Software configuration method, software access control method, device and electronic equipment

Abstract

This invention relates to the field of software security technology, and discloses a software configuration method, a software access control method, a device, and an electronic device. The method includes: collecting feature information of all access points (APs) within a preset area, and filtering all authorized APs according to preset filtering rules; encrypting the feature information of the authorized APs using an encryption algorithm to generate an encrypted authorization database; and distributing and integrating the encrypted authorization database into the target software. This invention improves the software's autonomous security control capability over its operating environment by collecting AP features within a region, filtering authorized devices, and integrating them into the target software after encryption.

Description

Technical Field

[0001] This invention relates to the field of software security technology, specifically to a software configuration method, a software access control method, a device, and an electronic device. Background Technology

[0002] Existing software licensing management solutions primarily rely on technologies such as online server authentication, GPS positioning, active wireless network connection, or hardware fingerprint binding for access control. Online server authentication depends on network connectivity, posing single points of failure and privacy risks. GPS positioning suffers from severe signal attenuation in indoor environments, failing to meet the positioning accuracy requirements of indoor scenarios such as office areas. Authentication based on active wireless network connections requires devices to actively initiate association and authentication requests, raising security risks of being spoofed by fake hotspots, and also increasing distribution and management costs due to the need to manage network connection credentials. Hardware fingerprint binding can only identify device identity but cannot determine whether the device is located within an authorized area. Solutions based on near-field communication (NFC) such as RFID require the deployment of dedicated hardware within the authorized area, resulting in high deployment costs and limited coverage. Therefore, a method with low dependency and low implementation cost is needed for software access control. Summary of the Invention

[0003] This invention provides a software configuration method, a software access control method, a device, and an electronic device to solve the problems in related technologies where software operation area control schemes rely on servers, require active connection to wireless access points, depend on GPS, and require additional hardware deployment.

[0004] In a first aspect, the present invention provides a software configuration method, the method comprising: collecting feature information of all APs within a preset area, and filtering out all authorized APs according to preset filtering rules; encrypting the feature information of the authorized APs using an encryption algorithm to generate an encrypted authorization database; and distributing and integrating the encrypted authorization database into the target software.

[0005] In one optional implementation, the step of collecting feature information of all APs within a preset area and filtering out all authorized APs according to preset filtering rules includes: acquiring all broadcast APBeacon frames within the preset area via Wi-Fi scanning, and parsing feature information of all APs from the AP Beacon frames; the Wi-Fi scanning method is a passive listening mode; the feature information includes at least one of MAC address, SSID, and channel number information; and filtering out the authorized APs from all feature information acquired by scanning according to preset filtering rules.

[0006] In one optional implementation, the preset filtering rules include at least one of the following: retaining APs whose SSID matches the enterprise's preset network name, and filtering out hidden hotspots with empty SSIDs and hotspots whose area names are not the preset area names; retaining APs with signal strength higher than a preset threshold, and filtering out interfering APs with signal strength lower than a preset threshold; retaining APs whose MAC address's unique organizational identifier matches the AP vendor purchased by the enterprise, and filtering out APs from non-designated vendors; retaining APs that appear a preset number of times in a preset number of scans, and filtering out APs that appear a preset number of times.

[0007] In one optional implementation, encrypting the feature information of the authorized AP using an encryption algorithm to generate an encrypted authorization database includes: obtaining a seed key built into the target software and a unique hardware identifier for the current device, wherein the unique hardware identifier includes at least one of the following: motherboard serial number, hard drive serial number, network card MAC address, and CPU serial number; using a preset key derivation function to perform a mixing operation on the seed key and the unique hardware identifier to generate an actual encryption key; encrypting the feature information list of the authorized AP using the actual encryption key and attaching an authentication tag to obtain ciphertext data; generating integrity verification information for the ciphertext data, and packaging the ciphertext data and the integrity verification information together to generate an encrypted authorization database.

[0008] Secondly, the present invention provides a software access control method, the method comprising: responding to a software startup command, wirelessly scanning all broadcast AP information within a preset area, and parsing all current AP feature information from the AP information; reading an encrypted authorization database from locally installed target software, and decrypting the encrypted authorization database to obtain all authorized AP feature information; the target software being software configured using any of the software configuration methods of the first aspect and its corresponding optional embodiments; matching the current AP feature information with the authorized AP feature information; if the matching is successful, allowing the software to continue running; if the matching fails, denying the software from running.

[0009] In one optional implementation, the step of reading the encrypted authorization database from the locally installed target software and decrypting the encrypted authorization database to obtain all authorized AP feature information includes: reading the seed key built into the target software and obtaining the unique hardware identifier information of the current device; using a preset key derivation function to perform mixed derivation of the seed key and the unique hardware identifier information to generate an actual decryption key; using the actual decryption key to decrypt the ciphertext data in the encrypted authorization database and verifying the integrity of the authentication tag attached to the ciphertext data; after the authentication tag verification is successful, extracting the list of authorized AP feature information stored in the ciphertext data; if the authentication tag verification fails or decryption fails, it is determined that the encrypted authorization database has been tampered with or the current device has not been authorized.

[0010] In one optional implementation, matching the current AP feature information with the authorized AP feature information includes: if the feature information of a certain AP obtained by scanning matches a record in the list of authorized AP feature information, then the AP is recorded as a matched authorized AP; if at least one matched authorized AP exists among all the APs obtained by scanning, then the matching is considered successful and the software is allowed to continue running; if no matched authorized AP exists among all the APs obtained by scanning, then the matching is considered unsuccessful, the current device is outside the authorized area, and the software is refused to run.

[0011] In one optional implementation, the step of responding to a software startup command to wirelessly scan all broadcast AP information within a preset area and parsing all current AP feature information from the AP information includes: detecting whether the current device has wireless scanning capability; if it does not have wireless scanning capability, prompting the user to connect an external wireless signal receiver and perform scanning through the external wireless signal receiver; if it has wireless scanning capability, performing the step of wirelessly scanning all broadcast AP information within the preset area.

[0012] In one alternative implementation, after allowing the software to continue running if a match is successful, the method further includes: writing the authentication success status to a local cache record, the cache record containing at least one of the following: a hardware identifier hash of the current device, an authentication timestamp, and a summary of the authorized AP list.

[0013] In an optional implementation, before wirelessly scanning all broadcast AP information within a preset area and parsing all current AP feature information from the AP information, the method further includes: checking if the authentication success status exists in a local cache record; if the authentication success status does not exist, then performing the step of wirelessly scanning all broadcast AP information within the preset area; if the authentication success status exists, then determining whether the current device is a historically authenticated successful device within its validity period based on the authentication success status; if it is a historically authenticated successful device within its validity period, then allowing the software to run; if it is not a historically authenticated successful device within its validity period, then performing the step of wirelessly scanning all broadcast AP information within the preset area.

[0014] Thirdly, the present invention provides a software configuration device, comprising: a filtering module for collecting feature information of all APs within a preset area and filtering out all authorized APs according to preset filtering rules; an encryption module for encrypting the feature information of the authorized APs using an encryption algorithm to generate an encrypted authorization database; and a distribution module for distributing the encrypted authorization database and integrating it into the target software.

[0015] Fourthly, the present invention provides a software access control device, comprising: an AP scanning module, configured to, in response to a software startup command, wirelessly scan all broadcast AP information within a preset area and parse all current AP feature information from the AP information; an encrypted database reading module, configured to read an encrypted authorization database from locally installed target software and decrypt the encrypted authorization database to obtain all authorized AP feature information; wherein the target software is software configured using any one of the software configuration methods of claims 1-4; a matching module, configured to match the current AP feature information with the authorized AP feature information; a successful matching module, configured to allow the software to continue running if the matching is successful; and a failed matching module, configured to refuse software operation if the matching fails.

[0016] Fifthly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the software configuration method of the first aspect or any corresponding embodiment thereof, or the software access control method of the second aspect or any corresponding embodiment thereof.

[0017] In a sixth aspect, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the software configuration method of the first aspect or any corresponding embodiment thereof, or the software access control method of the second aspect or any corresponding embodiment thereof.

[0018] In a seventh aspect, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute the software configuration method of the first aspect or any corresponding embodiment thereof, or the software access control method of the second aspect or any corresponding embodiment thereof.

[0019] Based on the aforementioned technical means, by collecting AP feature information within a preset area and pre-screening legitimate devices according to filtering rules, subsequent encryption and integration operations are based on a clean set of authorized data, effectively eliminating unauthorized or illegal APs and reducing security risks. The filtered feature information is encrypted to generate an authorized database, ensuring the confidentiality and integrity of the data during storage and transmission, preventing unauthorized parties from reading or tampering with it. The encrypted database is distributed and integrated into the target software, enabling the software to complete AP identification and judgment based on locally fixed authorized data even when it is offline or unable to query the central server in real time. This simplifies the deployment and update process, avoids the cumbersome operations of online downloads or manual configuration, and improves deployment efficiency and consistency. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the first type of software configuration method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a first type of software access control method according to an embodiment of the present invention; Figure 3 This is a system architecture example diagram according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a system flow according to an embodiment of the present invention; Figure 5 This is a structural block diagram of a software configuration device according to an embodiment of the present invention; Figure 6 This is a structural block diagram of a software access control device according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0024] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0025] Existing software access control technologies primarily rely on single-dimensional protection methods such as hardware dongles, online license verification, local MAC address binding, GPS positioning, or Wi-Fi connection authentication. Each of these solutions has limitations in specific scenarios. Hardware dongles are expensive and easily lost, making them unsuitable for mobile devices without USB ports. Online activation schemes require devices to be connected to the internet, making them unusable in offline environments and dependent on the continuous availability of a central server. Local MAC address binding only verifies the device's own network identifier, failing to detect whether the device is in an authorized office area and leaving vulnerabilities such as easily tampered MAC addresses or arbitrary configuration in virtual machine environments. GPS positioning is severely affected by indoor signal attenuation and raises privacy compliance issues. Wi-Fi connection authentication requires the device to actually connect to the corporate network and obtain an IP address, making it unsuitable for desktops using only wired networks and potentially interfering with other network-dependent local services when switching Wi-Fi networks. In summary, these solutions generally suffer from strong external dependencies (hardware, network, location signals), weak environmental awareness (unable to determine if the device is actually located within the company's office space), difficulties in cross-platform adaptation, and high deployment and maintenance costs.

[0026] According to an embodiment of the present invention, a software configuration method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] This embodiment provides a software configuration method that can be used in the aforementioned electronic device. Figure 1 This is a flowchart of a software configuration method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps: Step S101: Collect feature information of all APs in the preset area and filter out all authorized APs according to the preset filtering rules.

[0028] Step S102: Encrypt the feature information of the authorized AP using an encryption algorithm to generate an encrypted authorization database.

[0029] Step S103: Distribute and integrate the encrypted authorization database into the target software.

[0030] Specifically, the system collects feature information from all Access Points (APs) within a preset area and filters out all authorized APs according to preset filtering rules. The preset area refers to the physical or logical range that the software is expected to cover, such as all floors of an office building or the space encompassed by a campus network. APs are basic hardware devices in a wireless network, responsible for providing wireless signal access. Feature information is a set of data describing the operating status and identity attributes of each AP, such as unique device identifier, operating frequency band, and signal parameters. Authorized APs are legitimate devices that have been confirmed by management and comply with security and operational policies. The data collection process involves acquiring the above data from all APs within the area, while the filtering process removes unqualified APs from the full dataset based on predefined criteria (such as an allow list or signature verification), retaining only authorized APs.

[0031] The authorized AP feature information obtained after screening is encrypted using an encryption algorithm to generate an encrypted authorization database. The encryption algorithm is a mathematical operation process that transforms plaintext data into ciphertext data. The specific implementation method can be selected according to security requirements, but its core function is to prevent the feature information from being read without authorization during storage or transmission. The encrypted authorization database is a data file that is organized into a certain structure by the ciphertext feature information of all authorized APs. Each record in the file corresponds to the encrypted information of one AP, and the whole file is encapsulated in the form of a database for easy unified management in the future.

[0032] The process involves distributing and integrating the cryptographic license database into the target software, transferring the database from the production environment to the build or release environment of the target software (possibly via an internal network, storage media, or other compliant channels), embedding the received database file into the target software's directory structure or resource package to make it an accessible component of the software, and packaging the cryptographic license database file in the software installation package or distributing it with software updates. The target software is an application that requires the use of licensed AP information for its operational logic, such as a network connectivity management or spectrum analysis tool.

[0033] The software configuration method provided in this embodiment pre-screens legitimate devices after collecting AP characteristic information on-site, and then encrypts the screening results before embedding them into the target software. This allows the software to still identify and determine APs based on locally fixed and secure authorization data even when it is offline or unable to query the central server in real time, reducing the security risks caused by counterfeit APs or unauthorized device access. Simultaneously, the encryption mechanism ensures that even if the database file is accidentally leaked, attackers cannot directly obtain the original characteristic information, enhancing data confidentiality and integrity. Furthermore, integrating the authorization database with the software distribution package avoids the cumbersome operation of configuring or downloading the authorization list separately for each deployment, simplifying the installation and update process of the software in different scenarios and improving deployment efficiency and consistency.

[0034] In one optional implementation, step S101 includes: Step a1: Obtain all broadcast AP Beacon frames within the preset area using Wi-Fi scanning, and parse the feature information of all APs from the AP Beacon frames; the Wi-Fi scanning method is passive listening mode; the feature information includes at least one of MAC address, SSID and channel number information.

[0035] Step a2: Based on the preset filtering rules, select authorized APs from all the feature information obtained by scanning.

[0036] Specifically, the feature information of all APs within a preset area is collected via Wi-Fi scanning, specifically in passive listening mode. In passive listening mode, the receiving device (such as a terminal running the software) sets its wireless network card to listening mode, continuously capturing Beacon frames periodically broadcast by all APs on the air interface. These Beacon frames are management frames actively sent by the APs, announcing their presence at fixed intervals. The frame body carries parameters such as the AP's MAC address, SSID, channel number, and supported data rates. The receiving device does not need to actively send any data; it simply waits and captures these frames. After acquiring the Beacon frames, the MAC address, SSID, and channel number of each AP are parsed out according to the field offsets defined in the IEEE 802.11 frame format, forming a complete feature list.

[0037] The entire list is then filtered according to preset filtering rules, retaining only authorized APs. These preset filtering rules are a predefined set of logical conditions used to distinguish between legitimate and unauthorized devices. Authorized APs are those that fully meet all these conditions; otherwise, they are unauthorized APs. The system iterates through each record in the entire list, comparing each record's parameters against the preset rules. If a record meets all conditions, the AP is marked as an authorized AP and all its feature information is retained; if any condition is not met, the record is discarded. After the iteration is complete, only the feature information of APs that meet all conditions is retained as the set of authorized APs.

[0038] This invention employs a passive monitoring mode to acquire Beacon frames, eliminating the need for actively sending probe requests and avoiding additional network traffic. Simultaneously, it continuously captures information broadcast by all APs within the area, ensuring comprehensive coverage. Parsing the Beacon frames yields core features such as MAC addresses, SSIDs, and channel numbers, providing accurate foundational data for subsequent filtering. By iterating and comparing against preset filtering rules, multiple conditions can be flexibly combined (such as SSID naming conventions, signal strength thresholds, MAC vendor identification, and channel stability) to accurately distinguish legitimate fixed APs from temporary interference devices. This effectively filters hidden hotspots, non-designated vendor devices, and APs with weak signals, ensuring a reliable and usable final set of authorized APs and reducing the risk of misjudgment.

[0039] In one optional implementation, the preset filtering rules include at least one of the following: Retain APs whose SSID matches the enterprise's default network name, and filter out hidden hotspots with empty SSIDs and hotspots with names other than the default area name.

[0040] APs with signal strength above a preset threshold are retained, while interfering APs with signal strength below a preset threshold are filtered out.

[0041] The organization retains the unique identifier of the MAC address and matches the AP purchased by the enterprise with the AP vendor, filtering out AP devices from non-designated vendors.

[0042] APs that appear a preset number of times in the scan results of a preset number of scans are retained, while APs that appear a preset number of times are filtered out.

[0043] Specifically, preset filtering rules are used to select authorized APs from the collected full list of AP characteristics. The rules include several items that can be used independently or in combination. SSID is the network name broadcast by the AP; the enterprise's preset network name is a pre-determined valid string. Hidden hotspots have empty SSIDs, making their affiliation impossible to directly identify. Hotspots with non-preset area names refer to other networks whose SSIDs do not conform to the enterprise's naming conventions. Signal strength is the wireless signal power value measured by the receiver, in dBm; the preset threshold is a numerical limit. The Organization Unique Identifier (OUI) of the MAC address is the first three bytes of the MAC address, assigned to equipment manufacturers by IEEE; each enterprise purchases a specific set of OUI codes from the AP vendors. Whether the same AP appears repeatedly in multiple scans can determine channel stability.

[0044] In practice, the system reads each AP record from the full list one by one. For SSID rules, if the SSID of a record matches the company's preset network name, the record continues to participate in subsequent judgments; if the SSID is empty or does not match the preset name, the record is discarded. Temporary hotspots (such as portable hotspots turned on by employees' personal mobile phones) and mobile hotspots (such as in-vehicle Wi-Fi devices) usually do not have the company's preset network name, and their SSIDs are often strings generated by the device by default (such as "iPhone", "AndroidAP", "MobileWiFi", etc.), or are simply empty (hidden hotspots). During filtering, the system compares the SSID of each AP with the company's preset network name (such as "Office-5G" or "Corp-WiFi"). Records that do not match are directly discarded, so these temporary or mobile devices are excluded due to SSID mismatches. For signal strength rules, the recorded signal strength value is compared with a preset threshold; if the value is higher than the threshold, it continues; if it is lower than the threshold, it is discarded. For OUI rules, the first three bytes of the MAC address in the record are extracted. If it belongs to the OUI set corresponding to the enterprise's procurement vendor, it continues; otherwise, it is discarded. For channel stability rules, the occurrence records of the AP in historical scans are checked. If it appears only in multiple consecutive scans (e.g., three), it is retained; if it appears only in a single scan, it is considered a temporary or mobile device and discarded. A record is marked as an authorized AP only if it meets all enabled rule requirements; if any rule is not met, it is removed from the list.

[0045] This invention, by comparing the continuous occurrence of access points (APs), can distinguish between fixed deployment devices and temporary access or mobile devices, avoiding misjudging short-lived unstable hotspots as legitimate authorized APs and improving the reliability of screening. This mechanism does not rely on additional hardware or external location information; it can complete the judgment only by utilizing the repeatability of the scanning time dimension. It is simple to implement and consumes few resources, making it suitable for device identification needs in various wireless environments. It can exclude temporary hotspots and mobile hotspots, reducing deployment complexity while maintaining the simplicity of the screening logic.

[0046] In one optional implementation, step S102 includes: Step b1: Obtain the seed key built into the target software and the unique hardware identification information of the current device. The unique hardware identification information includes at least one of the following: motherboard serial number, hard drive serial number, network card MAC address, and CPU serial number.

[0047] Step b2 involves using a preset key derivation function to perform a mixed operation on the seed key and the unique hardware identifier information to generate the actual encryption key.

[0048] Step b3: Encrypt the list of authorized AP's feature information using the actual encryption key and attach an authentication tag to obtain ciphertext data.

[0049] Step b4: Generate integrity verification information for the ciphertext data, and package the ciphertext data and integrity verification information together to generate an encrypted authorization database.

[0050] Specifically, this involves obtaining the seed key embedded in the target software and the unique hardware identifier information of the current device. The seed key is a fixed string or binary data pre-embedded in the target software's executable file or configuration file, such as a hexadecimal number "3F2A...". Its value is determined during the software development phase and released with the software. The unique hardware identifier information is a set of hardware signatures on the electronic device currently running the software that are not easily changed. It includes at least one or more of the following: motherboard serial number (stored in the motherboard firmware), hard drive serial number (an identifier written to the hard drive at the factory), network card MAC address (a globally unique address burned into the network card hardware), and CPU serial number (a unique identifier built into the processor). This is obtained by calling the hardware information query interface provided by the operating system. For example, in Windows systems, this is achieved by reading the attribute values ​​of instances of classes such as Win32_BaseBoard, Win32_DiskDrive, Win32_NetworkAdapterConfiguration, and Win32_Processor through WMI (Windows Management Instrumentation). In Linux systems, this is achieved by reading files in the / sys / class / dmi / id / directory, executing the dmidecode command, or obtaining the MAC address file of the network interface.

[0051] A pre-defined key derivation function is used to perform a mixed operation on the seed key and unique hardware identifier information to generate the actual encryption key. A key derivation function is a mathematical process that transforms input key materials (here, the seed key and hardware identifier information) into a fixed-length output key using a specific algorithm. Examples include PBKDF2 (a cryptographically based key derivation function 2), HKDF (an HMAC-based key derivation function), or a custom hash chain operation. The mixed operation refers to concatenating or XORing the byte sequence of the seed key with the byte sequence of the hardware identifier information in a predetermined order, and then feeding it into the key derivation function for iterative calculation. For example, the seed key can be used as the basic input, and the hardware identifiers can be concatenated with a specific delimiter to form a salt value. After multiple rounds of hash operations, an actual encryption key with a length that meets the requirements of the encryption algorithm (e.g., 16 bytes for AES-128, 32 bytes for AES-256) is generated. This key is different from either the single seed key or the hardware identifier information, and the same result can only be repeatedly calculated under the same software version on the same device.

[0052] The authorized AP feature information list is encrypted using the actual encryption key, and an authentication tag is appended to obtain ciphertext data. The authorized AP feature information list is a structured data set consisting of fields such as MAC address, SSID, and channel number of all authorized APs retained from the previous screening phase. It is typically serialized into JSON, XML, or fixed-length binary format before encryption. The encryption process uses an authenticated encryption mode (such as AES-GCM or AES-CCM). This mode generates an authentication tag—a fixed-length checksum—during encryption to verify the integrity and authenticity of the ciphertext data during decryption. The actual encryption key serves as the input parameter to the encryption algorithm, performing encryption operations on the serialized feature information list, outputting an unreadable ciphertext byte sequence, and simultaneously calculating the authentication tag. The ciphertext and authentication tag are then combined to form complete ciphertext data.

[0053] Integrity verification information is generated from the encrypted data, and the encrypted data and integrity verification information are packaged together to create an encrypted authorization database. The integrity verification information is a segment of verification data obtained by calculating a hash value (such as SHA-256) or a message authentication code (using a separate key to calculate HMAC) on the entire encrypted data. It is used to check whether the encrypted data has been accidentally tampered with or corrupted during software runtime. The encrypted data and integrity verification information are organized together according to a predefined binary format, such as writing a fixed identifier and version number in the file header, followed by the integrity verification information, and then the encrypted data length and the encrypted data itself. This ultimately forms a complete encrypted authorization database file, which is stored in a designated location on disk or in memory for subsequent distribution and integration.

[0054] In one example, the encrypted storage scheme employs a two-layer protection approach: key derivation and symmetric encryption. Key derivation: The actual encryption key is generated by mixing the seed key built into the software and the device hardware feature code (such as the hash value of the motherboard serial number or hard drive serial number) using SHA-256.

[0055] Data encryption: The list of authorized AP MAC addresses is encrypted using AES-256-GCM, with an authentication label to prevent tampering.

[0056] Integrity verification: Encrypted data is accompanied by HMAC to ensure that the authorization list has not been replaced or tampered with.

[0057] This invention, through the introduction of a hybrid derivation mechanism combining a seed key and a unique device hardware identifier, binds the actual encryption key to a specific device. Even if the encrypted authorization database file is copied to other devices, the different hardware identifiers prevent correct key derivation, thus hindering data decryption and enhancing data security. Employing an authentication encryption mode (such as AES-GCM) with an authentication tag attached during encryption effectively resists ciphertext tampering attacks. Failure to verify the authentication tag during decryption detects data modification, further improving data security. Adding independent integrity verification information provides a mechanism for quickly checking the integrity of ciphertext data during software runtime, preventing program anomalies caused by using corrupted or partially written database files. The entire encrypted authorization database is output in a structured package, facilitating subsequent distribution, storage, and integration into the target software's resource directory. This unifies the data encapsulation format. AES-256-GCM and key derivation functions are used to encrypt and store the authorized AP list, while binding the local hardware signature during initial authentication ensures the encrypted authorization database file cannot be copied to other devices, preventing the replacement or dissemination of authorization data.

[0058] This embodiment provides a software access control method that can be used in the aforementioned electronic device. Figure 2 This is a flowchart of a software access control method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: In response to the software startup command, wirelessly scan all broadcast AP information within the preset area and parse all current AP characteristic information from the AP information.

[0059] Step S202: Read the encrypted authorization database from the locally installed target software, and decrypt the encrypted authorization database to obtain all authorized AP feature information; the target software is the software configured by any one of the software configuration methods in the above embodiments and their corresponding optional embodiments.

[0060] Step S203: Match the current AP feature information with the authorized AP feature information.

[0061] Step S204: If the match is successful, the software is allowed to continue running.

[0062] Step S205: If the matching fails, the software operation is rejected.

[0063] Specifically, in response to the software startup command, the system wirelessly scans all broadcast AP information within a preset area and parses all current AP characteristic information from the AP information, as described in the aforementioned acquisition and parsing process. It then reads the encrypted authorization database from the locally installed target software and decrypts it to obtain all authorized AP characteristic information. The encrypted authorization database is a file generated by the aforementioned configuration method and stored in the target software's installation directory. It stores filtered and authenticated legitimate AP characteristic data in encrypted form. Decryption requires using the same key derivation mechanism as encryption to reconstruct the original list of authorized AP characteristic information, including fields such as the MAC address, SSID, and channel number of each authorized AP.

[0064] The current AP characteristic information is matched with the authorized AP characteristic information. This matching process is described in the aforementioned comparison logic. If a match is successful, the software is allowed to continue running; if a match fails, the software is denied from running. A successful match means that among all the currently scanned APs, for example, at least one AP's MAC address and SSID are completely identical to a record in the authorized AP characteristic information list, or that a preset matching threshold (such as the number of hits or the hit ratio) is met. Allowing the software to continue running indicates that the current wireless environment is deemed to meet the authorization conditions, and the software normally loads the main function interface and executes subsequent business logic. Denying the software from running means that the software terminates the startup process, which may provide an error message or exit execution to prevent the use of software functions in unauthorized network environments.

[0065] The software access control method provided in this embodiment scans the current environment's access points (APs) in real time during software startup and compares them with locally decrypted authorized AP information. This allows the software to autonomously determine network compliance before operation, allowing continued operation only upon successful matching. This prevents the software from being used in unauthorized or unexpected network environments, enhancing its control over the operating environment. The encrypted authorization database is stored locally in ciphertext, and decryption relies on device hardware identification. Even if the database file is extracted to other devices, the authorization information cannot be recovered, ensuring the security and uniqueness of the authorization data. The matching mechanism can be flexibly set to full matching or threshold matching to adapt to network changes in different scenarios, balancing security and ease of use. Furthermore, no Wi-Fi connection is required; AP MAC addresses can be obtained simply by scanning Beacon frames. No connection needs to be established, utilizing the BSSID (MAC address) of existing wireless APs in the office area as an environmental fingerprint. It is fully offline and easy to use, requiring no password and GPS positioning. It can be used in completely offline environments, making it suitable for confidential units and intranet isolation scenarios. It features a unified solution for Windows, Linux, and Android, with a single authentication logic covering all platforms and accurately determining whether the user is in an authorized office area, effectively distinguishing between internal and external use. It utilizes the underlying Wi-Fi scanning commands / APIs of each operating system to achieve unified logic. In an optional implementation, step S202 includes: Step c1: Read the seed key built into the target software and obtain the unique hardware identification information of the current device.

[0066] Step c2 involves using a preset key derivation function to derive the actual decryption key by mixing the seed key and the unique hardware identifier information.

[0067] Step c3: Decrypt the ciphertext data in the encrypted authorization database using the actual decryption key, and verify the integrity of the authentication tag attached to the ciphertext data.

[0068] Step c4: After the authentication tag is verified, extract the list of feature information of the authorized AP stored in the encrypted data.

[0069] In step c5, if the authentication tag verification fails or decryption fails, it is determined that the encrypted authorization database has been tampered with or the current device has not been authorized.

[0070] Specifically, the seed key built into the target software is read, and the unique hardware identifier information of the current device is obtained. This process is consistent with the reading and acquisition methods described in the encryption stage. A preset key derivation function is used to derive the actual decryption key by mixing the seed key and the unique hardware identifier information. The derivation algorithm is exactly the same as in the encryption stage. The actual decryption key is used to decrypt the ciphertext data in the encryption authorization database, and the integrity of the authentication tag attached to the ciphertext data is verified. Decryption and verification use the authentication decryption mode corresponding to that used during encryption (such as AES-GCM). The key, ciphertext, and authentication tag are sent together to the decryption function. Internally, the function first verifies the authentication tag before performing decryption and restoration.

[0071] After successful authentication tag verification, the authorized AP feature information list stored in the encrypted data is extracted. This list contains fields such as the MAC address, SSID, and channel number of each authorized AP, and is deserialized into structured data according to the format used during pre-encryption serialization (such as JSON or fixed-length binary). If authentication tag verification fails or decryption fails, the current device is determined to be unauthorized. Authentication tag verification failure indicates that the encrypted data has been modified during storage or transmission; decryption failure indicates that the derived decryption key is inconsistent with the actual encryption key used during encryption. This is usually because the hardware identification information of the current device is different from the device used when generating the database, resulting in a mismatch in key derivation. In all these failure scenarios, the software cannot obtain authorized AP information, and the subsequent process terminates.

[0072] This invention employs an authentication tag verification mechanism, enabling software to detect tampering of ciphertext immediately during decryption, effectively preventing unauthorized modification of the database file to bypass authorization checks. The decryption key is bound to the device hardware identifier, ensuring that even if the database file is copied to another machine, it cannot be decrypted correctly. This establishes a strong association between authorized data and the physical device, enhancing anti-proliferation capabilities. Upon verification failure, it clearly distinguishes between tampering and unauthorized actions, providing a basis for subsequent error handling.

[0073] In some optional implementations, step S203 above includes: Step d1: If the feature information of a certain AP obtained by scanning matches a record in the feature information list of authorized APs, then the AP is recorded as a hit authorized AP.

[0074] Step d2: If at least one of the scanned APs matches an authorized AP, the match is considered successful, and the software is allowed to continue running.

[0075] Step d3: If none of the APs obtained by the scan are authorized APs, the matching is deemed to have failed, the current device is outside the authorized area, and the software is refused to run.

[0076] The feature information of each current AP obtained through scanning is compared one by one with the records in the list of authorized AP feature information obtained after decryption. During the comparison, the MAC address is used as the primary matching field because the MAC address is a unique identifier burned into the hardware and is unforgeable. If the MAC address matches, the SSID and channel number are checked, and finally, the signal strength is checked to see if it is within the signal strength range. Only when all matches are found is the AP considered to correspond to an authorized record. Once a current AP record completely matches a record in the authorized list, the AP is recorded as a hit authorized AP. A hit means that the AP has been confirmed as a legitimate device within the pre-authorized scope.

[0077] After traversing all current APs, the number of authorized APs is counted. If at least one authorized AP is found among all APs detected, the match is considered successful, and the software is allowed to continue running. As long as at least one authorized AP is detected in the current environment, the device is considered to be within the authorized network coverage area, and the software can start normally and execute subsequent functions. If no authorized APs are found among all APs detected, the match is considered unsuccessful, the current device is outside the authorized area, and the software is refused to run. In this case, the software terminates the startup process and displays a message indicating that the environment is unauthorized or no legitimate AP could be found.

[0078] In one example, the matching algorithm uses a set intersection determination algorithm. Let the set of AP MAC addresses obtained from the scan be S = {s1, s2, ..., sm}, and the set of authorized AP MAC addresses be A = {a1, a2, ..., an}. The determination condition is: S ∩ A ≠ .

[0079] That is, as long as any authorized AP is detected, the environment is considered legitimate.

[0080] This invention employs a comparison mechanism that prioritizes MAC addresses and supplements them with SSIDs and channel numbers to ensure the accuracy and uniqueness of the match determination, avoiding false matches caused by overlapping networks or channels. As long as at least one authorized AP is present, the match is successful. Even if some APs are temporarily unavailable due to maintenance or malfunction, the software can still function normally as long as at least one authorized AP is within signal coverage, exhibiting inherent high availability. This mechanism tolerates the impact of temporary AP offlineness or signal attenuation, improving the software's availability in dynamic wireless environments. A complete lack of match indicates the software is outside the authorized area and is refused operation, effectively preventing the software from being launched in unauthorized network environments and strengthening compliance control of the operating environment. Furthermore, the matching logic is clear and simple, with low computational overhead, making it suitable for rapid completion during software startup. The multi-AP redundancy authorization mechanism ensures that the failure of a single AP does not affect normal software operation. It uses a set intersection determination (a match is achieved if the scanned AP set intersects with the authorized AP set), leveraging the inherent redundancy of multi-AP coverage within the office area to achieve high availability. Even if some APs are faulty or under maintenance, the software can run as long as at least one authorized AP is visible.

[0081] In one optional implementation, step S201 includes: Step e1: Detect whether the current device has wireless scanning capability.

[0082] Step e2: If wireless scanning capability is not available, the user is prompted to connect an external wireless signal receiver and perform scanning through the external wireless signal receiver.

[0083] Step e3: If wireless scanning capability is available, perform the step of wirelessly scanning all broadcast AP information within the preset area.

[0084] Specifically, it checks whether the current device has wireless scanning capability. The current device refers to the electronic terminal running the software, such as a laptop, desktop computer, tablet, or industrial control computer. Wireless scanning capability refers to whether the device's built-in or connected wireless network card can perform operations such as channel listening and frame capture normally. Specifically, it is whether the operating system can recognize the available wireless network interface and whether the interface supports switching the working mode to monitor mode or can perform active scanning.

[0085] If the device lacks wireless scanning capabilities, the user will be prompted to connect an external wireless signal receiver and perform the scan through that device. This prompt will appear in a dialog box in the graphical interface or in the command line, informing the user that the current device lacks an available wireless network interface and suggesting the insertion of a USB wireless network adapter or other external Wi-Fi adapter. An external wireless signal receiver is a type of independent hardware that connects to the device via a physical interface such as USB, Thunderbolt, or serial port. It integrates a wireless radio frequency chip and antenna, enabling it to independently receive and parse wireless signals. After the user inserts the device into the corresponding interface and the operating system loads the driver, the software re-enumerates network interfaces, identifies the newly added wireless network card, and uses it as the scanning source. Performing a scan through the external device means that the software sends the scan command to the external device, which then captures Beacon frames and parses their feature information. The acquired data is then transmitted back to the software through the interface.

[0086] This invention, through proactive detection of wireless scanning capabilities, enables the software to identify hardware deficiencies or driver malfunctions in advance, preventing scanning steps from failing due to a lack of available interfaces. When no scanning capability is detected, the software prompts the user to connect an external device and provides a path to continue scanning. This allows the software to operate normally on devices that do not originally have wireless capabilities (such as desktops and servers) with the aid of external hardware, enhancing hardware compatibility and environmental adaptability. The automatic detection and prompting mechanism reduces user troubleshooting time, improves the user experience, and ensures smooth execution of the scanning process under various hardware configurations.

[0087] In one alternative implementation, after step S204, the method further includes: Step f1: Write the authentication success status to a local cache record. The cache record contains at least one of the following: the hardware identifier hash of the current device, the authentication timestamp, and the summary of the authorized AP list.

[0088] Specifically, the successful authentication status is written to a local cache record. A local cache record is a data file or registry entry stored on the device's non-volatile storage medium (such as a hard drive, solid-state drive, or embedded flash memory) to store the status information of the most recent successful authentication. The cache record contains at least one of the following: the hardware identifier hash value of the current device, the authentication timestamp, and a summary of the authorized AP list. The hardware identifier hash value is a fixed-length digest obtained by hashing the device's unique hardware identifier information (such as motherboard serial number, hard drive serial number, network card MAC address, etc.), used to verify whether the record belongs to the current device when reading the cache. The authentication timestamp is a system time record of the moment of successful authentication, usually stored as a Unix timestamp or UTC time string. The authorized AP list summary is a short data set obtained by calculating the hash value of the entire list of authorized AP feature information, used to quickly verify whether the currently cached authorized data matches the authorized list in the encrypted authorized database. The above content is processed through a standard file write interface or registry write function.

[0089] This invention persistently stores successful authentication status, allowing software to reuse historical authentication results upon subsequent startups, avoiding the need to repeatedly execute the complete scanning and decryption process. Hardware identifier hash values ​​ensure that cached records are bound to the current device, preventing cached files from being copied to other devices and bypassing authorization checks, thus maintaining authentication security. The authorized AP list digest can be used to detect changes in the encrypted authorization database; if the database is updated, re-authentication can be triggered, ensuring the consistency of authorization data.

[0090] In one alternative implementation, prior to step S201, the following is included: Step g1: Check if a successful authentication status exists in the local cache. Step g2: If there is no successful authentication status, then perform the step of wirelessly scanning all broadcast AP information within the preset area; Step g3: If a successful authentication status exists, determine whether the current device is a historically successfully authenticated device within its validity period based on the successful authentication status. Step g4: If the device is a historically successfully authenticated device within its validity period, then allow the software to run; Step g5: If the device is not a historically authenticated device within its validity period, then perform the step of wirelessly scanning all broadcast AP information within the preset area.

[0091] Specifically, before the wireless scanning step is executed upon software startup, the system first checks the local cache for a successful authentication record. This check involves the software reading a cache file from a preset path, verifying its existence and parsing capability. If the cache file is missing or parsing fails, it indicates the absence of any historical authentication records. The software then performs a wireless scan of all broadcast AP information within the preset area, entering a real-time data collection and comparison process. If the cache file exists and parsing is successful, the system determines whether the current device is a valid historically authenticated device based on the successful authentication status. The judgment logic is as follows: The authentication timestamp is extracted from the cache record and its difference from the current system time is calculated. If the difference is less than a preset validity period threshold (e.g., 24 hours or 7 days, specifically defined by the software policy), the time validity is verified. Simultaneously, the hardware identifier hash value is extracted, and the hash is recalculated and compared for the current device. If they match, it proves the cache record originated from the local machine. When both conditions are met, the software is allowed to run directly, skipping the wireless scanning and matching process. If the authentication timestamp expires or the hardware identifier hash does not match, it is determined that the device is not a historically successfully authenticated device within the validity period. The software discards the cached record and performs the step of wirelessly scanning all broadcast AP information in the preset area, and then performs the complete collection, decryption and matching process again.

[0092] This invention, through prioritizing the checking of local cache records upon startup, allows the software to directly reuse historical authentication results within their validity period. This significantly reduces repetitive wireless scanning, database decryption, and AP matching operations, shortening startup time. The introduction of a threshold balances security and convenience, and mandatory re-verification after expiration avoids long-term authorization risks caused by network environment changes or device migration. The mandatory comparison mechanism of hardware identifier hashes prevents cross-device theft of cached files, ensuring the device uniqueness of authentication results.

[0093] As a specific embodiment of the present invention, such as Figure 3 As shown in the diagram, this is the deployment architecture of the authentication system. The system is divided into a three-layer deployment architecture: management terminal, physical operating environment of office area, and user devices. The administrator completes the collection, filtering, encryption and distribution of authorized data sources through the management terminal. User devices rely on the local encrypted authorization database and real-time wireless environment scanning to complete offline access authentication, so as to achieve the control effect of allowing target software to run in the enterprise office wireless environment.

[0094] The management module is a backend tool module for administrators. Following the data processing flow, it sequentially includes an AP scanning and collection tool, an authorized AP filter, an encryption tool, and an encrypted DB file distribution module. Administrators first use the AP scanning and collection tool to collect the BSSID identifiers of all wireless APs within the office area, completely capturing the original information of all wireless access points to form the basic data source. After collection, the data is sent to the authorized AP filter for filtering. The authorized AP filter automatically removes wireless signal data from temporary hotspots, portable hotspots, and other locations not belonging to the company's fixed office locations, retaining only the MAC address data corresponding to compliant office APs. After filtering, the list of legitimate AP MAC addresses is sent to the encryption tool. The encryption tool uses the AES-256 symmetric encryption algorithm to encrypt the authorized MAC list, generating an encrypted authorization database file. Finally, the encrypted DB file distribution module packages the encrypted authorization database and embeds it into the terminal software installation package, which is then distributed to each office user's terminal along with the client program to complete the offline authorization database deployment.

[0095] The physical operating environment layer of the office area is equipped with multiple fixed office wireless APs. The attached diagram shows AP-01, AP-02, and AP-N as examples of multiple access devices. Each office AP is configured with a unique fixed hardware MAC address. For example, AP-01 is bound to the MAC address AA:BB:CC:DD:01. Each office AP continuously broadcasts Beacon frame wireless signals as a signal reference for user devices to identify the office physical environment. The MAC addresses corresponding to all compliant office APs have been filtered and written into the encrypted authorization database at the management end.

[0096] The user device layer covers three mainstream office terminal devices: Windows terminals, Linux terminals, and Android terminals. Each type of terminal has a built-in environment scanning engine and matching decision engine. The terminal has a locally pre-stored encrypted authorization database encrypted with AES-256, which stores a complete list of MAC addresses of all legitimate office APs. When the terminal starts the target software, the device passively listens for Beacon frame signals broadcast by surrounding APs. The environment scanning engine adapted to the corresponding system calls the system's native interface to collect the MAC information of surrounding wireless devices. Specifically, the environment scanning engine of the Windows terminal calls the netsh wlanshow command to perform wireless environment collection, the environment scanning engine of the Linux terminal calls the nmcli tool or iwlist tool to complete the surrounding AP scan, and the environment scanning engine of the Android terminal calls the system's WifiManager API to obtain a real-time list of wireless APs. After the environmental scanning engine completes the data collection, it sends the real-time AP MAC data to the matching decision engine. The matching decision engine reads the locally pre-installed encrypted authorization database and decrypts it, extracts the authorized office AP MAC whitelist stored in the database, and compares and verifies the set of surrounding AP MACs obtained from the real-time scan with the authorized whitelist. If any office AP MAC that matches the authorized whitelist is found in the scan results, the authentication is deemed successful and the target software is allowed to run normally. If no compliant office AP MAC is found, the authentication is deemed unsuccessful and the startup and operation of the target software are restricted.

[0097] This implementation method utilizes the enterprise's existing office wireless AP hardware to complete the environment identification setup, eliminating the need for additional dedicated hardware equipment. The overall deployment is lightweight, and the authorization database uses AES-256 encryption for storage, effectively preventing the risk of the authorization whitelist being tampered with or private hotspots being forged to bypass authentication. At the same time, the entire authentication process is completed offline on the terminal, without relying on cloud server network connections. The environment verification logic can still be stably executed in offline scenarios. Furthermore, the system is compatible with multiple types of office terminals, including Windows, Linux, and Android. The unified authentication logic can adapt to mixed office scenarios with multiple terminals in the enterprise. It relies on the MAC of fixed office AP hardware to achieve accurate identification of physical office areas, distinguishing between enterprise office scenarios and unauthorized use scenarios such as home and outdoor mobile hotspots, enabling refined management of the software usage environment.

[0098] As a specific embodiment of the present invention, such as Figure 4As shown in the attached diagram, this implementation method fully describes the offline environment authentication execution steps when the self-developed software starts. The overall verification sequence is adjusted to first read the local device database to verify historical authentication records and validity periods, and then perform wireless network card hardware detection. The system distinguishes between the local device database that stores device authentication records and the encrypted authorization database that stores the authorized AP whitelist. Relying on the two independent databases, the system completes the dual-layer access control of device identity and office environment.

[0099] When a user initiates the self-developed software startup operation, the system automatically starts a complete authentication process. The program first reads the local device database to check if the database stores the device ID corresponding to the local machine, and verifies whether the authentication record corresponding to the device ID is within its validity period. If the local device ID already exists in the local device database and the authentication record has not expired, the authentication is directly determined to be successful, allowing the self-developed software to run normally and ending the authentication process. If the local device ID is not found in the local device database, or the stored device ID authentication record has expired, it means that the local machine has not completed the first compliance authentication or the original authentication permission has expired. The program then enters the next verification stage, executing the wireless network card hardware detection logic to determine whether the current terminal device is equipped with a usable wireless network card hardware.

[0100] If the hardware detection results indicate that the terminal does not have a wireless network card, the program will directly jump to the authentication failure branch, display a pop-up window indicating that the user does not have permission, and automatically exit the self-developed software, terminating the authentication process. If the detection confirms that the terminal is equipped with a usable wireless network card, the program will call the corresponding system adapter interface to scan the surrounding wireless environment, collect the MAC address information of all visible wireless APs in the current space, and after the scan is completed, the program will read the independently deployed encrypted authorization database and perform the decryption operation, and extract the pre-entered set of legally authorized office AP MAC whitelists from the decrypted encrypted authorization database.

[0101] The program performs an intersection matching operation between the set of surrounding APs obtained from real-time scanning and the whitelist of authorized AP feature information obtained from the decrypted encrypted authorization database. If the two sets of data do not intersect, it means that the current terminal is not in a compliant corporate office wireless environment, the program determines that the authentication has failed, pops up a message indicating that there is no permission to use the software, and automatically exits the self-developed software. If the two sets of data intersect, it proves that the environment in which the terminal is located includes corporate authorized office APs, the authentication is determined to be successful, the self-developed software is allowed to start and run normally, and the authentication process ends.

[0102] This implementation prioritizes verifying the device's historical valid authentication records by adjusting the verification order. For compliant devices that have been bound and whose permissions have not expired, multiple verification steps such as wireless scanning and hardware detection can be skipped, significantly reducing software startup time. At the same time, it combines device identity binding and office AP environment dual verification mechanisms. The software can only run normally if both the device is legal and the environment is compliant. It achieves full-process offline authentication by relying on a local encrypted database, without relying on network services. The AES-256 encrypted storage of authorization data and device ID records can effectively prevent security risks such as database tampering, spoofing hotspots to bypass authentication, and multiple devices sharing the authorization library. It is compatible with various terminal devices such as Windows, Linux, and Android, taking into account both software startup efficiency and offline usage security management needs.

[0103] This embodiment also provides a software configuration device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0104] This embodiment provides a software configuration device, such as... Figure 5 As shown, it includes: The filtering module 501 is used to collect feature information of all APs within a preset area and filter out all authorized APs according to preset filtering rules; Encryption module 502 is used to encrypt the feature information of authorized APs using an encryption algorithm to generate an encrypted authorization database; Distribution module 503 is used to distribute and integrate the encrypted authorization database into the target software.

[0105] The software configuration apparatus provided in this embodiment of the invention can execute the software configuration apparatus method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution. Further functional descriptions of the various modules and units described above are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0106] This embodiment also provides a software access control device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0107] This embodiment provides a software access control device, such as... Figure 6 As shown, it includes: The AP scanning module 601 is used to wirelessly scan all broadcast AP information within a preset area in response to a software startup command, and to parse all current AP characteristic information from the AP information; The encrypted database reading module 602 is used to read the encrypted authorization database from the locally installed target software, decrypt the encrypted authorization database, and obtain all authorized AP feature information; the target software is software configured by any of the software configuration methods in the above embodiments. The matching module 603 is used to match the current AP feature information with the authorized AP feature information; The "Match Successful" module 604 allows the software to continue running if a match is successful. The matching failure module 605 is used to refuse software operation if a match fails.

[0108] The software access control device provided in this embodiment of the invention can execute the software access control method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution. Further functional descriptions of the various modules and units described above are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0109] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0110] The following is a detailed reference. Figure 7 This diagram illustrates a suitable structural schematic for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 701, which can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) 702 or a program loaded from memory 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device. The processor 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0111] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic devices to exchange data via wireless or wired communication with other devices. Although Figure 7Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0112] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 709, or installed from a memory 708, or installed from a ROM 702. When the computer program is executed by the processor 701, it performs the functions defined in the software configuration method and software access control method of the embodiments of the present invention.

[0113] Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0114] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the software configuration method and software access control method shown in the above embodiments are implemented.

[0115] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0116] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A software configuration method, characterized in that, The method includes: Collect feature information of all APs within a preset area and filter out all authorized APs according to preset filtering rules; The feature information of the authorized AP is encrypted using an encryption algorithm to generate an encrypted authorization database; The encrypted authorization database is distributed and integrated into the target software.

2. The method according to claim 1, characterized in that, The process involves collecting feature information from all access points (APs) within a preset area and filtering out all authorized APs according to preset filtering rules, including: The system acquires all broadcast AP Beacon frames within a preset area using Wi-Fi scanning, and parses the characteristic information of all APs from the AP Beacon frames; the Wi-Fi scanning method is a passive listening mode; the characteristic information includes at least one of MAC address, SSID, and channel number information; According to preset filtering rules, the authorized AP is selected from all the feature information obtained by scanning.

3. The method according to claim 2, characterized in that, The preset filtering rules include at least one of the following: Retain APs whose SSID matches the enterprise's preset network name, and filter out hidden hotspots with empty SSIDs and hotspots whose names are not the preset area names; Retain APs with signal strength above a preset threshold, and filter out interfering APs with signal strength below a preset threshold; The organization retains the unique identifier of the MAC address and matches the AP purchased by the enterprise with the AP vendor, filtering out AP devices from non-designated vendors. APs that appear a preset number of times in the scan results of a preset number of scans are retained, while APs that appear a preset number of times are filtered out.

4. The method according to claim 1, characterized in that, The step of encrypting the feature information of the authorized AP using an encryption algorithm to generate an encrypted authorization database includes: Obtain the seed key built into the target software and the unique hardware identification information of the current device. The unique hardware identification information includes at least one of the following: motherboard serial number, hard disk serial number, network card MAC address, and CPU serial number. The seed key and the unique hardware identifier information are mixed and operated using a preset key derivation function to generate the actual encryption key; The feature information list of the authorized AP is encrypted using the actual encryption key, and an authentication tag is attached to obtain ciphertext data; Integrity verification information is generated for the encrypted data, and the encrypted data and the integrity verification information are packaged together to generate an encrypted authorization database.

5. A software access control method, characterized in that, The method includes: In response to the software startup command, the system wirelessly scans all broadcast AP information within a preset area and parses all current AP feature information from the AP information. The encrypted authorization database is read from the target software installed locally, and the encrypted authorization database is decrypted to obtain all authorized AP feature information; the target software is the software configured by any one of the software configuration methods of claims 1-4; Match the current AP feature information with the authorized AP feature information; If the match is successful, the software is allowed to continue running; If a match fails, the software will be refused to run.

6. The method according to claim 5, characterized in that, The process involves reading the encrypted authorization database from the locally installed target software, decrypting the encrypted authorization database, and obtaining all authorized AP feature information, including: Read the seed key built into the target software and obtain the unique hardware identification information of the current device; The seed key and the unique hardware identifier information are mixed and derived using a preset key derivation function to generate the actual decryption key; The encrypted data in the encrypted authorization database is decrypted using the actual decryption key, and the integrity of the authentication tag attached to the encrypted data is verified. After the authentication tag is verified, the list of feature information of the authorized AP stored in the encrypted data is extracted; If the authentication tag verification fails or decryption fails, it is determined that the encrypted authorization database has been tampered with or the current device has not been authorized.

7. The method according to claim 5, characterized in that, The step of matching the current AP feature information with the authorized AP feature information includes: If the feature information of a certain AP obtained by scanning matches a record in the feature information list of authorized APs, then the AP is recorded as a hit authorized AP; If at least one of the APs obtained by the scan matches an authorized AP, the match is considered successful, and the software is allowed to continue running. If no authorized AP is found among all the APs obtained by scanning, the matching is deemed to have failed, the current device is outside the authorized area, and the software is refused to run.

8. The method according to claim 5, characterized in that, In response to the software startup command, the system wirelessly scans all broadcast AP information within a preset area and parses all current AP characteristic information from the AP information, including: Check if the current device has wireless scanning capabilities; If wireless scanning capability is not available, the user will be prompted to connect an external wireless signal receiver and perform the scan through the external wireless signal receiver. If wireless scanning capability is available, then the step of wirelessly scanning all broadcast AP information within the preset area is performed.

9. The method according to claim 5, characterized in that, After stating that if a match is successful, the software is allowed to continue running, the following is also included: The authentication success status is written to a local cache record, which contains at least one of the following: the hardware identifier hash value of the current device, the authentication timestamp, and the summary of the authorized AP list.

10. The method according to claim 9, characterized in that, Before wirelessly scanning all broadcast AP information within the preset area and parsing all current AP characteristic information from the AP information, the method further includes: Check if the authentication success status exists in the local cache. If the authentication success status does not exist, then the step of wirelessly scanning all broadcast AP information within the preset area is performed; If the authentication success status exists, then determine whether the current device is a historically authenticated successful device within the validity period based on the authentication success status; If the device has a valid history of successful authentication, the software is allowed to run. If the device is not a historically authenticated device within its validity period, then the step of wirelessly scanning all broadcast AP information within the preset area is performed.

11. A software configuration device, characterized in that, The device includes: The filtering module is used to collect feature information of all APs within a preset area and filter out all authorized APs according to preset filtering rules; The encryption module is used to encrypt the feature information of the authorized AP using an encryption algorithm to generate an encrypted authorization database; The distribution module is used to distribute and integrate the encrypted authorization database into the target software.

12. A software access control device, characterized in that, The device includes: The AP scanning module is used to wirelessly scan all broadcast AP information within a preset area in response to a software startup command, and parse all current AP feature information from the AP information; The encrypted database reading module is used to read the encrypted authorization database from the target software installed locally, and decrypt the encrypted authorization database to obtain all authorized AP feature information; The target software is software configured using any one of the software configuration methods of claims 1-4; The matching module is used to match the current AP feature information with the authorized AP feature information; The successful match module allows the software to continue running if a match is found. The matching failure module is used to refuse software execution if a match fails.

13. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the software configuration method of any one of claims 1 to 4 or the software access control method of any one of claims 5 to 10.

Images