Windows platform-based application security authentication method and device
By encrypting the PE files of Windows platform applications and writing them to the target resource segment, combined with user authentication and permission verification, the problem of insufficient compliance of Windows platform applications in security assessment is solved, thereby improving security and reducing costs.
Patent Information
- Application Number
- CN202510706970.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-29
- Publication Date
- 2025-12-16
- Estimated Expiration
- 2045-05-29
AI Technical Summary
Existing Windows platform applications cannot be modified at the code level when facing confidentiality compliance requirements, resulting in insufficient security and compliance in identity authentication.
By encrypting the PE file corresponding to the application on the Windows platform and writing the encrypted PE file into the target resource segment of the preset PE file, the target is authenticated and decrypted. Combined with user identity authentication and permission authentication, a password-based identity authentication mechanism is added.
Without modifying the original application, the security of identity authentication has been improved, the confidentiality requirements have been met, and the authentication cost has been reduced.
Smart Images
Figure CN120234784B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and in particular to an application security authentication method and apparatus based on the Windows platform. Background Technology
[0002] Windows platform user authentication technology has evolved from single static passwords to multi-factor authentication, but it still faces the challenge of compliance requirements for password authentication.
[0003] Currently, taking power plants as an example, the business software in Security Zone 1 consists of PE files on the Windows platform. However, due to restrictions imposed by foreign brands or their long history, code-level integration modifications are not possible when faced with non-compliance with security assessments. Consequently, these modifications fail to meet the high-risk requirements for identity authentication in business systems during assessment activities, posing challenges to both compliance and security. Summary of the Invention
[0004] This invention provides an application security authentication method and apparatus based on the Windows platform, which addresses the urgent business security needs in existing assessment practices where business software cannot be modified to meet confidential assessment requirements or where software cannot be modified to improve the security of business software identity authentication.
[0005] This invention provides an application security authentication method based on the Windows platform, comprising:
[0006] Obtain the portable executable PE file corresponding to the application on the Windows platform;
[0007] The PE file is encrypted, and the encrypted PE file is written into the target resource segment of a preset PE file to obtain the target PE file; wherein, the preset PE file includes multiple resource segments, and the target resource segment belongs to the multiple resource segments;
[0008] Run the target PE file, and if the target PE file passes the target authentication and authorization, obtain the encrypted PE file and decrypt it to obtain the decrypted file; wherein, the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0009] According to the present invention, an application security authentication method based on the Windows platform is provided, wherein the encrypted PE file is associated with a target resource identifier, and the target authentication and authorization includes user identity authentication and user permission authentication; the user identity authentication includes at least one of dynamic password authentication and digital certificate challenge-response authentication.
[0010] The step of obtaining the encrypted PE file when the target PE file passes the target authentication and authorization includes:
[0011] After determining that the encrypted PE file exists in the target resource segment based on the target resource identifier, the encrypted PE file is then subjected to user identity authentication and user permission authentication in sequence.
[0012] After passing the user identity authentication and user permission authentication, the encrypted PE file is extracted from the target resource segment.
[0013] According to the application security authentication method based on the Windows platform provided by the present invention, obtaining the portable executable PE file corresponding to the application on the Windows platform includes:
[0014] The application is read in binary form to obtain the PE file.
[0015] According to the application security authentication method based on the Windows platform provided by the present invention, after encrypting the PE file, the method further includes:
[0016] The encrypted PE file is written to the end of the preset PE file to obtain the target PE file.
[0017] According to the application security authentication method based on the Windows platform provided by the present invention, the encryption of the PE file includes:
[0018] The PE file is then symmetrically encrypted.
[0019] According to the application security authentication method based on the Windows platform provided by the present invention, after obtaining the decrypted file, the method further includes:
[0020] The decrypted file is written to the path corresponding to the target PE file to obtain a temporary file; the path corresponding to the target PE file is the same as the path corresponding to the PE file.
[0021] The temporary file is hidden, and the hidden temporary file is run using the CreateProcess mechanism;
[0022] Depending on the running status of the temporary file, the temporary file may be deleted or retained.
[0023] According to the application security authentication method based on the Windows platform provided by the present invention, before the target PE file passes the target authentication and authorization, the method further includes:
[0024] If there are historically generated temporary files in the path corresponding to the PE file, delete the historically generated temporary files.
[0025] The present invention also provides an application security authentication device based on the Windows platform, comprising:
[0026] The acquisition module is used to acquire portable executable PE files corresponding to applications on the Windows platform.
[0027] The encryption and writing module is used to encrypt the PE file and write the encrypted PE file into the target resource segment of a preset PE file to obtain the target PE file; wherein, the preset PE file includes multiple resource segments, and the target resource segment belongs to the multiple resource segments;
[0028] The authentication and decryption module is used to run the target PE file, and, if the target PE file passes the target authentication and authorization, to obtain the encrypted PE file and decrypt it to obtain the decrypted file; wherein, the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0029] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the application security authentication method based on the Windows platform as described above.
[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the application security authentication method based on the Windows platform as described above.
[0031] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the application security authentication method based on the Windows platform as described above.
[0032] The present invention provides a Windows platform-based application security authentication method and apparatus. By encrypting the PE file corresponding to the Windows platform application and writing it into the target resource segment of a preset PE file, a target PE file is obtained. Finally, the target PE file is run, and if the target PE file passes the target authentication, the encrypted PE file is obtained and decrypted. This method can add a cryptographic authentication mechanism to Windows platform applications without any modifications, meet the relevant requirements of cryptographic authentication, improve the security of the original PE file authentication, and reduce authentication costs. Attached Figure Description
[0033] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0034] Figure 1 This is one of the flowcharts illustrating the application security authentication method based on the Windows platform provided by this invention.
[0035] Figure 2 This is the second flowchart of the application security authentication method based on the Windows platform provided by the present invention.
[0036] Figure 3 This is the third flowchart of the application security authentication method based on the Windows platform provided by this invention.
[0037] Figure 4 This is one of the structural schematic diagrams of the application security authentication device based on the Windows platform provided by the present invention.
[0038] Figure 5 This is the second schematic diagram of the application security authentication device based on the Windows platform provided by the present invention.
[0039] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0041] The following is combined Figures 1-5 This invention describes an application security authentication method and apparatus based on the Windows platform.
[0042] Figure 1 This is one of the flowcharts illustrating the application security authentication method based on the Windows platform provided by this invention, such as... Figure 1 As shown, the method includes the following steps:
[0043] Step 110: Obtain the portable executable PE file corresponding to the application on the Windows platform.
[0044] In this step, Windows platform applications refer to applications that are displayed on the Windows platform, including applications that can be displayed on the Windows platform, such as commonly used browsers, communication software, or video platforms; it also includes system applications that are not displayed on the Windows platform.
[0045] In this embodiment, the source code can be compiled into a file conforming to the PE format using a compiler (such as Visual Studio or MinGW), for example, a binary file or other specified multi-base format file.
[0046] Step 120: Encrypt the PE file and write the encrypted PE file into the target resource segment of the preset PE file to obtain the target PE file; wherein the preset PE file includes multiple resource segments and the target resource segment belongs to multiple resource segments.
[0047] In this step, for PE (Portable Executable) file formats under the Windows platform, there is a resource section inside, which is used to store some resource files, such as bitmaps and binary data.
[0048] In this embodiment, multiple resource segments can be manipulated using Windows-provided API functions (BeginUpdateResource, UpdateResource, or EndUpdateResource), such as adding or modifying resources.
[0049] In this embodiment, encrypting the PE file includes: performing symmetric encryption on the PE file.
[0050] Specifically, this embodiment can use symmetric encryption technology to encrypt PE files. For example, when using dynamic packing technology to encrypt PE files using a symmetric encryption algorithm, the code segment, data segment, and import table are encrypted, and then the shell program file completes the decryption operation at runtime.
[0051] In this embodiment, encrypting the PE file includes: asymmetric encryption (for example, during encryption, the PE file is symmetrically encrypted using the recipient's public key, and during decryption, the recipient uses the private key to obtain the decrypted file and then decrypts the data) or encryption by embedding resource segments and hiding information (for example, embedding the encrypted DLL module into the resource segment as RT_RCDATA type, and dynamically loading and decrypting it at runtime), etc.
[0052] In this embodiment, the PE resource segment adopts a three-level directory structure (type → name → language); the following parameters need to be assigned to the target resource segment:
[0053] Resource type: Custom type (such as RT_RCDATA or CUSTOM_DATA).
[0054] Resource identifier: A unique ID or string name (such as IDR_ENCRYPTED_PE).
[0055] Language code page: MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL) is used by default.
[0056] In this embodiment, the resource segment can be dynamically modified using the Windows API to write the encrypted PE file into the resource segment of the preset PE file by adding (or deleting and replacing if it exists), and finally outputting the target PE file with the encrypted resource segment.
[0057] In this embodiment, when the encrypted PE file data is written to the target resource segment, the data is stored according to a preset PE file alignment rule to avoid loading errors.
[0058] In this embodiment, a predefined preset PE file is used as a template to convert Windows platform applications into corresponding PE files. After encryption, the files are written to the resource end of the preset PE file. This achieves the goal of hiding Windows platform applications while adding corresponding authentication mechanisms based on the logic of the preset PE file itself, ultimately achieving the goal of securely launching Windows platform applications.
[0059] Step 130: Run the target PE file, and if the target PE file passes the target authentication and authorization, obtain the encrypted PE file and decrypt it to get the decrypted file; wherein, the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0060] In this step, target authentication and authorization can include user identity verification, such as requiring the user to enter a smart password key, a digital certificate verification PIN, or a user identifier plus a dynamic password for user identity verification at the front end; target authentication and authorization can also include user permission authentication, if the current user does not have access rights to the target PE file, then authentication fails.
[0061] In this step, the aforementioned target authentication and authorization can be performed by first verifying the user's identity, and then verifying the user's permissions if the identity verification is successful; or it can be performed by only verifying the user's identity.
[0062] In this step, the decryption method can be determined based on the encryption method. For example, if the PE file is encrypted using a symmetric encryption algorithm, the encrypted PE file can be decrypted using the corresponding key to obtain the corresponding decrypted file; if the PE file is encrypted using an asymmetric encryption algorithm, the corresponding decryption key can be obtained from the receiving end or a third party, and the encrypted PE file can be decrypted.
[0063] In this embodiment, during the execution of the target PE file, the presence of ciphertext fields and content can be checked by querying the ciphertext resource segment.
[0064] In this embodiment, when querying a encrypted resource segment (corresponding to a target resource segment), the data characteristics of all resource segments of the target PE file can be checked one by one to find the encrypted PE file in the target resource segment; or a specific resource identifier can be identified in all resource segments to quickly locate the target resource segment and the encrypted PE file corresponding to the resource identifier.
[0065] In this embodiment, after obtaining the encrypted PE file during the target PE file execution stage, multiple security authentications are required to decrypt the original PE file from the encrypted PE file and run it when accessing data, in order to ensure data security.
[0066] The application security authentication method based on the Windows platform provided in this invention encrypts the PE file corresponding to the Windows platform application and writes it into the target resource segment of a preset PE file to obtain the target PE file. Finally, the target PE file is run, and if the target PE file passes the target authentication, the encrypted PE file is obtained and decrypted. This method can add a cryptographic authentication mechanism to Windows platform applications without any modifications, meet the relevant requirements of cryptographic evaluation, improve the security of the original PE file authentication, and reduce authentication costs.
[0067] In some embodiments, the encrypted PE file is associated with a target resource identifier, and the target authentication includes user identity authentication and user permission authentication; user identity authentication includes at least one of dynamic password authentication and digital certificate challenge-response authentication; when the target PE file passes the target authentication, obtaining the encrypted PE file includes: determining that the encrypted PE file exists in the target resource segment based on the target resource identifier, and sequentially performing user identity authentication and user permission authentication on the encrypted PE file; if the user identity authentication and user permission authentication are passed, extracting the encrypted PE file from the target resource segment.
[0068] In this embodiment, the encrypted PE file has a mapping relationship with the target resource identifier; for example, after the encrypted PE file is stored in the target resource segment, it is recorded as resource A (corresponding resource identifier).
[0069] In this embodiment, PE files can be appended to a preset PE file as resources using packaging software. For example, the PE file corresponding to a Windows platform application can be defined as resource A, and resource A can be added to the target resource section of the preset PE file. The packaging software then outputs the final target PE file.
[0070] In this embodiment, during the user authentication phase, one of the following authentication methods can be selected:
[0071] (a) Dynamic password authentication: The target PE file generates a one-time dynamic password (such as the TOTP algorithm) at runtime, which is transmitted to the user via SMS or hardware token;
[0072] (b) Digital certificate challenge and response authentication: The client uses its private key to sign the server's random number, and the server verifies the legitimacy by using a pre-stored public key.
[0073] In this embodiment, after the user identity authentication is completed as described above, user permission authentication is performed in the following order:
[0074] Confirm whether the authenticated user has permission to access the decryption key. This permission can be bound to the key used in the encryption process. If the user's identity is confirmed to be legitimate after the above user authentication, then authenticate the access rights of the target PE file with the current user's identity. If the authentication is successful, the encrypted PE file can be directly extracted from the target resource segment of the target PE.
[0075] In this embodiment, after the encrypted PE file passes both the user identity authentication and user permission authentication, the encrypted PE file can be decrypted using the key associated with the encryption key to obtain the corresponding decrypted file, i.e., the original PE file.
[0076] The application security authentication method based on the Windows platform provided in this embodiment of the invention extracts the encrypted PE file from the target resource segment after determining the encrypted PE file according to the target resource identifier and passing user identity authentication and user permission authentication. This multi-layer authentication mechanism further improves the security of information authentication on the Windows platform.
[0077] In some embodiments, obtaining a portable executable PE file corresponding to an application on the Windows platform includes: reading the application in binary form to obtain the PE file.
[0078] In this embodiment, a binary file (i.e., a PE file) is read from a Windows platform application using packaging software; the binary file includes:
[0079] MZ header (used to identify the file as an executable program);
[0080] The offset pointing to the PE file header (e_lfanew field);
[0081] PE file header (used to define the architecture, such as x86 / x64);
[0082] PE file header (including metadata such as the number of sections, address of entry point, etc.);
[0083] Section tables and section data (including code segments ".text", data segments ".data") and source segments ".rsrc", etc., are used to describe the attributes and location of each section.
[0084] In this embodiment, the section data of the PE file is stored in the resource segment of the preset PE file according to a specific alignment rule to ensure the compatibility of memory mapping during loading.
[0085] For example, file alignment (FileAlignment) is typically 512 bytes, while memory alignment (SectionAlignment) is 4KB. Adjusting alignment parameters can optimize file size and loading efficiency.
[0086] The application security authentication method based on the Windows platform provided in this invention reads a PE file conforming to Windows specifications from the application's binary code, which facilitates the subsequent hiding of the PE file using a preset PE file, thereby improving the compilability and security of the application.
[0087] In some embodiments, after encrypting the PE file, the Windows-based application security authentication method further includes: writing the encrypted PE file to the end of a preset PE file to obtain the target PE file.
[0088] In this embodiment, the end position of the preset PE file can be determined by parsing the section table of the preset PE file; for example, the end offset of the preset PE file can be calculated by using the PointerToRawData and SizeOfRawData fields of IMAGE_SECTION_HEADER to determine the end position, that is, the write position of the encrypted PE file.
[0089] It should be noted that if the default file contains a certificate table, the digital signature area must be bypassed to avoid compromising the validity of the signature.
[0090] In this embodiment, after determining that the end of the preset PE file is writable, the original PE file can be encrypted using a symmetric encryption algorithm such as AES-CBC, generating ciphertext which is then appended to the end of the preset file to obtain the corresponding target PE file.
[0091] In this embodiment, if it is necessary to hide the encrypted PE file at the end of the preset PE file, the end data can be disguised as a resource segment (.rsrc) and dynamically written to the encrypted PE file using the UpdateResource API.
[0092] The application security authentication method based on the Windows platform provided in this invention obtains the target PE file by writing the encrypted PE file to the end of the preset PE file, thereby increasing the way the PE file is written to the preset PE file and improving the efficiency of obtaining the target PE file.
[0093] In some embodiments, by writing the encrypted PE file to the end of a preset PE file to obtain the target PE file, the encrypted PE file at the end of the target PE file can be directly read and decrypted during the decryption stage, which can improve the efficiency of PE file encryption and decryption.
[0094] In some embodiments, after obtaining the decrypted file, the security authentication method of the Windows platform further includes: writing the decrypted file to the path corresponding to the target PE file to obtain a temporary file; the path corresponding to the target PE file is consistent with the path corresponding to the PE file; hiding the temporary file and running the hidden temporary file through the CreateProcess mechanism; and performing deletion or retention operations on the temporary file according to the running status of the temporary file.
[0095] In this embodiment, the storage path of the preset PE file is obtained by calling the Windows API (such as GetModuleFileName or GetModuleFileNameEx) to ensure that the current user has write permissions; then a unique filename is generated by using GUID or timestamp to avoid conflicts with other processes; finally, the decrypted byte stream (corresponding to the decrypted file) is written to the path corresponding to the preset PE file to generate a temporary file.
[0096] In this embodiment, the Windows API SetFileAttributes is called to add the FILE_ATTRIBUTE_HIDDEN attribute to the temporary file, making it invisible in File Explorer by default, thus hiding the temporary file.
[0097] In this embodiment, a temporary file can be started using CreateProcess, and the window can be hidden using the STARTUPINFO structure; if the temporary file requires administrator privileges, ShellExecuteEx must be called before CreateProcess and the runas verb must be specified.
[0098] In this embodiment, after the process of the temporary file is detected to be in an exit state (waiting for it to end via WaitForSingleObject), DeleteFile can be called to delete the temporary file to reduce system memory usage.
[0099] In some embodiments, the name of the decrypted file may include a specific identifier (e.g., "Dec") to ensure that the target PE file can accurately read the decrypted file at runtime; after decryption, the file attribute also needs to be set to hidden to prevent the file from being accidentally deleted.
[0100] For example, a feasible naming format for decrypted files includes:
[0101] "Dec - 8-digit time information - specific characters (can be defined according to business requirements (such as user ID, task number, etc.)) + suffix", and set to hidden attribute using the command "attrib +h'filename'".
[0102] The application security authentication method based on the Windows platform provided in this embodiment of the invention obtains a temporary file by writing the decrypted file to the corresponding path of the target PE file; the temporary file is hidden, and the hidden temporary file is run through the CreateProcess mechanism, so as to realize the secure execution of sensitive operations without the user's awareness, while improving the stability of system operation.
[0103] In some embodiments, before the target PE file passes target authentication, the application security authentication method based on the Windows platform further includes: deleting historically generated temporary files if there are such files in the path corresponding to the PE file.
[0104] In this embodiment, the historically generated temporary files are temporary files stored in the corresponding path of the PE file when the user executed the application security authentication method based on the Windows platform in the previous few times.
[0105] In this embodiment, before the target PE file is authenticated and authorized after execution, all historically generated temporary files in the PE file storage path need to be deleted to free up storage space and improve the stability of PE file operation.
[0106] Figure 2 This is the second flowchart illustrating the application security authentication method based on the Windows platform provided by this invention. Figure 2 In the illustrated embodiment, the Windows platform application (hereinafter referred to as target file B) is written into a preset PE file (hereinafter referred to as file A) and hidden, which is achieved through the following steps:
[0107] (1) Read the target file B in binary mode (corresponding to inputting the target file B into the encryption process) to obtain its binary content, i.e., the PE file.
[0108] (2) The read PE file is sent to the password security management module for symmetric encryption to obtain ciphertext information, i.e., the encrypted PE file (corresponding to the encryption process, the password security management module performs data encryption and decryption and outputs ciphertext information).
[0109] (3) Write the ciphertext information into the resource segment of file A by adding (or deleting and replacing if it exists) to finally obtain the target PE file (corresponding to importing the ciphertext information into the resource segment and combining it with the input template PE file A to output file A with the ciphertext resource segment).
[0110] Figure 3 This is the third flowchart of the application security authentication method based on the Windows platform provided by this invention. Figure 3 In the illustrated embodiment, after obtaining the target PE file, security authentication can be performed through the following steps:
[0111] (1) After the program running the target PE file starts, it queries the encrypted resource segment to check whether there are encrypted fields and contents. For example, it queries whether a specific resource exists in the target PE file. If it does not exist, it will alarm and exit (corresponding to the program starting, querying a specific resource, and if the specific resource does not exist, the program terminates).
[0112] (2) If the ciphertext field exists and its content is not empty, the business process of identity authentication and data decryption of the target PE file based on cryptographic technology is started (when the specific resource exists, the process of cryptographic authentication and current permission authentication is entered in sequence; if both authentications are passed, the resource is read and written to a specific path to start; if any of the above authentications fails, the program terminates).
[0113] Specifically, at the front end, the PIN password verified by the smart password key, digital certificate, user identifier + dynamic password, and the ciphertext field content read when querying ciphertext resource segments are sent to the password security management module for processing; the password security management module can perform identity authentication based on digital certificate challenge response or through dynamic passwords; if identity authentication fails, an alarm will be triggered and the system will exit.
[0114] In this embodiment, the password security management module can configure security policies to bind user identities with the keys used to encrypt the PE files obtained above. If the current identity does not have the relevant access rights, an alarm will be triggered and the system will exit.
[0115] (3) If the current user has access rights, the password security control module will perform decryption operation, and the decrypted data will be sent back to file A. File A will then write the data to the current file path to generate a temporary file T. T (corresponding resource) will be named according to the preset naming rules and the file attribute will be set to hidden mode. If T already exists, the deletion operation will be performed first and then the data will be written (the resource will be named according to the preset naming rules to prevent the resource from being accidentally deleted).
[0116] In this embodiment, file A starts T via CreateProcess and hides its own window; at this time, it enters the original target B business process, while A monitors the process of T.
[0117] In this embodiment, when T exits, A will detect the relevant information and automatically delete the temporary file T, and A can then release resources and exit.
[0118] The following describes the application security authentication device based on the Windows platform provided by the present invention. The application security authentication device based on the Windows platform described below can be referred to in correspondence with the application security authentication method based on the Windows platform described above.
[0119] Figure 4 This is one of the structural schematic diagrams of the application security authentication device based on the Windows platform provided by the present invention, such as... Figure 4 As shown, the application security authentication device based on the Windows platform includes: an acquisition module 410, an encryption and writing module 420, and an authentication and decryption module 430.
[0120] The acquisition module 410 is used to acquire the portable executable PE file corresponding to the application on the Windows platform;
[0121] The encryption and writing module 420 is used to encrypt the PE file and write the encrypted PE file into the target resource segment of the preset PE file to obtain the target PE file; wherein the preset PE file includes multiple resource segments and the target resource segment belongs to multiple resource segments;
[0122] The authentication and decryption module 430 is used to run the target PE file, and, if the target PE file passes the target authentication and authorization, obtain the encrypted PE file and decrypt it to obtain the decrypted file; wherein, the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0123] The application security authentication device based on the Windows platform provided in this embodiment of the invention encrypts the PE file corresponding to the Windows platform application and writes it into the target resource segment of a preset PE file to obtain the target PE file. Finally, the target PE file is run, and if the target PE file passes the target authentication, the encrypted PE file is obtained and decrypted. This device can add a cryptographic authentication mechanism to Windows platform applications without any modifications, meet the relevant requirements of cryptographic evaluation, improve the security of the original PE file authentication, and reduce authentication costs.
[0124] Figure 5 This is the second schematic diagram of the structure of the application security authentication device based on the Windows platform provided by the present invention. Figure 5 In the embodiment shown, the Windows-based application security authentication device further includes: a PE generation module 510, a PE file execution module 520, and a password security management module 530.
[0125] The PE generation module 510 is used to read the portable executable PE file and send it to the password security control module for encryption to obtain the encrypted PE file.
[0126] The PE file execution module 520 is used to write ciphertext into the target resource segment of a preset PE file, generate the target PE file, and run it.
[0127] The password security control module 530 is used to perform user identity authentication and user permission authentication on the target PE file in sequence when the target PE file is running. If the user identity authentication and user permission authentication are passed, the encrypted PE file is obtained and decrypted to obtain the decrypted file.
[0128] The PE file execution module 520 is also used to write the decrypted file to the storage path of the current target PE file, generate a temporary file T, name T according to the preset naming rules, and set the file attribute to hidden mode; if T already exists, it will be deleted before being written.
[0129] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, communications interface 620, and memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a Windows platform-based application security authentication method. This method includes: obtaining a portable executable PE file corresponding to the Windows platform application; encrypting the PE file and writing the encrypted PE file into a target resource segment of a preset PE file to obtain a target PE file; wherein the preset PE file includes multiple resource segments, and the target resource segment belongs to multiple resource segments; running the target PE file, and if the target PE file passes target authentication, obtaining and decrypting the encrypted PE file to obtain a decrypted file; wherein the target authentication includes user identity authentication and user permission authentication, or user identity authentication.
[0130] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0131] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the application security authentication method based on the Windows platform provided by the above methods. The method includes: obtaining a portable executable PE file corresponding to the application on the Windows platform; encrypting the PE file and writing the encrypted PE file into a target resource segment of a preset PE file to obtain a target PE file; wherein the preset PE file includes multiple resource segments, and the target resource segment belongs to multiple resource segments; running the target PE file, and if the target PE file passes the target authentication and authorization, obtaining the encrypted PE file and decrypting it to obtain a decrypted file; wherein the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0132] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the application security authentication method based on the Windows platform provided by the above methods. The method includes: obtaining a portable executable PE file corresponding to the application on the Windows platform; encrypting the PE file and writing the encrypted PE file into a target resource segment of a preset PE file to obtain a target PE file; wherein the preset PE file includes multiple resource segments, and the target resource segment belongs to multiple resource segments; running the target PE file, and if the target PE file passes the target authentication and authorization, obtaining and decrypting the encrypted PE file to obtain a decrypted file; wherein the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
[0133] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0134] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for application security authentication based on the Windows platform, characterized in that, include: Obtain the portable executable PE file corresponding to the application on the Windows platform; The PE file is encrypted, and the encrypted PE file is written to the target resource segment of the preset PE file to obtain the target PE file; The step of writing the encrypted PE file into the target resource segment of the preset PE file to obtain the target PE file includes: The encrypted PE file is written to the resource segment of a preset PE file in a newly added manner, and the target PE file with the encrypted resource segment is output. The newly added manner includes: if a file exists in the resource segment of the preset PE file, it is deleted and replaced. Run the target PE file, and if the target PE file passes the target authentication and authorization, obtain the encrypted PE file and decrypt it to obtain the decrypted file; wherein, the target authentication and authorization includes first performing user identity authentication, and if the identity authentication is successful, then performing user permission authentication.
2. The application security authentication method based on the Windows platform according to claim 1, characterized in that, The encrypted PE file is associated with a target resource identifier, and the user authentication includes at least one of dynamic password authentication and digital certificate challenge-response authentication. The step of obtaining the encrypted PE file when the target PE file passes the target authentication and authorization includes: After determining that the encrypted PE file exists in the target resource segment based on the target resource identifier, the encrypted PE file is then subjected to user identity authentication and user permission authentication in sequence. After passing the user identity authentication and user permission authentication, the encrypted PE file is extracted from the target resource segment.
3. The application security authentication method based on the Windows platform according to claim 1, characterized in that, The method of obtaining the portable executable PE file corresponding to the application on the Windows platform includes: The application is read in binary form to obtain the PE file.
4. The application security authentication method based on the Windows platform according to claim 1, characterized in that, After encrypting the PE file, the method further includes: The encrypted PE file is written to the end of the preset PE file to obtain the target PE file.
5. The application security authentication method based on the Windows platform according to claim 1, characterized in that, The encryption of the PE file includes: The PE file is then symmetrically encrypted.
6. The application security authentication method based on the Windows platform according to claim 1, characterized in that, After obtaining the decrypted file, the method further includes: The decrypted file is written to the path corresponding to the target PE file to obtain a temporary file; the path corresponding to the target PE file is the same as the path corresponding to the PE file. The temporary file is hidden, and the hidden temporary file is run using the CreateProcess mechanism; Depending on the running status of the temporary file, the temporary file may be deleted or retained.
7. The application security authentication method based on the Windows platform according to claim 1, characterized in that, Before the target PE file passes target authentication and authorization, the method further includes: If there are historically generated temporary files in the path corresponding to the PE file, delete the historically generated temporary files.
8. An application security authentication device based on the Windows platform, employing the application security authentication method based on the Windows platform as described in claim 1, characterized in that, include: The acquisition module is used to acquire portable executable PE files corresponding to applications on the Windows platform. The encryption and writing module is used to encrypt the PE file and write the encrypted PE file into the target resource segment of a preset PE file to obtain the target PE file; wherein, the preset PE file includes multiple resource segments, and the target resource segment belongs to the multiple resource segments; The authentication and decryption module is used to run the target PE file, and, if the target PE file passes the target authentication and authorization, to obtain the encrypted PE file and decrypt it to obtain the decrypted file; wherein, the target authentication and authorization includes user identity authentication and user permission authentication, or user identity authentication.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the application security authentication method based on the Windows platform as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the application security authentication method based on the Windows platform as described in any one of claims 1 to 7.
Citation Information
Patent Citations
File access authority authentication method and electronic equipment
CN110059499A
PE file data protection method and device, equipment and medium
CN115828190A