. A software platform license authorization management method according to claim 2, characterized in that: Detailed steps to generate a unique machine code for the corresponding level of user permissions: The authorization level is the product of all authorization levels of the next node. The authorization level is the key-value pair preset in the multi-tree storage directory structure, the main node and the branch node; Convert the authorization level, validity period, number of forms, number of users, and user ID into strings; Concatenate the authorization level, validity period, number of forms, number of users, and user ID strings.

4. A software platform license authorization management method according to claim 3, characterized in that: Server hardware information includes hardware ID, authorization period, IP address and MAC address; Detailed steps to generate a unique machine code from server hardware information: Convert hardware ID, authorization period, IP address and MAC address into strings; Concatenate the converted strings of hardware ID, authorization period, IP address, and MAC address.

5. A software platform license authorization management method according to claim 4, characterized in that: The specific steps of the string interleaving method as a dynamic programming method are as follows: The validity period, number of forms, number of users, user ID, hardware ID, authorization period, IP address, and MAC address strings are randomly arranged and concatenated; A cycle is preset to randomly arrange the above randomly arranged character strings again; The initial random permutation string sequence is sent to the user end as a public key, and the period is stored as a private key on the authorized administrator end.

6. A software platform license authorization management method according to claim 5, characterized in that: The multitree storage structure of files or data is divided into a multitree storage structure of files and a multitree storage structure of data; The multitree storage structure of the file includes the file name, the multitree storage directory structure and the file storage path or storage relationship; The multi-tree storage structure of data includes the index directions of the main node, branch node and child node; The data or data table to be stored is stored in the corresponding multi-tree storage directory structure, main node and branch node; The multitree storage directory structure, main nodes and branch nodes are preset with key-value pairs.

7. A software platform license authorization management method according to claim 6, characterized in that: The detailed steps of step S2 include: S201, traverse one level upward or downward and one node upward or downward according to the node file storage path or storage relationship of the multi-tree storage directory structure and the node position where the branch node is located, and use the node and branch node storage files or data of the current multi-tree storage directory structure as the object that can be queried, modified and deleted; S202, authorizing corresponding levels according to the node depth corresponding to the nodes and branch nodes of the multi-tree storage directory structure; S203. The corresponding level authorization requires matching of corresponding user authority information.

8. A software platform license authorization management method according to claim 7, characterized in that: Detailed steps for digitally signing the authorization level in the machine code using an asymmetric encryption algorithm: Randomly select corresponding prime numbers to assign p and q to the preset key-value pair with the lowest node level in the authorization level; Calculate the public modulus of other key-value pairs in the multitree storage directory structure, main node and branch node higher than the lowest level one by one. The public modulus calculation formula is: n=p*q, n is the public modulus, p and q are the preset key-value pairs of the lowest node level in the authorization level, which are two random prime numbers; Convert the public modulus into binary code; Calculate the Euler function. The calculation formula of the Euler function is: , is the number of positive integers less than or equal to n that are coprime with n; Calculate the public key: , the value of e is a positive integer, e and are mutually prime; Calculate the private key: e*d % m = 1, where , we get: public key = (e, n), private key = (d, n); Encryption generates ciphertext: , C is the ciphertext, M is the plaintext; Decryption generates plaintext: , C is the ciphertext and M is the plaintext.

9. A software platform license authorization management method according to claim 8, characterized in that: When the second digital signature is verified, the second digital signature is performed only after the first digital signature is successfully verified; the second digital signature verification steps are: First, verify whether the initial random string sequence in the packaged LIC authorization file is completely matched. If it is matched, it will proceed to the next step. If it is not matched, a second digital signature verification error will be sent; The authorized administrator sends the private key period and initial signature time to the user; The user end calculates the result value of the number of times the initial random permutation string sequence is changed, and returns it to the authorized administrator end to verify whether the result value of the number of times the initial random permutation string sequence is changed is correct. If it is correct, the second digital signature verification is successful.

Images