CN118051891B

CN118051891B - A computer software encryption protection method

Info

Publication number: CN118051891B
Application number: CN202410239780.9A
Authority: CN
Inventors: 郭�东; 黄远花; 戴翠霞
Original assignee: Chongqing Yecao Technology Development Co ltd
Current assignee: Chongqing Yuyuntang Supply Chain Co.,Ltd.
Priority date: 2024-03-04
Filing date: 2024-03-04
Publication date: 2024-11-26
Anticipated expiration: 2044-03-04
Also published as: CN118051891A

Abstract

The application discloses a computer software encryption protection method, which relates to the technical field of software security and comprises the following steps: encrypting an account password input by a user by using an identity key of the CPU to generate a digital signature A ₁; signing the obtained user identity information by using a public key corresponding to the identity key of the CPU to generate a digital signature A ₂; matching the digital signature A ₁ with the digital signature A ₂, and if the digital signature A ₁ is consistent with the digital signature A ₂, performing preliminary verification on the identity of the user; receiving a one-time password TOTP ₁ input by a user; generating a current time one-time password TOTP ₂ through a TOTP algorithm, matching the generated one-time password TOTP ₂ with a received one-time password TOTP ₁, and if the generated one-time password TOTP ₂ is consistent with the received one-time password TOTP ₁, passing the second verification; acquiring behavior data of user access encryption software, and establishing a behavior baseline model; detecting a behavior baseline model of a user by adopting a machine learning model, and refusing access when abnormality is detected; aiming at the problem of low security of the encryption software in the prior art, the application improves the security of the encryption software.

Description

Computer software encryption protection method

Technical Field

The application relates to the technical field of software security, in particular to a computer software encryption protection method.

Background

With the widespread use of computer software in everyday life and business fields, there is an increasing demand for data security and user privacy protection. However, the conventional user identity authentication method has the problem of insufficient security, and is easy to attack by password cracking, identity impersonation and the like. At the same time, monitoring and analysis of user behavior has also become critical to address evolving network threats and internal security risks. Therefore, a comprehensive computer software encryption protection method is sought, which can effectively perform identity verification and monitor user behaviors, and is a problem which needs to be solved currently.

Traditional user authentication methods often rely on simple user name and password combinations and are vulnerable to password guessing and dictionary attacks. In addition, a single authentication method cannot provide enough security guarantee and is easy to bypass or imitate. Meanwhile, the traditional behavior monitoring method generally lacks deep analysis on user behaviors, and is difficult to accurately identify abnormal behaviors, so that security holes exist. Therefore, there is a need for an integrated solution that combines cryptography and machine learning methods to improve the security and accuracy of user authentication and behavior monitoring.

In the related art, a software protection method, a device, a system, a CPU chip and an electronic device are provided in chinese patent document CN113780817A1, where the software protection method is applied to an operation core in the CPU chip of the user device, and the method includes: after detecting the triggering operation of the user on the software, the security processor SP is instructed to identify the user equipment, wherein the identifying includes: verifying the user certificate by using the public key in the signature certificate, and verifying the public key in the user certificate by using the private key derived from the CPU chip identity key; if the SP successfully identifies the user device identity, the user is allowed to use the software. However, in this scheme, the certificate is not prevented from being tampered or forged by only checking and signing by means of the public key for signing the certificate.

Disclosure of Invention

1. Technical problem to be solved

Aiming at the problem of low security of the encryption software in the prior art, the application provides a computer software encryption protection method, which improves the security of the encryption software by performing double identity verification and the like through a CPU identity key and an ECDSA algorithm.

2. Technical proposal

The aim of the application is achieved by the following technical scheme.

The embodiment of the specification provides a computer software encryption protection method, which comprises the following steps: encrypting an account password input by a user by using an identity key of the CPU to generate a digital signature A ₁; acquiring stored user identity information, and signing the acquired user identity information by utilizing a public key corresponding to the identity key of the CPU to generate a digital signature A ₂; matching the digital signature A ₁ with the digital signature A ₂, and if the digital signature A ₁ is consistent with the digital signature A ₂, performing preliminary verification on the identity of the user; after the primary verification is passed, receiving a one-time password TOTP ₁ input by a user; generating a current one-time password TOTP ₂ by using a time seed synchronized with a user through a TOTP algorithm, matching the generated one-time password TOTP ₂ with a received one-time password TOTP ₁, and if the generated one-time password TOTP ₂ is consistent with the received one-time password TOTP ₁, passing the second verification; when the second verification is passed, the access restriction on the encrypted software is released, and the user is allowed to access the encrypted software; acquiring behavior data comprising login time, login location and access operation of a user accessing the encrypted software, and establishing a behavior baseline model according to the behavior data; detecting a behavior baseline model of a user by adopting a machine learning model, and locking a user account and refusing access when abnormality is detected; the time seed is generated by the system clock of the CPU and the random number.

The identity key of the CPU refers to a secure and trusted encryption key solidified (hard coded) inside the CPU chip, and the encryption key is used for proving the identity identification of the CPU. In the application, an account password input by a user is encrypted and signed to generate a digital signature A1. The CPU identity key is used as a private key of the ECDSA algorithm, and the signature is signed based on the private key, so that the signature can be proved to originate from a trusted CPU. The public key corresponding thereto is used to verify the validity of the signature A1. The public identity key of the CPU corresponds to the private key and is used for verifying the validity of the signature by the receiver. Since the identity key exists inside the CPU hardware and cannot be read or tampered, signature authentication based on the key is reliable and trustworthy. The signature generated by the hardware key has higher security and is difficult to imitate or forge.

Among these, the TOTP algorithm is a time-based one-time-based cryptographic algorithm. It is known as Time-based One-Time Password algorithm. In the application, the TOTP algorithm generates a dynamic one-time password by using a time seed and a hash algorithm. The time seed is synchronized in advance by the server and the client. After the preliminary verification is passed, the server generates a one-time password TOTP ₂ at the current time. The password is calculated and generated through a TOTP algorithm based on a time seed synchronized with a user by a server side. The client also independently calculates the current one-time password TOTP ₁ based on the same time seed and submits the current one-time password TOTP ₁ to the server. After receiving the TOTP ₁ sent by the client, the server matches the TOTP ₁ with the generated TOTP ₂. If so, passing the second layer verification. This mechanism may prevent the password from being used multiple times after it is captured. Each verification needs a new one-time password, so that the security is high. Replay attacks can also be prevented by updating the password with a time seed.

Specifically, the account password input by the user is securely encrypted to generate a digital signature a ₁ for subsequent verification of the user identity. The user enters an account password. And the CPU identity key is used for carrying out the encryption operation of the password, so that the safety and reliability of the encryption process are ensured. And executing a digital signature algorithm by using the generated encrypted password and the CPU private key to generate a digital signature A ₁. And acquiring the stored user identity information, signing the user identity information by utilizing a public key corresponding to the CPU identity key, and generating a digital signature A ₂ for verifying the integrity of the user identity. The identity information of the user, such as the user name, the authority, etc., is obtained from the secure storage. And executing a digital signature algorithm on the user identity information by using a public key corresponding to the CPU identity key to generate a digital signature A ₂. By matching the digital signatures a ₁ and a ₂, a preliminary verification of the user identity is performed. The digital signature a ₁ entered by the user and the stored digital signature a ₂ are obtained. Digital signature verification is performed using the public key of the CPU, ensuring that a ₁ and a ₂ are generated from the same private key. If A ₁ and A ₂ match, then the user identity is initially verified as passing, allowing the user to continue to access the system.

Specifically, after the primary verification is passed, the one-time password TOTP ₁ provided by the user is received as input for the second verification. After the user passes the preliminary authentication, the system prompts the user to input the one-time password TOTP ₁. Through the secure channel, the system receives and records the TOTP ₁ entered by the user. The time seed synchronized with the user is utilized to generate a one-time password TOTP ₂ at the current time through a TOTP algorithm. The system uses a time seed (clock-based seed) that is synchronized with the user. And generating a one-time password TOTP ₂ at the current moment by utilizing a TOTP algorithm and combining the time seed and the current moment. And matching the generated one-time password TOTP ₂ with the one-time password TOTP ₁ input by the user to finish the second verification. The system obtains the TOTP ₁ entered by the user and the generated TOTP ₂. Matching operations of the TOTP ₁ and the TOTP ₂ are performed. If the matching is successful, the second verification passes, and the system confirms that the user identity is valid. By means of the synchronization of the TOTP algorithm and the time seeds, different one-time passwords are generated at each moment. Through the matching of TOTP ₁ input by the user and TOTP ₂ generated by the system, the verification of the user identity is further enhanced, and the security of the system is improved. The method has higher effect in preventing security threats such as replay attack, eavesdropping and the like.

Specifically, after passing the second authentication, the user is allowed to access the encryption software. After the second verification is passed, the system releases the access restriction to the encryption software. The user can normally access the encryption software to execute the corresponding operation. And collecting behavior data of the user in the encryption software, wherein the behavior data comprise login time, login location, access operation and other information. The system records behavior data such as login time, login place and access operation of a user in the encryption software. The data may include user's oplogs, system logs, and the like. And establishing a behavior baseline model according to the normal behavior data of the user so as to facilitate subsequent abnormality detection. And analyzing and modeling the normal behavior data of the user by using a machine learning algorithm. A behavioral baseline is established including typical login times, common locations, normal access operations, etc. of the user. The actual behavior of the user is compared with the behavior baseline by using a machine learning model to detect abnormal behavior. And comparing the actual behavior of the user with the established behavior base line by adopting machine learning methods such as supervised learning or unsupervised learning. When the model detects abnormal behavior, a security alarm is triggered or corresponding security measures are taken. When abnormal user behavior is detected, corresponding safety measures are adopted, such as locking a user account, refusing access and the like. When the machine learning model detects abnormal behavior, the system may proactively take security measures, such as locking the user account, sending a security notification, etc. The time seed is used for generating a one-time password synchronous with the user and is generated by a system clock and a random number of the CPU. The system clock of the CPU is used as a part of the time seed to ensure the time synchronism. Random numbers are introduced to increase the complexity of seeds and improve the security. The steps of access restriction removal, user behavior data acquisition, machine learning model detection, exception handling, time seed generation and the like are comprehensively utilized, so that safe access and accurate monitoring of users in encrypted software are realized. By establishing a behavior baseline model and introducing machine learning, the system can be more flexibly adapted to the normal behavior change of the user and timely respond to abnormal behaviors, so that the overall safety of the system is improved.

Further, generating the digital signature a ₁ includes: acquiring an account number and a password input by a user; the digital signature A1 is generated using an elliptic curve digital signature algorithm ECDSA encryption engine in the CPU that stores TWISTED EDWARDS curve parameters. Wherein TWISTED EDWARDS is an elliptic curve, which is a variant constructed on the basis of the Edwards curve. The general equation form of TWISTED EDWARDS curve is ax ²+by²＝1+dx²y², where a, b, d are parameters of the curve and x, y are coordinates of points on the curve. In the application, in the process of generating the digital signature, the account password of the user is mapped to a point on a curve to be used as the input of ECDSA, and then an ECDSA algorithm is operated based on a TWISTED EDWARDS curve constructed to generate the signature.

Further, generating the digital signature a ₁ using an elliptic curve digital signature algorithm ECDSA encryption engine in the CPU storing TWISTED EDWARDS curve parameters includes: construction of a modified TWISTED EDWARDS curve equation: ax ²+by²+cz²＝1+dx²y², wherein a, b and d are curve parameters, and x and y are point coordinates; z is the third variable introduced, c is the coefficient of variable z; acquiring an account number and a password input by a user; through a hash mapping algorithm, the account number password is hashed and mapped to a point on the TWISTED EDWARDS constructed curve, and the point is used as an input point of an ECDSA encryption algorithm; generating a key pair by using an ECDSA encryption algorithm according to the built TWISTED EDWARDS curve; and performing ECDSA encryption operation according to the TWISTED EDWARDS curve, the input point and the key pair as input parameters to obtain a digital signature A ₁.

Specifically, the third variable z is introduced, so that the number of variables of the curve equation is increased, the curve equation is more complex, the shape of the curve is more various, and the safety intensity is improved. The attacker needs to crack more complex curve equations, and the cracking difficulty is increased. The influence degree of z on the curve equation can be controlled by modulating z through the coefficient c of the variable z, so that the curve equation with various different forms is formed, and the safety is further enhanced. The three-variable curve equation can define an elliptic curve in a three-dimensional space, while the original two-variable curve equation can only define a curve on a two-dimensional plane, thereby increasing the complexity of one dimension. In elliptic curve encryption, the variable z can be used for defining a third coordinate of an elliptic curve point, so that the complexity of representing the point on the curve is increased, and the safety intensity is improved. Compared with a fixed curve equation, the improved variable in the equation provides the capability of generating different curves, so that curve equation parameters can be customized for different users, and the encryption flexibility is improved.

Wherein the hash mapping algorithm is an algorithm that maps data to a point on an elliptic curve. In the present application, the user account password is obtained and a hash algorithm (e.g., SHA 256) is utilized to generate the hash value. And taking the generated hash value as an abscissa x, and obtaining an ordinate y corresponding to x through calculation and solving according to a modified TWISTED EDWARDS curve equation ax ²+by²+cz²＝1+dx²y². The corresponding point on the curve is determined using the coordinate pair (x, y) as the input point for the ECDSA algorithm. In the ECDSA signing process, the point and the private key are used for signature operation, and a signature is output. By means of hash mapping, data with any length can be mapped to elliptic curve points in a fixed domain range, and input is provided for an elliptic curve encryption algorithm. Specifically, the following hash mapping algorithms may be used to map the account password to a point on the TWISTED EDWARDS curves: SHA-256 hash map, SHA-3 hash map, bloom filter map, or dynamic kx map.

More specifically, a SHA3-512 hash algorithm is selected, an expanded account password is input, and a hash value hash with a length of 512 bits is calculated. The upper 256 bits of the hash value hash are taken as the abscissa x and the lower 256 bits are taken as the ordinate y. Substituting x, y into TWISTED EDWARDS's curve equation: ax ²+by²+cz²＝1+dx²y², the value of z is determined by solving calculations. The three-dimensional coordinates of the input point are the solved (x, y, z), and a point P on the curve is represented. The three-dimensional coordinate form of the point P is converted into a sequential string format as input to the ECDSA algorithm.

Specifically, a user account password is obtained, and a point P on a TWISTED EDWARDS curve is obtained through hash mapping calculation to be used as an input point. Selecting a random integer k, calculating r= pubkey ×k to obtain the coordinates of a point r, hashing an account password to calculate a hash value h, and calculatingThe signature (r, s) is output as the digital signature A1.

Further, generating a key pair using an ECDSA encryption algorithm includes: selecting a random number seed S with m-bit length; performing hash calculation by using an SHA-256 algorithm to obtain a hash (S); dividing the hash (S) into a first part and a second part in a cutting mode, wherein the first part is used as a random number sequence; the second part is exclusive-ored with the random number seed S as a random number seed S'; repeating the hash calculation, updating the random number seed S', and outputting a first part as a random number sequence until the random number sequence is larger than a preset length; acquiring a random number with an ordinal number Q in a random number sequence as a private key privkey; acquiring a point with the largest order in a TWISTED EDWARDS curve as a generator P; public key pubkey = privkey ×p is calculated.

Specifically, a random binary sequence with a length of m bits is selected as the random number seed S. Where the value of m needs to be determined according to the security strength requirements, typically 256 bits or more are taken. The random number seed S is padded to meet the input length requirement of the SHA-256 algorithm. And taking the filled seeds as input, and running the compression function and iterative operation of the SHA-256 algorithm. A 256-bit hash value output, i.e., hash (S), is obtained. Through the hash operation of SHA-256, the statistical correlation existing in the random number seed can be eliminated, and the unpredictability of the random number is enhanced. Based on the output hash (S) as a new seed, the SHA-256 operation can be repeatedly executed for iterative reinforcement, and stronger random numbers are output.

Specifically, the 256-bit hash value hash (S) generated in the previous step is equally divided into two parts, each part having a length of 128 bits: the first part is the upper 128 bits of the hash (S) and is used as a random number sequence, and the second part is the lower 128 bits of the hash (S). Performing bit level exclusive OR operation on the second part and the initial seed S to obtain a 128-bit new seed S': By intercepting the exclusive-or process, the new seed S' will achieve a lower correlation than the original seed S, improving unpredictability. The enhancement of randomness can be performed iteratively by repeatedly performing SHA-256 to generate a hash (S ') based on S', and truncating, xoring, and generating new seeds. The repeated iterations generate a random bit sequence of sufficient length as the random number input for the key generation.

Specifically, the hash operation is repeated to update the seeds, the SHA-256 operation is performed on the seeds S to generate a hash (S), the hash (S) is divided into two parts, the first part is used as a random number sequence, and the second part is exclusive-ored with the S to obtain new seeds S'. Replacing S, taking S' as a new seed, and returning. Repeating until the accumulated random number sequence is greater than the preset private key length n. From the generated random number sequence, a random number r with an ordinal number Q is selected as the private key privkey. Wherein Q can be a predetermined ordinal number selected in advance, or can be a random number meeting requirements. The intermediate result generated is deleted, and only the final private key is retained.

The order of the points on the elliptic curve refers to the minimum number of times that the continuous point addition operation can return to the original point O. The maximum order means that the order of the point reaches the maximum n on the curve. The generator refers to a group element with a group order n. For elliptic curve groups, the generator P refers to a curve point with a curve order n. In the application, the generation element point P with the largest order number on TWISTED EDWARDS curves, namely the order number n of the curves, is selected. Such a point P can return to the infinity point O by n consecutive point additions, where n is the minimum positive integer multiple thereof. The generation element points with the largest orders are used, so that the point multiplication operation result can be uniformly distributed on the whole elliptic curve group, and the encryption strength is improved.

Specifically, the maximum point of the order on the TWISTED EDWARDS curve is obtained, namely a generating element point P, a TWISTED EDWARDS curve equation is constructed, and curve parameters a, b and d are determined. The order n of the curve is obtained by mathematical calculation, derivation and solution. And traversing all points on the curve as candidate generation element points. Performing order calculation on each candidate point P: initializing a counter i=1. The point addition operation P + P is repeated, once again, until point O is reached. The minimum number i of times of reaching O is recorded, namely the order r of the point P. The count number r of all candidate points is compared. A point where r is equal to n is selected as the generation meta-point P. The generation metapoint P is stored for use in key generation and cryptographic operations. By traversing the points of the search order equal to the curve order n, the generator of TWISTED EDWARDS curve can be obtained and then applied to the subsequent elliptic curve cryptography operation.

Further, the digital signature A1 includes an ordered pair (r, s) of a coordinate point r and an integer U; coordinate point r: r= pubkey ×k, k represents a random integer; integer U: And rounding; h represents a hash value obtained by carrying out hash operation on account password data input by a user through a hash algorithm.

Further, calculating the hash value h includes: initializing 8 32-bit constant values; acquiring an account password input by a user, and dividing the account password into data blocks according to 512 bits; the following operations are performed on each data block: performing Boolean logic operation and modulo 32 addition to calculate a compression function value; randomly replacing and sequencing the compression function values obtained by calculation; performing modulo-32 addition on the replacement ordering result and the current hash value to update the hash value; iterative computation is carried out until the processing of all the data blocks is completed; the calculated hash values are combined and a 256-bit value is output as the final hash value h.

Specifically, 8 32-bit unsigned integer constant values IV1, IV2 are initialized, IV8 being the initial vector. And acquiring an account password input by a user, and dividing the account password into data blocks M1 and M2 according to 512 bits. For each data block Mi: and (3) carrying out Boolean logic operation (AND, OR, XOR and the like) with a constant IV to obtain 8 32-bit intermediate values, carrying out modulo 32 addition operation on the 8 intermediate values, calculating a modulo 32 addition result as a compression function output of the block, carrying out random permutation and sequencing on the compression function output, carrying out modulo 32 addition on the permutation result and a current accumulated hash value H, updating the hash value H, and repeating the step (3) to process all data blocks. The final hash value H is used as a hash result of the account password. The hash algorithm is realized through Boolean operation, modulo addition operation, replacement and other operations, so that the hash strength can be improved, and collision-free consistent mapping can be carried out on application data.

The boolean logic operation refers to a logic operation performed on a boolean type value (0 or 1), and commonly includes and (&), or (|), exclusive or (), and not (-), etc. In the present application, a bit-level logic operation is performed on a 32-bit unsigned integer. For example, the two 32-bit values are exclusive-ored, and the corresponding bits are exclusive-ored. The modulo-32 addition is an operation of adding two 32-bit unsigned integers and then taking the remainder of 232. Corresponding to the lower 32 bits of the addition result being retained only. The compression function is a function that compressively maps a variable length input to a fixed length output. In the present application, a plurality of 32-bit intermediate values of the compression function are modulo-32 added. Here, the 32-bit integer value calculated by boolean operation and modulo addition is output as a compression function of the input block.

Specifically, the user account password is blocked according to 512 bits, and the data block sequences M1, M2 are obtained. And sequentially taking each data block Mi, and carrying out operations such as Boolean logic operation, modular addition, replacement and the like to update the hash value H. The process is repeated until all the data blocks have been traversed. The account password is divided into m 512-bit blocks, and then m 32-bit intermediate hash values H1, H2 are obtained through iterative calculation. The m 32-bit hash values are sequentially concatenated to generate a 32 x m-bit combined value. The combined value is padded, expanded to 256 bits, and then truncated to the lower 256 bits as the final hash output h. Through iterative calculation and combination of hashes, account passwords with any length can be hashed, and a fixed-length hash value is output and used as input of subsequent operation.

Further, matching digital signature a ₁ and digital signature a ₂, comprising: acquiring a digital signature A ₁, wherein the digital signature A1 comprises ordered pairs (r, s) of coordinate points r and integers U; acquiring a digital signature A ₂ generated according to user identity information and based on an LWE algorithm; using a locally stored LWE algorithm to decrypt the private key, and performing LWE decryption on the user identity information in the digital signature A ₂ to obtain a plaintext of the user identity information; carrying out SHA256 hash operation on the obtained plaintext of the user identity information to generate a hash value e; inputting a coordinate point r, an integer U, a hash value e and a public key pubkey, and verifying the validity of the digital signature A ₁ through an ECDSA algorithm; if the verification is successful, the digital signature A ₁ and the digital signature A ₂ match, and the preliminary verification passes.

Where ordered pairs refer to a collection comprising two objects, where the order of the objects is important. Written in the form of (x, y), where x is the first object and y is the second object. In the present application, digital signature A ₁ is an ordered pair (r, s). r is a coordinate point in the signature representing the first part of the signature. s is an integer representing the second part of the signature. As ordered pairs of signatures (r, s), where the order of r and s cannot be exchanged, otherwise signature verification cannot be passed. By the ordered representation, the signature can be represented as two associated but semantically distinct components, including coordinate points and integers.

The LWE algorithm is a public key encryption algorithm based on learning that has a problem of errors (LEARNING WITH Errors). It uses a random set of linear equations and error terms to generate a public-private key pair, and performs encryption and signature operations. In the application, a random linear equation set is constructed, and an LWE public-private key pair is generated. The user identity information is signed by using the private key, and a signature A ₂ is obtained through operation. The correctness of signature a ₂ can be verified using the corresponding public key. Specifically, the decryption private key of the LWE algorithm is fetched from the local secure storage. The LWE decryption operation is performed on the input digital signature a ₂ using the private key. After the decryption is successful, the plaintext of the user identity information contained in the signature can be obtained. And carrying out SHA256 hash operation on the plain identity information obtained by decryption. The plaintext information is input through the compression function and iterative operation of SHA 256. A hash value of 256 bits in length is output and denoted as e. The decrypted and retrieved value e of Ming Wen Haxi is compared with the registered identity information hash value e' in the submitted signature process. If the two are consistent, verifying that the signature A ₂ passes, and the identity of the user is legal; otherwise, the verification fails.

Specifically, the validity of the digital signature a ₁ is verified by using the ECDSA algorithm, a verification material, a coordinate point r and an integer s are input to form the digital signature a ₁, a hash value e of the user identity information, and a public key pubkey of the ECDSA algorithm. The calculations u ₁ and u ₂ are performed,Where n is the order of the curve. And calculating point multiplication, and performing point multiplication operation on the calculated points by using u ₁ and u ₂ and the public key pubkey respectively to obtain two points Pu ₁ and Pu ₂.Pu₁＝u₁×pubkey,Pu₂＝u₂ multiplied by pubkey on the curve. If Pu ₁ and Pu ₂ are equal, the verification is successful and signature A ₁ is valid. Otherwise, the verification fails and the signature is invalid. The two signatures are matched, which means that the digital signature A ₁ passes verification and is matched with the signature A ₂, and the user identity is initially verified to pass.

Further, establishing a behavior baseline model, including: acquiring behavior data comprising login time, login location and access operation; analyzing login time, acquiring time granularity information, and dividing a day into 24 hours as a characteristic of time distribution histogram statistics; analyzing login places, obtaining address information, and dividing addresses into two types of places in an office area and outside the office area as the feature of place distribution histogram statistics; analyzing access operation, dividing the operation into two types of read-write operation and setting operation as the characteristic of operation distribution histogram statistics; obtaining a feature vector of time distribution histogram statistics by adopting a one-dimensional discrete histogram statistical function; obtaining a feature vector of the site distribution histogram statistics by adopting a binary statistical function; obtaining a feature vector of operation distribution histogram statistics by adopting a binary statistical function; and splicing the feature vector of the obtained time distribution histogram statistics, the feature vector of the place distribution histogram statistics and the feature vector of the operation distribution histogram statistics to serve as statistical feature vectors of the behavior data.

Wherein the baseline model is a concept in machine learning and refers to a standard mode of normal behavior established. In the application, the normal login time, place and operation behavior data of the user on the encryption software are obtained. Based on these behavioral data, a machine learning algorithm (e.g., LSTM neural network) is employed to build a baseline model of user behavior. The model determines the characteristics of the user normal time distribution, the place distribution and the operation distribution through learning the behavior data mode. In the subsequent monitoring, the new behavior data can be compared with the normal mode generated by the baseline model to judge whether the abnormality exists. If the new data deviates from the baseline greatly, the user behavior is abnormal, and the account can be stolen or internal leakage behavior exists. By establishing a baseline model, abnormal conditions of user behaviors can be monitored in real time, and the encryption software is safely monitored. In a word, the baseline model realizes real-time monitoring and risk identification of user behaviors by modeling and describing normal behaviors.

Wherein the one-dimensional discrete histogram statistical function is a mathematical tool for counting and expressing one-dimensional discrete data distribution. The one-dimensional discrete histogram statistical function performs statistical analysis on the data of the one-dimensional discrete variables, visually represents the distribution characteristics of the data by using a histogram bar graph, and can be converted into vectors for machine learning. Such statistical analysis methods are widely used to process data of classification variables.

The binary statistical function is a function method for counting binary variables. In the present application, the variables are divided into two categories, such as locations into two categories, in-office and out-of-office. For each data sample, it is determined which class it belongs to. Counting: the number of samples belonging to class 1 is denoted as n ₁ and the number of samples belonging to class 2 is denoted as n ₂. And (n ₁,n₂) forming a binary group to represent the statistical distribution of the binary variable. And (3) performing binary statistics on the place variable to obtain login times in the office area and outside the office area, and forming a place distribution feature vector. And performing binary statistics on the operation variables to obtain the times of read-write operation and setting operation, and forming an operation distribution feature vector. The two feature vectors reflect the location and operational preferences of the user's behavior and are input into a machine learning model to establish a behavioral baseline. And during detection, comparing the difference between the place and the operation distribution of the new sample and the baseline, and judging the risk.

Specifically, the login time, login location and behavior data of access operation of the user on the encrypted software are obtained. And analyzing the login time to obtain time granularity information, wherein the time granularity information is accurate to the hour level. Dividing 24 hours a day into 24 intervals, and counting the distribution of the login times of the user to form a time distribution characteristic. Analyzing the login places, judging whether the login places are in an office area or out of the office area, and classifying the login places into two types. And counting login distribution of the user at the two places to form place distribution characteristics. Analyzing the access operation, reading and writing files and setting software parameters, and dividing the access operation into two types of operation. And counting the times of the two types of operations to form operation distribution characteristics. All three features can be represented by a 24-bin histogram, reflecting the user behavior pattern. These feature data will be input into the machine learning model, training out the user behavior baseline. And comparing the difference between the new behavior and the baseline mode during detection to realize risk identification.

Specifically, 24 hours a day are tiled into 24 bins in time order as the horizontal axis of the histogram. The count is incremented by 1 as to which interval the user login time falls. Traversing all user login time data, and counting login times in different time intervals. The login times of each time interval are used as the height of the corresponding interval histogram. A 24 column time distribution histogram is finally formed. This histogram reflects the distribution of the user's different time logging software. The 24 column heights of the histogram are formed into a 24-dimensional temporal feature vector. Each element value in the vector represents a log-in count value for that time interval. This feature vector will be input into the machine learning model, training the baseline pattern of the user's temporal distribution. During detection, the distance between the new vector and the baseline vector is calculated, and whether the time distribution is abnormal or not is determined.

Specifically, three feature vectors of time distribution, location distribution, and operation distribution have been extracted separately in the foregoing. The time distribution feature vector is 24-dimensional, and represents the registration distribution of 24 time intervals. The location distribution feature vector is 2-dimensional, and represents the login times inside and outside the office area. The operation distribution feature vector is also 2-dimensional, representing the number of read-write and set operations. To comprehensively express the user behavior characteristics, the three vectors need to be spliced together. Setting a splicing sequence, firstly splicing time distribution, then site distribution and finally operation distribution. In this order, the elements of the three vectors are concatenated together in sequence. The final behavior statistical feature vector is obtained with dimensions 24+2+2=28. This 28-dimensional vector as a whole reflects the time, place and operational preferences of the user's behavior. The feature vector will be input into a machine learning model for establishing a user behavior baseline. At risk detection, the difference of the new sample behavior vector from the baseline vector can be calculated.

Further, establishing a behavior baseline model, including: and training the LSTM neural network by using the obtained statistical feature vector to serve as a behavior baseline model. The LSTM is called as Long Short-Term Memory network, and is a special circulating neural network structure. In the application, the LSTM network is characterized by learning long-term dependency relationship of long-sequence data. The LSTM can learn the time sequence rule by inputting the statistical feature sequence of the user behavior. The LSTM model is trained using the previously extracted behavioral statistics feature vectors. The LSTM network structure comprises memory units that can memorize long-term behavior patterns. Through model training, the LSTM network can establish a behavior baseline for normal users. When a user behavior vector is newly entered, its deviation from the baseline can be calculated. If the deviation exceeds a preset threshold, the user behavior is indicated to be abnormal. And finally, modeling and risk identification of the user behavior base line based on the LSTM network are completed.

Specifically, user behavior data is obtained in the early stage, and statistical feature vectors of three aspects of time, place and operation are extracted. And constructing an LSTM network model, wherein the dimension of an input layer is the same as the feature vector. Setting the number of LSTM memory units and determining the network structure. And defining the probability of normal or abnormal network output result. A large number of normal user behavior feature vector samples are collected. The LSTM network is trained using these samples to learn behavior patterns. Network parameters are optimized by a back propagation algorithm. The training is iterated for a plurality of times, and enabling the network output result to accord with the sample label. And when the model training error is small enough, completing the network training process. The LSTM network trained at this time may represent a baseline of normal user behavior. And (3) for the new input behavior sample, calculating a network output result and judging whether the network output result is normal or abnormal. And finally, obtaining a behavior baseline model capable of detecting the abnormality by using the LSTM.

Further, the abnormality detection includes: and detecting the acquired behavior data by using a behavior baseline model based on the LSTM neural network to obtain a detection score, and judging whether the behavior of the user is abnormal according to the detection score.

Specifically, the LSTM model of the user behavior baseline has been trained previously. And acquiring new user behavior data, and extracting the same characteristics. The extracted time, place and operation characteristic vector are input into the LSTM model. The LSTM model calculates the deviation of the behavioral samples from the learned baseline pattern. The larger the deviation, the less the sample does not match the normal behavior. The deviation value is converted into a detection score of the [0,1] interval, and the detection score is used as a final abnormality score. And setting a threshold value, and judging that the abnormal behavior is caused when the score exceeds 0.8. Based on the detection scores, it may be determined whether the user-specific behavior is at risk. And detecting and scoring the multiple behaviors of the user, and comprehensively judging the risk level of the user. If the multiple behavior detections all exceed the threshold value, confirming that the user has abnormality. And finally, detecting and identifying the risk by using the LSTM model.

3. Advantageous effects

Compared with the prior art, the application has the advantages that:

compared with a single identity verification algorithm, the double identity verification mechanism adopting the ECDSA digital signature algorithm and the LWE encryption algorithm can remarkably improve the safety strength of user identity verification and prevent the fraudulent identity from stealing important data;

The TOTP time one-time password is introduced for second re-verification, so that replay attack can be effectively resisted, and an attacker is prevented from logging in and authenticating by recording user data;

Based on user behavior data, a behavior baseline model is established, an LSTM neural network is used for abnormality detection, user operation behaviors can be monitored in real time, and protective measures are quickly taken when the abnormal behaviors are detected, so that the safety of the system is protected;

the random number generation scheme of the ECDSA algorithm is improved, so that randomness and unpredictability of the private key can be enhanced, the private key is prevented from being predicted by attack, and the encryption strength is improved;

Random replacement improvement is carried out on the hash algorithm, so that attacks such as differential analysis and the like can be effectively resisted, and the cryptographic security is improved;

the multidimensional feature modeling of time, place, operation and the like is adopted, so that the behavior mode of the user can be comprehensively reflected, and the accuracy of the behavior baseline model is improved;

Complex abnormal behavior patterns can be detected using a powerful time series model of the LSTM neural network.

Drawings

The present specification will be further described by way of exemplary embodiments, which will be described in detail by way of the accompanying drawings. The embodiments are not limiting, in which like numerals represent like structures, wherein:

FIG. 1 is an exemplary flow chart of a method for computer software encryption protection according to some embodiments of the present description;

FIG. 2 is an exemplary flow chart for generating a digital signature A1 according to some embodiments of the present description;

FIG. 3 is an exemplary flow chart for generating a fused feature vector according to some embodiments of the present description.

Detailed Description

The method and system provided in the embodiments of the present specification are described in detail below with reference to the accompanying drawings.

Fig. 1 is an exemplary flow chart of a method of computer software encryption protection, according to some embodiments of the present description, for preliminary verification that a user enters an account number and a password, which is signed with the ECDSA encryption engine of the CPU, to generate a digital signature a ₁. And acquiring locally stored user identity information, signing the user identity information by using a public key corresponding to the CPU, and generating a digital signature A2. Matching A ₁ with A ₂, and if the matching is consistent, passing the preliminary verification of the user. The second verification, the user enters the one-time password TOTP ₁. Based on the time seed, the one-time password TOTP ₂ is generated by a TOTP algorithm. TOTP ₁ and TOTP ₂ are compared and if they are identical, the second verification passes. After the two times of verification are passed, the access restriction on the target software is released, and the user is allowed to use normally. Recording the login time, place and operation behavior data of the user. A user behavior baseline model is established through a machine learning technology. It is detected whether there is an anomaly in the user's behavior from the baseline model. If the user account is abnormal, the user account is locked. The time seed is generated by the CPU clock and the random number and is updated synchronously with the user side in real time.

Fig. 2 is an exemplary flow diagram of generating a digital signature a ₁, shown in accordance with some embodiments of the present description, generating a digital signature a ₁, including: acquiring an account password input by a user, and performing signature operation based on stored TWISTED EDWARDS curve parameters by using an ECDSA encryption engine in a CPU: the equation of the curve is constructed TWISTED EDWARDS, The parameters a=1, b=2, c=3, d=4 are selected, and the curve equation is: ax ²+by²+cz²＝1+dx²y², which constructs a specific TWISTED EDWARDS curve. The account password hash is mapped to a curve point, the account is alice, and the password is password 123. Carrying out SHA-256 hash on the account password connection string to obtain a 256-bit hash value: 7c222fb2927d828af22f592134e8932480637c0d191e4fb63022ce85c0e02f85, then converting this hash value into coordinates (x, y) of a point on a curve as an input point. The mapping result is a dot (123, 456). This point is taken as input to the ECDSA signature. Selecting a random seed S, and selecting a 128-bit random seed: s= 1010010110111100101110101011001. Performing SHA-256 hash calculation to obtain a 256-bit hash value: hash (S) = 110010100110111001, once again, 101010101101. Exclusive or the second part with S as a new seed S': s' = 01001110101110001011011101011010. The SHA-256 calculation update seed is repeated to obtain more random number sequences. Designating q=250, the random number 1100101001 of the sequence number 250 is privkey. Obtaining a generating element point P, calculating the order n=521 of the curve through a mathematical method, traversing points (x, y) on the curve, and a point A (2, 3): setting a counter i=1, repeating the point addition operation a+a, & gt, until a+a+ & gt, a=o, the smallest i=157 is recorded, i.e. the order of point a is 157. Find a point of order equal to n, repeat the above traversal, find a point P (555, 666), whose order is calculated as 521. Therefore, the point P is determined as a generator of the curve, the order of the point P is equal to the order n of the curve, and the coordinates of the point P of the curve generator are (x, y) = (555, 666). Calculating a public key by dot product operation: pubkey = privkey x P, here privkey is considered as a large integer on the elliptic curve. The public key coordinates (X, Y), (888, 999) are finally obtained. This results in a key pair (privkey, pubkey) for ECDSA signature.

Initializing 8 32-bit constants IV1, and performing blocking processing on the obtained account number 'alice' and the password 'password 123' in the IV 8. The ASCII code of account number "alice" is split into the following 16 byte data blocks: 61. 6c, 69, 63, 65, 70, 61, 73, 77, 6f, 72, 64, 31, 32, 33. Initial vector, 8 32-bit initial vectors are set: v1=0x11111111, IV2 =0x22222222, the term "is used, IV8 = 0x 8888888. Boolean logical exclusive OR operation, carrying out exclusive OR ：61 XOR IV1＝0x73,6c XOR IV2＝0x52,69 XOR IV3＝0x59,63 XOR IV4＝0x4c,65 XOR IV5＝0x64,.......,33 XOR IV8＝0x8b. modulo 32 addition on 16 bytes of account number 'alice' and IV, adding ：0x73+0x52＝0x125 mod 0x20＝0x29,0x29+0x59＝0x082 mod 0x20＝0x17,0x17+0x4c＝0x063 mod 0x20＝0x23,.......,0x36+0x8b＝0x0c1 mod 0x20＝0x11. the modulo 32 of each two of exclusive OR results, and randomly scrambling the replacement sequence of the modulo addition result of the last step: 23, 88, 62, 107, 39, 68, 41, 117, thus completing the boolean logic operation, modulo addition and substitution processing on one data block, updating IV, taking new IV as the data processing initial vector of the next block, repeatedly processing all account data blocks, merging output hashes, and splicing them together to obtain a binary sequence of 32 x8 = 256 bits as the final hash value h, h = IV1 i IV2 i, &.

And verifying the digital signature, wherein A2 is a signature generated based on the LWE algorithm, comprises user identity information, takes a decryption private key of the LWE algorithm out of a local secure storage, takes A2 as input, and uses the LWE decryption algorithm and the private key to carry out decryption operation, and if decryption is successful, the plaintext of the original identity information contained in A2 can be extracted. The method comprises the steps of obtaining an identity information plaintext after LWE decryption, for example, "Alice #1990#CA", inputting the plaintext into SHA256 hash function operation, dividing the input into blocks, iterating compression function operation on each data block, outputting a 256-bit hash value as a hash result after the iterative operation, and using the obtained 256-bit hash value as e for subsequent signature verification. Input, r, s: coordinate points and integers in signature A1, e: SHA256 hash value of user identity information pubkey: public key of ECDSA algorithm. n is the order of elliptic curve, the point multiplication operation is performed on the curve with ,n＝115792089237316195423570985008687907853269984665640564039457584007908834671663.s＝987654321,r＝(x1,y1)// coordinate points, e=3299472402370823458234534512346345569, pubkey= (x, y)// public key point, then:

pu ₁＝u₁ x pubkey = (x 3, y 3)// calculate u1 multiplied by the public key point. Pu ₂＝u₂ x pubkey = (x 4, y 4)// computing u2 multiplies the public key point, if (x 3, y 3) = (x 4, y 4), then the verification passes.

FIG. 3 is an exemplary flow chart for generating a fused feature vector according to some embodiments of the present disclosure, such that a server side may collect log data uploaded by a client in real time and persist the log to a database for storage. The server analyzes the log data, extracts time, place and operation characteristics, inputs LSTM model detection and obtains detection scores. The server side reads client log data from the database, analyzes the log, and extracts a time field as a time feature: dividing 24 hours of a day into 24 time periods, calculating the frequency of a sample accessing each time period as time distribution, obtaining 24-dimensional time feature vectors, and extracting a location field as a location feature: dividing the method into two types of office and outlide, counting the access times of the two types of places, obtaining a 2-dimensional place feature vector, and extracting an operation field as an operation feature: the method comprises the steps of dividing operations into read and write, and counting the times of the two operations to obtain a 2-dimensional operation feature vector.

Specifically, the client log data format: { timestamp: "2023-03-01 08:00:00", location: "office", operation: "read" }. The server receives the log and stores the log in a log table in a MySQL database, reads the log from the log table, and performs feature extraction: timestamp was resolved into hour-level time periods: 08:00-09: the 00 hours are set as time period 1, 09:00-10: the 00 hours is set as time period 2. The time period with the largest number of times is set to 1, and the others are set to 0.location is "office" set to 1, "outlide" set to 0, operation is "read" set to 1, and "write" set to 0. Time feature vector time_fv= 0,1,0,0,1, & gt.0, place feature vector loc_fv= [1,0] (2 dimensions), operation feature vector op_fv=1, 0.

The three vectors are spliced to obtain a 28-dimensional fusion feature vector, and the time feature (24 dimensions): [0.1,0.2,0.5,0.3 ] the term "is used to mean" 0.1 "), the location feature (2-dimensional): 0.7,0.3] operational characteristics (2 dimensions): [0.6,0.4]. And splicing the three vectors to obtain a 28-dimensional fusion vector: [0.1,0.2,0.5,0.3,.......,.......,0.1,0.7,0.3,0.6,0.4]. Inputting the detection values into a trained LSTM model to obtain detection values, and inputting the detection values into an input layer: 28 input nodes, matching 28-dimensional feature vectors, hidden layer: 64 LSTM memory cells, output layer: 1 output node, representing the detection score. Inputting a feature vector: x= [0.1,0.2,0.5,0.3, ] the term "a", "0.1,0.7,0.3,0.6,0.4". LSTM layer operation: x is input into the memory unit, four gates are operated in sequence, the weights of the input gate, the forgetting gate and the output gate are calculated, and the hidden state and the memory unit are updated in a recursion mode. The output layer gets a score between (0, 1) by LSTM layer processing, the LSTM output in this example has a detection score of 0.83. If the score exceeds the threshold, it is determined that there is an abnormality, and if the score exceeds the threshold value 0.83, it is determined that the abnormality is in an abnormal mode.

The detection module is used for detecting the score determines whether or not it is abnormal. If an anomaly is detected, a response is returned to the client denying access. The client receives the response and prompts the user account to be locked. The server side records the log and locks the account number.

The foregoing has been described schematically the application and embodiments thereof, which are not limiting, but are capable of other specific forms of implementing the application without departing from its spirit or essential characteristics. The drawings are also intended to depict only one embodiment of the application, and therefore the actual construction is not intended to limit the claims, any reference number in the claims not being intended to limit the claims. Therefore, if one of ordinary skill in the art is informed by this disclosure, a structural manner and an embodiment similar to the technical scheme are not creatively designed without departing from the gist of the present application, and all the structural manners and the embodiments belong to the protection scope of the present patent. Furthermore, the inclusion of the term does not exclude other elements or steps, a term before an element does not exclude the inclusion of a plurality of such elements. The various elements recited in the product claims may also be embodied in software or hardware. The terms first, second, etc. are used to denote a name, but not any particular order.

Claims

1. A computer software encryption protection method, comprising:

Use the CPU's identity key to encrypt the account password entered by the user to generate a digital signature A ₁ ; obtain the stored user identity information, and generate a digital signature A ₂ based on the user identity information and the LWE algorithm; match the digital signature A ₁ and the digital signature A ₂ , if they are consistent, the user identity is initially verified;

When the initial verification is passed, the one-time password TOTP ₁ input by the user is received; and the one-time password TOTP ₂ of the current moment is generated through the TOTP algorithm using the time seed synchronized with the user, and the generated one-time password TOTP ₂ is matched with the received one-time password TOTP _1. If they are consistent, the second verification is passed;

After passing the second verification, the access restriction to the encryption software is lifted, allowing the user to access the encryption software;

Obtain behavioral data of users accessing encryption software, including login time, login location, and access operations, and establish a behavioral baseline model based on the behavioral data;

Use machine learning models to detect user behavior baseline models. When anomalies are detected, lock the user account and deny access.

The time seed is generated by the CPU system clock and random numbers;

Generate a digital signature A ₁ , including:

Get the account and password entered by the user;

Generate a digital signature A ₁ using the elliptic curve digital signature algorithm ECDSA encryption engine in the CPU that stores the Twisted Edwards curve parameters;

Matching digital signature _A1 and digital signature _A2 , including:

Obtain a digital signature A ₁ , _which includes an ordered pair (r, s) of a coordinate point r and an integer U, where s is an integer;

Obtaining a digital signature A ₂ generated based on the user identity information and the LWE algorithm;

Use the locally stored LWE algorithm to decrypt the private key, perform LWE decryption on the user identity information in the digital signature A ₂ , and obtain the plaintext of the user identity information;

Perform SHA256 hash operation on the plain text of the obtained user identity information to generate a hash value e;

Input the coordinate point r, integer U, hash value e and public key pubkey, and verify the validity of the digital signature A ₁ through the ECDSA algorithm;

If the verification is successful, the digital signature _A1 and the digital signature _A2 match, and the preliminary verification is passed.

2. The computer software encryption protection method according to claim 1, characterized in that:

The digital signature A ₁ is generated by using the elliptic curve digital signature algorithm ECDSA encryption engine in the CPU storing the Twisted Edwards curve parameters, including:

Construct the improved Twisted Edwards curve equation:

ax ² +by ² +cz ² =1+dx ² y ²

Among them, a, b, d are curve parameters, x and y are point coordinates; z is the third variable introduced, and c is the coefficient of variable z;

Get the account and password entered by the user;

Through the hash mapping algorithm, the account password is hashed and mapped to a point on the constructed Twisted Edwards curve as the input point of the ECDSA encryption algorithm;

Generate a key pair using the ECDSA encryption algorithm based on the constructed Twisted Edwards curve;

According to the Twisted Edwards curve, the input point and the key pair as input parameters, an ECDSA encryption operation is performed to obtain a digital signature A ₁ .

3. The computer software encryption protection method according to claim 2, characterized in that:

Generate a key pair using the ECDSA encryption algorithm, including:

Select a random number seed S with a length of m bits;

Use the SHA-256 algorithm to perform hash calculation and obtain hash(S);

The hash(S) is divided into the first part and the second part by interception, the first part is used as the random number sequence; the second part is XORed with the random number seed S to be the random number seed S';

Repeat the above hash calculation, update the random number seed S', and output the first part as the random number sequence until the random number sequence is greater than the preset length;

Get the random number with sequence number Q in the random number sequence as the private key privkey;

Get the point with the largest order in the Twisted Edwards curve as the generator P;

Calculate the public key pubkey = privkey × P;

The length of the first part and the second part is 128 bits.

4. The computer software encryption protection method according to claim 3, characterized in that:

The digital signature A1 contains an ordered pair (r, s) of a coordinate point r and an integer U, where s is an integer;

Coordinate point r:

r = pubkey × k, where k represents a random integer;

Integer U:

And round up;

h represents the hash value obtained by performing a hash operation on the account and password data input by the user through a hash algorithm.

5. The computer software encryption protection method according to claim 4, characterized in that:

Calculate the hash value h, including:

Initialize 8 32-bit constant values;

Get the account and password entered by the user and split them into 512-bit blocks;

Perform the following operations on each data block:

Perform Boolean logic operations and modulo 32 addition to calculate the compression function value;

Randomly permute and sort the calculated compression function values;

Perform modulo 32 addition on the permutation sort result and the current hash value to update the hash value;

Iterate the calculation until all data blocks are processed;

Combine the calculated hash values and output a 256-bit value as the final hash value h;

Wherein, obtaining the final hash value h includes:

Obtain the account and password entered by the user, divide the input account and password into multiple data blocks according to the length of 512 bits, and obtain the data block sequence M1, M2, ....., Mm;

After performing Boolean logic operation on the data block Mi and the constant IV, an addition operation is performed with modulo 32 to calculate the compression function value;

Randomly permute and sort the calculated compression function values;

Perform a modulo 32 addition operation on the result after permutation sorting and the current cumulative hash value {Hi} to obtain an updated hash value Hi;

Repeat the hash value update step until all data blocks are traversed to obtain hash values H1, H2, ..., Hm;

Connect the m 32-bit intermediate hash values in order to obtain a 32*m-bit combined value.

Determine the length of the obtained 32*m-bit combination value. If the length of the combination value is less than 256 bits, add padding bits to extend the combination value to 256 bits. Otherwise, truncate it to 256 bits.

The resulting 256-bit value is output as the final hash value h.

6. The computer software encryption protection method according to claim 1, characterized in that:

Establish a behavioral baseline model, including:

Obtain behavioral data including login time, login location, and access operations;

Parse the login time, obtain the time granularity information, and divide a day into 24-hour intervals as the feature of the time distribution histogram statistics;

Parse the login location, obtain address information, and divide the address into two categories: inside the office area and outside the office area as the characteristics of the location distribution histogram statistics;

Parse access operations and classify them into two categories: read and write operations and set operations as the features of operation distribution histogram statistics;

Using one-dimensional discrete histogram statistical function, the characteristic vector of time distribution histogram statistics is obtained;

Using binary statistical function, the characteristic vector of location distribution histogram statistics is obtained;

Using a binary statistical function, the characteristic vector of the operation distribution histogram statistics is obtained;

The obtained feature vector of the time distribution histogram statistics, the feature vector of the location distribution histogram statistics, and the feature vector of the operation distribution histogram statistics are concatenated to serve as the statistical feature vector of the behavior data.

7. The computer software encryption protection method according to claim 6, characterized in that:

Establish a behavioral baseline model, including:

The obtained statistical feature vector is used to train the LSTM neural network as the behavioral baseline model.

8. The computer software encryption protection method according to claim 7, characterized in that:

Anomaly detection, including:

The behavioral baseline model based on the LSTM neural network is used to detect the acquired behavioral data, obtain the detection score, and judge whether the user's behavior is abnormal based on the detection score.