A power software offline authorization method, system and storage medium

Abstract

This invention discloses an offline authorization method, system, and storage medium for power software, relating to the field of data security technology. An offline authorization system for power software includes a client and a server: the client generates a unique device identifier based on collected multi-dimensional fingerprint information of the device; the unique device identifier is mixed with version information to generate a machine code and transmitted to the server; the server verifies the legality of the received machine code; after successful verification, the server generates authorization data based on the machine code; the authorization data is encrypted to generate an activation code and transmitted to the client; the client receives the activation code generated by the server, decrypts it to obtain the authorization data, and generates a local encrypted authorization file after offline verification of the authorization data; the local encrypted authorization file is loaded during software runtime to verify the authorization validity offline. This invention enables offline software authorization management and improves authorization security.

Description

Technical Field

[0001] This invention relates to an offline authorization method, system, and storage medium for power software, belonging to the field of data security technology. Background Technology

[0002] With the rapid development of smart grid construction, power system relay protection devices play a crucial role in the safe operation of the power grid. Various relay protection devices, measurement and control devices, and monitoring backend systems require specialized management and configuration software for parameter setting, function configuration, and operational monitoring. In power system environments, these devices typically operate in industrial sites such as substations and power plants, facing the following unique challenges: Physical isolation environment: The relay protection device operates in the production control area (Zone I). According to the "Regulations on Security Protection of Power Monitoring Systems", it is strictly prohibited to connect to the Internet, and the traditional online authorization and verification mechanism cannot be used. High reliability requirements: The power system has extremely high requirements for operational continuity, and the authorized verification mechanism must not affect the normal operation of the equipment, requiring complete offline verification; Device binding requirement: To prevent the configuration software from being illegally copied and abused, the software license must be strongly bound to a specific relay protection device to ensure that the software can only be used on authorized devices; Unified management of multiple types of equipment: There are many types of relay protection devices, including AC systems, DC systems, overseas power grid systems and industrial systems, which require a unified authorized management platform; Hierarchical access control: Different personnel (R&D engineers, debugging engineers, operation and maintenance personnel) require different software operation permissions, so fine-grained access control needs to be implemented.

[0003] Existing offline licensing solutions have the following technical problems in the field of power system relay protection device software: 1. Simple hardware IDs are easily forged and tampered with, making them unsuitable for the high security requirements of power systems; 2. Lack of identification data collection for storage devices such as hard drives, resulting in insufficient uniqueness of device fingerprints; 3. Using symmetric encryption algorithms makes key management difficult and poses a risk of key leakage; 4. The storage of authorized information is insecure and easily cracked, posing a security risk to the power system; 5. The lack of a flexible hierarchical authorization mechanism fails to meet the needs of different positions within the power system; 6. It is impossible to control the validity period in an offline environment, making it difficult to manage the authorization lifecycle; 7. Difficulty in unified management of multiple software products and multiple device types. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, and storage medium for offline authorization of power software. By collecting multi-dimensional device fingerprint information and combining it with public key encryption technology, a highly secure offline software authorization management system can be achieved.

[0005] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0006] On one hand, the present invention provides an offline authorization method for power software, executed by a client, comprising: A unique device identifier is generated based on the collected multi-dimensional fingerprint information of the device. The device's unique identifier is mixed with version information to generate a machine code, which is then transmitted to the server. Receive the activation code generated by the server, decrypt it to obtain the authorization data, and generate a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline.

[0007] Optionally, the device's multidimensional fingerprint information includes the network card MAC address, hardware identifier, software identifier, and username; The network interface card MAC address is obtained by traversing network interfaces, identifying physical network interfaces and excluding virtual network interfaces; The hardware identifier is a hard disk identifier read through a system call; The software identifier is the software name.

[0008] Optionally, the unique identifier calculation process for the device is as follows: Combine the multi-dimensional fingerprint information of the device; The hash value is obtained by performing a hash calculation on the combined multidimensional fingerprint information of the device. A fixed number of bits of the hash value are extracted as a unique identifier for the device.

[0009] Optionally, the machine code generation process is as follows: dynamically mix the device's unique identifier with the version information to generate a fixed-length hexadecimal machine code; The version information refers to the software version.

[0010] Optionally, the offline verification process includes: Use the locally stored private key to decrypt the activation code and obtain the authorization data; Extract the device's unique identifier from the authorized data and compare it with the device identifier calculated locally in real time to verify the consistency of hardware binding; Extract the validity period from the authorization data and compare it with the current system time to verify the timeliness of the authorization; Extract the software version from the license data and compare it with the current software version to verify backward compatibility.

[0011] Secondly, this invention provides an offline authorization method for power software, executed by a server, comprising: Verify the validity of the received machine code; After successful verification, authorization data is generated based on the machine code; The authorized data is encrypted to generate an activation code; The activation code is transmitted to the client.

[0012] Optionally, the authorization data includes a unique device identifier, permission information, validity period, and software version; The permission information includes permission levels or functional module access markers set according to the user's role or operational needs, so that the client can open or close the corresponding functional interface according to the markers after decryption.

[0013] Optionally, the encryption uses an asymmetric encryption algorithm to encrypt the authorized data with a public key to generate an activation code.

[0014] Thirdly, this invention provides an offline authorization system for power software, comprising a client and a server: The client generates a unique device identifier based on the collected multidimensional fingerprint information of the device; the unique device identifier is mixed with version information to generate a machine code and transmitted to the server; The server verifies the validity of the received machine code; After successful verification, the server generates authorization data based on the machine code; the authorization data is then encrypted to generate an activation code, which is transmitted to the client. The client receives the activation code generated by the server, decrypts it to obtain the authorization data, and generates a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the power software offline licensing method described in any of the first aspects.

[0016] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: 1. This invention achieves highly secure offline software authorization management by collecting multi-dimensional device fingerprint information and combining it with public key encryption technology. This not only meets the security requirements of physical isolation in power systems, but also provides flexible access control and version management functions. 2. This invention ensures the security of authorized information through asymmetric encryption technology. The public key is used for encryption, and the private key is used for decryption, thus solving the key management problem. Attached Figure Description

[0017] Figure 1 This is a flowchart of the offline licensing method for power software according to the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other. Example 1:

[0019] This embodiment introduces an offline authorization system for power software, such as... Figure 1 As shown, it includes both the client and server sides: The client generates a unique device identifier based on the collected multidimensional fingerprint information of the device; the unique device identifier is mixed with version information to generate a machine code and transmitted to the server; The server verifies the validity of the received machine code; After successful verification, the server generates authorization data based on the machine code; the authorization data is then encrypted to generate an activation code, which is transmitted to the client. The client receives the activation code generated by the server, decrypts it to obtain the authorization data, and generates a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline. Example 2:

[0020] Based on the same inventive concept as Embodiment 1, this embodiment introduces an offline licensing method for power software, executed by the client, including: A unique device identifier is generated based on the collected multi-dimensional fingerprint information of the device. The device's unique identifier is mixed with version information to generate a machine code, which is then transmitted to the server. Receive the activation code generated by the server, decrypt it to obtain the authorization data, and generate a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline.

[0021] The device's multidimensional fingerprint information includes the network card MAC address, hardware identifier, software identifier, and username; The network interface card MAC address is obtained by traversing network interfaces, identifying physical network interfaces and excluding virtual network interfaces; The hardware identifier is a hard disk identifier read through a system call; The software identifier is the software name.

[0022] The process for calculating the unique identifier of the device is as follows: The device's multidimensional fingerprint information is combined in the format of "network card MAC address: hard disk identifier: software name: username"; The hash value is obtained by performing a hash calculation on the combined multidimensional fingerprint information of the device. A fixed number of bits of the hash value are extracted as a unique identifier for the device.

[0023] The machine code generation process is as follows: the unique identifier of the device and the version information are dynamically mixed to generate a fixed-length hexadecimal machine code. The version information refers to the software version.

[0024] The offline verification process includes: Use the locally stored private key to decrypt the activation code and obtain the authorization data; Extract the device's unique identifier from the authorized data and compare it with the device identifier calculated locally in real time to verify the consistency of hardware binding; Extract the validity period from the authorization data and compare it with the current system time to verify the timeliness of the authorization; Extract the software version from the license data and compare it with the current software version to verify backward compatibility. Example 3:

[0025] Based on the same inventive concept as Embodiments 1 and 2, this embodiment introduces an offline licensing method for power software, executed by a server, including: Verify the validity of the received machine code; After successful verification, authorization data is generated based on the machine code; The authorized data is encrypted to generate an activation code; The activation code is transmitted to the client.

[0026] The authorized data includes the device's unique identifier, permission information, validity period, and software version; The permission information includes permission levels or functional module access markers set according to the user's role or operational needs, so that the client can open or close the corresponding functional interface according to the markers after decryption.

[0027] The encryption uses an asymmetric encryption algorithm to encrypt the authorized data with a public key to generate an activation code. Example 4:

[0028] This embodiment describes the implementation process of an offline authorization method for power software, taking the offline authorization of relay protection device configuration software as an example: On the engineering station where relay protection configuration software is installed, perform the following operations: (1) Obtain the physical network card MAC address: Traverse the network interfaces through the system API, identify the physical network card (such as eth0, enp0s), exclude virtual network cards (such as lo, docker0), and obtain the MAC address "00:1a:2b:3c:4d:5e"; (2) Read the hard drive physical serial number: Read the hard drive identifier "WD-WX12A34B56C7" through system call; (3) Get the current username: Get the system login username "admin"; (4) Obtain the software name: Predefined software identifier "SOFT_NAME" (relay protection configuration software); The collected information is combined in the format "MAC address: hard disk identifier: software identifier: username", and a hash value is calculated using the SHA-256 algorithm. The first 8 even-numbered bits, "A1B2C3D4", are extracted as the unique device identifier. The software version 0x0100 is then XORed with the unique device identifier to generate a 16-bit hexadecimal machine code "A1B2C3D4A1B2C2D4A1B3".

[0029] The server issues the activation code and performs the following operations in the authorization center: (1) Verify the validity of the machine code format and parse out the device identifier "A1B2C3D4" and software version 0x0100; (2) Set authorization data: permission level 0x02 (engineering version), validity period 2025-12-31 (relative number of days 9496, hexadecimal "2518"), software version 0x0100; (3) Combined authorization data: "A1B2C3D4" + "02" + "2518" + "0100" = "A1B2C3D40225180100"; (4) Use the RSA-2048 public key to encrypt the authorization data and generate the activation code "0x8f7e9d..." (Base64 encoding format).

[0030] The client-side offline verification process performs the following operations on the engineer's workstation: (1) After the user enters the activation code, the client uses the locally stored RSA private key to decrypt the activation code; (2) Extract the device's unique identifier "A1B2C3D4" and compare it with the device identifier calculated locally (if they match, the comparison is successful). (3) Extract the expiration date "2518" (2025-12-31) and compare it with the current date (if it has not expired, it will pass); (4) Extract the software version "0100" and verify the version compatibility (if the current version 0x0100 <= the licensed version 0x0100, then it passes); (5) After successful verification, the activation code will be encrypted and stored as a license.dat file; The software runtime verification process involves automatically loading the license.dat file upon startup of the relay protection configuration software, decrypting and verifying the authorized data using a private key, all without requiring a network connection, thus meeting the power system security protection requirements. Example 5:

[0031] This embodiment describes the implementation process of an offline authorization method for power software, taking the authorization upgrade of DC control equipment configuration software as an example: Collect device fingerprint information on the DC control equipment commissioning workstation, including MAC address, hard drive identifier, software name "TESTNAME" and username.

[0032] Generate 16-bit machine code according to the method in Example 1.

[0033] The server issues an activation code. The user has already purchased a software v2.0 license and now needs to upgrade to v3.0. (1) Original license code version: 0x0200; (2) Current software version: 0x0300; (3) Version compatibility check: 0x0300 <= 0x0200 is not true, the original license cannot be used; (4) The server generates a new authorization code: the permission information remains unchanged, and the software version is updated to 0x0300; (5) Use public key encryption to generate a new activation code; After the client-side offline verification is completed using the new activation code, the software can use the new features added in v3.0 (such as IEC61850 protocol support, intelligent alarms, etc.) while protecting the user's original investment. Example 6:

[0034] This embodiment describes the implementation process of an offline authorization method for power software, taking hierarchical access control as an example: The device fingerprint information is collected and a 16-bit machine code is generated according to the method in Example 1.

[0035] The server issues activation codes, which are based on the user's role and different access levels. (1) Operation and maintenance personnel: permission level 0x01, supports viewing protection settings, operating status, and exporting reports; (2) Debugging Engineer: Permission level 0x02, adds setting value adjustment, protection function enable / disable, and fault recording analysis; (3) R&D Engineer: Permission level 0x03, adds algorithm parameter adjustment, development and debugging interface, and private protocol configuration.

[0036] The client performs offline verification, and the software controls access based on the decrypted permission level: (1) Permission 0x01 user: The interface only displays the monitoring and report menus; (2) User with permission 0x02: Displays professional menus such as setting value adjustment and waveform analysis; (3) Permissions 0x03 User: Show all menus, including advanced debugging functions. Example 7:

[0037] Based on the same inventive concept as other embodiments, this embodiment introduces a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the power software offline licensing method as described in any of Embodiment 1.

[0038] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0039] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0040] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0041] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0042] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A power software offline authorization method, executed by a client, characterized in that, include: A unique device identifier is generated based on the collected multi-dimensional fingerprint information of the device. The device's unique identifier is mixed with version information to generate a machine code, which is then transmitted to the server. Receive the activation code generated by the server, decrypt it to obtain the authorization data, and generate a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline.

2. The offline licensing method for power software according to claim 1, characterized in that, The device's multidimensional fingerprint information includes the network card MAC address, hardware identifier, software identifier, and username; The network interface card MAC address is obtained by traversing network interfaces, identifying physical network interfaces and excluding virtual network interfaces; The hardware identifier is a hard disk identifier read through a system call; The software identifier is the software name.

3. The offline licensing method for power software according to claim 1, characterized in that, The process for calculating the unique identifier of the device is as follows: Combine the multidimensional fingerprint information of the device; The hash value is obtained by performing a hash calculation on the combined multidimensional fingerprint information of the device. A fixed number of bits of the hash value are extracted as a unique identifier for the device.

4. The offline licensing method for power software according to claim 1, characterized in that, The machine code generation process is as follows: the unique identifier of the device and the version information are dynamically mixed to generate a fixed-length hexadecimal machine code. The version information refers to the software version.

5. The offline licensing method for power software according to claim 1, characterized in that, The offline verification process includes: Use the locally stored private key to decrypt the activation code and obtain the authorization data; Extract the device's unique identifier from the authorized data and compare it with the device identifier calculated locally in real time to verify the consistency of hardware binding; Extract the validity period from the authorization data and compare it with the current system time to verify the timeliness of the authorization; Extract the software version from the license data and compare it with the current software version to verify backward compatibility.

6. A method for offline authorization of power software, executed by a server, characterized in that, include: Verify the validity of the received machine code; After successful verification, authorization data is generated based on the machine code; The authorized data is encrypted to generate an activation code; The activation code is transmitted to the client.

7. The offline licensing method for power software according to claim 6, characterized in that, The authorized data includes the device's unique identifier, permission information, validity period, and software version; The permission information includes permission levels or functional module access markers set according to the user's role or operational needs, so that the client can open or close the corresponding functional interface according to the markers after decryption.

8. The offline authorization method for power software according to claim 6, characterized in that, The encryption uses an asymmetric encryption algorithm to encrypt the authorized data with a public key to generate an activation code.

9. An offline licensing system for power software, comprising a client and a server, characterized in that, include: The client generates a unique device identifier based on the collected multidimensional fingerprint information of the device. The device's unique identifier is mixed with version information to generate a machine code, which is then transmitted to the server. The server verifies the validity of the received machine code; After successful verification, the server generates authorization data based on the machine code; The authorized data is encrypted to generate an activation code, which is then transmitted to the client. The client receives the activation code generated by the server, decrypts it to obtain the authorization data, and generates a local encrypted authorization file after the authorization data is verified offline. The local encrypted authorization file is loaded during software runtime to verify the authorization validity offline.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the power software offline licensing method as described in any one of claims 1 to 8.

Images