A chip-based offline authorization method and system

Abstract

The application discloses a kind of off-line authorization methods based on chip, method is operated at authorization center, method includes the following steps: reading the serial number of authorization chip;Random number is generated as the private key of authorization chip;Certificate request is made according to private key, wherein, certificate request includes user information, wherein, user information is the serial number of authorization chip;Certificate request also includes certificate validity period, wherein, certificate validity period is the authorization time of authorization chip;Certificate issuing is carried out to certificate request using corresponding business certificate authority CA, and the authorization certificate of chip is generated;Wherein, business CA is selected by root CA;The private key of authorization chip and authorization certificate are written into authorization chip, and the authorization of chip is completed.The method of the application adopts the way of off-line authorization to chip, and the operation complexity of product authorization is reduced by saving the authorization information in the secure chip;The application is realized by using asymmetric encryption algorithm, and the security of authorization is guaranteed in the authorization center.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of digital encryption technology, in particular to a chip-based offline authorization method and system. BACKGROUND

[0002] The conventional authorization method for terminals or systems (hereinafter referred to as devices) is an online authorization method. The process is as follows: after the production of a device is completed, a special authorization tool is used to establish communication with the device to obtain a machine code (the selection of the machine code is usually such that the information of each device is unique and cannot be changed), then a specific encryption algorithm and key are used to encrypt the machine code to generate an authorization file, and then the authorization file is written back to the device, thus completing the authorization. The authorization method of the prior art can be seen in Figure 1 .

[0003] Then, when the device is running, the business program will detect whether the device has been authorized during initialization. First, the machine code of the device is read, and then the same encryption algorithm and key as the registration tool are used to encrypt the machine code. The encryption result is compared with the registration information (authorization file information) of the device. If they are consistent, it means that the device has been registered and can run normally. If they are not consistent, it means that the device has not been registered, and the program is terminated, thereby preventing the business program from running on an unauthorized device. The process of detecting authorization by the device business program can be seen in Figure 2 .

[0004] This authorization method has three disadvantages: (1) In order to ensure the universality of the authorization function, the machine code information is usually obtained from the MAC address, network card information, etc. These information can be changed by technical means. Thus, the registration file can be obtained from an authorized device and modified to the same machine code, thereby completing the cracking of the authorization. (2) The method of encrypting the machine code is usually a hash algorithm or a symmetric encryption algorithm, and some are private encryption algorithms. Once the encryption algorithm is leaked, the entire encryption system will be cracked, which poses a technical risk. (3) The authorization operation of this authorization method is performed after the production of the device is completed and the running conditions are met. Each device needs to be powered on, complete the communication connection, and then be registered. The steps are cumbersome. If a large number of devices need to be supplied, this step will take a lot of time and affect the supply schedule.

[0005] In order to ensure the uniqueness and unchangeability of the device information, a chip with a globally unique serial number (UID) needs to be used. Some authorization schemes currently use secure chips and use asymmetric encryption algorithms for authorization. However, there is a problem that some products have authorization time requirements. In addition, most companies have a rich product line, and the price difference between different series is very large. If the same registration method is used, it may be possible for someone to use the authorization of a low-priced device for a high-priced product, causing economic losses. SUMMARY

[0006] The present application aims to provide a chip-based offline authorization method and system

[0007] To achieve the above-mentioned purpose, the present application provides a chip-based offline authorization method, characterized in that the method is operated at an authorization center, and the method comprises the following steps:

[0008] reading the serial number of the authorization chip;

[0009] generating a random number as the private key of the authorization chip;

[0010] making a certificate request according to the private key, wherein the certificate request comprises user information, and the user information is the serial number of the authorization chip; the certificate request also comprises a certificate validity period, and the certificate validity period is the authorization time of the authorization chip;

[0011] issuing a certificate to the certificate request using a corresponding business certificate authority (CA), to generate an authorization certificate of the chip; wherein the business CA is selected by a root CA;

[0012] writing the private key of the authorization chip and the authorization certificate into the authorization chip, to complete the authorization of the chip.

[0013] In a preferred embodiment, the private key of the authorization chip is encrypted and stored in an external unreadable area.

[0014] The present application provides a chip-based offline authorization method, characterized in that the method is operated at a device, and the method comprises the following steps:

[0015] reading the serial number of the authorization chip;

[0016] reading the authorization certificate of the authorization chip;

[0017] reading the user information of the authorization certificate, and comparing the user information with the serial number of the authorization chip;

[0018] if the user information is inconsistent with the serial number of the authorization chip, judging that the verification fails;

[0019] if the user information is consistent with the serial number of the authorization chip, continuing to verify the legality of the authorization certificate using the business CA certificate of the business program of the device, wherein the business CA certificate of the business program of the device is the CA certificate of the corresponding business in the authorization center;

[0020] if the authorization certificate is not a certificate issued by the authorization center or the authorization certificate is not a certificate issued by the business CA of the business program of the device, judging that the authorization certificate is an illegal certificate;

[0021] If the authorization certificate is a certificate issued by the authorization center and the authorization certificate is a certificate issued by the business CA of the business program of the device, continue to read the valid time of the authorization certificate.

[0022] In a preferred embodiment, the method further comprises the steps of:

[0023] Comparing the valid time of the authorization certificate with the local time;

[0024] If the valid time of the authorization certificate is not within the valid period, the authorization detection fails;

[0025] If the valid time of the authorization certificate is within the valid period, a random number is generated and the generated random number is sent to the authorization chip;

[0026] Receiving a signature result, and verifying using the authorization certificate, wherein the signature result is generated by signing the random number by the authorization chip;

[0027] If the verification fails, the authorization detection fails;

[0028] If the verification succeeds, the business program starts normal operation.

[0029] The present application provides a chip-based offline authorization system, characterized in that the system comprises an authorization chip, an authorization center and a device, wherein the authorization center and the authorization chip are communicatively connected via a chip tooling, and wherein the device runs a business program;

[0030] The authorization center is configured to perform the following operations:

[0031] Read the serial number of the authorization chip;

[0032] Generate a random number as the private key of the authorization chip;

[0033] Make a certificate request according to the private key, wherein the certificate request includes user information, and the user information is the serial number of the authorization chip; the certificate request also includes a certificate validity period, and the certificate validity period is the authorization time of the authorization chip;

[0034] Use the corresponding business certificate authority CA to issue a certificate for the certificate request, generating an authorization certificate for the chip; wherein the business CA is selected by the root CA;

[0035] Write the private key of the authorization chip and the authorization certificate into the authorization chip to complete the authorization of the chip.

[0036] In a preferred embodiment, the private key of the authorization chip is encrypted and stored in an external unreadable area.

[0037] The application provides a chip-based offline authorization system, characterized in that the system comprises an authorization chip, an authorization center and a device, wherein the authorization center is in communication connection with the authorization chip via a chip tool, and a service program runs in the device;

[0038] The device is configured to perform the following operations:

[0039] read the serial number of the authorization chip;

[0040] read the authorization certificate of the authorization chip;

[0041] read the user information of the authorization certificate and compare the user information with the serial number of the authorization chip;

[0042] if the user information is inconsistent with the serial number of the authorization chip, it is judged that the verification fails;

[0043] if the user information is consistent with the serial number of the authorization chip, the service CA certificate of the service program of the device is used to verify the legality of the authorization certificate, wherein the service CA certificate of the service program of the device is the CA certificate of the corresponding service in the authorization center;

[0044] if the authorization certificate is not the certificate issued by the authorization center or the authorization certificate is not the certificate issued by the service CA of the service program of the device, it is judged that the authorization certificate is an illegal certificate;

[0045] if the authorization certificate is the certificate issued by the authorization center and the authorization certificate is the certificate issued by the service CA of the service program of the device, the valid time of the authorization certificate is read.

[0046] In a preferred embodiment, the device is further configured to perform the following operations:

[0047] compare the valid time of the authorization certificate with the local time;

[0048] if the valid time of the authorization certificate is not within the valid period, the authorization detection fails;

[0049] if the valid time of the authorization certificate is within the valid period, a random number is generated and the generated random number is sent to the authorization chip;

[0050] receive the signature result and use the authorization certificate to verify, wherein the signature result is generated by signing the random number by the authorization chip;

[0051] if the verification fails, the authorization detection fails;

[0052] if the verification succeeds, the service program starts normal operation.

[0053] Compared with the prior art, the present application has the following advantages: (1) the off-line authorization mode is adopted, the authorization information is stored in the secure chip, and the operation complexity of product authorization is reduced; (2) the authorization time and the authorized business scope can be set, and the flexibility of authorization is increased; (3) the asymmetric encryption algorithm is adopted in the present scheme, the authorization is performed at the authorization center, and the security of authorization is ensured; if the details and the algorithm of the present authorization scheme are leaked, as long as the private key of the authorization system is protected, the risk of being cracked does not exist. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 is a process schematic diagram of the authorization process of the prior art.

[0055] Figure 2 is a process schematic diagram of the authorization detection of the prior art.

[0056] Figure 3 is a logical architecture schematic diagram of the multi-level CA of the authorization system according to an embodiment of the present application.

[0057] Figure 4 is a process schematic diagram of the chip off-line authorization according to an embodiment of the present application.

[0058] Figure 5 is a process schematic diagram of the authorization detection according to an embodiment of the present application. DETAILED DESCRIPTION

[0059] The specific embodiments of the present application are described in detail below with reference to the accompanying drawings, but it should be understood that the protection scope of the present application is not limited by the specific embodiments.

[0060] Unless otherwise explicitly indicated, in the entire specification and claims, the term "comprise" or its variants such as "contain" or "include" and the like will be understood to include the stated element or component without excluding the other elements or components.

[0061] The present application provides a chip-based off-line authorization method, characterized in that the method is operated at an authorization center, and the method comprises the following steps: reading the serial number of an authorized chip; generating a random number as the private key of the authorized chip; making a certificate request according to the private key, wherein the certificate request comprises user information, and the user information is the serial number of the authorized chip; the certificate request further comprises a certificate validity period, and the certificate validity period is the authorization time of the authorized chip; using a corresponding business certificate authority CA to issue a certificate for the certificate request, to generate an authorization certificate of the chip; wherein the business CA is selected by a root CA; and writing the private key of the authorized chip and the authorization certificate into the authorized chip, to complete the authorization of the chip.

[0062] In a preferred embodiment, the private key of the authorization chip is encrypted and stored in an external unreadable area.

[0063] The application provides a chip-based offline authorization method, characterized in that the method is operated at a device, and the method comprises the following steps: reading a serial number of an authorization chip; reading an authorization certificate of the authorization chip; reading user information of the authorization certificate and comparing the user information with the serial number of the authorization chip; if the user information is inconsistent with the serial number of the authorization chip, judging that the verification fails; if the user information is consistent with the serial number of the authorization chip, continuing to verify the legality of the authorization certificate by using a business CA certificate of a business program of the device, wherein the business CA certificate of the business program of the device is a CA certificate of a corresponding business in an authorization center; if the authorization certificate is not a certificate issued by the authorization center or the authorization certificate is not a certificate issued by the business CA of the business program of the device, judging that the authorization certificate is an illegal certificate; if the authorization certificate is a certificate issued by the authorization center and the authorization certificate is a certificate issued by the business CA of the business program of the device, continuing to read a valid time of the authorization certificate.

[0064] In a preferred embodiment, the method further comprises the following steps: comparing the valid time of the authorization certificate with a local time; if the valid time of the authorization certificate is not within the valid period, judging that the authorization detection fails; if the valid time of the authorization certificate is within the valid period, generating a random number and sending the generated random number to the authorization chip; receiving a signature result and verifying the signature result by using the authorization certificate, wherein the signature result is generated by signing the random number by the authorization chip; if the verification fails, judging that the authorization detection fails; if the verification succeeds, starting the normal operation of the business program.

[0065] The application provides a chip-based offline authorization system, characterized in that the system comprises an authorization chip, an authorization center and a device, wherein the authorization center and the authorization chip are communicatively connected via a chip tool, and a business program is run in the device; the authorization center is configured to perform the following operations: reading a serial number of the authorization chip; generating a random number as a private key of the authorization chip; making a certificate request according to the private key, wherein the certificate request comprises user information, and the user information is the serial number of the authorization chip; the certificate request further comprises a certificate valid period, and the certificate valid period is an authorization time of the authorization chip; using a corresponding business CA to sign the certificate request to generate an authorization certificate of the chip; the business CA is selected by a root CA; the private key of the authorization chip and the authorization certificate are written into the authorization chip to complete the authorization of the chip.

[0066] In a preferred embodiment, the private key of the authorization chip is encrypted and stored in an external unreadable area.

[0067] The application provides a chip-based offline authorization system, characterized in that the system comprises an authorization chip, an authorization center and a device, wherein the authorization center is in communication connection with the authorization chip via a chip tool, and a service program runs in the device; the device is configured to read the serial number of the authorization chip, read the authorization certificate of the authorization chip, read the user information of the authorization certificate and compare the user information with the serial number of the authorization chip; if the user information is inconsistent with the serial number of the authorization chip, it is judged that the verification fails; if the user information is consistent with the serial number of the authorization chip, the service CA certificate of the service program of the device is used to verify the legality of the authorization certificate, wherein the service CA certificate of the service program of the device is the CA certificate of the corresponding service in the authorization center; if the authorization certificate is not the certificate issued by the authorization center or the authorization certificate is not the certificate issued by the service CA of the service program of the device, it is judged that the authorization certificate is an illegal certificate; if the authorization certificate is the certificate issued by the authorization center and the authorization certificate is the certificate issued by the service CA of the service program of the device, the valid time of the authorization certificate is read.

[0068] In a preferred embodiment, the device is further configured to compare the valid time of the authorization certificate with the local time; if the valid time of the authorization certificate is not within the valid period, the authorization detection fails; if the valid time of the authorization certificate is within the valid period, a random number is generated and sent to the authorization chip; a signature result is received and verified using the authorization certificate, wherein the signature result is generated by signing the random number by the authorization chip; if the verification fails, the authorization detection fails; if the verification succeeds, the service program starts normal operation.

[0069] In a specific embodiment, the product authorization method of the application is that an authorization chip is added to each device, an authorization personnel completes the authorization of the chip before the device is generated, and then sends the authorization chip to a device production department, and the device production department adds the chip to the device in the production link, so that the device has completed the authorization as soon as it is produced.

[0070] In one embodiment, the present application relates to the following subjects: authorized chip: a security chip with a globally unique serial number (UID) and cannot be changed, and has a storage area for storing authorization information. Chip tooling: a tool for connecting the chip for communication with the chip. Authorization system: a system for authorizing the chip, authorizing the chip through the chip tooling, having a multi-level digital certificate issuing function, having a root certificate authority CA, creating a multi-level sub-CA according to business division, each level of CA represents a CA of a type of business function, and the multi-level CA is allocated as shown in the following figure. Business program: a program for processing business functions, which is the protection object of the present application, and the authorization function is to prevent the business program from running in an unauthorized device. Different types of devices have different business programs. Device: the running carrier of the business program, which is general or special hardware.

[0071] Reference is made below Figure 4 The process of chip offline authorization of the present application is introduced. In one embodiment, at the authorization center, the authorized chip is connected using a special tool, connected using the authorization system, and then the following operations are performed:

[0072] (1) Read the serial number of the authorized chip;

[0073] (2) Generate a random number as the private key of the chip;

[0074] (3) Make a certificate request according to the private key, and in the request information, the user information is filled in the chip serial number obtained in step 1 to realize the binding of the certificate and the chip; the CA selects the corresponding business CA to realize the binding with the business, and the certificate validity period is filled in the authorization time of the chip.

[0075] (4) The corresponding business CA is used to issue a certificate for the certificate request, and the authorized certificate of the chip is generated;

[0076] (5) Finally, the private key and the authorized certificate are written into the authorized chip, and the authorization of the chip is completed. The private key information is encrypted and saved to the external unreadable area to ensure absolute confidentiality.

[0077] After the chip is authorized, according to the device generation plan, a specified number of authorized chips of the corresponding business are sent to the corresponding product production unit, and the authorized chip is welded to the product mainboard. Since the chip has been authorized, the device is a product that has been authorized as soon as it is produced.

[0078] Reference is made below Figure 5 The process of authorization detection of the present application is introduced. In one embodiment, the device related to the present application has a CA certificate of the corresponding business in the authorization system. To prevent the CA certificate from being tampered with, the digital certificate content is fixed in the business program.

[0079] The service program of the device carries out authorization detection at startup, and only when the authorization detection passes, the service function is operated, otherwise the running is terminated and all service programs are deleted. The detection flow is as follows:

[0080] (1) reading the serial number of the authorization chip;

[0081] (2) reading the authorization certificate of the authorization chip;

[0082] (3) reading the user information of the authorization certificate, and comparing with the chip serial number, if they are inconsistent, the verification fails;

[0083] (4) using the service CA certificate of the service program to verify the legality of the authorization certificate, and considering that the certificate is not issued by the authorization system or is not issued by the service CA as an illegal certificate;

[0084] (5) reading the valid time of the authorization certificate, and comparing with the local time to see whether it is within the valid period, if not, the detection fails;

[0085] (6) generating a random number, sending it to the authorization chip, the authorization chip signing the random number, returning the signature result, the service program using the authorization certificate for verification, if the verification fails, the detection fails;

[0086] If the above steps are all successful, the authorization detection is passed, and the service program can normally run.

[0087] Among them, sending the random number to the authorization chip for signature is to prevent illegal cracking personnel from detecting the authorization chip signal of the authorized device, using other chips for simulation, thereby reducing the risk of cracking.

[0088] It should be understood that the above-mentioned sequence of writing of each process in various embodiments of the present application does not mean the sequence of execution, and the execution sequence of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0089] It should be understood that the above specific embodiments of the present application are only used for illustrative or explanatory purposes of the principles of the present application, and do not constitute a limitation on the present application. Therefore, any modification, equivalent replacement, improvement, etc. made without departing from the spirit and scope of the present application shall be included in the protection scope of the present application. In addition, the appended claims of the present application are intended to cover all variations and modifications falling within the scope and boundary of the appended claims, or the equivalent forms of such scope and boundary.

Claims

1. A chip-based off-line authorization method, characterized by, The method is applied to an authorized chip, an authorization center and a device, the method is operated at the authorization center, and the method comprises the following steps: reading a serial number of the authorized chip; generating a random number as a private key of the authorized chip; making a certificate request according to the private key, wherein the certificate request comprises user information, the user information is the serial number of the authorized chip, and the certificate request further comprises a certificate validity period, the certificate validity period is an authorized time of the authorized chip; issuing a certificate by using a corresponding business certificate authority (CA) to the certificate request to generate an authorized certificate of the chip, wherein the business CA is selected by a root CA; writing the private key of the authorized chip and the authorized certificate into the authorized chip to complete authorization of the chip; the method is operated at the device, and the method comprises the following steps: reading a serial number of the authorized chip; reading an authorized certificate of the authorized chip; reading user information of the authorized certificate and comparing the user information with the serial number of the authorized chip; if the user information is inconsistent with the serial number of the authorized chip, judging that the verification fails; if the user information is consistent with the serial number of the authorized chip, continuing to verify the legality of the authorized certificate by using a business CA certificate of a business program of the device, wherein the business CA certificate of the business program of the device is a CA certificate of a corresponding business in the authorization center; if the authorized certificate is not a certificate issued by the authorization center or the authorized certificate is not a certificate issued by the business CA of the business program of the device, judging that the authorized certificate is an illegal certificate; if the authorized certificate is a certificate issued by the authorization center and the authorized certificate is a certificate issued by the business CA of the business program of the device, continuing to read a valid time of the authorized certificate.

2. The chip-based off-line authorization method of claim 1, wherein, Wherein, the private key of the authorized chip is encrypted and stored in an external unreadable area.

3. The chip-based off-line authorization method of claim 1, wherein, The method further comprises the following steps: comparing the valid time of the authorized certificate with a local time; if the valid time of the authorized certificate is not within a valid period, judging that the authorization detection fails; if the valid time of the authorized certificate is within the valid period, generating a random number and sending the generated random number to the authorized chip; receiving a signature result, and verifying by using the authorized certificate, wherein the signature result is generated by signing the random number by the authorized chip; if the verification fails, judging that the authorization detection fails; if the verification succeeds, a business program starts to normally run.

4. A chip-based offline authorization system, characterized by The system comprises an authorized chip, an authorization center and a device, wherein the authorization center is connected with the authorized chip through a chip tool, and a business program runs in the device; wherein the authorization center is configured to perform the following operations: reading a serial number of the authorized chip; generating a random number as a private key of the authorized chip; According to the private key, a certificate request is made, wherein the certificate request comprises user information, and the user information is a serial number of the authorized chip; the certificate request further comprises a certificate validity period, and the certificate validity period is an authorized time of the authorized chip; The certificate request is subjected to certificate issuance by a corresponding business certificate authority CA to generate an authorized certificate of the chip; wherein the business CA is selected by a root CA; The private key of the authorized chip and the authorized certificate are written into the authorized chip to complete authorization of the chip.

5. The chip-based off-line authorization system of claim 4, wherein, The private key of the authorized chip is encrypted and stored in an external unreadable area.

6. A chip-based offline authorization system, characterized by The offline authorization method is implemented according to any one of claims 1-3, and the system comprises an authorized chip, an authorized center and a device, wherein the authorized center is in communication connection with the authorized chip via a chip tooling, and a business program runs in the device; The device is configured to perform the following operations: read a serial number of the authorized chip; read an authorized certificate of the authorized chip; read user information of the authorized certificate and compare the user information with the serial number of the authorized chip; if the user information is inconsistent with the serial number of the authorized chip, it is determined that the verification fails; if the user information is consistent with the serial number of the authorized chip, the business CA certificate of the business program of the device is used to verify the legality of the authorized certificate, wherein the business CA certificate of the business program of the device is a CA certificate of a corresponding business in the authorized center; if the authorized certificate is not a certificate issued by the authorized center or the authorized certificate is not a certificate issued by the business CA of the business program of the device, it is determined that the authorized certificate is an illegal certificate; if the authorized certificate is a certificate issued by the authorized center and the authorized certificate is a certificate issued by the business CA of the business program of the device, the validity time of the authorized certificate is read.

7. The chip-based off-line authorization system of claim 6, wherein, The device is further configured to perform the following operations: compare the validity time of the authorized certificate with a local time; if the validity time of the authorized certificate is not within the validity period, the authorization detection fails; if the validity time of the authorized certificate is within the validity period, a random number is generated and sent to the authorized chip; receive a signature result, and use the authorized certificate to verify the signature result, wherein the signature result is generated by signing the random number by the authorized chip; if the verification fails, the authorization detection fails; if the verification succeeds, the business program starts normal operation.

Images