Encrypted Service Modules With DRM Key Retrieval for App Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing copyright protection methods for application programs are vulnerable to unauthorized use due to the ability of users to modify authentication results, allowing unauthorized access to service functions.
Innovation Solution
Implementing an encryption mechanism where the service modules of application programs are encrypted, requiring key information from a DRM server only upon user authentication, ensuring that only authorized users can access and decrypt these modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the DRM module checks authentication results locally without encryption, then the operation is simple and fast, but unauthorized users can modify authentication results to access service functions
Solution Approach 1:
The application program is segmented into service modules that are encrypted separately. Each service module is protected individually through encryption, allowing the system to maintain simplicity in the DRM checking process while enhancing security through the segmentation of protected components.
Solution Approach 2:
The service modules are pre-encrypted before being loaded into memory. This preliminary encryption action ensures that when the DRM module checks authentication results, the service modules remain protected unless proper decryption keys are provided, thereby enhancing security without complicating the authentication checking mechanism.
2Reliability
If service modules are encrypted, then unauthorized access is prevented, but the system complexity increases due to encryption and decryption processes
Solution Approach 1:
The DRM server acts as an intermediary that manages the encryption keys and authentication processes. By offloading the key management and decryption coordination to the DRM server, the local system complexity is reduced while maintaining strong copyright protection through the intermediary's secure key management.
Solution Approach 2:
The system changes the state of service modules from unencrypted to encrypted form based on authentication parameters. When a user is authenticated, the encryption parameter changes to allow decryption; otherwise, the encrypted state is maintained, providing dynamic copyright protection without permanent system complexity.
3Speed
If authentication results are stored locally in the terminal, then the access speed is fast, but the security is reduced as users can modify local data
Solution Approach 1:
Authentication results and service modules are pre-encrypted and stored in a secure manner locally. This preliminary encryption action allows fast retrieval and authentication speed while maintaining data integrity, as the encrypted state prevents unauthorized modification even if local storage is accessed.
Solution Approach 2:
The encryption parameter of stored authentication data is dynamically controlled based on user authorization. When authentication is successful, the system changes the decryption parameter to allow access; otherwise, the data remains in an encrypted state, ensuring both fast access when authorized and integrity when unauthorized.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application discloses a method for processing an application program and a related product. The method includes: when a non-service module obtains a first running instruction triggered by a user for running a target first service module, sending, by a terminal, a key acquiring request to a digital rights management (Digital Rights Management, DRM) server by using the non-service module, where the key acquiring request is used to request key information corresponding to the target first service module, and the key information is fed back by the DRM server when it is determined that the user has use permission of the target first service module; and decrypting, by the terminal, the target first service module based on the key information by using the non-service module, and executing a service function corresponding to the target first service module.