Embodiment
Usually usually finish in developer's side for the encryption of application program in the prior art, cryptographic means differs, and has increased the weight of developer's work load; The application program of utilizing simultaneously prior art to encrypt just can be transferred to be installed in other terminal and use after being cracked successfully once, serious infringement developer's copyright rights and interests, and be unfavorable for using the shop application programs and unify toll administration.The schematic flow sheet of a kind of application program guard method that Fig. 1 provides for one embodiment of the invention, as shown in Figure 1, present embodiment provides a kind of application program guard method, comprising:
Step 110: the second user ID that reads second portable terminal that need to run application.
Concrete, after some the second acquisition for mobile terminals arrive this application program, when needs move this application program, at first obtain the second user ID of this second portable terminal, for example the second portable terminal is mobile phone, then the second user ID of the second portable terminal can be the SIM(Subscriber Identity Module of its phone number such as 135*******49 or the second portable terminal, client identification module) the IMSI(International Mobile SubscriberIdentification Number of card, international mobile subscriber identity) information etc.The obtain manner of the second portable terminal application programs both can be to download from server that to obtain also can be to transmit from other portable terminals to obtain.
Step 120: the second user ID and the first user sign of having stored are compared; Wherein, the first user sign is the user ID of purchase applications.If comparison result is consistent, then execution in step 130; If comparison result is inconsistent, then execution in step 140.
Use the user ID of the portable terminal of purchase applications that the application program of downloading is encrypted in the present embodiment, when the second portable terminal need to move this application program, need the second user ID by second portable terminal at comparison current application program place, whether identical with the user ID of buying and download this application program.Can guarantee like this to wish to use the user of this application program for buying the user of this application program.The user who has stopped other portable terminals uses this application program in the situation of purchase applications not.The first portable terminal of for example buying this application program is the cellphone subscriber, its first user is designated this cellphone subscriber's phone number such as 135*******49, itself and current hope is moved the second user ID of the second portable terminal of this application program and compares.
Step 130: be decrypted according to first user sign application programs, and allow the second running of mobile terminal application program;
Step 140: the refusal application programs is decrypted.
Process accordingly according to the comparison result application programs, concrete, if wishing the second user ID of the second portable terminal of this application program of use is exactly to buy the first user sign of this application program, for example through comparison, the second user ID of this second portable terminal also is 132*******49, identical with the first user sign, then can the application program in this second portable terminal be decrypted, thereby allow this application program of this running of mobile terminal.Opposite, if wish to use the second portable terminal of this application program by the comparison user ID, for example, through comparison, the second user ID of this second portable terminal is 131*******31, and is not identical with the first user sign 132*******49 that buys this application program, is not the first user sign of buying this application program, then refuse application programs and be decrypted, prevent this application program of the second running of mobile terminal.
The application program guard method that present embodiment provides after the second user ID that reads second portable terminal that need to run application, is compared the second user ID and the first user sign of having stored; Wherein, the first user sign is the user ID of purchase applications; If comparison result is consistent, then is decrypted according to first user sign application programs, and allows the second running of mobile terminal application program; If comparison result is inconsistent, then refuses application programs and be decrypted.Technical scheme provided by the invention; because the deciphering of application program is associated with the user ID of buying this application program; so after application program is successfully deciphered, also can't be shifted in the terminal that is installed to other unpaid expense family by the user and use, be conducive to the copyright protection of application program.
The application program guard method that present embodiment proposes is applicable to mobile phone and uses; encrypt by developer, the interlock of application shop simultaneously; and can be encrypted by user's unique identification; so that after the user buys this application program; only can also can't move even carry out unloading with its user ID for an one user, this technical scheme can strengthen the protection to Software Intellectual Property Rights; stop the use of unpaid expense family application programs, can prevent effectively that application program is cracked simultaneously.Realized the developer, used shop interlock encryption, the shop application programs is carried out unified toll administration.
Preferred as technique scheme, step 110: comprise before reading the second user ID of second portable terminal that need to run application:
Step 101: obtain the first user sign that signs in to application shop purchase applications.
Step 102: be encrypted according to first user sign application programs.
Identify for obtaining the first user of having bought this application program before downloading in application program, and automatically encrypt according to this first user sign application programs, is downloaded by the first portable terminal after encrypting.After the download, whether the user ID of relatively encrypting is identical with the user ID of current portable terminal, if the same shows this portable terminal for having bought application program, then is decrypted operation and operation.If these application passes of approach such as process download or copy transmissions are in other portable terminal, for example, another portable terminal, it is the mobile phone of purchase applications not, during the application program of directly sending by reception other-ends such as bluetooths, then should limit this mobile phone to the use of this application program.
Preferred as technique scheme, step 102 is encrypted according to first user sign application programs and comprises: carry out segmentation according to default Cipher Strength application programs and form a plurality of application program fragments, and use the preset-key generating algorithm that the first user sign is processed the generation encryption key, be encrypted according to encryption key and default cryptographic algorithm application programs fragment.Above-mentioned Cipher Strength refers to that application program is divided into several sections to be encrypted, as application program being divided into the n section, and need to be respectively preset-key generating algorithm Fa (the x) (a=1 that every section application program arranges correspondence, 2..n), parameter x is for buying the first user sign of this application program herein, and default cryptographic algorithm Ga (y)=Ga (Fa (x)) (a=1,2..n), in the present embodiment, when first user is designated the phone number of first terminal, parameter x is the phone number of portable terminal, and the parameter y of default cryptographic algorithm is the key that is generated by the preset-key generating algorithm according to this phone number.Default cryptographic algorithm and key schedule can be: the symmetric encipherment algorithms such as data encryption standards (DataEncryption Standard, vehicle economy S), Advanced Encryption Standard (Advanced EncryptionStandard is called for short AES) or 3-DES.
It is more then to encrypt hop count owing to the level of encryption of selecting is higher, and safety coefficient is also higher, but can cause the application program travelling speed also to reduce, so concrete Cipher Strength size should appropriately be selected in conjunction with complexity and the operational efficiency of this application program.
Preferred as technique scheme, be decrypted specifically according to first user sign application programs in the step 130 and comprise: according to the preset-key generating algorithm first user sign is processed the generation key, be decrypted according to cryptographic algorithm and Cipher Strength application programs fragment.That is, if in ciphering process, use the des encryption algorithm to be encrypted, then in decrypting process, also should use corresponding des encryption algorithm to be decrypted.
This decrypting process is the inverse operation of the ciphering process of above-mentioned steps 102, and the encrypting and decrypting process is all relevant with the first user sign of buying this application program.
Preferred as technique scheme, first user is designated phone number; The second user ID is the phone number of the second portable terminal.Because portable terminal is normally bound with phone number using the shop purchase applications by network in the time of at present mostly, and pay by the phone number related account, so preferred phone number is as user ID, application programs is encrypted decryption oprerations.
Preferred as technique scheme, the application program guard method that present embodiment provides also comprises: after application programs is decrypted, remove in the internal memory of the second portable terminal the interim fragment for the decryption application generation.Can further guarantee the security of application program by the interim fragment of removing the decryption application generation, avoid illegal program by reading interim frag info this application program to be carried out password cracking, can also greatly improve in addition the travelling speed of application program.In the interim fragment that in the internal memory of removing the second portable terminal, produces for decryption application simultaneously, also can remove the interim fragment of other the program of having carried out in the internal memory, can further improve the application program travelling speed like this.
Preferred as technique scheme, the application program guard method that present embodiment provides also comprises: after application programs is decrypted, monitor the application program operation, if having unusually, then withdraw from application program.Can find timely to exist the abnormal process of potential safety hazard by the operation that monitors application program, if there is abnormal process, can affect the security of this application program, then should timely this application program be withdrawed from, be cracked to prevent this application program.
The developer is submitted to and uses on the shop after application program is finished in exploitation, concrete can submit the submission of carrying out application program in the administration module of module to by the application program of using the shop.Application program submits to the administration module of module for the unique number of the application assigned server end of submission, is convenient to developer's management.
Necessary register account number before the application program downloading service in user application shop in using present embodiment, when registration, need to submit the user ID of own mobile phone to, the user ID of mobile phone is preferably phone number in the present embodiment, for ease of management, a phone number can only be registered an account in addition.After the user logs in account, download in the shop and required application program is bought in payment using, when finishing payment, the user uses access customer is write in the shop automatically in this application program phone number information, application programs is carried out the body segmentation and according to the generation key of user's phone number information, again according to key combining encryption algorithm encrypt applications.Certainly the out of Memory of user mobile phone also can be used as user ID, such as the IMSI information of mobile phone, uses the IMSI information that the shop can obtain by alternate manner user mobile phone.Similarly, an IMSI information can only account of corresponding registration.
Application program is installed also and is started behind mobile phone, at first reads the user ID phone number of mobile phone during startup, and the phone number whether checking writes when buying this application program is identical, if consistent, then by checking, is decrypted according to this phone number; If inconsistent, then refusal deciphering can be selected to withdraw from this application program or give corresponding refusal prompting.
A kind of application program that Fig. 2 provides for further embodiment of this invention is protected the schematic flow sheet of equipment, and as shown in Figure 2, the embodiment of the invention also provides a kind of application program protection equipment, comprising:
Identity reading module 12 is for the second user ID that reads second portable terminal that need to run application;
Signcomparing module 13 is connected withidentity reading module 12, is used for the second user ID thatidentity reading module 12 is read and compares with the first user of having stored sign; Wherein, the first user sign is the user ID of purchase applications;
Deciphering module 14 is connected withsign comparing module 13, is consistent if be used for the comparison result ofsign comparing module 13, then is decrypted according to first user sign application programs, and allows the second running of mobile terminal application program;
Processing module 15 is connected withsign comparing module 13, is inconsistent if be used for the comparison result ofsign comparing module 13, then refuses application programs and is decrypted.
The application program protection equipment that present embodiment provides, read the second user ID of second portable terminal that need to run application byidentity reading module 12 after, signcomparing module 13 is compared the second user ID and the first user sign of having stored; Wherein, the first user sign is the user ID of purchase applications; If comparison result is consistent, then is decrypted according to first user sign application programs by deciphering module 14, and allows the second running of mobile terminal application program; If comparison result is inconsistent, then be decrypted byprocessing module 15 refusal application programs.Technical scheme provided by the invention; because the deciphering of application program is associated with the user ID of buying this application program; so after application program is successfully deciphered, also can't be shifted to be installed in other terminal by the user and use, be conducive to the copyright protection of application program.
The specific implementation process of this apparatus embodiments is identical with the implementation process of above-mentioned application program guard method embodiment, sees also in detail embodiment of the method, does not repeat them here.
Preferred as technique scheme, equipment also comprises:
Identifier acquisition module 10 is used for obtaining the first user sign that signs in to application shop purchase applications;
Encrypting module 11 is connected withidentifier acquisition module 10, is used for being encrypted according to first user sign application programs.
Preferred as technique scheme, encrypting module 11 specifically is used for:
Carry out segmentation according to default Cipher Strength application programs and form a plurality of application program fragments, and use the preset-key generating algorithm that the first user sign is processed the generation encryption key, be encrypted according to encryption key and default cryptographic algorithm application programs fragment.
Preferred as technique scheme, deciphering module 14 specifically is used for:
According to the preset-key generating algorithm described first user sign is processed the generation key, according to cryptographic algorithm and Cipher Strength described application program fragment is decrypted.
Preferred as technique scheme, first user is designated phone number; The second user ID is the phone number of the second portable terminal.
Preferred as technique scheme, the equipment of present embodiment also comprises: wash module 16, is connected with deciphering module 14, be used for after application programs is decrypted, remove in the internal memory of the second portable terminal the interim fragment for the decryption application generation.This wash module 16, be optional module, after the program start operation, bring into operation, be mainly used in removing the interim fragment that decryption application produces, can further guarantee the security of application program, avoid illegal program by reading interim frag info this application program to be carried out password cracking, can also greatly improve in addition the travelling speed of application program.In the interim fragment that in the internal memory of removing the second portable terminal, produces for decryption application simultaneously, also can remove the interim fragment of other the program of having carried out in the internal memory, can further improve the application program travelling speed like this.
Preferred as technique scheme, the equipment of present embodiment also comprises: attack and monitor module 17, is connected with deciphering module 14, be used for after application programs is decrypted, monitor the application program operation, if having unusually, then withdraw from application program.This attack monitors that module 17 is optional module, after the program start operation, bring into operation, can find timely to exist the abnormal process of potential safety hazard by the operation that monitors application program, if there is abnormal process, can affect the words of the security of this application program, then should timely this application program be withdrawed from, be cracked to prevent this application program.
The exploitation of application program is uploaded the concrete steps of encryption and is in the concrete present embodiment:
The developer submits the submission of carrying out application program in the device at a kind of software that the application shop provides after application program is finished in exploitation.Software submits to device for the unique number of application assigned this locality of submission, is convenient to developer's management;
After application program was submitted to and to be finished, it was that application program writes one section code that above-mentioned software is submitted device to, and implanted this application program and become safety insert.The application program protection equipment that provides in the present embodiment is provided this safety insert, comprisesidentity reading module 12,sign comparing module 13; deciphering module 14; processingmodule 15,identifier acquisition module 10 and encrypting module 11, and two alternative wash module that arrange 16 monitor module 17 with attacking.Each module that comprises in the application program protection equipment can submit to the upgrading of device to expand with software in the future.After application programs had been added above-mentioned application program protection equipment, the application program of using software to submit to the upper transmission module of device will write again application program protection equipment was uploaded to the application shop server.
And the user from the process of using shop down load application program encryption deciphering is in the present embodiment:
Necessary register account number before the application program downloading service in the application shop that the user mentions in using present embodiment need to be submitted the phone number of oneself or the user ID of other types to when registration, a phone number can only be registered an account;
After the user logged in account, the payment function purchase applications of shop download module was used in use, used theidentifier acquisition module 10 of this application program protection equipment in the shop when finishing payment, obtained the first user sign that signs in to application shop purchase applications; Encrypting module 11 is encrypted according to first user sign application programs.
In mobile phone, install and operation after application program is downloaded, at first start theidentity reading module 12 in the application program protection equipment during operation, read the second user ID of second portable terminal that need to run application;Sign comparing module 13 is comparedidentity reading module 12 the second user ID that reads and the first user sign of having stored; Deciphering module 14 if the comparison result ofsign comparing module 13 is consistent, then is decrypted according to first user sign application programs, and allows the second running of mobile terminal application program;Processing module 15 if the comparison result ofsign comparing module 13 is inconsistent, is then refused application programs and is decrypted.
One of ordinary skill in the art will appreciate that: all or part of step that realizes above-mentioned each embodiment of the method can be finished by the relevant hardware of programmed instruction.Aforesaid program can be stored in the computer read/write memory medium.This program is carried out the step that comprises above-mentioned each embodiment of the method when carrying out; And aforesaid storage medium comprises: the various media that can be program code stored such as ROM, RAM, magnetic disc or CD.
It should be noted that at last: above each embodiment is not intended to limit only in order to technical scheme of the present invention to be described; Although with reference to aforementioned each embodiment the present invention is had been described in detail, those of ordinary skill in the art is to be understood that: it still can be made amendment to the technical scheme that aforementioned each embodiment puts down in writing, and perhaps some or all of technical characterictic wherein is equal to replacement; And these modifications or replacement do not make the essence of appropriate technical solution break away from the scope of various embodiments of the present invention technical scheme.