Software license information monitoring method and device, server and storage medium

Abstract

Embodiments of the present application provide a kind of software license information monitoring method, device, server and storage medium, involve software management technical field.The scheme of the embodiment of the present application includes: every specified time length generates transaction information block, transaction information block includes license information, and license information includes the available time length balance of the software to be protected when generating transaction information block, and the root encryption value is calculated according to the transaction information block generated.Then generate information block, information block includes the root encryption value and transaction list, and transaction list includes the transaction information block generated in order.Information block is added to information chain, and information chain includes the information block generated in order.The method can avoid software license information to be tampered with and take effect, improve security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software management, in particular to a software license information monitoring method and device, a server and a storage medium. BACKGROUND

[0002] Commercial software generally needs to be controlled by a license, thereby limiting the user's use permission of the commercial software. License control refers to controlling the user's use of the software within their own permissions through license information. The software license information can include the effective time of the software, the legal use duration and the number of permitted nodes.

[0003] The legal use duration refers to the duration during which the user can legally use the software, such as 60 days, 365 days, etc. When the user uses the software beyond the legal use duration, the software function will be limited or unavailable. The number of permitted nodes refers to the maximum number of nodes that can use the software. For example, if a user buys a one-year use permission of a software gateway, the software gateway allows a maximum of 100 routers to access, the legal use duration of the software gateway is 365 days, and the number of permitted nodes is 100. When 100 routers have accessed the software gateway, if a new router requests to access the software gateway, the access request of the router is rejected.

[0004] License control is mainly to avoid tampering with the license information. The current license control method is as follows: when the software is deployed, the hardware information of the host where the software is located is obtained, which includes but is not limited to the Media Access Control (MAC) address of the host's network card and the hard disk serial number. Then a key is generated according to the hardware information, the license information is encrypted by the key to form a ciphertext. In the process of software running, the ciphertext is decrypted to obtain the license information, and license control is performed according to the obtained license information.

[0005] However, the encryption of the license information depends on the hardware information of the host. If the host is a virtual machine or the host is in a containerized scenario, it will be difficult to obtain the hardware information of the host, and it is difficult to effectively protect the license information. In addition, even if the hardware information of the host can be obtained and encrypted using the hardware information, if the tamperer also obtains the hardware information of the host, the ciphertext can be decrypted, and the license information is at risk of being tampered with, and the security is poor. SUMMARY

[0006] The embodiments of the present application aim to provide a software license information monitoring method, device, server and storage medium to avoid license information from being tampered and take effect, and improve security. The specific technical solutions are as follows.

[0007] In a first aspect, the embodiments of the present application provide a software license information monitoring method applied to a server, and the method comprises the following steps.

[0008] Generating a transaction information block every specified time length, wherein the transaction information block comprises license information, and the license information comprises a balance of available time length of the software to be protected at the time of generating the transaction information block;

[0009] Calculating a root encryption value according to the generated transaction information block;

[0010] Generating an information block, wherein the information block comprises the root encryption value and a transaction list, and the transaction list comprises the transaction information blocks generated in sequence;

[0011] Adding the information block to an information chain, wherein the information chain comprises the information blocks generated in sequence.

[0012] In a possible implementation, the balance of available time length of the software to be protected is determined by the following steps:

[0013] Obtaining a current system time and an effective time of the software to be protected;

[0014] Determining a used time length of the software to be protected according to a difference between the current system time and the effective time of the software to be protected;

[0015] Determining the balance of available time length of the software to be protected according to a difference between a total available time length of the software to be protected and the used time length.

[0016] In a possible implementation, after the step of generating the information block, the method further comprises the following steps:

[0017] Broadcasting the information block to a backup node of the server and / or an external cache to form a backup information chain of the information chain in the backup node and / or the external cache.

[0018] In a possible implementation, the information block comprises header information, and the header information comprises the root encryption value and a parent encryption value;

[0019] The method further comprises the following steps:

[0020] Obtaining header information of a previous information block generated before the information block;

[0021] Calculating the parent encryption value based on the obtained header information of the previous information block.

[0022] In a possible implementation, the generating the information block comprises:

[0023] generating a data part of the information block, the data part comprising a balance of a time length available for the software to be protected;

[0024] calculating an encryption value of the information block according to the data part of the information block;

[0025] adding the encryption value of the information block to header information of the information block.

[0026] In a possible implementation, the calculating the root encryption value according to the generated transaction information block comprises:

[0027] calculating, according to the generated one or more transaction information blocks, an encryption value of each transaction information block by using a preset encryption algorithm on the permission information of each transaction information block;

[0028] calculating a component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks;

[0029] calculating the root encryption value by using the preset encryption algorithm on the component encryption value.

[0030] In a second aspect, the present application provides a monitoring method of software permission information, applied to a server, and permission information of software to be protected is stored in the form of an information chain;

[0031] The information chain comprises information blocks established in sequence, and the information blocks comprise a transaction list and a root encryption value; the transaction list comprises transaction information blocks generated in sequence, and the transaction information blocks comprise permission information; the permission information comprises a balance of a time length available for the software to be protected when the transaction information blocks are generated; and the root encryption value is obtained by encrypting the permission information.

[0032] The method comprises:

[0033] calculating a root encryption value according to each transaction information block comprised in a transaction list of a to-be-verified information block;

[0034] comparing the calculated root encryption value with a root encryption value stored in the to-be-verified information block;

[0035] determining whether the permission information of the software to be protected is tampered with according to a comparison result.

[0036] In a possible implementation, the header information in the information block includes a root encryption value and a parent encryption value; the parent encryption value is an encryption value generated according to the header information of a previous information block generated before the current information block; and the method further includes:

[0037] obtaining the header information of the previous information block of the to-be-verified information block;

[0038] calculating an encryption value based on the obtained header information of the previous information block;

[0039] comparing the encryption value calculated based on the header information of the previous information block with the parent encryption value stored in the to-be-verified information block;

[0040] determining whether the license information of the to-be-protected software is tampered with according to a comparison result.

[0041] In a possible implementation, the header information of the information block further includes an encryption value of the information block, the encryption value of the information block being an encryption value calculated according to a data part of the information block, and the data part of the information block including the license information of the to-be-protected software when the information block is generated.

[0042] The method further includes:

[0043] calculating an encryption value of the to-be-verified information block according to a data part of the to-be-verified information block;

[0044] comparing the calculated encryption value of the to-be-verified information block with the encryption value of the to-be-verified information block stored in the to-be-verified information block;

[0045] determining whether the license information of the to-be-protected software is tampered with according to a comparison result.

[0046] In a possible implementation, the calculating a root encryption value according to the license information of each transaction information block included in the transaction list in the to-be-verified information block includes:

[0047] calculating, for one or more transaction information blocks included in the transaction list in the to-be-verified information block, an encryption value of each transaction information block by using a preset encryption algorithm on the license information of each transaction information block;

[0048] calculating a component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks;

[0049] calculating the root encryption value by using the preset encryption algorithm on the component encryption value.

[0050] In a possible implementation, the component encryption value is calculated according to the preset encryption algorithm and encryption values of the one or more transaction information blocks, and the calculation of the component encryption value includes:

[0051] For each preset number of continuous transaction information blocks in the transaction list of the to-be-verified information block, the encryption values of the preset number of continuous transaction information blocks are calculated by using the preset encryption algorithm, to obtain a paragraph encryption value.

[0052] The at least one calculated paragraph encryption value is calculated by using the preset encryption algorithm, to obtain the component encryption value.

[0053] In a possible implementation, the method further includes:

[0054] The available duration balance included in each transaction information block in the transaction list included in the to-be-verified information block is compared with the available duration balance included in a previous transaction information block.

[0055] According to the comparison result, it is determined whether the available duration balance of the to-be-protected software is tampered with.

[0056] In a possible implementation, the method further includes:

[0057] The latest generated information block in the backup information chain is obtained from a backup node and / or an external cache.

[0058] The information block obtained from the backup node and / or the external cache is compared with the to-be-verified information block.

[0059] According to the comparison result, it is determined whether the license information of the to-be-protected software is tampered with.

[0060] In a third aspect, the present application provides a software license information monitoring device, applied to a server, and the device includes:

[0061] A generation module is configured to generate a transaction information block every specified duration, and the transaction information block includes license information, and the license information includes an available duration balance of the to-be-protected software when the transaction information block is generated.

[0062] A calculation module is configured to calculate a root encryption value according to the generated transaction information block.

[0063] The generation module is further configured to generate an information block, and the information block includes the root encryption value and a transaction list, and the transaction list includes the transaction information blocks generated in sequence.

[0064] A storage module is configured to add the information block to an information chain, and the information chain includes the information blocks generated in sequence.

[0065] In a possible implementation, the generating module is specifically configured to determine the available time length balance of the software to be protected by the following steps:

[0066] obtaining a current system time and an effective time of the software to be protected;

[0067] determining a used time length of the software to be protected according to a difference between the current system time and the effective time of the software to be protected;

[0068] determining the available time length balance of the software to be protected according to a difference between the total available time length of the software to be protected and the used time length.

[0069] In a possible implementation, the apparatus further includes:

[0070] a broadcasting module configured to broadcast the information block to a backup node of the server and / or an external cache to form a backup information chain of the information chain in the backup node and / or the external cache.

[0071] In a possible implementation, the information block includes header information, and the header information includes the root encryption value and a parent encryption value.

[0072] The computing module is further configured to:

[0073] obtain header information of a previous information block generated before the information block;

[0074] compute the parent encryption value based on the obtained header information of the previous information block.

[0075] In a possible implementation, the generating module is specifically configured to:

[0076] generate a data part of the information block, and the data part includes the available time length balance of the software to be protected at present;

[0077] compute the encryption value of the information block according to the data part of the information block;

[0078] add the encryption value of the information block to the header information of the information block.

[0079] In a possible implementation, the computing module is specifically configured to:

[0080] compute the license information of each transaction information block by using a preset encryption algorithm according to the generated one or more transaction information blocks, to obtain the encryption value of each transaction information block respectively;

[0081] compute the component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks.

[0082] The preset encryption algorithm is used to calculate the component encryption value, and the root encryption value is obtained.

[0083] In a fourth aspect, the embodiments of the present application provide a software license information monitoring device, applied to a server, license information of a software to be protected is stored in the form of an information chain;

[0084] The information chain includes information blocks established in sequence, and the information blocks include a transaction list and a root encryption value; the transaction list includes transaction information blocks generated in sequence, the transaction information blocks include license information, and the license information includes a balance of a usable time length of the software to be protected when the transaction information blocks are generated; and the root encryption value is obtained by encrypting the license information.

[0085] The device includes:

[0086] A calculation module is configured to calculate a root encryption value according to each transaction information block included in a transaction list of a to-be-verified information block.

[0087] A verification module is configured to compare the calculated root encryption value with a root encryption value stored in the to-be-verified information block, and determine whether the license information of the software to be protected is tampered with according to a comparison result.

[0088] In a possible implementation, the information block includes header information, and the header information includes a root encryption value and a parent encryption value; the parent encryption value is an encryption value generated according to header information of a last information block generated before the current information block; and the device further includes:

[0089] A obtaining module is configured to obtain header information of the last information block of the to-be-verified information block.

[0090] The calculation module is further configured to calculate an encryption value based on the obtained header information of the last information block.

[0091] The verification module is further configured to compare the encryption value calculated based on the header information of the last information block with a parent encryption value stored in the to-be-verified information block, and determine whether the license information of the software to be protected is tampered with according to a comparison result.

[0092] In a possible implementation, the header information of the information block further includes an encryption value of the information block, and the encryption value of the information block is an encryption value calculated according to a data part of the information block, and the data part of the information block includes license information of the software to be protected when the information block is generated.

[0093] The computing module is further configured to compute the encrypted value of the to-be-verified information block according to a data part of the to-be-verified information block.

[0094] The verifying module is further configured to compare the computed encrypted value of the to-be-verified information block with the encrypted value of the to-be-verified information block stored in the to-be-verified information block, and determine whether the license information of the to-be-protected software is tampered with according to a comparison result.

[0095] In a possible implementation, the computing module is specifically configured to:

[0096] For one or more transaction information blocks included in the transaction list in the to-be-verified information block, the license information of each transaction information block is computed by using a preset encryption algorithm, and an encrypted value of each transaction information block is obtained respectively;

[0097] A component encrypted value is computed according to the preset encryption algorithm and the encrypted values of the one or more transaction information blocks;

[0098] The component encrypted value is computed by using the preset encryption algorithm, and a root encrypted value is obtained.

[0099] In a possible implementation, the computing module is specifically configured to:

[0100] For each preset number of continuous transaction information blocks in the transaction list in the to-be-verified information block, the encrypted values of the preset number of continuous transaction information blocks are computed by using the preset encryption algorithm, and a paragraph encrypted value is obtained;

[0101] The at least one computed paragraph encrypted value is computed by using the preset encryption algorithm, and the component encrypted value is obtained.

[0102] In a possible implementation, the verifying module is further configured to:

[0103] Whether the available duration balance included in each transaction information block in the transaction list included in the to-be-verified information block is less than the available duration balance included in a previous transaction information block is compared;

[0104] Whether the available duration balance of the to-be-protected software is tampered with is determined according to a comparison result.

[0105] In a possible implementation, the obtaining module is further configured to obtain, from a backup node and / or an external cache, an information block newly generated in a backup information chain;

[0106] The verifying module is further configured to compare the information block obtained from the backup node and / or the external cache with the to-be-verified information block, and determine whether the license information of the to-be-protected software is tampered with according to a comparison result.

[0107] In a fifth aspect, the embodiments of the present application further provide a server, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication with each other through the communication bus.

[0108] The memory is used for storing a computer program.

[0109] The processor is used for executing the program stored on the memory, and realizes the method steps of the first aspect.

[0110] In a sixth aspect, the embodiments of the present application further provide a server, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication with each other through the communication bus.

[0111] The memory is used for storing a computer program.

[0112] The processor is used for executing the program stored on the memory, and realizes the method steps of the second aspect.

[0113] In a seventh aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the method in the first aspect.

[0114] In an eighth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the method in the second aspect.

[0115] In a ninth aspect, the embodiments of the present application further provide a computer program product containing instructions, which, when running on a computer, causes the computer to execute the method in the first aspect.

[0116] In a tenth aspect, the embodiments of the present application further provide a computer program product containing instructions, which, when running on a computer, causes the computer to execute the method in the second aspect.

[0117] According to the technical solution, the root encryption value is calculated according to the license information included in each transaction information block that has been generated, and if the license information included in any transaction information block is tampered with, the root encryption value will change. In the embodiment of the application, the root encryption value is calculated according to each transaction information block included in the transaction list of the to-be-verified information block, and whether the license information is tampered with can be determined by comparing the calculated root encryption value with the stored root encryption value. Because the hardware information is not used when the root encryption value is generated, as long as the tamperer does not know the encryption algorithm used in the embodiment of the application, it is difficult to tamper with the root encryption value. Even if the tamperer tampers with the information in all transaction information blocks, as long as the root encryption value is not tampered with, the tampered license information can be found through the above process, and the tampered license information can be avoided from being used. Therefore, the software license information monitoring method can improve the security of the software license information without using the hardware information of the host computer.

[0118] Of course, implementing any product or method of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0119] In order to more clearly illustrate the technical solutions of the embodiments of the present application and the prior art, the drawings needed to be used in the embodiments and the prior art are briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0120] Figure 1 An exemplary schematic diagram of a data structure of a transaction information block provided by an embodiment of the present application;

[0121] Figure 2 An exemplary schematic diagram of a data structure of a hash tree provided by an embodiment of the present application;

[0122] Figure 3 An exemplary schematic diagram of a data structure of an information block provided by an embodiment of the present application;

[0123] Figure 4 An exemplary schematic diagram of a data structure of an information chain provided by an embodiment of the present application;

[0124] Figure 5 An exemplary schematic diagram of a relationship between devices in a distributed cluster system provided by an embodiment of the present application;

[0125] Figure 6 An exemplary schematic diagram of a License device implementing read-write functions provided by an embodiment of the present application;

[0126] Figure 7A flow chart of a software license information monitoring method provided by an embodiment of the present application is shown in FIG. 1.

[0127] Figure 8 A flow chart of another software license information monitoring method provided by an embodiment of the present application is shown in FIG. 2.

[0128] Figure 9 An exemplary flow chart of a software license information monitoring method provided by an embodiment of the present application is shown in FIG. 3.

[0129] Figure 10 A structural diagram of a software license information monitoring device provided by an embodiment of the present application is shown in FIG. 4.

[0130] Figure 11 A structural diagram of another software license information monitoring device provided by an embodiment of the present application is shown in FIG. 5.

[0131] Figure 12 A structural diagram of a server provided by an embodiment of the present application is shown in FIG. 6. DETAILED DESCRIPTION

[0132] To make the objectives, technical solutions, and advantages of the present application clearer, further detailed description will be made to the present application with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative work fall within the protection scope of the present application.

[0133] In the related art, software License information is generally encrypted by hardware information. If the host of the software is a physical machine, the hardware information of the physical machine can be collected by the corresponding function of the operating system. If the host of the software is a virtual machine, the hardware information of the virtual machine is virtual and variable, and thus the virtualization software of the manufacturer of the virtual machine is needed to collect the hardware information of the physical machine where the virtual machine is located. If the virtualization software does not support the function of obtaining the hardware information of the physical machine, the hardware information of the physical machine cannot be obtained.

[0134] In addition, if the software is deployed in a container, the physical machine where the software is located is easy to change due to the portability and dynamic characteristics of the container. Therefore, in the containerization scenario, the hardware information of the physical machine where the software is located will be difficult to obtain. Therefore, it will be difficult to encrypt the license information of the software by using the hardware information of the physical machine.

[0135] At present, large software generally adopts a distributed cluster architecture system, and license information will also be saved in a distributed manner. The encryption method of license information by using hardware information of a host is not applicable to a distributed cluster. Therefore, the use scenario of the method of protecting license information by using hardware information is limited, and the security is poor.

[0136] To solve the above problems, an embodiment of the present application provides a software license information monitoring method.

[0137] Since the license information of software is relatively sensitive data, the server needs to monitor the license information of software, so as to ensure that the license information of the installed software is not tampered with.

[0138] The present disclosure takes the encryption algorithm as a hash algorithm as an example to introduce the data structure of the transaction information block, the information block and the information chain involved in the present disclosure. It should be understood that the encryption algorithm is not limited to the hash algorithm. For example, the present disclosure can also use a shift encryption algorithm and other encryption algorithms to calculate the encryption value.

[0139] In the software license information monitoring method provided by the present disclosure, the server can generate a transaction information block according to the license information of the software every day for the software to be protected. Of course, the frequency of generating the transaction information block can also be one transaction information block every two days, or two transaction information blocks every day. The frequency of generating the transaction information block is not limited.

[0140] (1) As shown in Figure 1 , the data structure diagram of the transaction information block in the embodiment of the present application is shown. The transaction information block includes header information and a data part. Figure 1 The header information of the transaction information block includes the serial number of the transaction information block and the hash value of the transaction information block. The hash value of the transaction information block is obtained by performing a hash operation on the data part of the transaction information block.

[0141] The data part of the transaction information block includes the available duration balance. The available duration balance is the remaining available time of the software to be protected.

[0142]

[0143] ​Optionally, the data part of the transaction information block can further include at least one of a component identifier, a timestamp, a number of permission nodes, a random number, and a reserved field. The component identifier can be used to indicate which component the generated transaction information block is for, because the software component can also be used as an independent software product for development or consumers. The timestamp is the system time when the transaction information block is generated. By adding the random number, the encryption or decryption method for calculating the transaction information block can be more complex, and the difficulty of tampering with the hash value of the transaction information block is increased. The random number can be a 16-bit random number. The reserved field is used for subsequent expansion of the content of the data part of the transaction information block.

[0144] (2) After the transaction information block is generated, the transaction information block can be encrypted based on the generated transaction information block to obtain a data structure composed of encrypted values.

[0145] This embodiment takes the use of a hash algorithm as an example to illustrate the concepts involved in the method of the present disclosure. In the case of using a hash algorithm as the encryption algorithm, a hash tree can be generated based on the generated transaction information block. As shown in Figure 2 Figure 2 is a data structure diagram of the hash tree in the embodiment of the present application. It is assumed that the software to be protected includes two components, component 1 and component 2. Figure 2 Each TX represents a data part of a transaction information block, or each TX represents a transaction information block. It is assumed that component 1 and component 2 have been used for 60 days, and 60 transaction information blocks have been generated for component 1, which correspond to Figure 2 TX1 to TX60 in the upper half; and 60 transaction information blocks have been generated for component 2, which correspond to Figure 2 TX1 to TX60 in the lower half.

[0146] The hash values of every 5 TXs are spliced respectively, and then the spliced results are subjected to hash operation to obtain paragraph hash values.

[0147] Then, the paragraph hash values corresponding to the same component are spliced, and then subjected to hash operation to obtain a component hash value.

[0148] Taking component 1 as an example, the hash values of TX1-TX5 are spliced, and then subjected to hash calculation to obtain the paragraph hash value of TX1-TX5, which is detailed in Hash(1-5) in Figure 2 . The paragraph hash value corresponding to TX6-TX10, the paragraph hash value corresponding to TX10-TX15, and so on until the paragraph hash value of TX56-TX60 are calculated, and 12 paragraph hash values of component 1 can be obtained.

[0149] ​The 12 paragraph hash values of component 1 are spliced and hashed to obtain the component hash value of component 1, which is detailed in component Hash (1-60) in Figure 2 In this embodiment, the component hash information includes the component hash value and the data part of the last generated transaction information block of the component. The component hash information of component 1 includes the component hash value of component 1 and the information of TX60 of component 1.

[0150] Based on the same calculation method, the component hash information of component 2 can be obtained, which includes the component hash value of component 2 and the information of TX60 of component 2.

[0151] The component hash value of component 1 and the component hash value of component 2 are spliced and hashed to obtain the root hash value.

[0152] If the software to be protected only includes one component, such as component 1, after obtaining the paragraph hash value of component 1, the paragraph hash value of component 1 is spliced and hashed to obtain the root hash value.

[0153] In the above calculation process, each 5 transaction information blocks are taken as a paragraph to calculate the paragraph hash value. If there are less than 5 transaction information blocks generated, such as only 4 transaction information blocks, the paragraph hash value is calculated based on the hash values of the 4 transaction information blocks. Or 53 transaction information blocks have been generated, and the last paragraph hash value calculated is the paragraph hash value of TX50 to TX53.

[0154] In the above, the paragraph hash value is calculated based on the hash value of each 5 transaction information blocks as an example. In actual implementation, it is not limited to 5, such as 2 or 3.

[0155] (3) After obtaining the hash tree shown in Figure 3 , the information block can be generated based on the hash tree and the transaction list. As shown in Figure 3 , the information block can be generated based on the hash tree and the transaction list. As shown in Figure 2The data structure of the information block is shown in the embodiment of the present application. The information block also includes the header information and the data part from the data structure, in addition, the information block also includes the transaction part. The header information of the information block is used to store the hash value generated according to the transaction information block. The header information of the information block can include any one or more of the parent hash value, the hash value of the current information block, and the root hash value. Optionally, the header information can also include any one or more of the time stamp, the random value and the serial number. The parent hash value is the hash value obtained by performing the hash operation on the header information of the last information block generated before the current information block; for example, according to the time sequence, the information block 1, the information block 2, the information block 3 and the information block 4 have been generated, and the information block 5 is currently being generated, then the parent hash value included in the header information of the information block 5 is the hash value obtained by performing the hash operation on the header information of the information block 4.

[0156] The hash value of the current information block is the hash value obtained by performing the hash operation on the data part of the current information block;

[0157] The root hash value is the root hash value in Figure 2 .

[0158] The time stamp is the system time when the current information block is generated;

[0159] The serial number included in the header information is the serial number of the current information block, for example, the current information block is the 5th information block generated for the software to be protected, then the serial number included in the header information is 5.

[0160] The data part of the information block is used to store the component hash information. For example, the data part of the information block includes Figure 4 the component hash information of the component 1 and the component hash information of the component 2.

[0161] The transaction part of the information block is used to store the data part of the transaction information block generated by each component. For example, the transaction part of the information block can include the transaction list of the component 1 and the transaction list of the component 2, wherein the transaction list of the component 1 includes TX1-TX60 which have been generated for the component 1, and the transaction list of the component 2 includes TX1-TX60 which have been generated for the component 2.

[0162] (4) The data structure formed according to the information block generated in a certain order, which is called information chain in the present disclosure. As shown in Figure 4 , the data structure of the information chain provided in the embodiment of the present application is shown in the figure. Figure 4

[0163] ​The information chain includes information blocks established in sequence, the first generated information block in the information chain is referred to as a genesis block in the present disclosure, the data structure of the genesis block is the same as that of other information blocks, and the genesis block includes the total available time length of the component in terms of content, that is, the total available time length of the component.

[0164] Figure 4 Two information blocks generated after the genesis block are exemplarily shown in FIG. 2, and in actual implementation, the number of information blocks is not limited thereto.

[0165] As an example, one transaction information block can be generated every day, and the above-mentioned hash tree is calculated based on all generated transaction information blocks, and then one information block is created every day, that is, one information block is added to the information chain every day. Figure 5 An information block is added to the information chain as shown in FIG. 3.

[0166] The software license information monitoring method provided by the embodiment of the present application can be applied to a distributed cluster system including multiple servers, and the method process provided by the embodiment of the present application can be executed by the servers included in the distributed cluster system.

[0167] In an implementation, a License device can be deployed in a distributed cluster system where software to be protected is located, the License device is a process or a part of a process. The License device can be specifically deployed in any server of the distributed cluster system, and the License device is used to implement the method process provided by the embodiment of the present application.

[0168] Optionally, multiple License devices can also be deployed in the distributed cluster system, one of the License devices is used as a master node, and the other License devices are used as backup nodes. The master node is used to store and / or verify the license information of the software to be protected. The backup nodes are used to verify the license information of the software to be protected.

[0169] Figure 5 A schematic diagram of the relationship between devices in a distributed cluster system provided by the embodiment of the present application is shown in FIG. 4. Figure 5 As shown in FIG. 4, three License devices are deployed in the distributed cluster system, which are License device 1, License device 2 and License device 3, and each License device has a data read-write function.

[0170] The business service device can communicate with the License device 1, the License device 2 and the License device 3 through an application programming interface (API) gateway.

[0171] The business service device is used to control the software license of the software to be protected. Specifically, it is used to manage the user's use of the software to be protected. For example, the business service device can determine whether the user has permission to use the software to be protected by the license information of the software to be protected.

[0172] In other words, an API gateway can implement routing and load balancing functions.

[0173] A service device can send a read request to the API gateway. When the API gateway receives a read request from a service device, it can forward the read request to the appropriate server using a load balancing strategy or by random selection. Figure 5 One of the license devices in the system reads the license information of the software to be protected and sends it to the business service device through the API gateway. The business service device then performs software license control based on the read license information.

[0174] The write function of the license device can be used to write the license information of the software to be protected and to prevent the license information from being tampered with.

[0175] Figure 6 The License device, API gateway, and business service device are all software deployed in a distributed cluster system. Specifically, the License device, API gateway, and business service device can be deployed on one server in the distributed cluster system, or they can be deployed on multiple servers in the distributed cluster system.

[0176] like Figure 6 As shown, Figure 6 This is an exemplary schematic diagram illustrating the read / write functionality of the license device provided in this application embodiment. The service device can request to read the license information stored in the license device via an API gateway. Furthermore, the license device writes the latest license information at specified intervals. Figure 6 The three licensed devices can elect one licensed device as the master node through an election mechanism, while the other two licensed devices serve as backup nodes.

[0177] Figure 6 Taking License device 1 as the master node and License device 2 and License device 3 as backup nodes as an example, License device 1 writes information every specified time interval, that is, it generates the latest license information of the software to be protected and stores the license information.

[0178] After the license device 1 generates the license information, the generated license information is synchronized to the license device 2 and the license device 3, and the license device 2 and the license device 3 check the stored license information every preset time period, so as to prevent the license information from being tampered. Alternatively, the license device 1 can also check the stored license information every preset time period.

[0179] The period in which the master node writes the license information can be the same as the period in which the backup node checks the license information, for example, the master node writes the license information once a day. Correspondingly, the backup node checks the license information once a day. Alternatively, in order to enhance security, the backup node can also shorten the checking period, for example, check once an hour.

[0180] Figure 5 For example, the API gateway receives a read request, forwards the read request to the license device 3 according to the load balancing strategy, and the license device 3 can process the read request subsequently.

[0181] It should be noted that, if Figures 1 to 6 If there is only one license device in the system as shown in the figure, the license device can complete the writing and checking of the license information.

[0182] For the convenience of understanding, first, the related content involved in the embodiments of the present application is explained and described.

[0183] The embodiments of the present application can store and check the license information in the granularity of software or in the granularity of components included in the software.

[0184] If the granularity is software, the license information of the software to be protected is stored and checked. The license information of the software to be protected includes the available time balance of the software to be protected, and optionally, the number of license nodes of the software to be protected.

[0185] If the granularity is component, the license information of each component included in the software to be protected is stored and checked. The license information of the component includes the available time balance of the component, and optionally, the number of license nodes of the component.

[0186] The preset encryption algorithm used in the process of storing and checking the license information in the embodiments of the present application can be a hash algorithm, a shift algorithm, etc.

[0187] The following takes the component as the protection granularity and the hash algorithm as the preset encryption algorithm used as an example.

[0188] It should be understood that the following concepts involved in the present disclosure can be known based on the above embodiments regarding paragraph hash values, component hash values, component hash information, and root hash values, since the present disclosure does not limit the type of encryption algorithm employed:

[0189] Paragraph encryption value: the encryption value obtained by performing encryption calculation on the encryption values of a preset number of consecutive transaction information blocks is referred to as a paragraph encryption value;

[0190] Component encryption value: the encryption value obtained by performing encryption calculation on at least one or more paragraph encryption values generated by the same component is referred to as a component encryption value;

[0191] Component encryption information: the component encryption information can be determined according to the component encryption value and the last generated transaction information block of the component. The component encryption information can include all contents of the last generated transaction information block, or include only the data part of the last generated transaction information block, or include only the available duration balance and the number of permission nodes of the last generated transaction information block. Specifically, the component encryption information can be selected according to actual needs.

[0192] Root encryption value: the encryption value obtained by performing encryption calculation on the component encryption values of different components or the same component is referred to as a root encryption value.

[0193] Parent encryption value: the encryption value obtained by performing encryption calculation on the header information of the last information block generated before the current information block.

[0194] The following will be described in detail in combination with Figure 7 The monitoring method of software license information provided by the embodiments of the present application is described in detail.

[0195] As shown in Figure 1 The present application provides a monitoring method of software license information, which is applied to a server, and the method comprises the following steps:

[0196] S701, the server generates a transaction information block every specified duration.

[0197] In an embodiment, a transaction information block of the software to be protected is generated every specified duration, and the transaction information block includes license information, and the license information includes the available duration balance of the software to be protected at the time of generating the transaction information block.

[0198] In the present disclosure, the software to be monitored by the server is referred to as the software to be protected, and the software to be protected can be a plurality of components included in the software, or an independently used software.

[0199] Taking the software to be protected including component 1 and component 2 as an example, if the specified time length is 1 day, one transaction information block is generated for component 1 every day, and one transaction information block is generated for component 2 every day.

[0200] It can be understood that the available time length balance included in the transaction information block generated every day decreases in turn.

[0201] Optionally, the license information further includes a number of license nodes. Other information can also be included in the transaction information block, which can be referred to in detail in Figure 1 .

[0202] S702, the server calculates a root encryption value according to the generated transaction information block.

[0203] This step can be specifically implemented as follows: the server calculates the encryption value of each transaction information block by using a preset encryption algorithm to calculate the license information of each transaction information block according to the generated one or more transaction information blocks. Then, the component encryption value is calculated according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks, and the root encryption value is obtained by using the preset encryption algorithm to calculate the component encryption value.

[0204] If it is the first day that the user is authorized to use the software to be protected, that is, only one transaction information block has been generated, the server calculates the root encryption value according to the one transaction information block. If it is not the first day that the user is authorized to use the software to be protected, the server calculates the root encryption value according to the generated multiple transaction information blocks.

[0205] Taking the preset encryption algorithm as a hash algorithm as an example, the encryption values involved in the embodiments of the present application can all be hash values.

[0206] For each generated transaction information block, referring to the data structure of the transaction information block shown in Figure 3 , the license information of the transaction information block includes the available time length balance. In order to improve security, other information in the data part of Figure 2 may also be included. Hash operation is performed on the data part of each transaction information block to obtain the hash value of each transaction information block.

[0207] Then, the component hash value is obtained by performing hash operation on the hash values of each generated transaction information block, and the root hash value can be calculated according to the hash algorithm and the component hash value. For example, if the hash values of five transaction information blocks are 101, 102, 103, 104 and 105, the five hash values can be spliced to obtain 101102103104105, and the hash operation is performed on the value to obtain the component hash value.

[0208] The five hash values can be hashed again after other values are added to the five hash values respectively, for example, 5 is added to the five hash values respectively, and then the hash values of the five transaction information blocks are updated to 106, 107, 108, 109 and 200, and then the hash operation is performed to obtain the component hash value.

[0209] If the software to be protected includes multiple components, the component hash value of each component can be calculated according to the hash value of the transaction information block of each component. Then, the component hash value of each component is spliced, and the hash operation is performed to obtain the root hash value. The calculation process can be referred to the description of the root hash value in the foregoing Figure 3 . By calculating the root hash value, the hash tree shown in Figure 5 can be obtained.

[0210] S703, the server obtains the header information of the last information block generated before the current information block to be generated.

[0211] For example, it is the 60th day of using the software to be protected, that is, the 60th information block needs to be generated, and the last information block is the information block generated on the 59th day.

[0212] The header information of the last information block can include the root encryption value and the parent encryption value of the last information block. Optionally, the header information can also include other data, which can be referred to the description of the header information in the foregoing Figure 3 .

[0213] S704, the server calculates the parent encryption value based on the obtained header information of the last information block.

[0214] It is assumed that the last information block is the 59th information block, and the hash operation is performed on the content included in the header information of the 59th information block to obtain the hash value of the header information of the 59th information block. The hash value of the header information of the 59th information block is the parent hash value of the 60th information block. The parent hash value will be stored in the header information of the 60th information block.

[0215] In the embodiments of the present application, the execution order between S702 and S703-S704 is not limited. That is, the root encryption value can be calculated first, or the parent encryption value can be calculated first, or both of them can be calculated at the same time.

[0216] S705, the server generates the information block.

[0217] The information block can include the root encryption value and the transaction list, and the transaction list includes the transaction information blocks generated in sequence.

[0218] Referring to Figure 2 , the server needs to generate the header information, the data part and the transaction list of the information block respectively.

[0219] The head information can include the encryption value of the information chain in addition to the parent encryption value and the root encryption value. Based on this, the process of generating the information block includes:

[0220] generating a data part of the information block. The data part of the information block includes the available time balance of the software to be protected. The encryption value of the information block is calculated based on the data part of the information block, and the encryption value of the information block is added to the head information of the information block. For example, if the available time balance of the software to be protected included in the data part of the information block is 10 days, the encryption operation can be performed on 10 to obtain the encryption value of the information block.

[0221] The data part of the information block can be specifically a component hash information in a hash tree of Figure 3 The hash value of the information block can be obtained by performing a hash operation on the data part of the information block.

[0222] After the root hash value, the parent hash value, and the hash value of the information block are calculated, the information block as shown in Figure 6 can be generated.

[0223] S706, the server adds the information block to the information chain, and the information chain includes the information blocks generated in sequence.

[0224] In the embodiments of the present application, the server can add the information block to the last of the information chain after generating the information block every day. In an implementation, the information chain is stored by serialization encryption.

[0225] The above method provided by the present disclosure can be used in a distributed cluster system. If there is a backup node of the server, the server can send the information block to the backup node of the server after generating the information block each time;

[0226] In the method provided by the present disclosure, the generated information block can also be cached by additionally setting a cache space. Therefore, the server can also send the information block to an external cache after generating the information block each time.

[0227] By the above method, a backup information chain of the information chain can be formed in the backup node and / or the external cache. The server can compare the information chain stored by itself with the backup information chain in the backup node and / or the external cache to determine whether the information chain is modified, thereby improving the security of the information chain.

[0228] In combination with Figure 6 , the server can send the information block to the backup node and / or the external cache after generating the information block each time. Figure 8For example, the License device 1, the License device 2 and the License device 3 in the above embodiment are respectively deployed in the server 1, the server 2 and the server 3, and the server 2 and the server 3 are backup nodes of the server 1. After the server 1 generates the information block, the server 1 can send the information block to the server 2 and the server 3.

[0229] In the above embodiment, when the server generates the transaction information block, the server needs to determine the available time length balance of the software to be protected. The available time length balance of the software to be protected can be determined by the following steps:

[0230] Step 1, the server obtains the current system time and the effective time of the software to be protected.

[0231] Step 2, the server determines the used time length of the software to be protected according to the difference between the current system time and the effective time of the software to be protected.

[0232] Step 3, the server determines the available time length balance of the software to be protected according to the difference between the total available time length of the software to be protected and the used time length.

[0233] For example, the effective time of the software to be protected is April 1, 2020, the effective time can be the first registration time of the software to be protected, the current system time of the server is April 20, 2020, and the total available time length of the software to be protected is 30 days. It can be determined that the software to be protected has been used for 20 days, and the available time length balance is 10 days.

[0234] If the software to be protected includes multiple components, the effective time and the total available time length of each component can be different, and the available time length balance of each component is determined respectively. For a component, the server determines the available time length balance of the component by obtaining the current system time and the effective time of the component, determining the used time length of the component according to the difference between the current system time and the effective time of the component. Then, the available time length balance of the component is determined according to the difference between the total available time length of the component and the used time length.

[0235] The embodiments of the present disclosure also provide a software license information monitoring method, which is applied to a server. As shown in the method includes: Figure 8

[0236] S801, the server calculates a root encryption value according to each transaction information block included in the transaction list of the information block to be verified.

[0237] The information block to be verified is an information block already stored in the information chain. In an implementation, the information block to be verified is the last information block currently generated.

[0238] ​In the embodiments of the present application, the to-be-verified information block in the information block can be verified once every hour, or can be verified once every five information blocks generated. Of course, the frequency of verification is not limited to the above embodiments, and can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0239] The server calculates the license information of each transaction information block in the one or more transaction information blocks included in the transaction list of the to-be-verified information block by using a preset encryption algorithm, respectively obtains an encryption value of each transaction information block. Then, the server calculates a component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks. Then, the server calculates a root encryption value by using the preset encryption algorithm on the component encryption value.

[0240] The server calculates the component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks, which can be specifically implemented as follows: the server calculates, for each preset number of continuous transaction information blocks in the transaction list of the to-be-verified information block, an encryption value of the preset number of continuous transaction information blocks by using the preset encryption algorithm, and obtains a paragraph encryption value. Then, the server calculates the component encryption value by using the preset encryption algorithm on the at least one paragraph encryption value obtained.

[0241] The method for calculating the root encryption value in this step is the same as the method for calculating the root encryption value in the process of generating the information block, and specific reference can be made to the related description in the above embodiments.

[0242] S802, the server compares the root encryption value calculated with the root encryption value stored in the to-be-verified information block.

[0243] In the embodiments of the present application, if all the information included in the information block is not tampered with, the root encryption value calculated should be the same as the root encryption value stored in the to-be-verified information block. If the license information included in the to-be-verified information block is tampered with, the root encryption value calculated will be different from the root encryption value stored in the to-be-verified information block.

[0244] The embodiments of the present application can complete the verification of the to-be-verified information block through the root encryption value. In order to further increase the security of the license information, subsequent S803-S805 can also be executed to verify the to-be-verified information block through the parent encryption value, and / or subsequent S806-S807 can also be executed to verify the to-be-verified information block through the encryption value of the to-be-verified information block. Since the parameters used in the above three verification processes are different, the embodiments of the present application do not limit the execution order between S801-S802, S803-S805 and S806-S807. Figure 3 For example, S801 to S807 are sequentially executed in the above embodiments.

[0245] S803, the server acquires the header information of the previous information block of the to-be-verified information block.

[0246] The previous information block of the to-be-verified information block is an information block generated before the to-be-verified information block.

[0247] The header information of the previous information block can include a root encryption value and / or a parent encryption value, and optionally, can further include Figure 5 Other information in the header information of the information block.

[0248] S804, the server calculates an encryption value based on the acquired header information of the previous information block.

[0249] The method of calculating the encryption value in this step is the same as the method of calculating the parent encryption value when the to-be-verified information block is generated, and reference can be made to the related description in the above embodiments, which will not be described herein again.

[0250] S805, the server compares the encryption value calculated based on the header information of the previous information block with the parent encryption value stored in the to-be-verified information block.

[0251] Since the way of calculating the encryption value in this step is the same as the method of calculating the parent encryption value when the to-be-verified information block is generated, if any information included in the header information of the previous information block of the to-be-verified information block is tampered with, the calculated encryption value will be different from the parent encryption value stored in the to-be-verified information block.

[0252] For S803 to S805, for example, if the to-be-verified information block is information block 50, the previous information block of the to-be-verified information block is information block 49. The header information of the to-be-verified information block 50 includes a parent encryption value, which is an encryption value calculated based on the header information of information block 49 when information block 50 is generated.

[0253] In the verification process, the server can acquire the header information of information block 49, and perform encryption calculation on the header information of information block 49 acquired at this time to calculate an encryption value.

[0254] Then, the encryption value calculated at this time is compared with the parent encryption value stored in the header information of information block 50. If the two are different, it means that the header information included in information block 49 has been tampered with, or the parent encryption value stored in information block 50 has been tampered with.

[0255] S806, the server calculates an encryption value based on the acquired header information of the previous information block.

[0256] In the embodiment of the present application, the data part of the to-be-verified information block can include license information of the to-be-protected software when the to-be-verified information block is generated. If the to-be-protected software includes multiple components, the data part of the to-be-verified information block includes license information of each component.

[0257] The method for calculating the encryption value of the to-be-verified information block in this step is the same as the method for calculating the encryption value of the to-be-verified information block when the to-be-verified information block is generated, and reference can be made to the related description in the above embodiment, which will not be repeated here.

[0258] S807, the server compares the calculated encryption value of the to-be-verified information block with the encryption value of the to-be-verified information block stored in the to-be-verified information block.

[0259] For example, the encryption value of the to-be-verified information block stored in the to-be-verified information block is the encryption value of the to-be-verified information block calculated when the to-be-verified information block is generated. Figure 6 If any information in the data part of the to-be-verified information block is tampered with, the calculated encryption value of the to-be-verified information block will be different from the encryption value of the to-be-verified information block stored in the to-be-verified information block.

[0260] S808, the server determines whether the license information of the to-be-protected software is tampered with according to the comparison result.

[0261] For example, if the comparison result in any of S802, S805 and S807 is different, it means that the license information of the to-be-protected software is tampered with.

[0262] If any of the transaction information blocks of the to-be-protected software includes tampered license information, the encryption value of the transaction information block will change, and then the root encryption value will change. In the embodiment of the present application, the root encryption value is recalculated based on the transaction list included in the to-be-verified information block, and if the calculated root encryption value is different from the root encryption value stored in the to-be-verified information block, it can be determined that the license information of the to-be-protected software is tampered with. As can be seen, the tampering of the license information by the tamperer is easy to be found, and the tampering difficulty is relatively large, and the security of the license information of the to-be-protected software is improved without using the hardware information of the host.

[0263] In addition, if the license information included in the previous information block of the to-be-verified information block is tampered with, the header information of the previous information block will change, and thus the encryption value calculated according to the header information of the previous information block will be different from the parent encryption value stored in the to-be-verified information block. Therefore, by comparing the calculated encryption value with the parent encryption value stored in the to-be-verified information block, it can be determined whether the previous information block is tampered with. Since the encryption value calculated according to the header information of the previous information block is included in each information block in the information chain, that is, each information block has a parent encryption value, if the tamperer wants the tampering to go undetected, he needs to modify the parent encryption value included in each information block, which is very difficult. Therefore, by using this method, the security of the license information of the to-be-protected software can be improved.

[0264] Similarly, if the license information of the to-be-protected software is tampered with, the data part of the to-be-verified information block will change, and thus the calculated encryption value of the to-be-verified information block will be different from the encryption value of the to-be-verified information block stored in the to-be-verified information block. When the tamperer does not know the encryption algorithm used in the present application, it is difficult to tamper with the encryption value of the to-be-verified information block. Therefore, by comparing the calculated encryption value of the to-be-verified information block with the stored encryption value of the to-be-verified information block, it can be determined whether the license information is tampered with, and the security of the license information is improved.

[0265] In another embodiment of the present application, another license information monitoring method is also provided, which specifically includes:

[0266] The server compares whether the available time length balance included in each transaction information block in the to-be-verified information block is less than the available time length balance included in the previous transaction information block. According to the comparison result, it is determined whether the available time length balance of the to-be-protected software is tampered with.

[0267] The previous information block of a transaction information block refers to the last transaction information block generated before the transaction information block. For example, if a transaction information block is generated every day, the available time length balance in each transaction information block included in the transaction list decreases in turn. Assuming that the transaction list includes transaction information block 1 to transaction information block 3, it can be compared whether the available time length balance included in transaction information block 2 is 1 day less than the available time length balance included in transaction information block 1, and whether the available time length balance included in transaction information block 3 is 1 day less than the available time length balance included in transaction information block 2.

[0268] If the available time length balance included in transaction information block 3 is 27, and the available time length balance included in transaction information block 2 is 20, it can be determined that the available time length balance included in transaction information block 3 is tampered with.

[0269] In another embodiment of the present application, another license information monitoring method is also provided, which includes:

[0270] The server obtains the latest generated information block in the backup information chain from the backup node and / or the external cache, compares the information block obtained from the backup node and / or the external cache with the to-be-verified information block, and determines whether the license information of the to-be-protected software is tampered with according to a comparison result.

[0271] In combination Figure 6 , still taking the License device 1, the License device 2 and the License device 3 in Figure 9 as examples, the License device 1, the License device 2 and the License device 3 are respectively deployed in the server 1, the server 2 and the server 3, and the server 2 and the server 3 are backup nodes. The server 2 can obtain the latest generated information block in the backup information chain of the server 3, for example, the information block 60. Then the server 2 compares the information block 60 stored in the server 2 with the obtained information block 60, and if the two are inconsistent, it is determined that the license information in the server 2 and / or the server 3 is tampered with.

[0272] Further, the server 2 can obtain the information block 60 from the external cache, compare the information block 60 stored in the server 2 with the information block 60 obtained from the external cache, and if the two are consistent, it is indicated that the information block 60 stored in the server 2 is not tampered with; if the two are inconsistent, it is indicated that the information block 60 stored in the server 2 is tampered with, and the server 2 can replace the information block 60 stored in the server 2 with the information block 60 obtained from the external cache. Alternatively, the server 2 can obtain the entire information chain from the external cache, replace the information chain stored in the server 2 with the information chain obtained from the external cache, and thus complete the correction of the tampered license information.

[0273] The complete flow of the embodiment of the present application is introduced below. As shown in Figure 9 , when the License device is started, if a plurality of License devices are included in the distributed cluster system, the License devices can determine the master node and the backup node through a competitive mechanism. Figure 9 Then the master node loads the information chain stored in the local encrypted sequence. If the information chain exists, it is indicated that it is not the first start, and the information chain is normally loaded from the local; if the information chain does not exist, it is determined whether the to-be-protected software is a newly deployed software.

[0274]

[0275] ​If the software to be protected is new software, the master node obtains the genesis block information from the message queue and the total available time length and the number of license nodes of each component included in the software to be protected from the License server of the distributed cluster system. Wherein, the genesis block information can be pre-configured in the message queue when the software to be protected is deployed. After the master node reads the genesis block information from the message queue, the genesis block information will be deleted from the message queue. After the user purchases the use right of the software to be protected, the total available time length and the number of license nodes of each component included in the software to be protected will be stored in the License server. If the user renews the use right to extend the use period and / or increase the number of license nodes, the total available time length and / or the number of license nodes of the software to be protected stored in the License server will also be updated accordingly.

[0276] If the software to be protected is not new software, the master node obtains the existing information chain from the external cache.

[0277] Then the master node starts to execute a timing task. As an example, the timing task can trigger the master node to interact with the License server through a heartbeat message every 5 minutes to obtain the latest total available time length and the number of license nodes of the software to be protected, so as to ensure the accuracy of the total available time length and the number of license nodes of each component used by the master node.

[0278] The timing task can also trigger the master node to generate a transaction block for each component every day. Based on the generated transaction block, an information block is generated and sent to the backup node. In another embodiment, the master node can also directly send the information block to the external cache of the master node. The external cache refers to other cache space inside the master node, which is used to back up the information block.

[0279] Wherein, the master node can send the information block to the backup node and the external cache in a unicast or broadcast manner.

[0280] If the master node broadcasts the information block in a broadcast manner, the backup node and the external cache can obtain the information block from the message queue and add the information block to the backup information chain, Figure 9 The process of obtaining the information block by the backup node and the external cache is omitted in the above embodiment.

[0281] After the master node generates the information block, the information block is also added to the locally saved information chain, and the information block is serialized and encrypted, Figure 10 The process of adding the information block to the locally saved information chain is omitted in the above embodiment.

[0282] For each backup node, the information block is checked by a timing task. As an example, the backup node can check the information block once every 1 hour.

[0283] Firstly, the backup node performs tampering check on system time. The backup node can acquire the transaction list in the information block to be verified, and compare whether the available time length balance included in each transaction information block in the transaction list is less than the available time length balance included in the previous transaction information block. If not, it is determined that the verification result is abnormal, indicating that the available time length balance in the transaction information block may be incorrect due to the tampering of the system time. If it is determined that the verification result is abnormal, the abnormality is broadcasted, so that the master node and other backup nodes can learn the abnormality according to the received broadcast message.

[0284] If the verification result is normal, integrity check is performed. The integrity check refers to recalculating the root hash value, the parent hash value and the hash value of the information block according to the transaction list included in the information block to be verified, and comparing the recalculated root hash value, the recalculated parent hash value and the recalculated hash value of the information block with the stored root hash value, the stored parent hash value and the stored hash value of the information block in the information block, respectively. If any one is different, it is determined that the license information is tampered, i.e. the verification result is abnormal. Then the abnormality is broadcasted.

[0285] If the verification result is normal, consistency check is performed. The consistency check refers to checking whether the information block to be verified stored in the master node and each backup node is the same, and whether the information block to be verified stored in the master node and each backup node is the same as the information block to be verified in the external cache. If there is a different case, it is said that the verification is abnormal, i.e. the information block to be verified in the master node or the backup node is tampered. Then the abnormality is broadcasted.

[0286] The above verification order is only an example, and the embodiments of the present application are not limited to performing according to the above verification order. The verification methods mentioned in the above embodiments can be independently executed, or can be executed according to other orders.

[0287] The master node and the backup node can both perform memory maintenance. That is, the master node and the backup node can acquire the abnormality of the information block to be verified from the message queue, and can acquire the correct information chain from the external cache through the consistency fault tolerance algorithm to complete the update of the locally stored information chain.

[0288] The master node and / or the backup node can also provide the license information of each component to the business service device through the API gateway. In the case where it is determined that the license information provided to the business service device is tampered, the business service device can also be informed through the API gateway, and the correct license information can be sent to the business service device through the API gateway, so that the business service device can control the license of each component of the software to be protected according to the correct license information.

[0289] In combination with the above embodiments, the software license information monitoring method can protect the information to be protected from being tampered in the following aspects.

[0290] Aspect one, if the system time is adjusted forward, the available time length balance in the newly generated transaction information block becomes longer. The embodiment of the application can compare the available time length balance in the transaction information block with the available time length balance in the previous transaction information block in the transaction list. If the available time length balance in the current transaction information block is greater than the available time length balance in the previous information block, the system time can be corrected in time, so as to store the correct transaction information block. In addition, if the system time is adjusted forward, the timestamp in the newly generated transaction information block will be smaller than the timestamp in the previous transaction information block, so the tampering method of adjusting the system time forward can be easily avoided.

[0291] Aspect two, if the available time length balance in the transaction information block of a component of the software to be protected is tampered with, the hash value of the transaction information block will change, and then the hash value of the information block and the root hash value will change, so the tampering can be found by recalculating the hash value of the information block and the root hash value, so that the tampered available time length balance cannot take effect.

[0292] Aspect three, if the component hash information included in the information block is tampered with, the root hash value will change. The hash value of the information block included in the header information of the information block is generated according to the component hash information of each component, and the tampering of the component hash information will also cause the header information of the information block to change.

[0293] Since the parent hash value included in the header information of the next information block is the hash value of the header information of the current information block, if the component hash information of the current information block is tampered with, the header information of the current information block will change, which will cause the parent hash value included in the next information block to be incorrect. If the tampering is to take effect, the parent hash value included in each subsequent information block needs to be further tampered with, which is difficult to achieve. If the subsequent each information block cannot be modified, the tampering of the component hash information cannot take effect.

[0294] Aspect four, since the genesis block in the information chain can only be generated once based on the preconfigured genesis block information, the genesis block cannot be modified, and the information chain is also serialized and encrypted, and cannot be directly modified without decryption, which further ensures the security of the license information.

[0295] Aspect five, if the information chain stored in a server is tampered with, the information chain stored in the backup node and the external cache can also be used for verification, that is, as long as the information chain in the external cache is not tampered with, the tampering of the information chain of any server can be found and corrected.

[0296] Aspect six, if the container image of the license device is tampered with, the un-tampered information chain can also be obtained from the container image of another license device or the external cache, ensuring the security of the software license information in the containerization scenario.

[0297] Based on the same technical concept, the embodiments of the present application also provide a software license information monitoring device, which is also referred to as the license device in the previous embodiments. The device can be configured in a server, and specifically, as shown in Figure 11 The device includes:

[0298] The generation module 1001 is configured to generate a transaction information block every specified time length, the transaction information block including license information, and the license information including a balance of available time length of the software to be protected at the time of generating the transaction information block.

[0299] The calculation module 1002 is configured to calculate a root encryption value according to the generated transaction information block.

[0300] The generation module 1001 is further configured to generate an information block, the information block including the root encryption value and a transaction list, and the transaction list including the transaction information blocks generated in sequence.

[0301] The storage module 1003 is configured to add the information block to an information chain, the information chain including the information blocks generated in sequence.

[0302] In an embodiment, the generation module 1001 is specifically configured to determine the balance of available time length of the software to be protected by the following steps:

[0303] Obtaining a current system time and an effective time of the software to be protected.

[0304] Determining a used time length of the software to be protected according to a difference between the current system time and the effective time of the software to be protected.

[0305] Determining the balance of available time length of the software to be protected according to a difference between a total available time length of the software to be protected and the used time length.

[0306] In an embodiment, the device further includes:

[0307] The broadcast module is configured to broadcast the information block to a backup node of the server and / or an external cache, so as to form a backup information chain of the information chain in the backup node and / or the external cache.

[0308] In an embodiment, the information block includes header information, and the header information includes the root encryption value and a parent encryption value.

[0309] The calculation module 1002 is further configured to:

[0310] Retrieve the header information of the previous information block generated before the current information block;

[0311] The parent encrypted value is calculated based on the header information of the previous information block.

[0312] In one implementation, the generation module 1001 is specifically used for:

[0313] The data portion of the generated information block includes the remaining available time of the currently protected software;

[0314] Calculate the encrypted value of the information block based on the data portion of the information block;

[0315] Add the encrypted value of the information block to the header information of the information block.

[0316] In one embodiment, the calculation module 1002 is specifically used for:

[0317] Based on one or more generated transaction information blocks, the permission information of each transaction information block is calculated using a preset encryption algorithm to obtain the encryption value of each transaction information block.

[0318] The component encryption value is calculated based on the preset encryption algorithm and the encryption value of one or more transaction information blocks;

[0319] The root encryption value is obtained by calculating the encryption value of the component using a preset encryption algorithm.

[0320] Based on the same technical concept, this application also provides a software license information monitoring device, which is the License device mentioned in the previous embodiments. This device can be configured in a server. Specifically, the license information of the software to be protected is stored in the form of an information chain;

[0321] The information chain consists of information blocks built in sequence, each containing a transaction list and a root encrypted value. The transaction list consists of transaction information blocks generated in sequence, each containing license information. The license information includes the remaining available time of the software to be protected when the transaction information block is generated. The root encrypted value is obtained by encrypting the license information.

[0322] like Figure 12 As shown, the device includes:

[0323] The calculation module 1101 is used to calculate the root encryption value based on each transaction information block included in the transaction list of the information block to be verified.

[0324] The checking module 1102 is configured to compare the calculated root encryption value with the root encryption value stored in the information block to be checked, and determine whether the license information of the software to be protected is tampered with according to a comparison result.

[0325] In an embodiment, the header information of the information block includes the root encryption value and the parent encryption value, wherein the parent encryption value is an encryption value generated according to the header information of the last information block generated before the current information block; the device further includes:

[0326] The obtaining module is configured to obtain the header information of the last information block of the information block to be checked;

[0327] The calculation module 1101 is further configured to calculate the encryption value based on the obtained header information of the last information block.

[0328] The checking module 1102 is further configured to compare the encryption value calculated based on the header information of the last information block with the parent encryption value stored in the information block to be checked, and determine whether the license information of the software to be protected is tampered with according to a comparison result.

[0329] In an embodiment, the header information of the information block further includes an encryption value of the information block, and the encryption value of the information block is an encryption value calculated according to a data part of the information block, and the data part of the information block includes the license information of the software to be protected when the information block is generated.

[0330] The calculation module 1101 is further configured to calculate the encryption value of the information block to be checked according to the data part of the information block to be checked.

[0331] The checking module 1102 is further configured to compare the calculated encryption value of the information block to be checked with the encryption value of the information block to be checked stored in the information block to be checked, and determine whether the license information of the software to be protected is tampered with according to a comparison result.

[0332] In an embodiment, the calculation module 1101 is specifically configured to:

[0333] For one or more transaction information blocks included in the transaction list in the information block to be checked, the license information of each transaction information block is calculated by using a preset encryption algorithm, and the encryption value of each transaction information block is obtained respectively;

[0334] The component encryption value is calculated according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks.

[0335] The root encryption value is obtained by calculating the component encryption value by using the preset encryption algorithm.

[0336] In an embodiment, the calculation module 1101 is specifically configured to:

[0337] For each set of consecutive transaction information blocks in the transaction list to be verified, a preset encryption algorithm is used to calculate the encryption value of the preset set of consecutive transaction information blocks to obtain the segment encryption value.

[0338] Using a preset encryption algorithm, the encrypted value of at least one paragraph is calculated to obtain the encrypted value of the component.

[0339] In one embodiment, the verification module 1102 is further configured to:

[0340] Compare the available time balance of each transaction information block to the transaction list included in the information block to be verified, and see if it is less than the available time balance of the preceding transaction information block.

[0341] The comparison results determine whether the remaining available time of the software to be protected has been tampered with.

[0342] In one implementation, the acquisition module is further configured to acquire the latest generated information block in the backup information chain from the backup node and / or external cache;

[0343] The verification module 1102 is also used to compare the information block obtained from the backup node and / or external cache with the information block to be verified; and to determine whether the license information of the software to be protected has been tampered with based on the comparison result.

[0344] This application also provides a server, such as... ​ As shown, it includes a processor 1201, a communication interface 1202, a memory 1203, and a communication bus 1204. The processor 1201, the communication interface 1202, and the memory 1203 communicate with each other through the communication bus 1204.

[0345] Memory 1203 is used to store computer programs;

[0346] The processor 1201, when executing a program stored in the memory 1203, implements the steps of the above-described method for monitoring software license information.

[0347] The communication bus mentioned in the above server can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0348] The communication interface is configured to communicate between the server and other devices.

[0349] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0350] The aforementioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. It can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0351] In another embodiment provided in the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of the software license information monitoring method.

[0352] In another embodiment provided in the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of the software license information monitoring method.

[0353] In the embodiments described above, all or some of the steps can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, all or some of the steps can be implemented in the form of one or more computer programs or program elements. The computer programs reside (at least temporarily) in a memory of a computer during execution. The memory can be a RAM memory, a flash memory, a ROM memory, an EPROM memory, or any other suitable memory. The memory can be integral to or separate from the computer. The computer programs can be written in any suitable programming language, such as C, C++, Java, Visual Basic, etc. The computer programs can be written in assembly or machine language, if desired. The computer programs can be distributed over network coupled file servers, or can be distributed by any other suitable means.

[0354] It is to be understood that the terminology "first", "second" and the like used throughout this specification are merely used to distinguish one entity or action from another entity or action, and do not imply or suggest any actual relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0355] Each of the embodiments described in the specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0356] The above description is only the preferred embodiment of the present application, and is not used to limit the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A monitoring method of software license information applied to a server, characterized by, The method comprises: generating a transaction information block every specified time length, the transaction information block comprising license information, the license information comprising a balance of available time length of the software to be protected at the time of generating the transaction information block; calculating a root encryption value according to the generated transaction information block, the root encryption value being an encryption value calculated according to different component encryption values or component encryption values of the same component, the component encryption value being an encryption value calculated according to at least one or more paragraph encryption values generated by the same component, the paragraph encryption value being an encryption value calculated by encrypting the encryption values of a preset number of consecutive transaction information blocks; generating an information block, the information block comprising the root encryption value and a transaction list, the transaction list comprising the transaction information blocks generated in sequence; adding the information block to an information chain, the information chain comprising the information blocks generated in sequence.

2. The method of claim 1, wherein, The balance of available time length of the software to be protected is determined by the following steps: obtaining a current system time and an effective time of the software to be protected; determining a used time length of the software to be protected according to the difference between the current system time and the effective time of the software to be protected; determining the balance of available time length of the software to be protected according to the difference between the total available time length of the software to be protected and the used time length.

3. The method according to claim 1 or 2, characterized in that, After the information block is generated, the method further comprises: broadcasting the information block to a backup node of the server and / or an external cache to form a backup information chain of the information chain in the backup node and / or the external cache.

4. The method of claim 1, wherein, The information block comprises header information, the header information comprising the root encryption value and a parent encryption value; The method further comprises: obtaining the header information of a previous information block generated before the information block; calculating the parent encryption value based on the obtained header information of the previous information block.

5. The method of claim 4, wherein, The generation of the information block comprises: generating a data part of the information block, the data part comprising the balance of available time length of the software to be protected at present; calculating an encryption value of the information block according to the data part of the information block; adding the encryption value of the information block to the header information of the information block.

6. The method of claim 1, wherein, The calculation of the root encryption value according to the generated transaction information block comprises: calculating the license information of each transaction information block to obtain the encryption value of each transaction information block by using a preset encryption algorithm according to one or more generated transaction information blocks; calculating a component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks; calculating the component encryption value by using the preset encryption algorithm to obtain the root encryption value.

7. A method for monitoring software license information, applied to a server, characterized in that, The license information of the software to be protected is stored in the form of an information chain. The information chain comprises information blocks established in sequence, and the information blocks comprise a transaction list and a root encryption value; the transaction list comprises transaction information blocks generated in sequence, and the transaction information blocks comprise license information, wherein the license information comprises a balance of available time length of the software to be protected when the transaction information block is generated, and the root encryption value is encrypted according to the license information; the root encryption value is an encryption value calculated according to component encryption values of different components or the same component; the component encryption value is an encryption value calculated according to at least one or more paragraph encryption values generated by the same component; and the paragraph encryption value is an encryption value calculated according to encryption values of a preset number of continuous transaction information blocks. The method comprises: calculating a root encryption value according to each transaction information block included in a transaction list of a to-be-verified information block; comparing the calculated root encryption value with a root encryption value stored in the to-be-verified information block; determining whether license information of the software to be protected is tampered with according to a comparison result.

8. The method of claim 7, wherein, The information block comprises header information, and the header information comprises a root encryption value and a parent encryption value; the parent encryption value is an encryption value generated according to header information of a last information block generated before the current information block; and the method further comprises: obtaining header information of the last information block of the to-be-verified information block; calculating an encryption value based on the obtained header information of the last information block; comparing the encryption value calculated based on the header information of the last information block with a parent encryption value stored in the to-be-verified information block; determining whether license information of the software to be protected is tampered with according to a comparison result.

9. The method of claim 8, wherein, The header information of the information block further comprises an encryption value of the information block, and the encryption value of the information block is an encryption value calculated according to a data part of the information block, and the data part of the information block comprises license information of the software to be protected when the information block is generated; The method further comprises: calculating an encryption value of the to-be-verified information block according to a data part of the to-be-verified information block; comparing the calculated encryption value of the to-be-verified information block with an encryption value of the to-be-verified information block stored in the to-be-verified information block; determining whether license information of the software to be protected is tampered with according to a comparison result.

10. The method of claim 7, wherein, The calculation of the root encryption value according to the license information of each transaction information block included in the transaction list in the to-be-verified information block comprises: for one or more transaction information blocks included in the transaction list in the to-be-verified information block, calculating the license information of each transaction information block by using a preset encryption algorithm to obtain an encryption value of each transaction information block; calculating a component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks; and calculating the root encryption value by using the preset encryption algorithm on the component encryption value.

11. The method of claim 10, wherein, The calculation of the component encryption value according to the preset encryption algorithm and the encryption values of the one or more transaction information blocks comprises: For each preset number of continuous transaction information blocks in the transaction list included in the to-be-verified information block, the preset encryption algorithm is used to calculate the encryption value of the preset number of continuous transaction information blocks, to obtain a paragraph encryption value; The preset encryption algorithm is used to calculate the at least one calculated paragraph encryption value, to obtain the component encryption value.

12. The method of claim 7, wherein, The method further comprises: comparing whether the available duration balance included in each transaction information block in the transaction list included in the to-be-verified information block is less than the available duration balance included in the previous transaction information block; determining whether the available duration balance of the to-be-protected software is tampered with according to the comparison result.

13. The method of claim 7, wherein, The method further comprises: obtaining the latest generated information block in the backup information chain from the backup node and / or the external cache; comparing the information block obtained from the backup node and / or the external cache with the to-be-verified information block; determining whether the license information of the to-be-protected software is tampered with according to the comparison result.

14. A server, characterized by The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method in any one of claims 1-13. The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method in any one of claims 1-13. ​ 15. A computer-readable storage medium, characterized in that, ​

Images