Software license generation, verification method and device

Abstract

The present invention provides a software license generation and verification method and device, which relates to the field of computer software technology. The generation method comprises: receiving a software license generation request including a TPM public key, a TPM public key certificate and authorization information sent by a device to be authorized; after verifying that the TPM public key certificate is passed, generating a software license plain text according to the authorization information; generating a software license ciphertext according to the TPM public key and the software license plain text; sending the software license ciphertext to the device to be authorized, so that the device to be authorized can restore the software license plain text according to the built-in TPM private key and the software license ciphertext, and the TPM private key corresponds to the TPM public key. The present invention overcomes the security problems that the operating environment is easily simulated and the authorization information is easily tampered.

Description

Technical Field

[0001] The present invention relates to the field of computer software technology, and in particular to a method and device for generating and verifying a software license. Background Art

[0002] The generation and verification of software licenses is an important part of commercial software release, especially for paid commercial software. Before the software is run, a safe and efficient software license verification mechanism can effectively control the number of target groups using the software and the period of use of the software by the authorized groups, thereby maximizing the benefits of paid products and protecting the intellectual property rights of software developers.

[0003] In traditional software license authorization schemes, for software licenses authorized to machine A, attackers can simulate A's operating environment on other similar machines and continuously copy A's software licenses to make the same software license run on other unauthorized machines. The authorized use period of the software is usually stored in plain text in the configuration file. Crackers can relatively easily modify the authorized use period of the software and use the software indefinitely without authorization. Vulnerabilities in software license generation and verification are not conducive to the protection of software developers' intellectual property rights and cause huge economic losses to software developers. Summary of the invention

[0004] The present invention provides a software license generation and verification method and device, which are used to solve the security problems of the software license mode in the prior art that the operating environment is easy to be simulated and the authorization information is easy to be tampered.

[0005] In a first aspect, the present invention provides a method for generating a software license, comprising:

[0006] Receive a software license generation request including a TPM public key, a TPM public key certificate, and authorization information sent by a device to be authorized;

[0007] After verifying that the TPM public key certificate is passed, generating a software license plain text according to the authorization information;

[0008] Generate a software license ciphertext according to the TPM public key and the software license plaintext;

[0009] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0010] According to a software license generation method provided by the present invention,

[0011] Generating a software license ciphertext according to the TPM public key and the software license plaintext includes:

[0012] Generate an intermediate key to encrypt the software license plaintext to obtain a first intermediate ciphertext;

[0013] Encrypting the intermediate key according to the TPM public key to obtain a second intermediate ciphertext;

[0014] concatenating the first intermediate ciphertext and the second intermediate ciphertext into the software license ciphertext,

[0015] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized recovers the software license plaintext according to the built-in TPM private key and the software license ciphertext, including:

[0016] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized decrypts the second intermediate ciphertext according to the built-in TPM private key to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0017] According to a software license generation method provided by the present invention,

[0018] Before sending the software license ciphertext to the device to be authorized, the method further includes:

[0019] Digitally signing the software license ciphertext using a preset signature private key to obtain signature data;

[0020] adding the signature data to the software license ciphertext,

[0021] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized recovers the software license plaintext according to the built-in TPM private key and the software license ciphertext, including:

[0022] The software license ciphertext is sent to the device to be authorized, so that after the device to be authorized verifies the signature data according to the pre-acquired signature public key, it uses the built-in TPM private key to decrypt the second intermediate ciphertext to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0023] According to a software license generation method provided by the present invention, after verifying that the TPM public key certificate is passed, the method further includes:

[0024] Generate summary information of the TPM public key and store the summary information, wherein the summary information is used to verify the TPM public key sent by the device to be authorized when the device to be authorized updates the software license.

[0025] In a second aspect, the present invention provides a software license verification method, comprising:

[0026] Upload a software license generation request including a TPM public key, a TPM public key certificate, and authorization information to a server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext;

[0027] Receiving the software license ciphertext sent by the server;

[0028] Recovering the software license plaintext containing the authorization information using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key;

[0029] The software license is verified based on the authorization information in the restored software license plain text.

[0030] According to a software license verification method provided by the present invention, the software license ciphertext includes: a first intermediate ciphertext and a second intermediate ciphertext, wherein the first intermediate ciphertext is obtained by encrypting the software license plaintext according to an intermediate key generated by a server, and the second intermediate ciphertext is obtained by encrypting the intermediate key according to the TPM public key.

[0031] The software license plain text containing the authorization information is restored using the built-in TPM private key and the software license ciphertext, including:

[0032] Decrypting the second intermediate ciphertext using the built-in TPM private key to obtain the intermediate key;

[0033] The first intermediate ciphertext is decrypted using the intermediate key to obtain the software license plaintext.

[0034] According to a software license verification method provided by the present invention, the software license ciphertext further includes: signature data, the signature data is obtained by the server digitally signing the software license ciphertext according to a preset signature private key,

[0035] Before the method uses the built-in TPM private key to decrypt the second intermediate ciphertext to obtain the intermediate key, the method further includes:

[0036] The signature data is verified according to a pre-acquired signature public key.

[0037] According to a software license verification method provided by the present invention, before performing software license verification according to authorization information in the restored software license plain text, the method further includes: determining the data format of the restored software license plain text, and outputting verification failure information if the data format does not conform to the predetermined data format.

[0038] According to a software license verification method provided by the present invention, before uploading a software license generation request including a TPM public key and authorization information to a server, the method further includes:

[0039] Determine whether the TPM key is generated in the TPM secure storage area;

[0040] When the TPM key is generated, reading a TPM public key of the TPM key;

[0041] If the TPM key is not generated, the TPM key is generated, and the generated TPM key is stored in the TPM secure storage area.

[0042] In a third aspect, the present invention provides a software license generation device, comprising:

[0043] A software license generation request receiving module, used to receive a software license generation request including a TPM public key, a TPM public key certificate and authorization information sent by a device to be authorized;

[0044] A software license plaintext generation module, used to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate;

[0045] An encryption module, used to generate a software license ciphertext according to the TPM public key and the software license plaintext;

[0046] The software license ciphertext sending module is used to send the software license ciphertext to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to the built-in TPM private key and the software license ciphertext, and the TPM private key corresponds to the TPM public key.

[0047] In a fourth aspect, the present invention provides a software license verification device, comprising:

[0048] A software license generation request uploading module, used to upload a software license generation request including a TPM public key, a TPM public key certificate and authorization information to a server, so as to request the server to generate a software license plain text according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plain text;

[0049] A software license ciphertext receiving module, used for receiving the software license ciphertext sent by the server;

[0050] A decryption module, used to recover the software license plaintext containing the authorization information by using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key;

[0051] The verification module is used to verify the software license according to the authorization information in the software license plain text.

[0052] In a fifth aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the processor implements a software license generation method as described in any one of the above, or implements a software license verification method as described in any one of the above.

[0053] In a sixth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements any of the software license generation methods described above, or implements any of the software license verification methods described above.

[0054] The software license generation and verification method and device provided by the present invention receive the TPM public key, TPM public key certificate and authorization information sent by the device to be authorized, generate the software license plain text according to the authorization information, and generate the software license ciphertext according to the TPM public key and the software license plain text, thereby avoiding the authorization information from being tampered with; and before generating the software plain text, it is necessary to verify the TPM public key certificate, and by verifying the TPM public key certificate, it is ensured that the TPM public key must be from the physical TPM chip of the device to be authorized (rather than the TPM simulated by the software); and after the subsequent software license ciphertext is sent to the device to be authorized, the software license plain text is restored according to the TPM private key corresponding to the TPM public key and the software license ciphertext built into the device to be authorized, thereby ensuring that the generated software license is physically one-to-one bound to the device to be authorized, and avoiding the problem of the running environment being simulated. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 It is a flowchart of the method for generating a software license provided by the present invention;

[0057] Figure 2 It is a flowchart of the software license verification method provided by the present invention;

[0058] Figure 3 It is a structural schematic diagram of a software license generating device provided by the present invention;

[0059] Figure 4 It is a structural schematic diagram of the software license verification device provided by the present invention;

[0060] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Trusted Platform Module (TPM) technology is a technical standard for secure cryptographic coprocessors developed by TCG (Trusted Computing Group). This technical standard has been adopted by ISO (International Organization for Standardization) as the international standard for secure cryptographic coprocessors. At present, TPM chips produced by major chip manufacturers based on TPM technical standards have been widely used in personal computers and industrial computers based on various mainstream processor architectures, and are fully supported by mainstream operating systems such as Windows and Linux.

[0063] The TPM chip can exist as a trusted root of the computer system, and its trustworthiness is based on the random number PS (Primary Seed, referred to as the seed number) that is pre-set in the secure storage area of ​​the chip when it leaves the factory. The TPM protocol ensures that during the entire life cycle of the chip, unless physically destroyed by violence, the seed number and the private key part of the asymmetric key (Primary Key, referred to as TPM key) derived from it (referred to as: TPM private key) cannot be obtained through any software. The true randomness of the seed number also guarantees the uniqueness of the TPM private key in each TPM chip. In addition, TPM chip manufacturers ensure the integrity and source reliability of the TPM public key by providing a certificate for the public key part of the TPM key (referred to as: TPM public key). Using the TPM public key with a certificate provided by the TPM chip manufacturer can ensure:

[0064] 1) This public key must come from a real physical TPM device (not a software-emulated TPM device, or public key data generated by an algorithm);

[0065] 2) Data encrypted by this public key can only be decrypted by a computing device with a TPM chip installed, and this TPM chip must store the TPM private key corresponding to this TPM public key. The TPM key derived from the seed number referred to here can be an asymmetric key generated for different types of asymmetric algorithms, including but not limited to the mainstream RSA asymmetric encryption algorithm and the Elliptic Curve Cryptography (ECC) asymmetric encryption algorithm.

[0066] By utilizing the correlation between the TPM public key and the TPM chip, the data encrypted by the TPM public key is bound to the computing device installed with the TPM at the hardware level.

[0067] Based on the above principles, the software license generation method provided by the embodiment of the present invention is as follows: Figure 1 As shown, for a server, such as a cloud server of a software developer, the method includes:

[0068] Step S110, receiving a software license generation request including a TPM public key, a TPM public key certificate and authorization information sent by the device to be authorized, wherein the authorization information includes: an identification of the device to be authorized, information about the software to be authorized and an expected authorization time. Of course, the device to be authorized refers to the above-mentioned device with a TPM chip, which will generate a TPM public key and a TPM private key. Among them, the TPM public key certificate is not data generated by the TPM chip, but a digital signature issued by the TPM chip manufacturer for the TPM public key generated by the TPM chip, to ensure that the TPM public key pointed to by this certificate must be from the physical TPM chip of this brand (not the TPM simulated by software).

[0069] Step S120, after verifying the TPM public key certificate, generate a software license plain text according to the authorization information. In this step, the timestamp data of the software license expiration time is generated. The timestamp data of the expiration time is obtained by the difference between the current time of the server and the computer reference time, plus the length of the expected authorization time. The device identifier to be authorized can be a device serial number (Serial Number, SN) or a vehicle identification number (Vehicle Identification Number, VIN), and the software information to be authorized includes: software version and other information. The device identifier to be authorized, the software information to be authorized and the timestamp data are organized in a predetermined data format (such as: Yaml data format) to form a software license plain text. If the TPM public key certificate verification fails, the cloud server will record the information that the TPM public key certificate verification failed, and return the information that the software license generation request failed to the device to be authorized. Specifically, the method of verifying the TPM public key certificate is: sending the received TPM public key certificate to the CA (Certificate Authority) server of the corresponding TPM manufacturer, and the CA server verifies whether the TPM public key certificate is legal, and returns the verification result. Alternatively, you can directly obtain the root certificate and intermediate certificates at all levels from the TPM manufacturer's CA server, and calculate the cryptographic correlation between the received TPM public key certificate and the certificate obtained from the CA server to verify the legitimacy of the TPM public key certificate.

[0070] Step S130: Generate software license ciphertext according to the TPM public key and the software license plaintext. After the software license ciphertext is generated, the software license exists in the form of ciphertext during the transmission process and in the device to be authorized, thereby preventing tampering, and the software license ciphertext can only be decrypted by a computing device with a TPM chip installed, thereby preventing the use of the software under unauthorized conditions by simulating the operating environment on other identical or similar models.

[0071] Step S140: Send the software license ciphertext to the device to be authorized, so that the device to be authorized can restore the software license plaintext, i.e., the software license, according to the built-in TPM private key corresponding to the TPM public key and the software license ciphertext. As mentioned above, the device to be authorized refers to the device with a TPM chip, and the TPM private key corresponding to the TPM public key is a TPM key pair generated by the TPM chip.

[0072] The software license generation method provided in this embodiment receives the TPM public key, TPM public key certificate and authorization information sent by the device to be authorized, generates the software license plain text according to the authorization information, and generates the software license ciphertext according to the TPM public key and the software license plain text, thereby avoiding the authorization information from being tampered with; and before generating the software plain text, it is necessary to verify the TPM public key certificate, and by verifying the TPM public key certificate, it is ensured that the TPM public key must be from the physical TPM chip of the device to be authorized (rather than the TPM simulated by the software), and after the subsequent software license ciphertext is sent to the device to be authorized, the software license plain text is restored according to the TPM private key corresponding to the TPM public key and the software license ciphertext built into the device to be authorized, thereby ensuring that the generated software license is physically one-to-one bound to the device to be authorized, avoiding the problem of the operating environment being simulated. Therefore, the software license generation method of this embodiment can ensure that the software can only be used after being authorized in a specific device, avoiding illegal cracking and piracy.

[0073] One implementation of step S130 may be to directly use the TPM public key to encrypt the software license plaintext, but the software license plaintext data volume is large, and the TPM chip is a low-speed arithmetic unit, and the decryption efficiency is low and the stability is poor during subsequent decryption. In order to improve the efficiency and stability of decryption, therefore, in this embodiment, step S130 includes:

[0074] Generate an intermediate key to encrypt the software license plaintext to obtain a first intermediate ciphertext. In this step, the intermediate key can be a symmetric key (such as a 256-bit random binary sequence) generated by a symmetric encryption algorithm, and the symmetric encryption algorithm can use AES-256 or a symmetric encryption algorithm with equivalent security level. The encryption and decryption of the software license plaintext by the randomly generated symmetric key can be run on a high-speed main CPU device (on the CPU on the server side during encryption and on the CPU of the device to be authorized during decryption, rather than the TPM chip). While efficiently verifying the software license, there is also a great deal of room for expansion of the amount of software license data, which is convenient for future expansion of the software license information content.

[0075] The intermediate key is encrypted according to the TPM public key to obtain the second intermediate ciphertext. The software license plaintext is encrypted by the randomly generated intermediate key, which is a symmetric key. The TPM public key only encrypts this randomly generated symmetric key. The length of the symmetric key is fixed and the data volume is small. For the TPM chip, which is a low-speed computing device, the symmetric key with a fixed length and a small data volume is subsequently decrypted on the device to be authorized, ensuring the efficiency and stability of decryption verification. Moreover, the symmetric key is encrypted by the TPM public key, avoiding the problem of eavesdropping during the transmission of the symmetric key, and ensuring security.

[0076] The first intermediate ciphertext and the second intermediate ciphertext are concatenated into the software license ciphertext. In the case where the software license ciphertext includes the first intermediate ciphertext and the second intermediate ciphertext, the above step S140 includes:

[0077] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized decrypts the second intermediate ciphertext according to the built-in TPM private key corresponding to the TPM public key to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0078] Furthermore, before sending the software license ciphertext to the device to be authorized, the method further includes:

[0079] The software license ciphertext is digitally signed using a preset signature private key to obtain signature data. Digital signatures can be performed in the following ways, but are not limited to:

[0080] a) Using the SHA-256 algorithm to concatenate the first intermediate ciphertext and the second intermediate ciphertext to obtain the software license ciphertext operation to generate a first digital summary.

[0081] b) Encrypt the first digital summary content using the signature private key through the RSA algorithm to generate final signature data.

[0082] The signature data is added to the software license ciphertext, that is, the software license ciphertext at this time consists of three parts: the first intermediate ciphertext, the second intermediate ciphertext and the signature data. Specifically, the three parts can be organized in the YAML data format to form the software license ciphertext.

[0083] In the case where the software license ciphertext includes the first intermediate ciphertext, the second intermediate ciphertext and the signature data, the above step S140 includes:

[0084] The software license ciphertext is sent to the device to be authorized, so that after the device to be authorized verifies the signature data according to the pre-acquired signature public key, it uses the built-in TPM private key corresponding to the TPM public key to decrypt the second intermediate ciphertext to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0085] In this embodiment, the software license ciphertext composed of the first intermediate ciphertext and the second intermediate ciphertext is digitally signed, and the signature public key corresponding to the signature private key is preset in the device to be authorized to perform the corresponding signature verification operation, which ensures that the software license cannot be forged and further enhances the non-tamperability of the software license. The signature key is different from the TPM key. It can be generated by the software manufacturer on the server that generates the software license (i.e., the cloud server of the above-mentioned software developer) through the corresponding algorithm, and the signature private key is only known by the server that generates the software license.

[0086] In this embodiment, the cloud server of the software developer and the device to be authorized may use different coding environments. In order to facilitate data transmission in different coding environments, the first intermediate ciphertext, the second intermediate ciphertext and the signature data are hexadecimal strings (0-9, a-f). It is only necessary to convert the generated binary strings of the first intermediate ciphertext, the second intermediate ciphertext and the signature data into hexadecimal strings in the above corresponding steps.

[0087] In step S120, after the TPM public key certificate is verified, the method further includes: generating summary information of the TPM public key and storing the summary information, wherein the summary information is used to verify the TPM public key sent by the device to be authorized when the device to be authorized updates the software license.

[0088] Specifically, when the device to be authorized needs to update the software license subsequently, the TPM public key and authorization information sent by the device to be authorized are received, and when the software license is updated, it is not necessary to send the TPM public key certificate.

[0089] Calculate the summary information of the received TPM public key, and compare the currently calculated summary information with the previously stored summary information for verification. If the two are consistent, it means that the verification is successful, and continue to execute the above steps after generating the software license plain text according to the authorization information to obtain the updated software license; otherwise, return an error message to the device to be authorized and stop the update operation.

[0090] In this embodiment, when the software license is generated for the first time, the summary information of the TPM public key is stored on the cloud server of the software developer, so that when the device to be authorized that has installed the authorized software needs to update the software license, it can be updated quickly, that is, there is no need to verify the TPM public key certificate again. At the same time, it also prevents other devices that also have a TPM chip but have never been authorized by it from initiating a software license update operation to obtain an updated software license.

[0091] The present invention also provides a software license verification method for a device to be authorized, such as Figure 2 As shown, including:

[0092] Step S210: Upload a software license generation request including a TPM public key, a TPM public key certificate, and authorization information to a server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext. The authorization information includes: an identification of a device to be authorized, information of the software to be authorized, and an expected authorization time. The server is usually a cloud server of a software developer.

[0093] Step S220: Receive the software license ciphertext sent by the server, where the software license ciphertext is generated in the above step S130. The software license exists in the form of ciphertext during the transmission process and in the device to be authorized, thereby preventing it from being tampered with.

[0094] Step S230: Use the built-in TPM private key corresponding to the TPM public key and the software license ciphertext to restore the software license plaintext containing the authorization information. Specifically, since the TPM private key will not leave the TPM chip, the software license ciphertext is input through the I / O interface of the TPM chip, and the decrypted software license plaintext is output through the I / O interface of the TPM chip. If the software license ciphertext is modified, the TPM chip will return an error when decrypting it, causing the software license verification process to stop and return verification failure information.

[0095] Step S240, perform software license verification according to the authorization information in the restored software license plaintext. Specifically, read the decrypted software license plaintext data for verification, and the verification steps include: identification of the device to be authorized, for example: whether the SN is consistent with the actual SN of the device to be authorized. If not, the verification fails and verification failure information is returned. If consistent, read the timestamp data and compare it with the current time of the device to be authorized. If the timestamp data is greater than the current time, return verification passed and the verification procedure ends. If the timestamp data is less than the current time, it means that the software license has expired and verification failure is returned.

[0096] The software license verification method provided in this embodiment is used to decrypt and verify the software license ciphertext generated by the above-mentioned software license generation method. Since the software license is sent in the form of ciphertext and exists in the device to be authorized, the authorization information is prevented from being tampered with; through TPM public key certificate verification, it is ensured that the TPM public key must be from the physical TPM chip of the device to be authorized (rather than the TPM simulated by the software), and after the software license ciphertext is sent to the device to be authorized, the software license plaintext can only be restored from the software license ciphertext by the device to be authorized according to the built-in TPM private key corresponding to the TPM public key, thereby ensuring that the generated software license is physically one-to-one bound to the device to be authorized, avoiding the problem of the operating environment being simulated. Therefore, the software license verification method of this embodiment can ensure that the software can only be used after being authorized in a specific device, avoiding illegal cracking and piracy.

[0097] In this embodiment, if the software license ciphertext includes: a first intermediate ciphertext and a second intermediate ciphertext, the first intermediate ciphertext is obtained by encrypting the software license plaintext according to an intermediate key generated by a server, and the second intermediate ciphertext is obtained by encrypting the intermediate key according to the TPM public key, then step S230 includes:

[0098] The second intermediate ciphertext is decrypted using a built-in TPM private key corresponding to the TPM public key to obtain the intermediate key.

[0099] The first intermediate ciphertext is decrypted using the intermediate key to obtain the software license plaintext.

[0100] Specifically, the second intermediate ciphertext is input into the TPM chip through the I / O of the TPM chip, and the decrypted information obtained by decrypting the TPM private key in the TPM chip is obtained. If the second intermediate ciphertext is modified, the TPM chip will return an error, the software license verification process stops, and the verification failure information is returned; if the decrypted data is successfully returned, that is, the intermediate key is successfully decrypted, the first intermediate ciphertext is decrypted using the intermediate key to obtain the software license plaintext, if the decryption fails, the verification failure information is returned, if the decryption is successful, the above step S240 is executed.

[0101] In this embodiment, if the software license ciphertext further includes: signature data, the signature data is obtained by the server digitally signing the software license ciphertext according to a preset signature private key, then before using the built-in TPM private key corresponding to the TPM public key to decrypt the second intermediate ciphertext to obtain the intermediate key, it also includes:

[0102] The signature data is verified according to the pre-acquired signature public key. Specifically, the first intermediate ciphertext, the second intermediate ciphertext and the signature data are obtained from the software license ciphertext, the first intermediate ciphertext and the second intermediate ciphertext are spliced ​​into an intermediate string, and the second digital summary of the intermediate string is calculated using SHA-256; the signature data is decrypted using the preset signature public key to obtain the first digital summary in the above step a), and the information of the first digital summary and the second digital summary are compared. If they are inconsistent, the software license verification process stops and the verification failure information is returned. If they are consistent, the signature verification is passed. In this embodiment, before the first intermediate ciphertext and the second intermediate ciphertext are decrypted, the signature data is verified, which ensures the unforgeability of the software license and further enhances the untamperability of the software license.

[0103] After the verification is passed, the second intermediate ciphertext is decrypted using the built-in TPM private key corresponding to the TPM public key to obtain the intermediate key. Specifically, the second intermediate ciphertext is input into the TPM through the I / O of the TPM chip, and the decryption information of the TPM chip is obtained. If the second intermediate ciphertext is modified, the TPM chip will return an error, the software license verification process stops, and the verification failure information is returned; if the decrypted data is successfully returned, that is, the intermediate key is successfully decrypted, the first intermediate ciphertext is decrypted using the intermediate key to obtain the software license plaintext. If the decryption fails, the verification failure information is returned. If the decryption succeeds, the above step S240 is executed.

[0104] It should be noted that: if in the above-mentioned method of generating a software license, the first intermediate ciphertext, the second intermediate ciphertext and the signature data are converted into hexadecimal strings, then after receiving the software ciphertext including the first intermediate ciphertext, the second intermediate ciphertext and the signature data, the corresponding hexadecimal string is first converted into a binary string and then subsequent processing is performed.

[0105] Furthermore, in order to quickly determine whether the software license ciphertext is successfully restored to the software license plaintext, before step S240, it is first determined whether the restored software license plaintext format is a predetermined data format (the software license plaintext must be generated in a certain data format, such as: Yaml data format). If the software license ciphertext has been modified, or the intermediate key decrypted by the TPM private key is incorrect, then the decrypted data format must be inconsistent with the data format of the software license plaintext, and the decrypted data content is also inconsistent. Therefore, if the data format judgment fails, the verification failure information is returned. If the data format judgment succeeds, the decrypted software license plaintext data is read for verification.

[0106] In this embodiment, before uploading the software license generation request including the TPM public key and the authorization information to the server, the following steps are also included:

[0107] It is determined whether the TPM key is generated in the TPM security storage area. If not, it indicates that this is the first time that the device to be authorized requests a software license.

[0108] When the TPM key is generated, a TPM public key of the TPM key is read.

[0109] In the case where the TPM key is not generated, the TPM key is generated and stored in the TPM secure storage area. Since generating a TPM key is a time-consuming process, it is usually generated at the first request, and the TPM key can be directly read from the TPM secure storage area in the future, which is convenient and fast.

[0110] The software license generation device provided by the present invention is described below. The software license generation device described below and the software license generation method described above can be referenced to each other.

[0111] like Figure 3 As shown, the software license generating device of the present invention comprises:

[0112] The software license generation request receiving module 310 is used to receive a software license generation request including a TPM public key, a TPM public key certificate and authorization information sent by a device to be authorized. The authorization information includes: an identification of the device to be authorized, information of the software to be authorized and an expected authorization time.

[0113] The software license plain text generation module 320 is used to generate a software license plain text according to the authorization information after verifying the TPM public key certificate.

[0114] The encryption module 330 is used to generate a software license ciphertext according to the TPM public key and the software license plaintext.

[0115] The software license ciphertext sending module 340 is used to send the software license ciphertext to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to the built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0116] The software license generation device provided by the present invention generates a software license plain text according to the authorization information by receiving the TPM public key, TPM public key certificate and authorization information sent by the device to be authorized, and generates a software license ciphertext according to the TPM public key and the software license plain text, thereby avoiding the authorization information from being tampered with; and before generating the software plain text, it is necessary to verify the TPM public key certificate, and by verifying the TPM public key certificate, it is ensured that the TPM public key must be from the physical TPM chip of the device to be authorized (rather than the TPM simulated by the software), and after the subsequent software license ciphertext is sent to the device to be authorized, the software license plain text is restored according to the TPM private key corresponding to the TPM public key built into the device to be authorized and the software license ciphertext, thereby ensuring that the generated software license is physically one-to-one bound to the device to be authorized, avoiding the problem of the operating environment being simulated. Therefore, the software license generation method of this embodiment can ensure that the software can only be used after being authorized in a specific device, avoiding illegal cracking and piracy.

[0117] Optionally, the encryption module 330 includes:

[0118] The first encryption module is used to generate an intermediate key to encrypt the software license plain text to obtain a first intermediate ciphertext.

[0119] The second encryption module is used to encrypt the intermediate key according to the TPM public key to obtain a second intermediate ciphertext.

[0120] The ciphertext concatenation module is used to concatenate the first intermediate ciphertext and the second intermediate ciphertext into the software license ciphertext.

[0121] The software license ciphertext sending module 340 is specifically used to send the software license ciphertext to the device to be authorized, so that the device to be authorized decrypts the second intermediate ciphertext according to the built-in TPM private key to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0122] Optionally, the software license generation device provided by the present invention further includes: a digital signature module, configured to digitally sign the software license ciphertext using a preset signature private key to obtain signature data; and add the signature data to the software license ciphertext.

[0123] The software license ciphertext sending module 340 is specifically used to send the software license ciphertext to the device to be authorized, so that after the device to be authorized verifies the signature data according to the pre-acquired signature public key, it uses the built-in TPM private key to decrypt the second intermediate ciphertext to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

[0124] Optionally, the software license generation device provided by the present invention further includes: a TPM public key summary generation module, used to generate summary information of the TPM public key and store the summary information, wherein the summary information is used to verify the TPM public key sent by the device to be authorized when the device to be authorized updates the software license.

[0125] The software license verification device provided by the present invention is described below. The software license verification device described below and the software license verification method described above can be referred to each other.

[0126] like Figure 4 As shown, the software license verification device of the present invention includes:

[0127] The software license generation request uploading module 410 is used to upload a software license generation request including a TPM public key, a TPM public key certificate and authorization information to a server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext, wherein the authorization information includes: an identification of a device to be authorized, information of software to be authorized and an expected authorization time.

[0128] The software license ciphertext receiving module 420 is used to receive the software license ciphertext sent by the server.

[0129] The decryption module 430 is used to recover the software license plain text containing the authorization information by using the built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0130] The verification module 440 is used to verify the software license according to the authorization information in the plain text of the software license.

[0131] The software license verification device provided by the present invention is used to decrypt and verify the software license ciphertext generated by the software license generation device. Since the software license is sent in the form of ciphertext and exists in the device to be authorized, the authorization information is prevented from being tampered with. The TPM public key certificate is verified to ensure that the TPM public key must be from the physical TPM chip of the device to be authorized (rather than the TPM simulated by the software), and after the software license ciphertext is sent to the device to be authorized, the software license plaintext can only be restored from the software license ciphertext by the device to be authorized according to the built-in TPM private key corresponding to the TPM public key, thereby ensuring that the generated software license is physically one-to-one bound to the device to be authorized, avoiding the problem of the operating environment being simulated. Therefore, the software license verification device of this embodiment can ensure that the software can only be used after being authorized in a specific device, avoiding illegal cracking and piracy.

[0132] Optionally, the software license ciphertext includes: a first intermediate ciphertext and a second intermediate ciphertext, the first intermediate ciphertext is obtained by encrypting the software license plaintext according to an intermediate key generated by a server, and the second intermediate ciphertext is obtained by encrypting the intermediate key according to the TPM public key, and the decryption module 430 includes:

[0133] The first decryption module is used to decrypt the second intermediate ciphertext by using a built-in TPM private key to obtain the intermediate key.

[0134] The second decryption module is used to decrypt the first intermediate ciphertext using the intermediate key to obtain the software license plaintext.

[0135] Optionally, the software license ciphertext further includes: signature data, where the signature data is obtained by the server digitally signing the software license ciphertext according to a preset signature private key, and the decryption module 430 further includes:

[0136] The signature verification module is used to verify the signature data based on the pre-acquired signature public key.

[0137] Optionally, the software license verification device provided by the present invention further includes: a plain text format determination module, which is used to determine the data format of the restored software license plain text, and output verification failure information if it does not conform to the predetermined data format. Of course, if it conforms to the predetermined data format, the verification module 440 is executed.

[0138] Optionally, the software license verification device provided by the present invention further includes:

[0139] The TPM key determination module is used to determine whether the TPM key is generated in the TPM secure storage area.

[0140] The TPM public key reading module is used to read the TPM public key of the TPM key when the TPM key is generated.

[0141] The TPM public key generation module is used to generate the TPM key when the TPM key has not been generated, and store the generated TPM key in the TPM secure storage area.

[0142] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540.

[0143] In an electronic device, such as a cloud server, its processor 510 may call logic instructions in the memory 530 to execute a software license generation method, the method comprising:

[0144] A software license generation request including a TPM public key, a TPM public key certificate, and authorization information is received from a device to be authorized.

[0145] After the TPM public key certificate is verified, a software license plain text is generated according to the authorization information.

[0146] A software license ciphertext is generated according to the TPM public key and the software license plaintext.

[0147] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0148] In another electronic device, such as a server to be authorized, its processor 510 may call logic instructions in the memory 530 to execute a software license verification method, the method comprising:

[0149] Upload a software license generation request including the TPM public key, TPM public key certificate and authorization information to the server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext.

[0150] Receive the software license ciphertext sent by the server.

[0151] The software license plain text containing the authorization information is restored using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0152] The software license is verified based on the authorization information in the restored software license plain text.

[0153] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0154] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the software license generation method provided by the above methods, the method comprising:

[0155] A software license generation request including a TPM public key, a TPM public key certificate, and authorization information is received from a device to be authorized.

[0156] After the TPM public key certificate is verified, a software license plain text is generated according to the authorization information.

[0157] A software license ciphertext is generated according to the TPM public key and the software license plaintext.

[0158] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0159] Or execute the software license verification method provided by the above methods, the method comprising:

[0160] Upload a software license generation request including the TPM public key, TPM public key certificate and authorization information to the server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext.

[0161] Receive the software license ciphertext sent by the server.

[0162] The software license plain text containing the authorization information is restored using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0163] The software license is verified based on the authorization information in the restored software license plain text.

[0164] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for generating a software license provided by the above methods is implemented, and the method includes:

[0165] A software license generation request including a TPM public key, a TPM public key certificate, and authorization information is received from a device to be authorized.

[0166] After the TPM public key certificate is verified, a software license plain text is generated according to the authorization information.

[0167] A software license ciphertext is generated according to the TPM public key and the software license plaintext.

[0168] The software license ciphertext is sent to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0169] Or execute the software license verification method provided by the above methods, the method comprising:

[0170] Upload a software license generation request including the TPM public key, TPM public key certificate and authorization information to the server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext.

[0171] Receive the software license ciphertext sent by the server.

[0172] The software license plain text containing the authorization information is restored using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

[0173] The software license is verified based on the authorization information in the restored software license plain text.

[0174] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0175] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating a software license, characterized in that: include: Receive a software license generation request including a TPM public key, a TPM public key certificate, and authorization information sent by a device to be authorized; After verifying that the TPM public key certificate is passed, generating a software license plain text according to the authorization information; Generate a software license ciphertext according to the TPM public key and the software license plaintext; The software license ciphertext is sent to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key.

2. The method for generating a software license according to claim 1, wherein: Generating a software license ciphertext according to the TPM public key and the software license plaintext includes: Generate an intermediate key to encrypt the software license plaintext to obtain a first intermediate ciphertext; Encrypting the intermediate key according to the TPM public key to obtain a second intermediate ciphertext; concatenating the first intermediate ciphertext and the second intermediate ciphertext into the software license ciphertext, The software license ciphertext is sent to the device to be authorized, so that the device to be authorized recovers the software license plaintext according to the built-in TPM private key and the software license ciphertext, including: The software license ciphertext is sent to the device to be authorized, so that the device to be authorized decrypts the second intermediate ciphertext according to the built-in TPM private key to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

3. The method for generating a software license according to claim 2, wherein: Before sending the software license ciphertext to the device to be authorized, the method further includes: Digitally signing the software license ciphertext using a preset signature private key to obtain signature data; adding the signature data to the software license ciphertext, The software license ciphertext is sent to the device to be authorized, so that the device to be authorized recovers the software license plaintext according to the built-in TPM private key and the software license ciphertext, including: The software license ciphertext is sent to the device to be authorized, so that after the device to be authorized verifies the signature data according to the pre-acquired signature public key, it uses the built-in TPM private key to decrypt the second intermediate ciphertext to obtain the intermediate key, and uses the intermediate key to decrypt the first intermediate ciphertext to obtain the software license plaintext.

4. The method for generating a software license according to any one of claims 1 to 3, characterized in that: After verifying that the TPM public key certificate is passed, it also includes: Generate summary information of the TPM public key and store the summary information, wherein the summary information is used to verify the TPM public key sent by the device to be authorized when the device to be authorized updates the software license.

5. A software license verification method, characterized in that: include: Upload a software license generation request including a TPM public key, a TPM public key certificate, and authorization information to a server, so as to request the server to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plaintext; Receiving the software license ciphertext sent by the server; Recovering the software license plaintext containing the authorization information using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key; The software license is verified based on the authorization information in the restored software license plain text.

6. The software license verification method according to claim 5, characterized in that: The software license ciphertext includes: a first intermediate ciphertext and a second intermediate ciphertext, wherein the first intermediate ciphertext is obtained by encrypting the software license plaintext according to an intermediate key generated by a server, and the second intermediate ciphertext is obtained by encrypting the intermediate key according to the TPM public key. The software license plain text containing the authorization information is restored using the built-in TPM private key and the software license ciphertext, including: Decrypting the second intermediate ciphertext using the built-in TPM private key to obtain the intermediate key; The first intermediate ciphertext is decrypted using the intermediate key to obtain the software license plaintext.

7. The software license verification method according to claim 6, characterized in that: The software license ciphertext also includes: signature data, which is obtained by the server digitally signing the software license ciphertext according to a preset signature private key. Before the method uses the built-in TPM private key to decrypt the second intermediate ciphertext to obtain the intermediate key, the method further includes: The signature data is verified according to a pre-acquired signature public key.

8. The software license verification method according to claim 5, characterized in that: Before performing software license verification according to the authorization information in the restored software license plain text, the method further includes: determining the data format of the restored software license plain text, and outputting verification failure information when the data format does not conform to the predetermined data format.

9. The software license verification method according to any one of claims 5 to 8, characterized in that: Before uploading the software license generation request including the TPM public key and authorization information to the server, it also includes: Determine whether the TPM key is generated in the TPM secure storage area; When the TPM key is generated, reading a TPM public key of the TPM key; If the TPM key is not generated, generate the TPM key and store the generated TPM key in the TPM secure storage area.

10. A software license generation device, characterized in that: include: A software license generation request receiving module, used to receive a software license generation request including a TPM public key, a TPM public key certificate and authorization information sent by a device to be authorized; A software license plaintext generation module, used to generate a software license plaintext according to the authorization information after verifying the TPM public key certificate; An encryption module, used to generate a software license ciphertext according to the TPM public key and the software license plaintext; The software license ciphertext sending module is used to send the software license ciphertext to the device to be authorized, so that the device to be authorized can restore the software license plaintext according to the built-in TPM private key and the software license ciphertext, and the TPM private key corresponds to the TPM public key.

11. A software license verification device, characterized in that: include: A software license generation request uploading module, used to upload a software license generation request including a TPM public key, a TPM public key certificate and authorization information to a server, so as to request the server to generate a software license plain text according to the authorization information after verifying the TPM public key certificate, and to generate a software license ciphertext according to the TPM public key and the software license plain text; A software license ciphertext receiving module, used for receiving the software license ciphertext sent by the server; A decryption module, used to recover the software license plaintext containing the authorization information by using a built-in TPM private key and the software license ciphertext, wherein the TPM private key corresponds to the TPM public key; The verification module is used to verify the software license according to the authorization information in the software license plain text.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for generating a software license according to any one of claims 1 to 4 is implemented, or the method for verifying a software license according to any one of claims 5 to 9 is implemented.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating a software license according to any one of claims 1 to 4 is implemented, or the method for verifying a software license according to any one of claims 5 to 9 is implemented.

Images