Process interception type software protection method based on double-process mutual monitoring and license verification

Abstract

The invention relates to the technical field of software security, and discloses a process interception type software protection method based on double-process mutual monitoring and license verification, which comprises the following steps: S1, starting and initializing a host process; s2, starting a mutual monitoring mechanism: establishing a bidirectional monitoring and heartbeat detection mechanism between the host process and the daemon process; s3, loading and checking the license: carrying out digital signature verification on the license file; s4, operation monitoring: if the license is valid, allowing the controlled program to operate normally; if the license is invalid, triggering a process interception mechanism; and S5, a service stopping mechanism. Through a double-process mutual monitoring mechanism, mutual monitoring and automatic recovery between processes are realized, the problem of single-point failure existing in a single-process guarding mode is solved, and the destroy resistance of a protection system is improved; the mode of combining hardware fingerprint binding and digital signature verification is adopted, it is ensured that the license corresponds to the physical device and cannot be tampered, and the problems of copying, abusing and counterfeiting of the license are prevented.

Description

Technical Field

[0001] This invention relates to the field of software security technology, specifically a process interception-based software protection method based on dual-process mutual monitoring and license verification. Background Technology

[0002] With the deep application of software technology in key areas such as industrial control, financial transactions, artificial intelligence and business design, the protection of software copyright and operational security has become an important issue concerning the core assets of enterprises and market order. Traditional software protection technologies mainly rely on single-process protection, static serial number verification or simple license file comparison mechanisms. These methods have exposed many inherent defects when facing increasingly complex reverse engineering, network attacks and malicious abuse, and their protection capabilities are inadequate.

[0003] First, the single-process daemon model poses a serious single point of failure risk. In this architecture, a separate daemon process is responsible for monitoring the operation of the main program. Once this daemon process is forcibly terminated by the user using tools such as Task Manager, or terminated by malware, the entire protection system collapses instantly, and the core application is left in a completely unprotected and uncontrolled state, which can be arbitrarily copied and used.

[0004] Secondly, traditional license verification mechanisms are extremely vulnerable. Most schemes rely on plaintext serial numbers or unencrypted license files. This information is easily copied, tampered with, or bypassed using memory patching techniques; more importantly, they lack dynamic binding to the physical hardware environment, allowing a legitimate license to be copied and abused on countless devices, rendering software licensing meaningless.

[0005] Furthermore, existing technologies lack effective proactive operational control capabilities. When the system detects an invalid, expired, or abnormal license, it can usually only display a warning message to the user, but cannot prevent the protected program from continuing to run. This alert-only, action-free approach has no deterrent effect on intentional pirates and cannot eliminate the illegal use of software at its source.

[0006] In addition, some protection schemes neglect system stability and user experience in their design; in order to achieve continuous protection, their frequent restarting behavior after the process is terminated may exhaust system resources, cause system lag, or even misjudge and terminate the user's normal program, thereby affecting the normal work and user experience of legitimate users. Summary of the Invention

[0007] The purpose of this invention is to provide a process interception-based software protection method based on dual-process mutual monitoring and license verification, so as to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: A process-interception software protection method based on dual-process mutual monitoring and license verification includes the following steps: S1. Main process startup and initialization: The main process starts, registers the operating system startup items, and initializes the logging system and configuration environment; S2. Mutual monitoring mechanism start-up: Create the main process and start the daemon process to establish a two-way monitoring and heartbeat detection mechanism between the main process and the daemon process, forming a dual-process mutual monitoring mechanism; S3. License Loading and Verification: Read the license file, perform digital signature verification on the license file, and compare the hardware fingerprint in the license file with the hardware fingerprint of the current operating environment. S4. Operation monitoring: Perform corresponding operations based on the verification results of step S3; If the license is valid, the controlled program is allowed to operate normally; If the license is invalid, the process interception mechanism is triggered to automatically detect and terminate the successfully matched process using a tiered termination strategy. S5. Service shutdown mechanism: In response to external commands, the main process and the daemon process exit synchronously, terminating mutual monitoring and protection functions.

[0009] As a further aspect of the present invention: in step S2, the steps for forming the dual-process mutual monitoring mechanism are as follows: S21. Connection establishment and heartbeat initialization: The main process creates and starts the daemon process. The two processes connect through the inter-process communication channel and exchange process identity information. S22. Continuous monitoring and anomaly detection: The main process and the daemon process respectively start a heartbeat detection thread and a process status check thread to continuously monitor the other party; if no heartbeat signal is received from the other party within the preset timeout period, or if the handle of the other party's process is detected to be invalid through the application programming interface, the other party's process is immediately determined to have terminated abnormally. S24. Self-recovery restart and stability control: When it is determined that the other party's process has terminated abnormally, an exponential backoff strategy is adopted to immediately restart the other party's process; If the number of restarts reaches the preset maximum limit within any sliding time window, the restart attempt will be stopped and an error log will be recorded.

[0010] As a further aspect of the present invention: in step S22, The heartbeat detection is implemented as follows: both the main process and the daemon process send heartbeat data packets to each other at a fixed first preset time interval; at the same time, a second preset time is set as the heartbeat reception timeout duration, which is greater than the first preset time interval. The process status check is implemented as follows: periodically call the application programming interface and attempt to open the handle of the other party's process with the set permissions. If the opening fails, the process is determined to not exist.

[0011] As a further aspect of the present invention: in step S3, the method for implementing license loading and verification is as follows: S31. License file reading and parsing: Read the structured license file from the storage medium and parse it into a data structure containing authorization information field, hardware fingerprint field and digital signature field; S32. Digital Signature Verification: Based on an asymmetric encryption algorithm, a pre-set public key is used to decrypt and verify the digital signature in the license file to confirm the integrity and authenticity of the license content. S33. Hardware fingerprint comparison: Collect various hardware serial number information of the currently running device, generate the current device fingerprint through a hash algorithm, and compare its consistency with the hardware fingerprint field parsed from the license file. S34. Authorization Status Analysis and Adjudication: Provided that both digital signature verification and hardware fingerprint comparison are passed, the authorization information field in the license is analyzed and compared with the current system status to comprehensively determine whether the license is valid.

[0012] As a further aspect of the present invention: in step S32, the specific implementation steps of digital signature verification are as follows: S321. Extract the license data to be verified from the parsed data structure and serialize it into a normalized string; S322. Calculate the first hash value of the normalized string using an asymmetric encryption algorithm; decrypt the signature data in the license using a preset public key to obtain the second hash value; S323. Compare the first hash value with the second hash value. If they match, the signature verification is successful.

[0013] As a further aspect of the present invention: in step S33, the specific implementation steps of hardware fingerprint comparison are as follows: S331. Collect various hardware serial number information of currently running devices; The collected hardware information is then concatenated into a single string according to a predetermined order and format. The hash value generated by calculating the string using an asymmetric encryption algorithm is the fingerprint of the current device. S332. The calculated current device fingerprint is strictly compared with the license data parsed from the license file; if they are completely consistent, the device is matched and the verification is successful; if they are inconsistent, the license is copied to other devices, the verification fails, and the interception is triggered.

[0014] As a further aspect of the present invention: in step S4, the process interception mechanism includes process interception activation and target process identification, wherein, The process interception activation method is as follows: In protected mode, a periodic process scanning and interception process is initiated; The method for identifying target processes is as follows: obtain the list of currently running processes through the application programming interface and match it with a predefined list of controlled processes.

[0015] As a further aspect of the present invention: in step S4, the graded termination strategy adopts a graded strategy of first normal termination and then forced termination; wherein, Normal termination strategy: Terminate the target process by using the system process termination application programming interface and exiting normally. Forced termination strategy: When the normal termination strategy fails, the target process is terminated by executing a system forced termination command.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention utilizes a dual-process mutual monitoring mechanism to achieve mutual monitoring and automatic recovery between processes, fundamentally solving the single-point-of-failure problem inherent in single-process protection mode and significantly improving the protection system's resilience. It employs a combination of hardware fingerprint binding and digital signature verification to ensure that the license strictly corresponds to the physical device and is tamper-proof, effectively preventing license duplication, abuse, and forgery. By directly linking authorization verification with process execution, it automatically intercepts and terminates the controlled process when the license expires, achieving a complete protection loop from verification to interception, completely eliminating unauthorized use. Furthermore, it introduces exponential backoff and window rate limiting strategies to intelligently control the process restart frequency, ensuring protection strength while avoiding excessive system resource consumption, thus balancing protection effectiveness and user experience. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a process interception-based software protection method based on dual-process mutual monitoring and license verification. Detailed Implementation

[0018] Please see Figure 1 In this embodiment of the invention, a process interception-based software protection method based on dual-process mutual monitoring and license verification includes the following steps: S1. Main process startup and initialization: The main process starts, registers the operating system startup items, and initializes the logging system and configuration environment; S2. Mutual Monitoring Mechanism Activation: Create the main process and start the daemon process, establishing a two-way monitoring and heartbeat detection mechanism between the main process and the daemon process, forming a dual-process mutual monitoring mechanism; the specific steps are as follows: S21. Connection establishment and heartbeat initialization: The main process (e.g., MyApp.exe) creates and starts a daemon process (e.g., MyAppGuard.exe). The two processes connect through an inter-process communication channel and exchange process identity information. S22. Continuous Monitoring and Anomaly Detection: The main process and the daemon process respectively start a heartbeat detection thread and a process status check thread to continuously monitor the other party. If no heartbeat signal is received from the other party within a preset timeout period (e.g., no heartbeat packet is received within 5 seconds); or if the handle of the other party's process is detected to be invalid through an application programming interface (such as the Windows API) (e.g., unable to obtain a valid handle to the other party's process through OpenProcess), the other party's process is immediately determined to have terminated abnormally. The heartbeat detection is implemented as follows: both the main process and the daemon process send heartbeat data packets to each other at a fixed first preset time interval (e.g., 3 seconds); at the same time, a second preset time is set as the heartbeat reception timeout duration, which is greater than the first preset time interval, such as the second preset time being set to 5 seconds; The process status check is implemented as follows: periodically (e.g., every 10 seconds) calls the application programming interface and attempts to set permissions (e.g., ... (Permissions) Open the handle of the other party's process; if opening fails, it is determined that the process does not exist. S24. Self-recovery restart and stability control: When it is determined that the other party's process has terminated abnormally, an exponential backoff strategy is adopted to immediately restart the other party's process; In the exponential backoff strategy, the waiting time interval for consecutive restarts increases exponentially based on the number of restarts, i.e., the waiting time for the next restart. ;in, This is the initial waiting time; = retreat base; This refers to the number of restarts. This represents the maximum waiting time limit. Assuming, , ; ;; Then, the waiting time for the next restart : First restart: Waiting ; Second restart: Waiting ; ... 6th restart: Waiting ; 7th and subsequent restarts: Waiting ; If the number of restarts reaches the preset maximum limit within any sliding time window, the restart attempt will be stopped and an error log will be recorded. Assume that within any sliding 10-minute time window, the number of times the other process can be restarted should not exceed 10. If it reaches 10 times, the restart attempt will be stopped and an ERROR-level log will be recorded, such as: [ERROR] Restartrate limit exceeded in last 10 minutes. Ceasing restart attempts to prevent resource exhaustion; This indicates that the system may be under continuous attack or has compatibility issues, requiring manual intervention.

[0019] S3. License Loading and Verification: Read the license file, perform digital signature verification on the license file, and compare the hardware fingerprint in the license file with the hardware fingerprint of the current operating environment; the specific implementation method is as follows: S31. License File Reading and Parsing: Read the structured license file from the storage medium and parse it into a data structure containing authorization information fields, hardware fingerprint fields, and digital signature fields; wherein, the structured license file is... A format file that contains at least the attributes used to describe the authorization. Object, used to identify authorized devices Strings, and those used for integrity verification String; S32. Digital Signature Verification: Based on an asymmetric encryption algorithm, a pre-set public key is used to decrypt and verify the digital signature in the license file to confirm the integrity and authenticity of the license content; the specific implementation steps are as follows: S321. Extract the license data to be verified from the parsed data structure (e.g., ...). Fields Fields (Fields), and serialize them into normalized strings to ensure consistency during validation; S322. Calculate the first hash value of the normalized string using an asymmetric encryption algorithm. The signature data in the license is decrypted using a pre-set public key to obtain the second hash value. ; S323. Compare the first hash value. With the second hash value If they match, the signature verification is successful. S33. Hardware Fingerprint Comparison: Collect various hardware serial number information of the currently running device, generate the current device fingerprint through a hash algorithm, and compare its consistency with the hardware fingerprint field parsed from the license file; the specific implementation steps are as follows: S331. Collect various hardware serial number information of the currently running device, such as CPU serial number, motherboard serial number, hard disk serial number and MAC address information; The collected hardware information is then concatenated into a single string according to a predetermined order and format; for example, concatenating strings.

[0020]

[0021] The hash value generated by calculating the string using an asymmetric encryption algorithm is the fingerprint of the current device. S332, Combine the calculated current device fingerprint with the license data parsed from the license file (e.g., The system performs a strict comparison of the fields; if they match completely, the device is matched and verification passes; if they do not match, the license has been copied to another device, verification fails, and an interception is triggered. S34. Authorization Status Analysis and Adjudication: Provided that both digital signature verification and hardware fingerprint comparison are passed, the authorization information field in the license is analyzed and compared with the current system status to comprehensively determine whether the license is valid. The parsing of the authorization information field includes validity period checks and functional module checks. In the validity period check, if the current system time is later than the expiration time specified in the license, the authorization is deemed invalid. In the functional module check, check whether the function you are currently trying to use is in the check list.

[0022] S4. Operation monitoring: Perform corresponding operations based on the verification results of step S3; If the license is valid, the controlled program is allowed to operate normally; If the license is invalid, a process interception mechanism is triggered to automatically detect and terminate successfully matched processes using a tiered termination strategy. This process interception mechanism includes process interception activation and target process identification. The process interception activation method is as follows: In protected mode, a periodic process scanning and interception process is started; the scanning interval is a fixed value, such as a value range of 5 to 30 seconds; The method for identifying target processes is as follows: obtain the list of currently running processes through an application programming interface (such as the Windows API) and match it with a predefined list of controlled processes; the list of controlled processes is stored as a collection of process executable file names, including the names of the main program and its related component processes.

[0023] The tiered termination strategy employs a tiered approach, first normal termination and then forced termination; among which, Normal termination strategy: Terminate the target process through the system process termination application programming interface (such as Windows API) and attempt to terminate the target process with a normal exit code; this allows the program to perform cleanup work and save user data; Forced termination strategy: When the normal termination strategy fails, the target process is terminated by executing the system's forced termination command; it has a high success rate and can kill most stubborn processes.

[0024] S5. Service shutdown mechanism: In response to external commands, the main process and the daemon process exit synchronously, terminating mutual monitoring and protection functions; among them, external commands include specific password commands or flag files existing in a specific path.

[0025] Suppose, for a product named Industrial design software; the main program is The rendering engine is The main process is The daemon process is The following methods are used to protect this software: Main process startup and initialization: After the user powers on the device Automatic startup First, try creating a name A mutex; if creation fails, it means an instance is already running, and the current process will exit automatically. During initialization, it writes its own path to the registry. Below In key-value pairs; And in Create a log file in the directory Read configuration files from the same directory. ;

[0026] .

[0027] Mutual monitoring mechanism activated: After reading the configuration, use start up ; Two processes communicate via named pipes Establish a connection and send heartbeat packets to each other every 3 seconds; The user opened Task Manager and forcibly terminated the process. ; Call immediately after a 5-second heartbeat timeout. confirm It has disappeared; First restart: Wait 1 second, Restart Log records: ; Malicious script kills again Second restart: Wait 2 seconds, Restart it again; Log entries: .

[0028] License loading and verification: Read document; Digital signature verification: The program uses a built-in public key pair. The field is decrypted to obtain the hash value H2; Program calculation and Fields Value, get ; result: equal The signature verification passed, indicating that the license document has not been tampered with. Hardware fingerprint comparison: Data collection machine The serial numbers of the motherboard and hard drive are used to generate the current hardware fingerprint. ; result: With the license The discrepancy may be due to the user copying the license file and software to another computer. Final ruling: The license was deemed invalid by the S3 step due to a mismatch in hardware fingerprints.

[0029] Operation monitoring: Because the S3 verification failed, the system immediately switched from "normal operation mode" to "protection mode"; Start an interception scan loop that runs every 10 seconds; First scan (09:01:00): The system process list contains... No match, no operation; Second scan The user attempted to start it. The scanner found In the list of controlled processes middle; Call And pass in exit code 0; but The operation may have failed due to a lack of response during initialization. Execute system commands again ; result: The process was successfully terminated; Log records:

[0030] ; A pop-up message appears on the user's screen: "An invalid software license has been detected; the program has been terminated. Please contact the supplier."

[0031] Service shutdown mechanism: Suppose that the software needs to be legally upgraded or maintained, and the protection system needs to be temporarily shut down; The system administrator enters the password in the command line: Or create an empty file in the program data directory. ; After detecting the command, first send to Send a stop signal; both processes clean up resources (such as closing log files and releasing mutexes), and then exit synchronously and gracefully; Log records: ; Result: The dual-process mutual monitoring completely stopped, and the protection function was removed until the next system restart or manual operation.

[0032] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A process intercepting software protection method based on dual-process mutual monitoring and license verification, characterized in that, The method comprises the following steps: S1, main process startup and initialization: the main process is started, the operating system startup self-starting item is registered, and the log system and the configuration environment are initialized; S2, mutual monitoring mechanism startup: the main process is created, and the daemon process is started, and the bidirectional monitoring and heartbeat detection mechanism between the main process and the daemon process is established, forming a double-process mutual monitoring mechanism; S3, license loading and verification: the license file is read, the digital signature verification of the license file is performed, and whether the hardware fingerprint in the license file is consistent with the hardware fingerprint of the current running environment is compared; S4, running monitoring: according to the verification result of step S3, the corresponding operation is performed; If the license is valid, the controlled program is allowed to run normally; If the license is invalid, the process interception mechanism is triggered, automatic detection is performed, and a hierarchical termination strategy is adopted to execute the termination operation on the process matched successfully; S5, service termination mechanism: in response to an external instruction, the main process and the daemon process are synchronously exited, and the mutual monitoring and protection function is terminated.

2. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 1, characterized in that, In the S2 step, the steps of forming the double-process mutual monitoring mechanism are as follows: S21, connection establishment and heartbeat initialization: the main process creates and starts the daemon process, and the two parties are connected through an inter-process communication channel and exchange process identity information; S22, continuous monitoring and abnormality detection: the main process and the daemon process start the heartbeat detection thread and the process state checking thread respectively, and continuously monitor the other party; when the heartbeat signal of the other party is not received within a preset timeout period, or the handle of the other party process is detected to be invalid through an application programming interface; the other party process is immediately determined to be abnormally terminated; S24, self-recovery restart and stability control: after determining that the other party process is abnormally terminated, an exponential backoff strategy is adopted to immediately execute the operation of restarting the other party process; And in any one sliding time window, if the number of restarts reaches the maximum limit, stop the restart attempt and record the error log.

3. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 2, characterized in that, In the S22 step, The implementation method of heartbeat detection is as follows: the main process and the daemon process both send heartbeat data packets to the other party at a fixed first preset time interval; at the same time, a second preset time is also set as the heartbeat receiving timeout time, which is greater than the first preset time interval; The implementation method of process state checking is as follows: periodically call the application programming interface, and try to open the handle of the other party process with a set permission, if the opening fails, it is determined that the process does not exist.

4. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 1, characterized in that, In the S3 step, the implementation method of license loading and verification is as follows: S31, license file reading and parsing: reading the structured license file from the storage medium, and parsing it into a data structure containing the authorization information field, the hardware fingerprint field and the digital signature field; S32, digital signature verification: based on the asymmetric encryption algorithm, the preset public key is used to decrypt and verify the digital signature in the license file, to confirm the integrity and authenticity of the license content; S33, hardware fingerprint comparison: the hardware serial number information of the current running device is collected, the current device fingerprint is generated through a hash algorithm, and consistency comparison is performed with the hardware fingerprint field parsed from the license file; S34, authorization state analysis and ruling: under the premise that the digital signature verification and the hardware fingerprint comparison are both passed, the authorization information field in the license is analyzed and compared with the current system state to comprehensively determine whether the license is valid.

5. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 4, characterized in that, In the S32 step, the specific implementation steps of the digital signature verification are as follows: S321, separate the license data to be verified from the parsed data structure and serialize it into a standardized string; S322, calculate the first hash value of the standardized string using an asymmetric encryption algorithm; Decrypt the signature data in the license using the preset public key to obtain the second hash value; S323, compare the first hash value and the second hash value, and if they are consistent, the signature verification is passed.

6. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 4, characterized in that, In the S33 step, the specific implementation steps of the hardware fingerprint comparison are as follows: S331, collect multiple hardware serial number information of the current running device; And splice the collected multiple hardware information into a string according to the predetermined order and format; Use an asymmetric encryption algorithm to calculate the string to generate a hash value, which is the current device fingerprint; S332, compare the calculated current device fingerprint with the license data parsed from the license file; If they are completely consistent, the device is matched and the verification is passed; If they are not consistent, the license is copied to other devices, the verification fails, and the interception is triggered.

7. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 1, characterized in that, In the S4 step, the process interception mechanism includes process interception activation and target process identification, wherein, The method of process interception activation is as follows: in the protection mode, start the periodic process scanning and interception process; The method of target process identification is as follows: obtain the current running process list through the application programming interface, and match it with the predefined controlled process list.

8. The process intercepting software protection method based on dual-process mutual monitoring and license verification according to claim 1, characterized in that, In the S4 step, the hierarchical termination strategy adopts a hierarchical strategy of normal termination first and forced termination later; wherein, Normal termination strategy: terminate the target process with a normal exit code through the system process termination application programming interface; Forced termination strategy: when the normal termination strategy fails, terminate the target process by executing the system forced termination command.

Images