The software security means of defence of mobile terminal
Technical field
The present invention relates to technical field of software security more particularly to a kind of software security means of defences of mobile terminal.
Background technology
Mobile terminal due to easy to carry and easily stolen, easily by other people usurped by critical software thereon.At present, it is mobile
The software security means of defence of terminal leads to generally by by the MAC Address binding of software and mobile terminal or in runs software
Mobile phone short message verification is crossed, when mobile terminal is stolen, the mode of the MAC Address binding of software and mobile terminal can not protect software
Safety, and since there are the duplication of SIM card and personation technologies, the safety of mobile phone short message verification method is also weaker.
China Patent Publication No. CN103167491, publication date on June 19th, 2013, invention it is entitled a kind of based on soft
The mobile terminal uniqueness certification of part digital certificate, this application discloses a kind of mobile terminal based on software digital certificate only
One property certification, it includes mobile terminal registration part and mobile terminal authentication part, and the mobile terminal registration includes following step
Suddenly:Public and private key pair is generated in the terminal, and using mobile terminal device information as claims, Generate Certificate request, so
Certificate request is sent to application server afterwards to register, application server receives certificate request and verified, is verified
Afterwards, mobile terminal software digital certificate is signed and issued using the private key of application server, and is sent to mobile terminal, mobile terminal receives
Software digital certificate will preserve after software digital certification authentication, complete the registration of mobile terminal device;The mobile terminal
Certification includes the following steps:Running of mobile terminal after being verified to environment, sends connection request, using clothes to application service
Device be engaged in mobile terminal transmission random information, mobile terminal signs, and be sent to application server to random information using private key,
Application server verifies signing messages and certificate information, and mobile terminal device information is obtained after being verified.Its shortcoming is,
This method can only be by software and mobile terminal binding, when mobile terminal is stolen, it is impossible to protect software on mobile terminal not by
Other people use.
Invention content
It the technical issues of critical software during the purpose of the present invention is overcoming mobile terminal stolen thereon easily stolen use, carries
A kind of software security means of defence of mobile terminal has been supplied, can be ensured that the critical software on mobile terminal can only be made by user
With preventing software from being usurped by other people, improve the safety of software.
To solve the above-mentioned problems, the present invention is achieved by the following scheme:
The software security means of defence of the mobile terminal of the present invention, includes the following steps:
S1:The certificate of authority, the software of software on the MAC Address of mobile terminal, the mobile terminal are allowed into the geography used
Position range and subscriber phone number storage on the server, and are bound;
S2:User opens software client, software client pop-up safety code input pair after mobile terminal is connected network
Frame is talked about, the MAC Address of itself and soft ware authorization certificate are sent to server by mobile terminal by network, and server is to MAC
Location and soft ware authorization certificate verified, server sends safety code to user mobile phone if being proved to be successful, otherwise server
Do not allow the software client Connection Service device end on the mobile terminal, prevent running software;
S3:When user mobile phone receives the safety code of server transmission, the safety code that mobile phone receives is input to shifting by user
The safety code is sent to server, server pair by the safety code input dialogue frame of software client, mobile terminal in dynamic terminal
The safety code received is verified that server sends geographical location verification instruction to mobile terminal and use if being proved to be successful
Family mobile phone, otherwise server do not allow the software client Connection Service device end on the mobile terminal;
S4:After mobile terminal receives geographical location verification instruction, mobile terminal is obtained by the GPS module of itself works as
Preceding geographical location information, and the geographical location information is sent to server, refer to when user mobile phone receives geographical location verification
After order, user mobile phone obtains current geographic position information by the GPS module of itself, and the geographical location information is sent to clothes
Business device, server calculate mobile terminal and user according to mobile terminal geographic position information and user mobile phone geographical location information
Whether the distance between mobile phone, the mobile terminal geographic position information that server judgement receives are located at preset geographical position
In the range of putting and whether the distance between mobile terminal and user mobile phone are less than setting value, and if it is server allows the shifting
The software client Connection Service device end normal operation in terminal is moved, otherwise server does not allow the software visitor on the mobile terminal
Family end Connection Service device end.
In the technical program, mobile terminal is tablet computer or laptop, and GPS module is carried on mobile terminal,
Software client on mobile terminal is installed, corresponding software server end is installed on server, server can be with movement
Terminal and user mobile phone wirelessly communicate, and GPS module is carried on user mobile phone.
When user starts the software client on mobile terminal, mobile terminal and server communication, server will verify shifting
Whether the MAC Address of dynamic terminal and the certificate of authority of software are correct.Each mobile terminal has unique MAC Address, mobile
When terminal installs software client, the MAC Address of itself is sent to server by mobile terminal, server by the MAC Address with
The soft ware authorization certificate binding of the software client of mobile terminal installation.The MAC Address and soft ware authorization certificate of mobile terminal are tested
Safety code verification is carried out after demonstrate,proving successfully again, further protects software security.
After safety code is proved to be successful, server communicates respectively with mobile terminal and user mobile phone carries out geographical location verification.
User can set on the server between the geographical position range that mobile terminal uses and mobile terminal and user mobile phone away from
From threshold value, if distance of the mobile terminal not in the geographical position range of setting or between mobile terminal and user mobile phone exceeds
Distance threshold, then the software client on mobile terminal cannot connect operation with the software server end on server, so as to have
Effect prevents software from being usurped by other people, it is ensured that the critical software on mobile terminal can only be used by user, improve the safety of software
Property.
Preferably, the server is sent to the safety code of user mobile phone by AES encryption algorithm for encryption, the user
The key of the AES encryption algorithm is stored on mobile phone, the safety code ciphertext received is decrypted into safety code in plain text by user mobile phone
It shows, safety code is input to the safety code input dialogue frame on mobile terminal software by user in plain text.It prevents because of user hand
The SIM card of machine is replicated or palms off and reveal safety code.
Preferably, the AES encryption algorithm uses 256bits keys.
Preferably, the software security means of defence of the mobile terminal, further includes step S5:After running software, every
A period of time T1 server carries out a geographical location verification with mobile terminal and communicates, and server sends geographical location verification instruction
To mobile terminal, mobile terminal is obtained after receiving the geographical location verification instruction of server transmission by the GPS module of itself
Current geographic position information, and the geographical location information is sent to server, server is with judging the mobile terminal received
Manage whether location information is located in preset geographical position range, if it is server allows soft on the mobile terminal
Part client continues the operation of Connection Service device end, and otherwise server does not allow the software client Connection Service on the mobile terminal
Device end, software are out of service.Verify that a geographical location information can real-time guard software security at regular intervals.
The software security means of defence of the mobile terminal, further includes step S5:After running software, T1 at regular intervals
Server carries out a geographical location verification with mobile terminal and user mobile phone and communicates respectively, and server sends geographical location simultaneously
To mobile terminal and user mobile phone, mobile terminal passes through after receiving the geographical location verification instruction of server transmission for verification instruction
The GPS module of itself obtains current geographic position information, and the geographical location information is sent to server, and user mobile phone receives
Current geographic position information is obtained, and should by the GPS module of itself after the geographical location verification instruction sent to server
Geographical location information is sent to server, and whether the mobile terminal geographic position information that server judgement receives is located at sets in advance
In fixed geographical position range and whether the distance between mobile terminal and user mobile phone are less than setting value, if it is service
Device allows the software client on the mobile terminal to continue the operation of Connection Service device end, and otherwise server does not allow the mobile terminal
On software client Connection Service device end, software is out of service.
Preferably, the mobile terminal passes through VPDN network connections with server.VPDN networks are Virtual Private Network, are protected
Demonstrate,prove the safety of mobile terminal and server communication.
The present invention substantial effect be:It can be ensured that the critical software on mobile terminal can only be used by user, prevent
Software is usurped by other people, improves the safety of software.
Description of the drawings
Fig. 1 is a kind of flow chart of the present invention.
Specific embodiment
Below with reference to the embodiments and with reference to the accompanying drawing the technical solutions of the present invention will be further described.
Embodiment 1:The software security means of defence of the mobile terminal of the present embodiment, as shown in Figure 1, including the following steps:
S1:The certificate of authority, the software of software on the MAC Address of mobile terminal, the mobile terminal are allowed into the geography used
Position range and subscriber phone number storage on the server, and are bound;
S2:User opens software client, software client pop-up safety code input pair after mobile terminal is connected network
Frame is talked about, the MAC Address of itself and soft ware authorization certificate are sent to server by mobile terminal by network, and server is to MAC
Location and soft ware authorization certificate are verified that server sends out the safety code Jing Guo AES encryption algorithm for encryption if being proved to be successful
User mobile phone is sent to, otherwise server does not allow the software client Connection Service device end on the mobile terminal, and software is prevented to transport
Row;
S3:When user mobile phone receives the safety code of server transmission, safety code ciphertext solution that user mobile phone will receive
Close to be shown in plain text into safety code, safety code is input to the safety code input dialogue on mobile terminal software by user in plain text
The safety code is sent to server by frame, mobile terminal, and server verifies the safety code received, if be proved to be successful
Then the verification instruction of server transmission geographical location does not allow to mobile terminal and user mobile phone, otherwise server on the mobile terminal
Software client Connection Service device end;
S4:After mobile terminal receives geographical location verification instruction, mobile terminal is obtained by the GPS module of itself works as
Preceding geographical location information, and the geographical location information is sent to server, refer to when user mobile phone receives geographical location verification
After order, user mobile phone obtains current geographic position information by the GPS module of itself, and the geographical location information is sent to clothes
Business device, server calculate mobile terminal and user according to mobile terminal geographic position information and user mobile phone geographical location information
Whether the distance between mobile phone, the mobile terminal geographic position information that server judgement receives are located at preset geographical position
In the range of putting and whether the distance between mobile terminal and user mobile phone are less than setting value, and if it is server allows the shifting
The software client Connection Service device end normal operation in terminal is moved, otherwise server does not allow the software visitor on the mobile terminal
Family end Connection Service device end;
S5:After running software, geographical location verification of T1 servers and mobile terminal progress at regular intervals communicates,
Server sends geographical location verification instruction to mobile terminal, and the geographical location verification that mobile terminal receives server transmission refers to
Current geographic position information is obtained by the GPS module of itself after order, and the geographical location information is sent to server, is serviced
Whether the mobile terminal geographic position information that device judgement receives is located in preset geographical position range, if it is takes
Business device allows the software client on the mobile terminal to continue the operation of Connection Service device end, and otherwise server does not allow the movement whole
Software client Connection Service device end on end, software are out of service.
The AES encryption algorithm of server for encrypting safety code uses 256bits keys, and safe code encryption can be prevented because of user
The SIM card of mobile phone is replicated or palms off and reveal safety code.Mobile terminal passes through VPDN network connections, VPDN nets with server
Network is Virtual Private Network, ensures the safety of mobile terminal and server communication.Mobile terminal is tablet computer, band on mobile terminal
There is GPS module, software client is installed on mobile terminal, corresponding software server end, server are installed on server
It can be wirelessly communicated with mobile terminal and user mobile phone, GPS module is carried on user mobile phone.
When user starts the software client on mobile terminal, mobile terminal and server communication, server will verify shifting
Whether the MAC Address of dynamic terminal and the certificate of authority of software are correct.Each mobile terminal has unique MAC Address, mobile
When terminal installs software client, the MAC Address of itself is sent to server by mobile terminal, server by the MAC Address with
The soft ware authorization certificate binding of the software client of mobile terminal installation.The MAC Address and soft ware authorization certificate of mobile terminal are tested
Safety code verification is carried out after demonstrate,proving successfully again, further protects software security.
After safety code is proved to be successful, server communicates respectively with mobile terminal and user mobile phone carries out geographical location verification.
User can set on the server between the geographical position range that mobile terminal uses and mobile terminal and user mobile phone away from
From threshold value, if distance of the mobile terminal not in the geographical position range of setting or between mobile terminal and user mobile phone exceeds
Distance threshold, then the software client on mobile terminal cannot connect operation with the software server end on server.Software is transported
After row, verify at regular intervals a mobile terminal geographical location information can real-time guard software security, so as to effectively anti-
Only software is usurped by other people, it is ensured that the critical software on mobile terminal can only be used by user, improve the safety of software.
Embodiment 2:The software security means of defence of the mobile terminal of the present embodiment, includes the following steps:
S1:The certificate of authority, the software of software on the MAC Address of mobile terminal, the mobile terminal are allowed into the geography used
Position range and subscriber phone number storage on the server, and are bound;
S2:User opens software client, software client pop-up safety code input pair after mobile terminal is connected network
Frame is talked about, the MAC Address of itself and soft ware authorization certificate are sent to server by mobile terminal by network, and server is to MAC
Location and soft ware authorization certificate are verified that server sends out the safety code Jing Guo AES encryption algorithm for encryption if being proved to be successful
User mobile phone is sent to, otherwise server does not allow the software client Connection Service device end on the mobile terminal, and software is prevented to transport
Row;
S3:When user mobile phone receives the safety code of server transmission, safety code ciphertext solution that user mobile phone will receive
Close to be shown in plain text into safety code, safety code is input to the safety code input dialogue on mobile terminal software by user in plain text
The safety code is sent to server by frame, mobile terminal, and server verifies the safety code received, if be proved to be successful
Then the verification instruction of server transmission geographical location does not allow to mobile terminal and user mobile phone, otherwise server on the mobile terminal
Software client Connection Service device end;
S4:After mobile terminal receives geographical location verification instruction, mobile terminal is obtained by the GPS module of itself works as
Preceding geographical location information, and the geographical location information is sent to server, refer to when user mobile phone receives geographical location verification
After order, user mobile phone obtains current geographic position information by the GPS module of itself, and the geographical location information is sent to clothes
Business device, server calculate mobile terminal and user according to mobile terminal geographic position information and user mobile phone geographical location information
Whether the distance between mobile phone, the mobile terminal geographic position information that server judgement receives are located at preset geographical position
In the range of putting and whether the distance between mobile terminal and user mobile phone are less than setting value, and if it is server allows the shifting
The software client Connection Service device end normal operation in terminal is moved, otherwise server does not allow the software visitor on the mobile terminal
Family end Connection Service device end;
S5:After running software, T1 servers carry out once respectively with mobile terminal and user mobile phone at regular intervals
Location verification communication is managed, server sends geographical location verification instruction to mobile terminal and user mobile phone simultaneously, and mobile terminal connects
It receives and current geographic position information is obtained, and will by the GPS module of itself after the geographical location verification that server is sent instructs
The geographical location information is sent to server, and user mobile phone is received after the geographical location verification that server is sent instructs by certainly
The GPS module of body obtains current geographic position information, and the geographical location information is sent to server, and server judges to receive
Whether the mobile terminal geographic position information arrived is located at interior preset geographical position range and mobile terminal and user hand
Whether the distance between machine is less than setting value, and if it is server allows the software client on the mobile terminal to continue to connect
Server end is run, and otherwise server does not allow the software client Connection Service device end on the mobile terminal, and software stops fortune
Row.
T1 servers communicate respectively with the geographical location verification of mobile terminal and user mobile phone progress at regular intervals,
Verify mobile terminal present position whether in the geographical position range of setting and user mobile phone whether to be located at mobile terminal attached
Closely, it can only be that user uses to further ensure that the software on mobile terminal, so as to which software be effectively prevent to be usurped by other people, further
Improve the safety of software.