Control method and system for remote locking of notebook computer and computer storage medium
By dynamically generating a password book on the server side and using the device's unique verification code for hardware binding, the security problem of BIOS lock protection for laptops is solved, achieving high security and flexible lock management, and meeting the management needs of complex business scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHENZHEN CITY MAIDIJIE ELECTRONICS TECH
- Filing Date
- 2026-01-30
- Publication Date
- 2026-05-19
AI Technical Summary
Existing laptop BIOS lock protection has low security, is easily cracked, and cannot dynamically update passwords or relock, failing to meet the management needs of complex business scenarios.
The password book is dynamically generated and managed by the server, and hardware binding is performed using the device's unique verification code. Flexible locking policies are generated to enable remote updates or invalidation of old passwords, and locking management is carried out by combining multiple dimensions of factors.
It improves the security and controllability of the lock, prevents the illegal transfer of unlocking codes between different devices, and meets the management needs of time-based rental and off-hour locking.
Smart Images
Figure CN122065295A_ABST
Abstract
Description
Technical Field
[0001] The embodiments in this specification relate to the field of computer security technology, and in particular to a control method, system, and computer storage medium for remotely locking a laptop computer. Background Technology
[0002] Currently, most laptops on the market implement BIOS-level lock protection primarily using a BIOS password. This method is relatively traditional. Generally, BIOS manufacturers use the HASH256 algorithm to store the hash value of the input password in SPI flash memory. This method has a low security level, is easily cracked, and once cracked, the password cannot be dynamically changed to lock the computer again. Summary of the Invention
[0003] The purpose of this application is to provide a control method, system, and computer storage medium for remotely locking a laptop computer, in order to solve the problems of low security, easy cracking, and inability to dynamically update passwords or relock existing laptop computer locking protection technologies.
[0004] The embodiments of this application adopt the following technical solutions: This application provides a method for remotely locking a laptop computer. The method is applied to a server and includes the following components: Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0005] This application embodiment also provides a control system for remotely locking a laptop computer. The control system is applied to a server and includes: The acquisition module, upon receiving an activation request from a computer terminal, acquires decryption feature information based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. The generation module generates locking information, including a codebook and locking strategy, based on the decryption feature information. The execution module returns the locking information to the computer terminal, so that the computer terminal performs the corresponding locking operation according to the locking strategy. The unlocking module, upon receiving an unlocking request from the user, generates an unlocking code based on the currently valid password book and the device's unique verification code. The verification module returns the unlock code to the user terminal, enabling the computer terminal to verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0006] This application also provides a computer storage medium, including a program for use in conjunction with an electronic device, the program being executed by a processor to complete the following steps: Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0007] Based on the control method, system, and computer storage medium for remotely locking a laptop computer according to the embodiments of this application, a password book is dynamically generated and managed by the server, and old passwords can be remotely updated or invalidated at any time, which completely solves the security risk that static passwords will be permanently invalidated once leaked, and has dynamism and high security; by extracting and solidifying multiple unique hardware information to generate a unique device verification code, the locking and unlocking logic can be uniquely associated with the motherboard of a specific device, effectively preventing the illegal transfer of the unlocking code between different devices.
[0008] In this way, by utilizing flexible lock-up strategies, the cloud can flexibly formulate and distribute strategies based on multiple factors such as time, meeting the management needs of complex business scenarios (such as hourly rentals, lock-up after get off work hours, etc.). Attached Figure Description
[0009] The accompanying drawings, which are included to provide a further understanding of the embodiments of this specification and form part of the embodiments of this specification, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating a remote locking method for a laptop computer provided in an embodiment of this application; Figure 2 This application provides a schematic diagram of the system module corresponding to a remote locking control method for a laptop computer, as shown in the embodiments of this application. Figure 3 This is a flowchart illustrating the execution logic of the computer terminal BIOS module corresponding to a remote locking control method for a laptop provided in an embodiment of this specification. Figure 4 A flowchart illustrating the execution logic of the OS module corresponding to a remote locking control method for a laptop computer provided in an embodiment of this specification; Figure 5 A flowchart illustrating the execution logic of the Server module corresponding to a remote locking control method for a laptop computer provided in the embodiments of this specification; Figure 6 A schematic diagram of a control system for remotely locking a laptop computer, provided in an embodiment of this application; Figure 7 This is a schematic diagram of the computer storage medium corresponding to a remote locking control method for a laptop computer provided in an embodiment of this application. Detailed Implementation
[0010] In existing technologies, traditional BIOS locking primarily relies on locally set static passwords, which are typically stored in the motherboard's SPI Flash after hashing. However, this traditional locking method has significant drawbacks. Firstly, if the static password is cracked or leaked, the laptop will be permanently unprotected, and users can only resolve the issue through high-risk operations such as flashing the BIOS, and the original static password cannot be remotely invalidated. Secondly, static passwords have a weak correlation with the device hardware itself, meaning they can be used on similar devices after being cracked, resulting in low security. Finally, this traditional locking method is inconvenient to manage and cannot meet the needs of remote, dynamic control of device locking in scenarios such as leasing or enterprise bulk device management.
[0011] Furthermore, although existing technologies have proposed controlling laptop devices via cloud-based commands, these methods are mostly simple locks at the application or operating system level, lacking deep, secure two-way authentication mechanisms at the BIOS level. This makes it difficult to prevent the extraction, copying, or bypassing of local passwords. Therefore, there is an urgent need for a remote BIOS locking solution that is more secure, more controllable, and deeply integrated with the hardware.
[0012] Therefore, this application provides a control method, system, and computer storage medium for remotely locking a laptop computer. By dynamically generating and managing a password book on the server side, old passwords can be remotely updated or invalidated at any time, completely solving the security risk that static passwords become permanently invalid once leaked. It has dynamism and high security. By extracting and solidifying multiple unique hardware information to generate a unique device verification code, the locking and unlocking logic can be uniquely associated with the motherboard of a specific device, effectively preventing the illegal transfer of the unlocking code between different devices.
[0013] In this way, by utilizing flexible lock-up strategies, the cloud can flexibly formulate and distribute strategies based on multiple factors such as time, meeting the management needs of complex business scenarios (such as hourly rentals, lock-up after get off work hours, etc.).
[0014] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0015] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.
[0016] Please see Figure 1 This is a flowchart illustrating a method for remotely locking a laptop computer, as provided in an embodiment of this application.
[0017] In this embodiment of the specification, the remote locking method for a laptop computer is applied to a server. Specifically, the remote locking method for a laptop computer may include the following steps: S101: After receiving an activation request sent by a computer terminal, obtain decryption feature information based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal; S103: Generate locking information, including a codebook and locking strategy, based on the decryption feature information; S105: Return the machine lock information to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock strategy; S107: After receiving the unlock request sent by the user, generate an unlock code based on the currently valid password book and the device's unique verification code; S109: The unlock code is returned to the user terminal, so that the computer terminal verifies the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0018] In the embodiments described in this specification, the server dynamically generates a unique encrypted password book and a corresponding locking strategy for each computer terminal based on the decryption feature information of each computer terminal. The decryption feature information includes the computer terminal's unique device verification code. Furthermore, the computer terminal's unique device verification code is generated at the BIOS layer by comprehensively utilizing multiple unique identification information from the motherboard hardware to generate a unique device verification code (VID), and the VID is written into a one-time programmable memory (OTP, a one-time programmable protection register in the motherboard's SPI flash) for permanent hardware binding. During locking and unlocking, the BIOS (Basic Input Output System) needs to perform collaborative verification using the VID, the dynamic password book issued by the server, and the unlocking code to ensure the security of the computer terminal.
[0019] As an application embodiment of this specification, for step S101, after receiving the activation request sent by the computer terminal, decryption feature information is obtained based on the activation request. The decryption feature information includes the unique device verification code of the computer terminal, which may specifically include: When the computer terminal is first started or first activated, a unique verification code for the device is generated by collecting the characteristic information of the computer terminal's motherboard. Receive an activation request sent by the computer terminal containing the device's unique verification code; The activation request is decrypted to obtain the decryption feature information, which contains the device's unique verification code.
[0020] In the embodiments described in this specification, the device unique verification code is a unique verification code generated by the BIOS layer of the computer terminal using the collected multiple unique identification information of the motherboard hardware, and the device unique verification code is stored in the one-time programmable memory of the motherboard.
[0021] The collected multiple unique identifiers may include the motherboard's UUID, the unique identifier of the SPI Flash, and the product serial number (PSN); the device unique verification code can be generated by hashing the multiple unique identifiers and adding a random salt value, which is not specifically limited here.
[0022] In addition, collecting the feature information of the computer terminal motherboard also includes reading the motherboard's PSN (Product Serial Number), device name, and device model, and storing this feature information in the ODR of the SPI flash.
[0023] Among them, ODR, OEM Data Region, is a dedicated area in the SPI flash memory for storing BIOS data, and its size can be up to 64K.
[0024] Furthermore, as an application embodiment of this specification, step S103, generating locking information including a codebook and locking strategy based on the decryption feature information, may specifically include: Based on the decryption feature information, a password book and locking strategy uniquely corresponding to the computer terminal are dynamically generated. The lock information is encrypted; The encrypted lock information is sent to the computer terminal.
[0025] In the embodiments of this specification, the locking strategy may specifically include locking conditions such as activation time and locking time. For example, it may specify the time period during which the computer terminal is locked and the time period during which it can be unlocked, etc., without making specific limitations here.
[0026] In practical applications, a codebook can specifically be an encrypted array of secret values corresponding to a time series.
[0027] Encrypting the locking information ensures the security of its transmission. After decrypting the locking information, the computer terminal can obtain information such as the dynamic password book and locking strategy. In this way, the computer terminal can perform corresponding locking operations based on the locking information sent by the server.
[0028] Furthermore, if the previously issued locking information is leaked, cracked, or expired, the server can proactively send a dynamically updated encrypted password book and corresponding locking policy to the computer terminal. The updated locking information can overwrite the previous locking information, rendering the previous locking information invalid. This further ensures the security and reliability of the computer terminal.
[0029] As an application embodiment of this specification, for step S107, after receiving the unlock request sent by the user terminal, generating an unlock code based on the currently valid password book and the device's unique verification code may specifically include: Based on the unlock request, obtain the device identifier of the computer terminal corresponding to the unlock request; Based on the device identifier, locate the password book that corresponds one-to-one with the device identifier; After decrypting the password book, the unique verification code of the device is combined with the password book. The unlock code is generated by performing a hash calculation on the combined data.
[0030] In the embodiments described in this specification, the unlock code is not a static password, but a dynamic, one-time valid security credential that is deeply bound to a specific computer device. That is to say, the unlock code is different each time it is unlocked, and it can only be used on a specific computer device and cannot be used on other devices.
[0031] When a user or administrator requests to unlock, they need to provide the server with the device identifier corresponding to the computer terminal that needs to be unlocked. The server can calculate the time period index corresponding to the computer terminal based on the current server time. The time period index is completely consistent with the verification information in the corresponding password book.
[0032] Furthermore, after decrypting the password book, the unique verification code of the device is combined with the password book, which may specifically include: Based on the current server time, obtain the time period index corresponding to the computer terminal; According to the time period index, the corresponding secret base value is retrieved from the codebook, wherein the secret base value is a random number or key that is pre-generated and stored in the codebook and is bound to time; Combine the device's unique verification code with the secret base value.
[0033] In the embodiments of this specification, after the codebook is unlocked, the corresponding secret base value can be found from the codebook according to the time period index. The secret base value is a random number or key that is pre-generated and stored in the codebook and bound to the time slice.
[0034] Furthermore, the device's unique verification code is combined with the secret base value, and a hash function is used to calculate and generate an intermediate value.
[0035] To ensure security, the intermediate value is not usually used directly as the unlock code during output. Instead, necessary information such as the time index and intermediate value can be further assembled into a structured data packet, and the data packet can be signed with the server's private key to generate a digital token.
[0036] In specific application scenarios, the digital token can be used as the unlock code, or the string obtained by encoding the digital token can be used as the unlock code; no specific restrictions are made here.
[0037] As an application embodiment of this specification, in step S109, the unlock code is returned to the user terminal, so that the computer terminal verifies the unlock code entered by the user terminal based on the locally stored password book and the device's unique verification code. If the verification is successful, an unlocking operation is performed on the computer terminal, which may specifically include: When verifying the unlock code input by the user terminal, the computer terminal calls a preset unlock function to verify whether the logical relationship between the device unique verification code, the verification information extracted from the password book, and the unlock code is accurate, based on the device unique verification code, the verification information extracted from the password book, and the unlock code. If the logical relationship between the device's unique verification code, the verification information extracted from the password book, and the unlock code is accurate, then an unlocking operation is performed on the computer terminal.
[0038] In the embodiments of this specification, the preset unlock function may be pre-saved on the computer terminal and can be used for verification of the unlock code.
[0039] This specification provides a remote locking method for laptop computers. By dynamically generating and managing a password book on the server side, old passwords can be remotely updated or invalidated at any time, completely solving the security risk that static passwords become permanently invalid once leaked. It has dynamism and high security. By extracting and solidifying multiple unique hardware information to generate a unique device verification code, the locking and unlocking logic can be uniquely associated with the motherboard of a specific device, effectively preventing the illegal transfer of the unlocking code between different devices.
[0040] In this way, by utilizing flexible lock-up strategies, the cloud can flexibly formulate and distribute strategies based on multiple factors such as time, meeting the management needs of complex business scenarios (such as hourly rentals, lock-up after get off work hours, etc.).
[0041] It should be noted that the above-described specific remote locking method for laptops is merely a specific application example and does not limit the scope of the embodiments in this specification. Other specific embodiments may also be included, which will not be elaborated here.
[0042] Based on the same inventive concept, this specification also provides specific application examples of the above-described control method for remotely locking a laptop computer.
[0043] like Figure 2 The diagram shown is an application structure diagram of the system module corresponding to a remote locking control method for a laptop computer provided in an embodiment of this specification.
[0044] In the embodiments of this specification, the system modules corresponding to the remote locking control method for a laptop computer may specifically include three modules: a computer terminal BIOS, a server, and a user terminal.
[0045] The computer terminal BIOS is used to receive the password book from the cloud. When the conditions are met, the BIOS is responsible for locking the machine; when the unlock code is entered, the BIOS is responsible for verifying the unlock code and unlocking the machine.
[0046] The server is responsible for receiving the computer terminal device configuration feature information reported by the BIOS, generating lock information and sending it back to the BIOS; after the device is locked, it is responsible for generating an unlock code for the user to unlock.
[0047] The user terminal (OS) is used to enable communication between the computer terminal BIOS and the server. In the embodiments described in this specification, an APP with this function needs to be installed on the user terminal.
[0048] The execution logic of each module will be explained below.
[0049] like Figure 3 The diagram shown is a flowchart illustrating the execution logic of the computer terminal BIOS module corresponding to a remote locking control method for a laptop provided in an embodiment of this specification.
[0050] In the embodiments of this specification, the execution logic steps of the computer terminal BIOS module are as follows: Step 1: Power on; Step 2: Entering the BIOS process; Step 3: Determine if this is the first time the device has been powered on; Step 4: If it is the first time booting up, the motherboard's Unique ID and UUID are read, and the VID is generated using the Unique ID and UUID; Among them, Unique ID is the unique identifier ID of the motherboard SPI flash, and UUID is the 128-bit unique motherboard identification ID.
[0051] VID, or Valid ID, is obtained by hashing the motherboard's Unique ID and UUID. VID is an important input parameter for decrypting locked devices.
[0052] Step 5: Read the device name and model of the computer terminal; Step 6: Obtain motherboard feature information and save it to BIOS ODR; Step 7: If this is not the first time the device has been powered on, determine whether the device lock conditions are met; Step 8: If the lock conditions are met, the BIOS will display a random screen and wait for unlocking. Step 9: Obtain the unlock code requested by the user from the server backend; Step 10: Determine if the unlock code entered by the user is correct; Step 11: If the unlock code is incorrect, return to step 8; Step 12: If the locking conditions are not met, or if the unlock code is correct, proceed to the unlocking process; Step 13: Enter OS.
[0053] In the embodiments described in this specification, the computer terminal BIOS module can be used to store the randomly generated BIOS public and private keys and the Server public key in the BIOS's ODR.
[0054] When the computer terminal is first started or activated, it can actively collect the motherboard's characteristic information. Specifically, this may include generating a VID using the motherboard's Unique ID and UUID, reading the PSN, device name, and device model, and placing this information in the ODR of the SPI flash.
[0055] When a user activates the motherboard's encryption function, the BIOS is responsible for encrypting the feature information and the BIOS public key together with the BIOS private key, and then reporting it to the server.
[0056] The BIOS can also decrypt the lock information sent back by the server using the server's public key, and then encrypt it using the SDK and store it in the BIOS's ODR; at the same time, it writes the VID into the OTP for permanent storage.
[0057] By using OTP memory to store critical information, any attempt to flash or modify the BIOS firmware may result in VID loss or verification failure, greatly increasing the threshold and cost of physical cracking.
[0058] When the computer boots up, the BIOS needs to check if the lock time has been met. If it has, the BIOS will lock the computer and display a password input box on the screen, waiting for the password to be entered to unlock. After the unlock code is entered, the BIOS can execute the corresponding unlock logic. The unlock function provided in the SDK is called during the unlock process. The VID, activation time, password book and unlock code are required as input parameters to verify whether the unlock code is correct. If it is correct, the unlock will proceed.
[0059] like Figure 4 The diagram shown is a flowchart illustrating the execution logic of the OS module corresponding to a remote locking control method for a laptop computer provided in an embodiment of this specification.
[0060] In the embodiments of this specification, the execution logic steps of the OS module are as follows: Step 1: Request device activation by requesting BIOS feature information from the BIOS module; Step 2: The BIOS module captures the feature information in the ODR, encrypts it, and sends it. Step 3: The BIOS module sends encryption signature information to the OS module; Step 4: Send the encryption feature information to the Server module; Step 5: The Server module decrypts the feature information, generates a password book, activation time, lock time, and sends it back to the BIOS module after encryption; Step 6: The Server module sends the machine lock information to the OS module; Step 7: The OS module receives the lock information; Step 8: The OS module sends the lock information back to the BIOS module; Step 9: The BIOS module saves the lock information to the ODR and writes the VID to the OTP.
[0061] In the embodiments described in this specification, the OS module can be equipped with a corresponding APP, which can be used by the administrator to initiate an activation operation from the interface provided by the APP. During activation, the APP requests encrypted feature information from the BIOS and sends it to the server in encrypted form. While waiting for the server to send back the activation time, lock time, password book and other lock information, the APP sends it to the BIOS in password form.
[0062] like Figure 5 The diagram shown is a flowchart illustrating the execution logic of the Server module corresponding to a remote locking control method for a laptop computer provided in an embodiment of this specification.
[0063] In the embodiments described in this specification, the execution logic steps of the Server module are as follows: Step 1: The computer sends an activation request to the server; Step 2: The server obtains decryption feature information based on the activation request; Step 3: The server generates a password book, activation time, lock time, and other locking information; Step 4: The server sends the password book, activation time, lock time, and other locking information to the computer. Step 5: The user or administrator sends a message to the server indicating that the password has been cracked; Step 6: The server generates new lock information based on the characteristic information; Step 7: The BIOS on the computer retains the new lock information; Step 8: The user or administrator requests an unlock code from the server; Step 9: The server generates an unlock code based on the feature information; Step 10: The server sends an unlock code to the user or administrator for the user to unlock.
[0064] In the embodiments of this specification, the Server module can be used to decrypt the encrypted feature information uploaded by the BIOS, record the feature information of each computer, generate a password book, activation time and lock time for each device based on the feature information, and generate an unlock code based on the feature information.
[0065] If the current BIOS password is cracked, the server can proactively modify the lock information and send it to the BIOS, rendering the original unlock password invalid; a new unlock password is required to unlock the device.
[0066] The specific implementation process of the embodiments in this specification can be referred to the various implementation steps corresponding to the above embodiments, and will not be repeated here.
[0067] Based on the same inventive concept, embodiments of this specification also provide a control system for remotely locking a laptop computer. For example... Figure 6 The diagram shown is a structural schematic of a remote locking control system for a laptop computer provided in an embodiment of this specification.
[0068] The remote locking control system for the laptop computer is applied to the server side, and the remote locking control system for the laptop computer may specifically include: The acquisition module 601, after receiving an activation request sent by a computer terminal, acquires decryption feature information based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. The generation module 602 generates locking information, including a codebook and a locking strategy, based on the decryption feature information. The execution module 603 returns the locking information to the computer terminal, so that the computer terminal performs the corresponding locking operation according to the locking strategy. The unlocking module 604, upon receiving an unlocking request from the user terminal, generates an unlocking code based on the currently valid password book and the device's unique verification code. The verification module 605 returns the unlock code to the user terminal, enabling the computer terminal to verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0069] based on Figure 6 The system described in this specification also provides some specific implementation schemes of the system, which will be described below.
[0070] Furthermore, upon receiving an activation request from the computer terminal, decryption feature information is obtained based on the activation request. This decryption feature information includes the computer terminal's unique device verification code, comprising: When the computer terminal is first started or first activated, a unique verification code for the device is generated by collecting the characteristic information of the computer terminal's motherboard. Receive an activation request sent by the computer terminal containing the device's unique verification code; The activation request is decrypted to obtain the decryption feature information, which contains the device's unique verification code.
[0071] Furthermore, the device unique verification code is generated by the BIOS layer of the computer terminal using the collected multiple unique identification information of the motherboard hardware. The collected multiple unique identification information includes the motherboard's UUID, the unique identifier of the SPIFlash, and the product serial number.
[0072] Furthermore, based on the decryption feature information, locking information including a codebook and locking strategy is generated, including: Based on the decryption feature information, a password book and locking strategy uniquely corresponding to the computer terminal are dynamically generated. The lock information is encrypted; The encrypted lock information is sent to the computer terminal.
[0073] Furthermore, the system is characterized by further comprising: If the lock information is leaked, cracked, or expired, the system will proactively send a dynamically updated lock information to the computer terminal. The updated lock information will overwrite the previously sent lock information, rendering the previously sent lock information invalid.
[0074] Furthermore, upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code, including: Based on the unlock request, obtain the device identifier of the computer terminal corresponding to the unlock request; Based on the device identifier, locate the password book that corresponds one-to-one with the device identifier; After decrypting the password book, the unique verification code of the device is combined with the password book. The unlock code is generated by performing a hash calculation on the combined data.
[0075] Furthermore, after decrypting the codebook, the unique verification code of the device is combined with the codebook, including: Based on the current server time, obtain the time period index corresponding to the computer terminal; According to the time period index, the corresponding secret base value is retrieved from the codebook, wherein the secret base value is a random number or key that is pre-generated and stored in the codebook and is bound to time; Combine the device's unique verification code with the secret base value.
[0076] Furthermore, the unlock code is returned to the user terminal, enabling the computer terminal to verify the unlock code entered by the user terminal based on the locally stored password book and the device's unique verification code. If the verification is successful, an unlocking operation is performed on the computer terminal, including: When verifying the unlock code input by the user terminal, the computer terminal calls a preset unlock function to verify whether the logical relationship between the device unique verification code, the verification information extracted from the password book, and the unlock code is accurate, based on the device unique verification code, the verification information extracted from the password book, and the unlock code. If the logical relationship between the device's unique verification code, the verification information extracted from the password book, and the unlock code is accurate, then an unlocking operation is performed on the computer terminal.
[0077] This specification provides a remote locking control system for laptops. By dynamically generating and managing a password book on the server side, old passwords can be remotely updated or invalidated at any time, completely solving the security risk that static passwords become permanently invalid once leaked. It has dynamism and high security. By extracting and solidifying multiple unique hardware information to generate a unique device verification code, the locking and unlocking logic can be uniquely associated with the motherboard of a specific device, effectively preventing the illegal transfer of the unlocking code between different devices.
[0078] In this way, by utilizing flexible lock-up strategies, the cloud can flexibly formulate and distribute strategies based on multiple factors such as time, meeting the management needs of complex business scenarios (such as hourly rentals, lock-up after get off work hours, etc.).
[0079] Based on the same inventive concept, embodiments of this specification also provide an electronic device, including at least one processor and a memory, wherein the memory stores a program and is configured to be executed by the at least one processor in the following steps: Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0080] Other functions of the processor can be found in the above embodiments, and will not be repeated here.
[0081] Based on the same inventive concept, embodiments of this specification also provide a computer-readable storage medium, including a program for use in conjunction with an electronic device, the program being executable by a processor to perform the following steps: Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
[0082] Other functions of the processor can be found in the above embodiments, and will not be repeated here.
[0083] like Figure 7As shown in the figure, this specification also provides a schematic diagram of the structure of a computer storage medium.
[0084] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.
[0085] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0086] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0087] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0090] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0091] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0092] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0093] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0094] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.
[0095] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.
[0096] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of protection of the claims of this application.
Claims
1. A method for remotely locking a laptop computer, characterized in that, The remote locking method for a laptop computer is applied to the server side, and the remote locking method for a laptop computer includes: Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
2. The method as described in claim 1, characterized in that, Upon receiving an activation request from a computer terminal, decryption feature information is obtained based on the activation request. This decryption feature information includes the computer terminal's unique device verification code, comprising: When the computer terminal is first started or activated, a unique verification code for the device is generated by collecting the characteristic information of the computer terminal's motherboard. Receive an activation request sent by the computer terminal containing the unique verification code of the device; The activation request is decrypted to obtain the decryption feature information, which contains the device's unique verification code.
3. The method as described in claim 2, characterized in that, The device's unique verification code is generated by the BIOS layer of the computer terminal using multiple unique identifiers collected from the motherboard hardware. These multiple unique identifiers include the motherboard's UUID, the unique identifier of the SPI Flash, and the product serial number.
4. The method as described in claim 1, characterized in that, Based on the decryption feature information, lock information including a codebook and lock strategy is generated, including: Based on the decryption feature information, a password book and locking strategy uniquely corresponding to the computer terminal are dynamically generated. The lock information is encrypted; The encrypted lock information is sent to the computer terminal.
5. The method as described in claim 4, characterized in that, The method further includes: If the lock information is leaked, cracked, or expired, the system will proactively send a dynamically updated lock information to the computer terminal. The updated lock information will overwrite the previously sent lock information, rendering the previously sent lock information invalid.
6. The method as described in claim 4, characterized in that, Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code, including: Based on the unlock request, obtain the device identifier of the computer terminal corresponding to the unlock request; Based on the device identifier, locate the password book that corresponds one-to-one with the device identifier; After decrypting the password book, the unique verification code of the device is combined with the password book. The unlock code is generated by performing a hash calculation on the combined data.
7. The method as described in claim 6, characterized in that, After decrypting the password book, the unique verification code of the device is combined with the password book, including: Based on the current server time, obtain the time period index corresponding to the computer terminal; According to the time period index, the corresponding secret base value is retrieved from the codebook, wherein the secret base value is a random number or key that is pre-generated and stored in the codebook and is bound to time; Combine the device's unique verification code with the secret base value.
8. The method as described in claim 1, characterized in that, The unlock code is returned to the user terminal, enabling the computer terminal to verify the unlock code entered by the user terminal based on the locally stored password book and the device's unique verification code. If the verification is successful, an unlocking operation is performed on the computer terminal, including: When verifying the unlock code input by the user terminal, the computer terminal calls a preset unlock function to verify whether the logical relationship between the device unique verification code, the verification information extracted from the password book, and the unlock code is accurate, based on the device unique verification code, the verification information extracted from the password book, and the unlock code. If the logical relationship between the device's unique verification code, the verification information extracted from the password book, and the unlock code is accurate, then an unlocking operation is performed on the computer terminal.
9. A control system for remotely locking a laptop computer, characterized in that, The remote locking control system for the laptop computer is applied to the server side, and the remote locking control system for the laptop computer includes: The acquisition module, upon receiving an activation request from a computer terminal, acquires decryption feature information based on the activation request, wherein the decryption feature information includes the unique device verification code of the computer terminal. The generation module generates locking information, including a codebook and locking strategy, based on the decryption feature information. The execution module returns the locking information to the computer terminal, so that the computer terminal performs the corresponding locking operation according to the locking strategy. The unlocking module, upon receiving an unlocking request from the user, generates an unlocking code based on the currently valid password book and the device's unique verification code. The verification module returns the unlock code to the user terminal, enabling the computer terminal to verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.
10. A computer storage medium comprising a program for use in conjunction with an electronic device, the program being executable by a processor to perform the following steps: Upon receiving an activation request from the computer terminal, decryption feature information is obtained based on the activation request, wherein... The decryption feature information includes the unique device verification code of the computer terminal; Based on the decryption feature information, lock information including a codebook and lock strategy is generated; The machine lock information is returned to the computer terminal, so that the computer terminal performs the corresponding machine lock operation according to the machine lock policy; Upon receiving an unlock request from the user, an unlock code is generated based on the currently valid password book and the device's unique verification code. The unlock code is returned to the user terminal, so that the computer terminal can verify the unlock code entered by the user terminal based on the password book stored locally and the device's unique verification code. If the verification is successful, the computer terminal is unlocked.