CN105808980B - The detection method and device of unauthorized use of software - Google Patents
The detection method and device of unauthorized use of software Download PDFInfo
- Publication number
- CN105808980B CN105808980B CN201610130104.3A CN201610130104A CN105808980B CN 105808980 B CN105808980 B CN 105808980B CN 201610130104 A CN201610130104 A CN 201610130104A CN 105808980 B CN105808980 B CN 105808980B
- Authority
- CN
- China
- Prior art keywords
- software
- time
- registration information
- system time
- finally
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 81
- 238000000034 method Methods 0.000 claims abstract description 22
- 230000004048 modification Effects 0.000 claims description 12
- 238000012986 modification Methods 0.000 claims description 10
- 239000000284 extract Substances 0.000 claims description 8
- 238000000605 extraction Methods 0.000 claims description 6
- 230000008859 change Effects 0.000 claims description 4
- 230000002123 temporal effect Effects 0.000 abstract description 17
- 238000010586 diagram Methods 0.000 description 3
- 238000007689 inspection Methods 0.000 description 3
- 238000013475 authorization Methods 0.000 description 2
- 230000001186 cumulative effect Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Multimedia (AREA)
- Technology Law (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The present invention relates to a kind of detection method of unauthorized use of software and device, method includes: acquisition software registration information；Detection type is determined according to the software registration type identification in software registration information；If detection type is that software is detected using the time, the software extracted in software registration information uses temporal information；It obtains system time and software and finally uses the time using the software in temporal information, part at the time of system time and software are finally included day part and are accurate to second using the time；When software finally uses the day part of time identical with the day part of system time, part at the time of whether part is more than or equal to system time at the time of software finally uses the time is judged, if so, the decision-making system time is illegally modified.In this way, modified according to part at the time of being accurate to second come the detection system time, the accuracy whether the detection system time be illegally modified improved.
Description
Technical field
The present invention relates to software detection fields, more particularly to the detection method and device of a kind of unauthorized use of software.
Background technique
With the development of software industry, after software supplier develops software, user needs to software supplier
Payment is to obtain licensing for software supplier.But there are some users, when by software registration information or system
Between modify, can indefinite duration use software, without obtaining the authorization of software supplier by way of payment.If energy
Detect whether software registration information or system time are modified, and prevent these user's unauthorized use of software, it will to software system
Make team and reduce loss, therefore whether inspection software registration information or system time are very important by modification.
Traditional detection method mainly includes that software uses two kinds of time detection and software access times detection.Wherein, it passes
For the software of system using in time detection, software is only accurate to the date using temporal information, causes system time to hold easily modified,
And only considered the case where system time finally uses the time more than or less than software in the detection process, it does not account for when being
The case where system time is equal to software when finally using the time, and software can be used always.If user will be accurate to the date
System time be revised as with software using the time it is equal when, user can continue to use software, above-mentioned detection method failure,
Cause detection accuracy lower.
Summary of the invention
Based on this, it is necessary to can illegally continue to make for how to avoid passing through modification software registration information and system time
The problem of with software, provides the detection method and device of a kind of unauthorized use of software.
A kind of detection method of unauthorized use of software, which comprises
Obtain software registration information；
Detection type is determined according to the software registration type identification in the software registration information；
If the detection type is that software is detected using the time, when extracting the software use in the software registration information
Between information；
Obtain system time and the software and finally use the time using the software in temporal information, the system time and
The part at the time of software is included day part and be accurate to second using the time；When the software finally uses the date of time
When part is identical with the day part of the system time, judge whether part is greater than at the time of the software finally uses the time
Part at the time of equal to the system time, if so, determining that the system time is illegally modified.
The method also includes at least one steps in following steps in one of the embodiments:
It obtains multiple softwares in the software registration information and finally uses the time, made by judging the multiple software finally
It is whether identical with the time, to detect whether the software registration information is illegally modified；
Extract the software service life in the software registration information, software finally uses time and deadline time poor, meter
It calculates the software service life and software finally uses the difference of time, by judging that the difference is with the deadline time difference
It is no identical, to detect whether the software registration information is illegally modified；
The software registration date in the day part and the software registration information of the system time is obtained, judgement is passed through
Whether whether the software registration date is less than or equal to the day part of the system time, non-to detect the system time
Method modification.
It is described by judging that the multiple software finally uses the time whether identical in one of the embodiments, with inspection
Survey whether the software registration information is illegally modified, comprising:
Judge that the multiple software finally uses the time whether identical；
If they are the same, then allow to continue to use software, and/or execute the software extracted in the software registration information to make
The step of time and deadline time difference are finally used with time limit, software, and/or execute the date for obtaining the system time
Partially with the software registration date in software registration information the step of；
If not identical, determine that the software registration information is illegally modified.
It is described by judging whether the difference and the deadline time difference are identical in one of the embodiments, with inspection
Survey whether the software registration information is illegally modified, comprising:
Judge whether the difference and the deadline time difference are identical；
If they are the same, then allow to continue to use software, and/or execute multiple softwares in the acquisition software registration information
The step of finally using the time, and/or execute the day part and the software registration information for obtaining the system time
In the software registration date；
If not identical, determine that the software registration information is illegally modified.
It is described by when judging whether the software registration date is less than or equal to the system in one of the embodiments,
Between day part, to detect whether the system time is illegally modified, comprising:
Judge whether the software registration date is less than or equal to the day part of the system time；
If so, allow to continue to use software, and/or executes and described obtain in the software registration information multiple softwares most
The time is used afterwards；And/or the execution software service life extracted in the software registration information, software finally use the time
With the step of deadline time difference；
If it is not, then determining that the software registration information is illegally modified.
The day part and the system time that the time is finally used when the software in one of the embodiments,
Day part it is identical when, judge at the time of the software finally uses the time whether part is more than or equal to the system time
Moment part, if so, determine in the step of system time is illegally modified, it is further comprising the steps of:
When the day part of the system time, which is less than the software, finally uses the day part of time, then institute is determined
System time is stated to be illegally modified；
When the day part of the system time, which is greater than the software, finally uses the day part of time, then institute is obtained
The software service life in system time and the software registration information is stated, by judging it is described whether the system time is greater than
Whether software service life has arrived at the software service life with inspection software.
The software obtained in the system time and the software registration information uses in one of the embodiments,
Whether the time limit is had arrived at described by judging whether the system time is greater than the software service life with inspection software
Software service life, comprising:
The software service life in the system time and the software registration information is obtained, when by judging the system
Between whether be greater than the software service life；
If so, determining that software service life has arrived, terminates software and use；
If it is not, then allowing to continue to use software.
In one of the embodiments, it is described detection type is determined according to the software registration type identification after, also wrap
It includes:
If the detection type is the detection of software access times, acquisition software is used secondary from the software registration information
Number information, and whether the software registration information according to the software access times infomation detection is illegally modified.
Software access times information is obtained from the software registration information in one of the embodiments, and according to institute
State whether software registration information described in software access times infomation detection is illegally modified, comprising:
Software is obtained from the software registration information uses total degree, access times and remaining access times；
Add operation is carried out to obtain operation values to the access times and remaining access times；
Detect whether the software registration information is illegally modified according to the operation values and the use total degree.
It is described in one of the embodiments, to detect the software registration using total degree with described according to the operation values
Whether information is illegally modified, comprising:
It is described using total degree to judge whether the operation values are equal to；
If so, then allowing to continue to use when the remaining access times are greater than 0；When the remaining access times are less than
When equal to 0, then software operation is terminated；
If it is not, then determining that software registration information is illegally modified.
The detection method of above-mentioned unauthorized use of software determines software according to software registration type identification in software registration information
Registration information detection type, when detection type is that software is detected using the time, then the software extracted in software registration information makes
It with temporal information, and obtains system time and software and finally uses the time using the software in temporal information, first comparison software is most
Afterwards using the day part of the day part of time and system time, when software finally uses the day part and system of time
Between day part it is identical when, then judge at the time of software finally uses the time part at the time of part and system time.In this way,
Effectively avoid for system time being revised as the case where software finally can continue to use software using the time.
A kind of detection device of unauthorized use of software, described device include:
Registration information obtains module, for obtaining software registration information；
Detection type determining module, for determining detection according to the software registration type identification in the software registration information
Type；
Software information extraction module extracts the software if detecting for software using the time for the detection type
Software in registration information uses temporal information；
Software information detection module is finally made for obtaining system time and the software using the software in temporal information
With the time, the part at the time of system time and the software are finally included day part and are accurate to second using the time；?
It is last according to the software when software finally uses the day part of time identical with the day part of the system time
It is whether non-to detect the system time using partially being compared with part at the time of the system time at the time of time
Method modification.
The software information detection module is also also used to execute at least one in following steps in one of the embodiments,
A step:
It obtains multiple softwares in the software registration information and finally uses the time, made by judging the multiple software finally
It is whether identical with the time, to detect whether the software registration information is illegally modified；
Extract the software service life in the software registration information, software finally uses time and deadline time poor, meter
It calculates the software service life and software finally uses the difference of time, by judging that the difference is with the deadline time difference
It is no identical, to detect whether the software registration information is illegally modified；
The software registration date in the day part and the software registration information of the system time is obtained, judgement is passed through
Whether whether the software registration date is less than or equal to the day part of the system time, non-to detect the system time
Method modification.
The detection device of above-mentioned unauthorized use of software determines software according to software registration type identification in software registration information
Registration information detection type, when detection type is that software is detected using the time, then the software extracted in software registration information makes
It with temporal information, and obtains system time and software and finally uses the time using the software in temporal information, first comparison software is most
Afterwards using the day part of the day part of time and system time, when software finally uses the day part and system of time
Between day part it is identical when, then judge at the time of software finally uses the time part at the time of part and system time.In this way,
It effectively avoids and system time is revised as the case where software finally can continue to use software using the time.
Detailed description of the invention
Fig. 1 is the flow diagram of the detection method of unauthorized use of software in one embodiment；
Fig. 2 is the flow diagram for the step of detection type is the detection of software access times in one embodiment；
Fig. 3 is the structural block diagram of the detection device of unauthorized use of software in one embodiment.
Specific embodiment
In order to make the objectives, technical solutions, and advantages of the present invention clearer, with reference to the accompanying drawings and embodiments, right
The present invention is further elaborated.It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, and
It is not used in the restriction present invention.
As shown in Figure 1, provide a kind of detection method of unauthorized use of software, this method specifically includes the following steps:
Step 102, software registration information is obtained.
Specifically, software is installed in equipment, software registration information can be stored in multiple files by software, can also
The content in software registration information to be respectively stored in multiple files.Optimal storage mode is to distinguish software registration information
It stores in the software registration file under the root of software, in the Logical Disk where system file and registration table.Software fortune
It can be soft from being extracted in the software registration file under software root, in Logical Disk where system file and registration table respectively when row
Part registration information.Software registration information is updated with the operation or registration of software.
Wherein, when software registration type is that software uses the time, corresponding software registration information includes software registration type
Whether mark, software service life, software registration date, software are finally used the mark of time type using the time, currently
Knowledge, deadline time are poor.
Software registration type identification: software developer can utilize character definition software registration type identification, such as define software
Registration type is identified as A or B, wherein software is using the A that is identified as of time type, then software access times type is identified as B；
Or defining software registration type identification is 01 or 02, software is identified as 01 using time type, then software access times type
Be identified as 02.
Software service life: the expiration time that logging software uses, software often re-register primary just update once, accurately
To second, example " 20151205 23:59:59 ".
The software registration date: on date when record registration, every registration is once primary with regard to updating, and is accurate to day, example
“20151205”。
Software finally uses the time: record last time uses the time of software or software kernels function, is accurate to the second, often
Primary, example " 20151110 10:15:23 " is updated using primary.
The mark of time type currently whether is used: indicating whether software is used this software registration class at this time
Type, 1 indicates to be used, and when inspection software registration information is just detected according to software using the information of time type；0 indicates not
It uses, uses the information of time type when inspection software registration information without using software.
Deadline time is poor: referring to that software finally uses the difference between time and software service life.
Wherein, when software registration type is software access times, corresponding software registration information includes software registration type
Mark, using total degree, the software registration date, the number used, currently whether be used number type mark and
Remaining access times.
It uses total degree: referring to that total number of software can be used in user, be generally subject to the requirement of user, such as
It 1000 times or 100 times, is operated and is updated according to the registration of software access times type using total degree, from registering first time,
As long as registered according to software access times type, new software will not cover the value of last time using total degree, and understand
It is with the total degree that uses using the cumulative last time registration of total degree currently registered, such as the total degree that uses of last registration
100 times, be specifically 1000 using total degree, then after registration finishes, software is exactly 1100 using total degree, behind when registering
And so on.
The number used: as soon as user uses the core function of time software or software, this number plus 1 adds up to use
Family is used for how many times.
The mark of number type currently whether is used: indicating whether software is used number registration type at this time, 1
Expression is used, and when inspection software registration information is just detected according to the information of software access times type；0 indicates not make
With information when, inspection software registration information without using software access times type.
Remaining access times: referring to that user there remains the number for being able to use software, when this value is 0, means that and removes
Non- purchase authorization again, otherwise can not normal use software or software core function.
Step 104, detection type is determined according to the software registration type identification in software registration information.
Specifically, software registration type identification is extracted from software registration information, software registration type identification can be number
At least one of word, character and a combination thereof.Software registration type identification mainly include software using the mark of time type and
The mark of software access times type.The software in equipment is mounted on according to the software registration type identification in software registration information
Determine corresponding detection type.
Step 106, if detection type is that software is detected using the time, when extracting the software use in software registration information
Between information.
It specifically, is to be registered using software using the time when determining software registration according to software registration type identification, then
Determine that detection type is that software is detected using the time.When being used further according to the software for extracting storage in corresponding software registration information
Between information.Software includes that software registration date, software finally use time and deadline time poor using temporal information.
Step 108, system time and software are obtained and finally uses the time using the software in temporal information, system time and
Part at the time of software is finally included day part and be accurate to second using the time；When software finally uses the day part of time
When identical with the day part of system time, judge whether part is more than or equal to system time at the time of software finally uses the time
At the time of part, if so, the decision-making system time is illegally modified.
Specifically, the system time of current system is obtained, and is finally used from software using extraction software in temporal information
Time.Wherein system time and software are finally using the time by the day part for being accurate to the date and at the time of being accurate to second
Part is constituted.The day part and software of first extraction system time finally use the day part of time, to the date portion of the two
Divide and is compared.When software finally use the time day part and system time day part it is equal when, then extraction system
Part and software part at the time of finally use the time at the time of time, part is compared at the time of to the two, when software most
When being partially larger than part at the time of being equal to system time at the time of using the time afterwards, then the decision-making system time is illegally modified, together
When terminate software any operation；When being partially less than system time at the time of software finally uses the time, then allow to continue to make
With software or continue to detect software, wherein continuing to carry out software detection can be by whether judging system time
Whether arrived more than inspection software service life with the software service life of inspection software.
In the present embodiment, determine that software registration information detects class according to software registration type identification in software registration information
Type then extracts the software in software registration information using temporal information, and obtain when detection type is that software is detected using the time
System time and software is taken finally to use the time using the software in the time, first comparison software finally uses the day part of time
With the day part of system time, when software finally uses the day part of time identical with the day part of system time,
Part at the time of part and system time at the time of software finally uses the time is judged again.This method can be applied to mountable soft
In the arbitrary equipment of part, effectively avoids and system time is revised as software finally can continue to use software using the time
Situation.
In one embodiment, the detection method of unauthorized use of software further includes in step a), step b) and step c)
At least one step:
Step a) obtains multiple softwares in software registration information and finally uses the time, made by judging multiple softwares finally
It is whether identical with the time, whether it is illegally modified with inspection software registration information.
Specifically, multiple softwares are extracted from software registration information and finally use the time, and plurality of software finally uses
Time is respectively stored in multiple and different file or position, extracts multiple softwares and finally uses time and more multiple softwares
It is finally whether consistent using the time, allow software to continue to use or continue to detect software if consistent；If different
It causes, then determines that software registration information is illegally modified, while terminating any operation of software.
Step b), extract software registration information in software service life, software finally use time and deadline time poor,
Software for calculation service life and software finally use the difference of time, by judging whether difference is identical as deadline time difference, with
Whether inspection software registration information is illegally modified.
Specifically, acquisition software service life, software finally use time and deadline time poor from software registration information,
Software final time is subtracted using software service life and obtains difference, judges whether difference is identical as deadline time difference, if phase
Together, then software is allowed to continue to use or continue to detect software；If it is not the same, then determining that software registration information is non-
Method modification, while terminating any operation of software.
Step c) obtains the software registration date in the day part and software registration information of system time, passes through judgement
Whether whether the software registration date is less than or equal to the day part of system time, be illegally modified with the detection system time.
Specifically, it obtains and is accurate to the day part of date in system time, and extract from software registration information soft
Part registration date, software registration date are equally accurate to the date, judge whether the software registration date is less than or equal to system time
Day part, if the software registration date be less than or equal to system time day part, allow to continue to use software or after
Continuous to detect to software, if the software registration date is greater than the day part of system time, the decision-making system time is illegally repaired
Change, while terminating any operation of software.
In one embodiment, step a) includes: to judge that multiple softwares finally use the time whether identical；If they are the same, then
Allow to continue to use software, and/or executes at least one step in step b) and step c)；If not identical, determine that software is infused
Volume information is illegally modified, while terminating any operation of software.
Specifically, when determining that multiple softwares finally use the time not identical, then determine that software registration information is illegally repaired
Change, while terminating any operation of software；If it is determined that then allowing to continue to use software when multiple softwares finally use the time identical
Or the step of continuing to execute software detection.
The step of continuing to execute software detection specifically can be the software service life extracted in software registration information, software
Finally poor using time and deadline time, software for calculation service life and software finally use the difference of time, determine difference with
When deadline time difference is not identical, determine that software registration information is illegally modified, while the step of terminating any operation of software；
And/or software registration date in the day part and software registration information of system time is obtained, determine that the software registration date is big
When the day part of system time, determine that system time is illegally modified, while the step of terminating any operation of software.
In one embodiment, step b) includes: to judge whether difference is identical as deadline time difference；If they are the same, then allow
Software is continued to use, and/or executes at least one step in step c) and step a)；If not identical, determine that software registration is believed
Breath is illegally modified, and terminates software operation.
Specifically, when determining that difference and deadline time difference be not identical, then determine that software registration information is illegally modified, eventually
Only any operation of software；If it is determined that then allowing to continue to use software when difference is identical as deadline time difference or continuing to execute soft
The step of part detects.
The step of continuing to execute software detection specifically can be the day part and software registration information for obtaining system time
In the software registration date, determine the software registration date whether be less than or equal to the day part of system time when, determine system
The step of time is illegally modified and terminates any operation of software；And/or multiple softwares are last in acquisition software registration information
Determine that system time is illegally modified and terminates software when determining that multiple softwares finally use the time identical using the time
The step of any operation.
In one embodiment, step c) includes: to judge whether the software registration date is less than or equal to the date of system time
Part；If so, allowing to continue to use software, and/or execute at least one step in step a) and step b)；If it is not, then
Determine that software registration information is illegally modified, terminates software operation.
Specifically, when determining that the software registration date is greater than the day part of system time, then determine software registration information
It is illegally modified, then terminates any operation of software；Determining that the software registration date is less than or equal to the day part of system time
When, then allow the step of continuing to use software or continuing to execute software detection.
The step of continuing to execute software detection, which specifically can be, obtains in software registration information multiple softwares when finally using
Between, when determining that multiple softwares finally use the time identical, determine that system time is illegally modified and terminates any behaviour of software
The step of making；And/or the software service life in extraction software registration information, software finally use time and deadline time poor,
Software for calculation service life and software finally use the difference of time, when determining that difference and deadline time difference be not identical, determine
The step of software registration information is modified and terminates any operation of software.
In a preferred embodiment, multiple softwares in software registration information are obtained and finally use the time, it is more multiple
Whether software finally uses the time identical, if software occur finally uses time different situation, determines that software registration is believed
Breath is illegally modified, and terminates the use of software.
If multiple softwares finally use the time identical, software service life in software registration information, software are extracted most
It is poor using time and deadline time afterwards, finally subtracted each other software service life and software to obtain the two difference using the time,
The two difference is compared with deadline time difference, judges whether difference is identical as deadline time difference, if not identical, is determined soft
Part registration information is illegally modified, then terminates the use of software.
If software service life and software finally use the difference of time identical as deadline time difference, system time is obtained
Day part and software registration information in the software registration date, by the day part of system time and software registration date into
Row compares, if the software registration date is greater than the day part of system time, determines that software registration information is illegally modified, and terminates
The use of software；If the software registration date is less than or equal to the day part of system time, 108 are thened follow the steps.
In one embodiment, step 108 is further comprising the steps of:
When the day part of system time, which is less than software, finally uses the day part of time, then decision-making system time quilt
Illegal modifications, while terminating any operation of software.
When the day part of system time be greater than software finally use the day part of time when, then obtain system time and
Software service life in the software registration information, by judging whether the system time is greater than software service life, if
It is then to determine that software service life has arrived, terminates software and use；If it is not, then allowing to continue to use software.
In the present embodiment, can determine whether software registration information or system time are repaired by different detecting steps
Change, can also be detected by combining a variety of detecting steps, improve the accuracy of detection, keep detection method tighter
Sincerely.
As shown in Fig. 2, in one embodiment, step 104 specifically further includes that detection type is software access times later
The step of detection, the specific steps are as follows:
Step 202, if detection type is the detection of software access times, the use that software is extracted from software registration information is total
Number, access times and remaining access times.
Specifically, after determining the detection of software access times, using total degree, having made in software registration information is extracted
With the softwares access times information such as number and remaining access times.
Step 204, add operation is carried out to access times and remaining access times, with obtain access times and
The sum of remaining access times.
Step 206, judgement access times and residue access times sum with use total degree whether equal；If so,
Then follow the steps 210；If it is not, thening follow the steps 208.
Specifically, when software registration information is not illegally modified, the sum of access times and remaining access times with make
Be with total degree it is equal, if unequal, then it represents that software registration information is illegally modified.
Step 208, determine that software registration information is illegally modified；After step 208, step 212 is executed.
Specifically, when determining that software registration information is illegally modified, indicate user in the case where uncommitted using soft
There is the suspicion that software is continued to use by modification software registration information in part, be illegally modified in judgement software registration information
Afterwards, any operation of software is terminated.
Step 210, judge whether remaining access times are greater than 0；If so, thening follow the steps 214；If it is not, thening follow the steps
212。
Specifically, when the sum for determining access times and remaining access times is equal with sum is used, software is indicated
Registration information is not illegally modified, but if remaining access times are greater than 0, expression can also continue to normal use software；It is no
Then, it indicates the use total degree for having reached software using the number of software, cannot be used continuously the software, terminate software behaviour
Make, user needs the usage charges for paying software again that can just continue to use software.
Step 212, any operation of software is terminated.
Step 214, allow to continue to use software.
In the present embodiment, making using total degree, access times and residue for software is extracted from software registration information
With number, extracted software access times information is calculated and compared, so that it is determined that whether software registration information is non-
Method modification.By the way that software access times information is simply calculated and compared, improves and whether determine software registration information
The accuracy being illegally modified.
As shown in figure 3, in one embodiment, providing a kind of detection device 300 of unauthorized use of software, the device is specific
It include: that registration information obtains module 302, detection type determining module 304, software information extraction module 306 and software information inspection
Survey module 308.
Registration information obtains module 302, for obtaining software registration information.
Detection type determining module 304, for determining detection according to the software registration type identification in software registration information
Type.
Software information extraction module 306 extracts software registration letter if detecting for software using the time for detection type
Software in breath uses temporal information.
Software information detection module 308 is finally made for obtaining system time and software using the software in temporal information
With the time, part at the time of system time and software are finally included day part and are accurate to second using the time；It is last in software
When using the day part of time and the identical day part of system time, at the time of finally using the time according to software part with
Part, which compares, at the time of system time comes whether the detection system time is illegally modified.
In the present embodiment, determine that software registration information detects class according to software registration type identification in software registration information
Type then extracts the software in software registration information using temporal information, and obtain when detection type is that software is detected using the time
System time and software is taken finally to use the time using the software in the time, first comparison software finally uses the day part of time
With the day part of system time, when software finally uses the day part of time identical with the day part of system time,
Part at the time of part and system time at the time of software finally uses the time is judged again.The device can be applied to mountable soft
In the arbitrary equipment of part, effectively avoids and system time is revised as software finally can continue to use software using the time
Situation.
In one embodiment, software information detection module 308 is also used to execute at least one step in following steps:
It obtains multiple softwares in software registration information and finally uses the time, be using the time by judging multiple softwares finally
It is no identical, whether it is illegally modified with inspection software registration information.
Software service life, software in extraction software registration information finally use time and deadline time poor, calculate soft
Part service life and software finally use the difference of time, soft to detect by judging whether difference is identical as deadline time difference
Whether part registration information is illegally modified.
The software registration date in the day part and software registration information of system time is obtained, by judging software registration
Whether whether the date is less than or equal to the day part of system time, be illegally modified with the detection system time.
In the present embodiment, can by different detecting steps is determined software registration information or system time whether by
Modification can also be detected by combining a variety of detecting steps, improve the accuracy of detection, keep detection method tighter
Sincerely.
Each technical characteristic of embodiment described above can be combined arbitrarily, for simplicity of description, not to above-mentioned reality
It applies all possible combination of each technical characteristic in example to be all described, as long as however, the combination of these technical characteristics is not deposited
In contradiction, all should be considered as described in this specification.
The embodiments described above only express several embodiments of the present invention, and the description thereof is more specific and detailed, but simultaneously
It cannot therefore be construed as limiting the scope of the patent.It should be pointed out that coming for those of ordinary skill in the art
It says, without departing from the inventive concept of the premise, various modifications and improvements can be made, these belong to protection of the invention
Range.Therefore, the scope of protection of the patent of the invention shall be subject to the appended claims.
Claims (12)
1. a kind of detection method of unauthorized use of software, which comprises
Respectively from extraction software is infused in the software registration file under software root, in Logical Disk where system file and registration table
Volume information；It include that multiple softwares being stored in different positions respectively finally use the time in the software registration information；
Detection type is determined according to the software registration type identification in the software registration information；
If the detection type is that software is detected using the time, obtains system time and extracted from the software registration information
Multiple softwares finally use the time；The system time and the multiple software include finally day part and essence using the time
Part at the time of really to the second；
When determining that the multiple software finally uses the time not identical, it is determined that the software registration information is illegally modified,
Terminate software operation；
When determining that the multiple software finally uses the time identical, and software finally use the time day part and the system
When the day part of time is identical, when judging whether part is more than or equal to the system at the time of software finally uses the time
Between at the time of part, if so, determining that the system time is illegally modified.
2. the method according to claim 1, wherein the method also includes at least one of following steps steps
It is rapid:
B) the software service life in the software registration information is extracted, software finally uses time and deadline time poor, calculating
The software service life and software finally use the difference of time, by judging whether are the difference and the deadline time difference
It is identical, to detect whether the software registration information is illegally modified；
C) the software registration date in the day part and the software registration information of the system time is obtained, by judging
The day part whether the software registration date be less than or equal to the system time is stated, it is whether illegal to detect the system time
Modification.
3. according to the method described in claim 2, it is characterized in that, the method also includes:
Judge that the multiple software finally uses the time whether identical；
If they are the same, then allow to continue to use software, alternatively, executing the step b) and/or executing the step c)；
If not identical, determine that the software registration information is illegally modified.
4. according to the method described in claim 2, it is characterized in that, by judging the difference and the phase in the step b)
Whether the limit time difference is identical, to detect whether the software registration information is illegally modified, comprising:
Judge whether the difference and the deadline time difference are identical；
If they are the same, then allow to continue to use software, and/or execute the step c)；
If not identical, determine that the software registration information is illegally modified.
5. according to the method described in claim 2, it is characterized in that, by judging the software registration date in the step c)
Whether the day part of the system time is less than or equal to, to detect whether the system time is illegally modified, comprising:
Judge whether the software registration date is less than or equal to the day part of the system time；
If so, allowing to continue to use software, and/or execute the step b)；
If it is not, then determining that the software registration information is illegally modified.
6. the method according to claim 1, wherein the day part for finally using the time when the software
When identical with the day part of the system time, judge whether part is more than or equal at the time of the software finally uses the time
The part at the time of system time further includes following step if so, determining in the step of system time is illegally modified
It is rapid:
When the day part of the system time, which is less than the software, finally uses the day part of time, then the system is determined
The system time is illegally modified；
When the day part of the system time, which is greater than the software, finally uses the day part of time, then the system is obtained
Software service life in system time and the software registration information, by judging whether the system time is greater than the software
Whether service life has arrived at the software service life with inspection software.
7. according to the method described in claim 6, it is characterized in that, the acquisition system time and software registration letter
Software service life in breath is with inspection software by judging whether the system time is greater than the software service life
It is no to have arrived at the software service life, comprising:
The software service life in the system time and the software registration information is obtained, by judging that the system time is
It is no to be greater than the software service life；
If so, determining that software service life has arrived, terminates software and use；
If it is not, then allowing to continue to use software.
8. the method according to claim 1, wherein the software registration according in the software registration information
Type identification determines after detection type, further includes:
If the detection type is the detection of software access times, software access times letter is obtained from the software registration information
Breath, and whether the software registration information according to the software access times infomation detection is illegally modified.
9. according to the method described in claim 8, it is characterized in that, obtaining software access times from the software registration information
Information, and whether the software registration information according to the software access times infomation detection is illegally modified, comprising:
Software is obtained from the software registration information uses total degree, access times and remaining access times；
Add operation is carried out to obtain operation values to the access times and remaining access times；
Detect whether the software registration information is illegally modified according to the operation values and the use total degree.
10. according to the method described in claim 9, it is characterized in that, described use total degree with described according to the operation values
Detect whether the software registration information is illegally modified, comprising:
It is described using total degree to judge whether the operation values are equal to；
If so, then allowing to continue to use when the remaining access times are greater than 0；When the remaining access times are less than or equal to 0
When, then terminate software operation；
If it is not, then determining that software registration information is illegally modified.
11. a kind of detection device of unauthorized use of software, which is characterized in that described device includes:
Registration information obtains module, for the logic from the software registration file under software root, where system file respectively
Software registration information is extracted in disk and registration table；It is stored in different positions respectively including multiple in the software registration information
In software finally use the time；
Detection type determining module, for determining detection class according to the software registration type identification in the software registration information
Type；
Software information extraction module, if being that software was detected using the time for the detection type, obtain system time and from
The multiple softwares extracted in the software registration information finally use the time；The system time and the multiple software finally make
Part at the time of being included day part and be accurate to second with the time；
Software information detection module, for when determining that the multiple software finally uses the time not identical, it is determined that described soft
Part registration information is illegally modified, and terminates software operation；When determining that the multiple software finally uses the time identical, and software is most
When identical with the day part of the system time using the day part of time afterwards, the time is finally used according to the software
Moment part is compared with part at the time of the system time to detect whether the system time is illegally modified.
12. device according to claim 11, which is characterized in that the software information detection module be also also used to execute with
At least one step in lower step:
Extract the software service life in the software registration information, software finally uses time and deadline time poor, calculating institute
State the difference that software service life and software finally use the time, by judge the difference and the deadline time difference whether phase
Together, to detect whether the software registration information is illegally modified；
The software registration date in the day part and the software registration information of the system time is obtained, by described in judgement
Whether the software registration date is less than or equal to the day part of the system time, to detect whether the system time is illegally repaired
Change.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610130104.3A CN105808980B (en) | 2016-03-07 | 2016-03-07 | The detection method and device of unauthorized use of software |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610130104.3A CN105808980B (en) | 2016-03-07 | 2016-03-07 | The detection method and device of unauthorized use of software |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105808980A CN105808980A (en) | 2016-07-27 |
| CN105808980B true CN105808980B (en) | 2019-06-11 |
Family
ID=56466889
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610130104.3A Active CN105808980B (en) | 2016-03-07 | 2016-03-07 | The detection method and device of unauthorized use of software |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105808980B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106250727A (en) * | 2016-08-16 | 2016-12-21 | 深圳市冠旭电子股份有限公司 | A kind of method for protecting software and device |
| CN107403078A (en) * | 2017-06-27 | 2017-11-28 | 深圳市元征科技股份有限公司 | The restriction application method and terminal of a kind of application |
| CN111079132A (en) * | 2019-12-27 | 2020-04-28 | 深圳市元征科技股份有限公司 | User authority management method, device and related equipment |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1702596A (en) * | 2005-07-08 | 2005-11-30 | 北京北大方正电子有限公司 | Method for protecting content of digital works for hand-held devices |
| CN102208003A (en) * | 2010-03-31 | 2011-10-05 | 鸿富锦精密工业（深圳）有限公司 | Software program protection system and method |
| CN103577727A (en) * | 2013-11-13 | 2014-02-12 | 深圳市创维群欣安防科技有限公司 | Software deadline verifying method and device |
| CN105046115A (en) * | 2015-09-15 | 2015-11-11 | 北京深思数盾科技有限公司 | Method and apparatus for detecting tampering with software operation time |
| CN105138900A (en) * | 2015-07-30 | 2015-12-09 | 珠海格力电器股份有限公司 | Control method and system for validity period of standalone software |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR100516826B1 (en) * | 2004-12-27 | 2005-09-26 | 엠텍비젼 주식회사 | Method and system for authenticating software license |
| CN101777002B (en) * | 2010-01-18 | 2012-12-19 | 杭州宇酷信息技术有限公司 | Software running method based on virtualization |
-
2016
- 2016-03-07 CN CN201610130104.3A patent/CN105808980B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1702596A (en) * | 2005-07-08 | 2005-11-30 | 北京北大方正电子有限公司 | Method for protecting content of digital works for hand-held devices |
| CN102208003A (en) * | 2010-03-31 | 2011-10-05 | 鸿富锦精密工业（深圳）有限公司 | Software program protection system and method |
| CN103577727A (en) * | 2013-11-13 | 2014-02-12 | 深圳市创维群欣安防科技有限公司 | Software deadline verifying method and device |
| CN105138900A (en) * | 2015-07-30 | 2015-12-09 | 珠海格力电器股份有限公司 | Control method and system for validity period of standalone software |
| CN105046115A (en) * | 2015-09-15 | 2015-11-11 | 北京深思数盾科技有限公司 | Method and apparatus for detecting tampering with software operation time |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105808980A (en) | 2016-07-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104123493B (en) | The safety detecting method and device of application program | |
| CN105808980B (en) | The detection method and device of unauthorized use of software | |
| CN103577748B (en) | Dynamic measuring method based on dependable computing and management system | |
| Phan et al. | Quantifying information leaks using reliability analysis | |
| Kang et al. | Changes in US inflation persistence | |
| CN108989150A (en) | A kind of login method for detecting abnormality and device | |
| CN105022957B (en) | Method for detecting malicious program on demand and electronic device thereof | |
| CN109302410A (en) | A kind of internal user anomaly detection method, system and computer storage medium | |
| CN106716382A (en) | Methods and systems for aggregated multi-application behavioral analysis of mobile device behaviors | |
| CN106529283B (en) | A kind of software-oriented defines network-based control device safety quantitative analysis method | |
| CN110048997A (en) | The security system and method for handling failure injection attacks | |
| CN109308411B (en) | Method and system for hierarchically detecting software behavior defects based on artificial intelligence decision tree | |
| CN112749389B (en) | Detection method and device for detecting vulnerability of intelligent contract damage sensitive data | |
| CN110414222A (en) | A kind of application privacy leakage failure detecting method and device based on component liaison | |
| CN105138903A (en) | ROP attack detection method based on RET instructions and JMP instructions | |
| CN109543408A (en) | A kind of Malware recognition methods and system | |
| US11720462B2 (en) | Physical execution monitor | |
| CN106650438A (en) | Method and device for detecting baleful programs | |
| CN110222243A (en) | Determine the method, apparatus and storage medium of abnormal behaviour | |
| CN109842858A (en) | A kind of service exception order detection method and device | |
| US7827534B2 (en) | Method for determining operational characteristics of a program | |
| Nabi et al. | A process of security assurance properties unification for application logic | |
| CN103678841A (en) | Monitoring alarm method and device for game | |
| CN104486353B (en) | A kind of security incident detection method and device based on flow | |
| CN102681936B (en) | Verification method and device for test result of financial system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |