Software protection method, device, system, CPU chip and electronic equipment

Abstract

Embodiments of the present invention disclose a software protection method, apparatus, system, CPU chip, and electronic device. The software protection method is applied to the computing core of a user device's CPU chip. The method includes: upon detecting a user triggering the use of software, instructing a security processor (SP) to identify the user device. This identification includes verifying the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using a private key derived from the CPU chip's identity key. If the SP successfully identifies the user device, the user is permitted to use the software. The technical solutions provided by the embodiments of the present invention are applicable to scenarios involving security defense of computer software, reducing the cost of software protection design and enhancing its security.

Description

Technical Field

[0001] The present invention relates to the field of software security technology, and in particular to a software protection method, device, system, CPU chip and electronic equipment. Background Art

[0002] With the rapid development of computer technology, the variety and functionality of computer software are growing, meeting the diverse needs of modern life and work. However, at the same time, computer software security issues are becoming increasingly prominent. Computer software developers often face threats to the software itself and its copyright, such as software decompilation and illegal copying of software licenses. The current mainstream defense solutions for these threats are as follows:

[0003] 1. Software-based protection method: This method mainly verifies the certificate or registration code through the key stored in the software, but it is easy to crack;

[0004] Second, hardware-based protection. The protection device under this method is usually called a dongle or encryption lock. It is a combination of software and hardware encryption product that is plugged into the USB (Universal Serial Bus) port or parallel port of the computer. Encryption is achieved by exchanging data with the dongle during software execution.

[0005] Currently, commonly used hardware protection methods, such as Figure 1 As shown in the figure, the dongle is plugged into the computer's USB port and connected to the CPU (central processing unit) via the USB serial bus. During software execution, data is exchanged with the dongle to implement the software's encryption and decryption functions. However, this protection method often has the following disadvantages: The external dongle requires additional hardware, increasing hardware costs; and in terms of security, the dongle is completely connected to the CPU via the serial bus, increasing its exposure and making it vulnerable to physical bus attacks. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a software protection method, device, system, CPU chip, and electronic device to reduce the cost of software protection design and enhance its security.

[0007] In a first aspect, an embodiment of the present invention provides a software protection method, which is applied to a computing core in a central processing unit (CPU) chip of a user device, and the method includes:

[0008] After detecting a trigger operation on the use of the software by the user, the security processor SP is instructed to perform identity identification of the user device, wherein the identity identification includes: using the public key in the signature certificate to verify the signature of the user certificate, and using the private key derived from the CPU chip identity key to verify the public key in the user certificate;

[0009] If the SP successfully identifies the user's device identity, the user is allowed to use the software.

[0010] Optionally, the software protection method further includes:

[0011] Send a certificate request containing the CPU chip identifier of the user device to the certificate management server;

[0012] Receive the user certificate and signature certificate issued by the certificate management server according to the certificate request and store them;

[0013] The user certificate includes a public key derived from a CPU chip identity key corresponding to the CPU chip identifier, and is signed by a private key corresponding to the public key in the signature certificate.

[0014] Optionally, instructing the security processor SP to perform identity identification of the user device further includes: instructing the SP to verify whether the user certificate is within the validity period.

[0015] Optionally, after allowing the user to use the software, the software protection method further includes:

[0016] When the user is using the software, the SP is instructed to use the public key in the user certificate to encrypt and protect the software's key codes and data;

[0017] When the need to use the setting key code and data is detected, the SP is instructed to use the private key derived from the CPU chip identity key to decrypt the setting key code and data of the software.

[0018] In a second aspect, an embodiment of the present invention provides a software protection method, which is applied to a security processor SP in a central processing unit (CPU) chip of a user device, and the method includes:

[0019] Receiving a user device identity identification instruction sent by the computing core in the CPU chip;

[0020] Identify the user device, where the identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key;

[0021] The identity recognition result is sent to the computing core in the CPU chip so that the computing core in the CPU chip can determine whether the user is allowed to use the software.

[0022] Optionally, before identifying the user device, the software protection method further includes:

[0023] Receive the user certificate and signature certificate imported by the computing core in the CPU chip.

[0024] Optionally, identifying the user device further includes: verifying whether the user certificate is within the validity period.

[0025] Optionally, the software protection method further includes:

[0026] Receive the encryption protection instruction sent by the computing core in the CPU chip; use the public key in the user certificate to encrypt and protect the software's key code and data;

[0027] Receive the decryption instruction sent by the computing core in the CPU chip; use the private key derived from the CPU chip identity key to decrypt the software's set key code and data.

[0028] Optionally, encrypt the software's key code and data, including:

[0029] Get the public key in the user certificate from the secure non-volatile memory FLASH;

[0030] The public key in the user certificate is sent to the cryptographic coprocessor so that the cryptographic coprocessor performs the following operations: reading the software's set key code and data from the system memory; encrypting the read result using the public key in the user certificate, and storing the encrypted protection result in the system memory.

[0031] Optionally, decrypt the software's key code and data, including:

[0032] A private key derived from the CPU chip identity key is obtained from the secure non-volatile memory FLASH; the private key derived from the CPU chip identity key is sent to the cryptographic coprocessor, so that the cryptographic coprocessor performs the following operations: reading the setting key code and data of the encrypted software from the system memory; decrypting the reading result using the private key derived from the CPU chip identity key, and storing the decrypted result in the system memory.

[0033] In a third aspect, an embodiment of the present invention provides a software protection method, applied to a certificate management server, the method comprising:

[0034] Receive a certificate request sent by a user device that includes a CPU chip identifier of the user device;

[0035] Obtain the CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and construct a user certificate based on the public key derived from the CPU chip identity key;

[0036] Sign the user certificate using the private key corresponding to the public key in the signing certificate;

[0037] The signature certificate and the signed user certificate are sent to the user device so that the user device can perform identity recognition and determine whether to allow the user to use the software.

[0038] Optionally, obtaining the CPU chip identity key corresponding to the CPU chip identifier in the certificate request includes:

[0039] The mapping relationship between the pre-created multiple CPU chip identifiers and the multiple CPU chip identity keys is searched, and the CPU chip identity key corresponding to the CPU chip identifier in the certificate request is obtained.

[0040] Optionally, before signing the user certificate using the private key corresponding to the public key in the signature certificate, the method further includes:

[0041] Use its own CPU chip key to derive a pair of asymmetric keys: public key and private key;

[0042] constructing a signing certificate based on the public key in the asymmetric key pair;

[0043] Stores the private key from the asymmetric key pair.

[0044] Optionally, the certificate request further includes certificate validity period and / or user customized information;

[0045] Build a user certificate based on the public key derived from the CPU chip identity key, including:

[0046] A user certificate is constructed based on the public key derived from the CPU chip identity key, as well as the certificate validity period and / or user customized information.

[0047] In a fourth aspect, an embodiment of the present invention provides a software protection device, which is applied to a computing core in a central processing unit (CPU) chip of a user device, and the device includes:

[0048] An identity identification indication unit, configured to instruct the security processor SP to perform identity identification of the user device upon detecting a triggering operation on the use of the software by the user, wherein the identity identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key;

[0049] The software use permission judgment unit is used to judge whether the user is allowed to use the software after the security processor successfully recognizes the user device identity.

[0050] In a fifth aspect, an embodiment of the present invention provides a software protection device, which is applied to a security processor SP in a central processing unit (CPU) chip of a user device, and the device includes:

[0051] an indication receiving unit, configured to receive a user equipment identity identification indication sent by a computing core in the CPU chip;

[0052] An identity recognition unit, configured to identify the user device, wherein the identity recognition includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key;

[0053] The identification result sending unit is used to send the identity identification result to the computing core in the CPU chip, so that the computing core in the CPU chip can determine whether the user is allowed to use the software.

[0054] In a sixth aspect, an embodiment of the present invention provides a software protection device, applied to a certificate management server, the device comprising:

[0055] a certificate request receiving unit, configured to receive a certificate request including a CPU chip identifier of the user equipment, sent by the user equipment;

[0056] A user certificate construction unit is used to obtain a CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and to construct a user certificate based on a public key derived from the CPU chip identity key;

[0057] A user certificate signing unit, configured to sign the user certificate using a private key corresponding to the public key in the signature certificate;

[0058] The certificate issuing unit is used to issue the signature certificate and the signed user certificate to the user device so that the user device can perform identity recognition and determine whether the user is allowed to use the software.

[0059] In a seventh aspect, an embodiment of the present invention provides a central processing unit (CPU) chip, which is applied to a user device. The CPU chip includes: a computing core and a security processor (SP); wherein:

[0060] The computing core includes the software protection device described in the fourth aspect above;

[0061] The security processor SP includes the software protection device described in the fifth aspect above.

[0062] In an eighth aspect, an embodiment of the present invention provides a software protection system, the system comprising a user device and a certificate management server; wherein:

[0063] The user equipment includes the central processing unit (CPU) chip described in the seventh aspect above;

[0064] The certificate management server includes the software protection device described in the sixth aspect above.

[0065] In the ninth aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method described in the first, second, or third aspects above.

[0066] The technical solution provided by the embodiments of the present invention implements a certificate built into the CPU chip of the user device. Software security checks can be performed by verifying the authenticity of this certificate through the SP. The software can only be used normally if the certificate signature is successfully verified and the public key in the certificate is successfully verified using the CPU chip identity key on the user device, which can represent the user device's identity. Because this software protection mechanism is implemented directly within the user device's CPU chip, and the core certificate verification step is performed by the SP, which is isolated from the computing core, it not only significantly reduces external exposure and enhances security, but also has a relatively simple design, eliminating the need for additional hardware and reducing costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 A schematic diagram of the software security defense solution architecture using hardware protection in the prior art;

[0069] Figure 2 A schematic diagram of a hardware architecture of a user equipment applicable to an embodiment of the present invention;

[0070] Figure 3 A flowchart of a software protection method provided in Embodiment 1 of the present invention;

[0071] Figure 4 A schematic structural diagram of a software protection device provided in the first embodiment of the present invention;

[0072] Figure 5 A flowchart of a software protection method provided in the second embodiment of the present invention;

[0073] Figure 6 A schematic diagram of the structure of a software protection device provided in the second embodiment of the present invention;

[0074] Figure 7 A schematic diagram of a user equipment software architecture provided by an embodiment of the present invention;

[0075] Figure 8a A flowchart of a software protection method provided in Embodiment 3 of the present invention;

[0076] Figure 8b A schematic diagram of the software architecture of a certificate management server provided in Example 3 of the present invention;

[0077] Figure 9 A schematic diagram of the structure of a software protection device provided in the third embodiment of the present invention;

[0078] Figure 10 An interactive diagram of a software protection method provided in Embodiment 4 of the present invention;

[0079] Figure 11 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0081] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0082] First, some of the terms involved in the embodiments of the present invention are briefly described.

[0083] SP: Secure Processor, a security processor integrated in the CPU chip, is mainly responsible for handling CPU security-related tasks.

[0084] Cryptographic coprocessor: A cryptographic coprocessor integrated into the CPU chip.

[0085] Chip Unique ID: Chip identity key, used in the CPU chip to derive keys representing the chip identity, such as the CEK (Content Encryption Key), and stored in the FUSE (Filesystem in Userspace).

[0086] Root Key: Chip root key, the root key in the CPU chip used to derive other keys, stored in FUSE.

[0087] SN: Serial Number. Each CPU chip shipped from the factory has a one-to-one serial number, which is stored in FUSE.

[0088] The embodiment of the present invention is applicable to the scenario of security defense of functional software on user equipment. The user equipment can be a computer such as a desktop computer, a laptop computer, or other physical device with a built-in CPU chip and functional software installed. The hardware architecture of the user equipment is as follows: Figure 2 As shown in the figure, the CPU chip in the user device not only includes a computing core (such as an X86 core, which is used as an example for convenience), but also integrates an SP and a cryptographic coprocessor. Outside the CPU chip are system memory, secure memory, and secure non-volatile memory (FLASH).

[0089] Among them, SP has the following characteristics:

[0090] 1. It has its own dedicated hardware resources and is a trusted execution environment, and its operation is not interfered with by the X86 core;

[0091] 2. All software running on the SP is verified by relevant security mechanisms (such as digital signatures) to ensure that they are trustworthy;

[0092] 3. The X86 core communicates with the SP through an internal hardware interface. The X86 core can only call functions specified by the SP. Calls to unspecified functions will be directly rejected by the SP.

[0093] 4. The SP has a built-in CPU chip identity key. The CPU chip identity key is confidential information of the CPU chip and cannot be known to the outside.

[0094] SP is mainly responsible for the management of confidential information such as keys and the implementation of related interfaces of cryptographic modules; the cryptographic coprocessor is mainly responsible for the implementation of various cryptographic algorithms and provides efficient cryptographic computing capabilities; the secure memory is owned by the SP and is used to store SP runtime code or data. The X86 core cannot access the secure memory. To prevent memory-related physical attacks, the hardware should automatically perform encryption and consistency protection when the SP accesses the secure memory; the secure FLASH is used to store keys and other information that needs to be persisted. To prevent related physical attacks, the SP should perform encryption and consistency protection when accessing the secure FLASH; the system memory stores the source data that users need to perform cryptographic operations on the X86 core. After receiving the cryptographic operation request from the X86 core and preparing the relevant key information, the SP instructs the cryptographic coprocessor to perform cryptographic operations. The cryptographic coprocessor can read user data directly from the system memory and put the data back into the system memory after the operation is completed to ensure the efficiency of the cryptographic operation.

[0095] The technical solutions of the present invention are described in detail below through various embodiments.

[0096] Example 1

[0097] This embodiment provides a software protection method, which is applied to Figure 2 The hardware architecture of the user device shown in FIG. 3 can be specifically executed by the computing core in the CPU chip of the user device. Figure 3 , the method includes the following steps 301-303.

[0098] Step 301: After detecting the user's triggering operation on the software, instruct the SP to perform identity identification of the user device, wherein the identity identification includes: using the public key in the signature certificate to verify the signature of the user certificate, and using the private key derived from the CPU chip identity key to verify the public key in the user certificate.

[0099] In this step, the user's triggering action for software use can be a gesture to start the software, such as clicking the software icon displayed on the device desktop. Upon detecting this triggering action, an indication signal is sent to the SP, instructing it to identify the user's device. After the SP returns the identification result, the SP determines whether to allow the user to use the software based on this result. If the user certificate signature is successfully verified and the public key in the user certificate is successfully verified, the SP has successfully identified the user's device; otherwise, the SP has failed to identify the user's device.

[0100] Step 302: If the SP successfully identifies the user device, the user is allowed to use the software.

[0101] Step 303: If the SP fails to identify the user device, the user is denied access to the software.

[0102] In this embodiment, the user certificate and signature certificate can be generated in advance, and then imported into the secure memory of the SP after detecting the triggering operation of the user on the use of the software. Exemplarily, the certificate is produced on the CPU chip manufacturer side, and can be specifically implemented by the certificate management server maintained by the CPU chip manufacturer. Accordingly, the software protection method provided by this embodiment also includes: sending a certificate request containing the CPU chip identifier of the user device to the certificate management server; receiving the user certificate and signature certificate issued by the certificate management server according to the certificate request, and storing them. Typically, the user certificate and signature certificate are stored in FUSE, and to ensure security, FUSE can only be read by the SP. Among them, the CPU chip identifier in the certificate request can be a string such as SN, and the certificate management server can uniquely determine the CPU chip on the user device based on this, and find the corresponding CPU chip identity key. The generated user certificate includes the public key derived from the CPU chip identity key corresponding to the CPU chip identifier, and the user certificate is signed by the private key corresponding to the public key in the signature certificate.

[0103] As a preferred implementation, instructing the security processor SP to perform identity recognition of the user device further includes: instructing the SP to verify whether the user certificate is within the validity period.

[0104] Furthermore, based on the above solution, the software protection method provided in this embodiment further includes, after allowing the user to use the software, instructing the SP to encrypt and protect the software's key code and data using the public key in the user's certificate during the user's use of the software; and upon detecting a need to use the key code and data, instructing the SP to decrypt the key code and data using a private key derived from the CPU chip's identity key. This can better protect the security of software use and prevent threats from external attacks.

[0105] Correspondingly, the software protection method in the aforementioned embodiment belongs to the same inventive concept. This embodiment also provides a software protection device, which can be implemented by software and applied to the computing core in the CPU chip of the user device. Figure 4 , the device comprises:

[0106] The identity identification instruction unit 401 is used to instruct the SP to perform identity identification of the user device after detecting the user triggering the use of the software. The identity identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key;

[0107] The software use permission determination unit 402 is configured to determine whether the user is allowed to use the software after the SP successfully identifies the user device identity.

[0108] Furthermore, the software protection device provided in this embodiment also includes:

[0109] The certificate request unit 403 is configured to send a certificate request including a CPU chip identifier of the user device to a certificate management server;

[0110] The certificate receiving unit 404 is used to receive and store the user certificate and signature certificate issued by the certificate management server according to the certificate request;

[0111] The user certificate includes a public key derived from a CPU chip identity key corresponding to the CPU chip identifier, and is signed by a private key corresponding to the public key in the signature certificate.

[0112] Furthermore, the identity identification instruction unit 401 is used to instruct the SP to perform identity identification of the user equipment, and further includes: instructing the SP to verify whether the user certificate is within the validity period.

[0113] Furthermore, the software protection device provided by the embodiment of the present invention further includes an encryption / decryption instruction unit 405, which is configured to:

[0114] When the user is using the software, the SP is instructed to use the public key in the user certificate to encrypt and protect the software's key codes and data;

[0115] When the need to use the setting key code and data is detected, the SP is instructed to use the private key derived from the CPU chip identity key to decrypt the setting key code and data of the software.

[0116] Example 2

[0117] This embodiment provides a software protection method, which is applied to Figure 2 The hardware architecture of the user equipment shown in FIG. 3 may be specifically implemented by the SP in the CPU chip of the user equipment. Figure 5 , the method includes the following steps 501-503.

[0118] Step 501: Receive a user equipment identity identification instruction sent by a computing core in a CPU chip.

[0119] Step 502: Identify the user device, wherein the identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key.

[0120] In this step, the user certificate and signature certificate imported by the computing core in the CPU chip can be received in advance, and then the user certificate and signature certificate can be stored in the storage space of the SP. Typically, the two certificates are stored in the secure memory. Among them, the user certificate is generated by using the public key derived from the CPU chip identity key on the user device, and has a one-to-one correspondence with the CPU chip identity key. Since the CPU chip identity key has a one-to-one correspondence with the user device, the user certificate and the user device also have a one-to-one correspondence, that is, the user certificate is a kind of information that can identify the identity of the user device. Therefore, the identity of the user device can be identified by verifying the authenticity of the user certificate. In addition, considering the security of the user certificate, the certificate must be signed. When verifying the authenticity of the user certificate, the public key in the signature certificate is first used to verify the signature of the user certificate, and then the private key derived from the CPU chip identity key is used to verify the public key in the user certificate. The specific certificate verification and public key verification process belongs to the existing technology and will not be repeated here.

[0121] Optionally, user device identification also includes verifying whether the user certificate is valid. In practice, the user certificate contains a start date and an end date, which the SP can use to determine whether the current time falls within these time periods. If so, the user certificate is considered valid. Otherwise, the user certificate is considered invalid, and user device identification fails.

[0122] Step 503: Send the identity recognition result to the computing core in the CPU chip, so that the computing core in the CPU chip determines whether the user is allowed to use the software.

[0123] Furthermore, based on the above solution, the software protection method provided in this embodiment also includes:

[0124] Receive the encryption protection instruction sent by the computing core in the CPU chip; use the public key in the user certificate to encrypt and protect the software's key code and data;

[0125] Receive the decryption instruction sent by the computing core in the CPU chip; use the private key derived from the CPU chip identity key to decrypt the software's set key code and data.

[0126] Exemplarily, encrypting and protecting software configuration key codes and data includes: obtaining a public key from a user certificate in secure FLASH; sending the public key from the user certificate to a cryptographic coprocessor, causing the cryptographic coprocessor to perform the following operations: reading the software configuration key codes and data from system memory; encrypting and protecting the read result using the public key from the user certificate, and storing the encrypted result in system memory. The encrypted configuration key codes and data can be stored in system memory, while any previously unencrypted configuration key codes and data in system memory can be deleted.

[0127] Accordingly, decrypting the software's key settings and data includes: obtaining a private key derived from the CPU chip's identity key from the secure non-volatile memory FLASH; sending the private key derived from the CPU chip's identity key to a cryptographic coprocessor, causing the cryptographic coprocessor to perform the following operations: reading the encrypted software's key settings and data from the system memory; decrypting the read result using the private key derived from the CPU chip's identity key, and storing the decrypted result in the system memory. The decrypted software's key settings and data can be stored in the system memory, while the previously encrypted software's key settings and data in the system memory are deleted.

[0128] The above solution uses the SP's built-in cryptographic coprocessor to accelerate the encryption and decryption process of software code and data.

[0129] Correspondingly, the software protection method in the above embodiment belongs to the same inventive concept. This embodiment also provides a software protection device, which can be implemented by software and applied to the SP in the CPU chip of the user equipment. Figure 6 , the device comprises:

[0130] An indication receiving unit 601 is configured to receive a user equipment identity identification indication sent by a computing core in a CPU chip;

[0131] The identity identification unit 602 is configured to identify the user device, wherein the identity identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key;

[0132] The identification result sending unit 603 is used to send the identity identification result to the computing core in the CPU chip, so that the computing core in the CPU chip can determine whether the user is allowed to use the software.

[0133] Furthermore, the software protection device provided in this embodiment further includes a certificate receiving unit 600, which is used to receive a user certificate and a signature certificate imported by the computing core in the CPU chip before the identity recognition unit 602 performs identity recognition on the user device.

[0134] Furthermore, the identity recognition unit 602 is used to perform identity recognition on the user equipment, and further includes: verifying whether the user certificate is within the validity period.

[0135] Furthermore, the software protection device provided in this embodiment further includes an encryption and decryption unit 604, which is used to:

[0136] Receive the encryption protection instruction sent by the computing core in the CPU chip; use the public key in the user certificate to encrypt and protect the software's key code and data;

[0137] Receive the decryption instruction sent by the computing core in the CPU chip; use the private key derived from the CPU chip identity key to decrypt the software's set key code and data.

[0138] Exemplarily, the encryption and decryption unit 604 is used to encrypt and protect the key codes and data set of the software, including:

[0139] Get the public key in the user certificate from the secure FLASH;

[0140] The public key in the user certificate is sent to the cryptographic coprocessor so that the cryptographic coprocessor performs the following operations: reading the software's set key code and data from the system memory; encrypting the read result using the public key in the user certificate, and storing the encrypted protection result in the system memory.

[0141] Exemplarily, the encryption and decryption unit 604 is used to decrypt the software's key code and data, including:

[0142] A private key derived from the CPU chip identity key is obtained from the secure FLASH; the private key derived from the CPU chip identity key is sent to the cryptographic coprocessor, so that the cryptographic coprocessor performs the following operations: reading the setting key code and data of the encrypted software from the system memory; decrypting the reading result using the private key derived from the CPU chip identity key, and storing the decrypted result in the system memory.

[0143] In addition, based on the above embodiment 1 and embodiment 2, the embodiment of the present invention further provides a CPU chip, which is applied to a user device. The CPU chip includes: a computing core and an SP. Among them: the computing core includes the software protection device provided in the above embodiment 1; the SP includes the software protection device provided in the above embodiment 2. In this technical solution, the software architecture of the CPU chip deployed on the user device is as follows: Figure 7As shown in Figure 1, the interfaces provided by the SP can be divided into two categories: "business" and "management." The management interface is used by device administrators and primarily provides user key management functions, such as verifying the signature of user certificates, verifying the correspondence between the public key in the user certificate and the identity key of the current user device's CPU chip, and verifying the validity period of the user certificate. The business interface is intended for upper-level users and primarily provides cryptographic functions such as encryption and decryption, and HMAC (Hash-based Message Authentication Code) authentication.

[0144] Example 3

[0145] This embodiment provides a software protection method, which is applied to a certificate management server. This method can be implemented in conjunction with the software protection method on the user device side provided in the above-mentioned embodiments 1 and 2 to achieve software security protection. The certificate management server can be maintained by the CPU chip manufacturer on the user device. Figure 8a , the method includes the following steps 801-804.

[0146] Step 801: Receive a certificate request sent by a user device, which includes a CPU chip identifier of the user device.

[0147] Step 802: Obtain the CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and construct a user certificate based on the public key derived from the CPU chip identity key.

[0148] In this step, a mapping relationship between multiple CPU chip identifiers and multiple CPU chip identity keys can be pre-created. After receiving a certificate request from a user device, the mapping relationship can be searched to obtain the CPU chip identity key corresponding to the CPU chip identifier in the certificate request. The obtained CPU chip identity key is then used to derive a pair of user keys, namely a public key and a private key, and then a user certificate is constructed based on the public key in the user key. Furthermore, the certificate request sent by the user device also includes the certificate validity period and / or user customization information, wherein the user customization information may include information about the unit to which the certificate belongs. Accordingly, a user certificate is constructed based on the public key derived from the CPU chip identity key corresponding to the CPU chip identifier in the certificate request, including: constructing a user certificate based on the public key derived from the CPU chip identity key, and the certificate validity period and / or user customization information. Among them, how to construct a user certificate based on the public key, certificate validity period and / or user customization information belongs to the prior art and will not be repeated here.

[0149] Step 803: Sign the user certificate using the private key corresponding to the public key in the signature certificate.

[0150] In specific implementations, the certificate management server's own CPU chip key can be used to derive a signing key. This signing key is an asymmetric key pair consisting of a public key and a private key. The private key can be stored in the certificate management server's memory and kept confidential, providing a signing service for user certificates. Furthermore, a signing certificate can be constructed based on the public key in this asymmetric key pair and provided to the user for verification on their device.

[0151] Step 804: Send the signature certificate and the signed user certificate to the user device so that the user device can perform identity recognition and determine whether to allow the user to use the software.

[0152] It should be noted that, as an implementation, after receiving a certificate request from a user device, a user certificate can be generated, and then the certificate and the signature certificate can be returned to the user device as a response to the certificate request. As another implementation, after receiving a certificate request from a user device, a user certificate can be generated and stored, and then the user certificate and signature certificate can be issued after receiving a certificate download request from the user device. This approach can facilitate certificate management by the certificate management server.

[0153] Typically, the software architecture of the certificate management server is as follows: Figure 8b As shown, in this architecture:

[0154] The certificate management server maintains two databases: a key database and a certificate database. The key database stores the correspondence between the SN of each sold CPU chip and its CPU chip identity key, and the certificate database stores the certificates generated by user device requests.

[0155] The certificate management server provides two certificates: a user certificate and a signature certificate. The user certificate contains the public key derived from the user device's unique CPU chip identity key, as well as the user-entered certificate validity period and certificate company information. The signature certificate contains the public key used to verify the user certificate.

[0156] The certificate management server receives a certificate request from a user device, which includes: the SN of the CPU chip ( Figure 8b Chip_SN in the certificate); the certificate validity period ( Figure 8b Start_date, Expire_date in ); User customized information, such as information about the company to which the user certificate belongs ( Figure 8b User_info in) etc.;

[0157] The certificate generation module of the certificate management server first queries the key database for the CPU chip identity key corresponding to the SN. The certificate generation module then uses the queried CPU chip identity key to derive a pair of asymmetric keys, whose public key is the user's public key. Furthermore, the certificate generation module uses the user's public key and other information entered by the user to construct a user certificate, signs the user certificate using the private key in the signature key, and saves it to the certificate database. The certificate management server also stores the private key corresponding to the public key used to verify the signature of the user certificate. This private key and the corresponding public key serve as the signing key, which is derived from the certificate management server's own CPU chip identity key.

[0158] Subsequently, the user device can use the user interface provided by the CPU chip manufacturer to enter the user device's SN and user-customized information, and query and download available user certificates and signature certificates from the certificate management server. The query and download services for user certificates and signature certificates are provided by the certificate maintenance module of the certificate management server. In addition, the administrator can also use the administrator interface to manage the certificate database through the certificate maintenance module, such as proactively discarding invalid user certificates in the database.

[0159] In addition, to prevent media failures from impacting database availability, a certificate database mirror is provided. The certificate management server automatically copies the entire certificate database or key data within it to another storage location. Whenever the certificate database is updated, the updated data is automatically copied to the mirrored location to ensure consistency between the mirrored data and the primary data.

[0160] As can be seen from the above scheme, the user certificate and signature certificate obtained by the user device have the following characteristics:

[0161] 1. The private key of the signed certificate is located in the certificate management server of the CPU chip manufacturer and is safe and controllable;

[0162] 2. The user certificate is bound to the unique CPU chip identity key of each CPU chip and can represent the identity information of the user device;

[0163] 3. The CPU chip identity key is only stored in the SP's storage space and the CPU chip manufacturer's key database, and cannot be obtained or tampered with by others;

[0164] 4. The user certificate and signature certificate can be imported together into the SP of the user device for validity verification;

[0165] 5. Users can customize functions such as user start and end validity period, user customized information, etc. in the user certificate to provide further management of the software.

[0166] Correspondingly, the software protection method in the above embodiment belongs to the same inventive concept. This embodiment also provides a software protection device, which can be implemented by software and applied to a certificate management server. Figure 9 , the device comprises:

[0167] The certificate request receiving unit 901 is configured to receive a certificate request including a CPU chip identifier of the user equipment sent by the user equipment;

[0168] The user certificate construction unit 902 is configured to obtain a CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and to construct a user certificate based on a public key derived from the CPU chip identity key;

[0169] The user certificate signing unit 903 is used to sign the user certificate using the private key corresponding to the public key in the signature certificate;

[0170] The certificate issuing unit 904 is configured to issue the signature certificate and the signed user certificate to the user device, so that the user device can perform identity recognition and determine whether to allow the user to use the software.

[0171] Exemplarily, the user certificate construction unit 902 is configured to obtain a CPU chip identity key corresponding to the CPU chip identifier in the certificate request, including:

[0172] The mapping relationship between the pre-created multiple CPU chip identifiers and the multiple CPU chip identity keys is searched, and the CPU chip identity key corresponding to the CPU chip identifier in the certificate request is obtained.

[0173] Furthermore, the software protection device provided in this embodiment further includes a signature certificate construction unit 900, which is configured to:

[0174] Use its own CPU chip key to derive a pair of asymmetric keys: public key and private key;

[0175] constructing a signing certificate based on the public key in the asymmetric key pair;

[0176] Stores the private key from the asymmetric key pair.

[0177] Furthermore, the certificate request also includes certificate validity period and / or user customized information;

[0178] The user certificate construction unit 902 is used to construct a user certificate based on the public key derived from the CPU chip identity key, including: constructing a user certificate based on the public key derived from the CPU chip identity key, as well as the certificate validity period and / or user customized information.

[0179] Example 4

[0180] Based on the above embodiments 1, 2, and 3, this embodiment provides a software protection system, which includes a user device and a certificate management server; wherein:

[0181] The user equipment includes a CPU chip; the CPU chip includes a computing core and an SP; the computing core includes the software protection device provided in the above embodiment 1; the SP includes the software protection device provided in the above embodiment 2;

[0182] The certificate management server includes the software protection device provided in the third embodiment.

[0183] Based on the above software protection system, a specific example of a software protection method under this system is provided below. Figure 10 , the software protection method includes:

[0184] Initialization phase:

[0185] The user-layer X86 core in the CPU chip on the user device requests a certificate that matches the device from the CPU chip manufacturer's certificate management server. The request includes information such as the device serial number, certificate validity period, and the company to which the certificate belongs.

[0186] The certificate management server searches the database for the CPU chip identity key corresponding to the device based on the device serial number carried in the received request. It then uses the CPU chip identity key to derive the user key: public key and private key. It then uses the public key in the user key and the certificate validity period, certificate owner, and other information in the request to construct a user certificate. It then uses the private key in the certificate management server's own signature key to sign the user certificate.

[0187] The certificate management server sends the signed certificate and user certificate to the user device, and the X86 core in the CPU chip on the user device saves the received certificate in FUSE.

[0188] Certificate verification phase: The X86 core in the CPU chip on the user device imports the signature certificate and user certificate into the SP's secure memory through the import interface predetermined by the SP; the SP uses the public key in the signature certificate to verify the signature of the user certificate; the SP uses the CPU chip identity key stored in FUSE to derive a private key to verify the public key stored in the user certificate to verify the correspondence between the two; the SP verifies the start and end dates stored in the user certificate to verify whether the user certificate is within the validity period.

[0189] Software running stage: If the certificate verification stage is passed, the user is allowed to use the software; in addition, at this stage, the encryption and decryption interface predetermined by the X86 core and the SP can be used to encrypt and protect the key code and data set by the software using the public key in the user certificate. When the set key code and data need to be used, the private key derived from the CPU chip identity chip key in the user space file system is used through the decryption interface predetermined by the SP to decrypt it.

[0190] Figure 11 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 3 、 Figure 5 or Figure 8a The process of the embodiment shown is as follows: Figure 11 As shown, the above-mentioned electronic device may include: a shell 1101, a processor 1102, a memory 1103, a circuit board 1104 and a power supply circuit 1105, wherein the circuit board 1104 is placed inside the space enclosed by the shell 1101, and the processor 1102 and the memory 1103 are set on the circuit board 1104; the power supply circuit 1105 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 1103 is used to store executable program code; the processor 1102 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 1103, so as to execute the software protection method described in any of the above-mentioned embodiments.

[0191] For details on the specific execution process of the above steps by the processor 1102 and the steps further executed by the processor 1102 by running the executable program code, please refer to the present invention. Figure 3 、 Figure 5 or Figure 8a The description of the illustrated embodiment will not be repeated here.

[0192] This electronic device exists in many forms, including but not limited to:

[0193] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, and feature phones.

[0194] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include: PDAs, MIDs, and UMPC devices, such as the iPad;

[0195] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0196] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server has a similar architecture to a general computer, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0197] (5) Other electronic devices with high-speed processing capabilities and installed with functional software.

[0198] The technical solution provided by the embodiment of the present invention will check the identity of the user device through the SP verification certificate in the CPU chip on the user device to prevent the unauthorized use of the software. When it is confirmed that the public key in the certificate matches the identity key of the device CPU chip, the certificate verification is successful, the user device identity is legal, and the software is allowed to start. If the certificate verification fails, it means that the user device identity is illegal, and the protected software on the device will not be able to execute normally, thereby achieving software authorization protection. At the same time, in order to prevent the software source code from being decompiled and tampered with at will, the embodiment of the present invention also uses the SP in the CPU chip on the user device to encrypt and protect key software code and data. In the entire solution, no additional external hardware such as a dongle will be added to the user device. It can be achieved by using the highly secure SP integrated in the CPU chip in conjunction with the computing core. This not only reduces hardware costs, but also reduces external exposure and will not be subject to physical attacks such as bus attacks.

[0199] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0200] In embodiments of the present invention, the term "and / or" describes the association relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0201] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0202] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0203] For the convenience of description, the above device is described as being divided into various units / modules based on their functions. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0204] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0205] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A software protection method, characterized in that: The method is applied to a computing core in a central processing unit (CPU) chip of a user device, and includes: After detecting a trigger operation on the use of the software by the user, the security processor SP is instructed to perform identity identification of the user device, wherein the identity identification includes: using the public key in the signature certificate to verify the signature of the user certificate, and using the private key derived from the CPU chip identity key to verify the public key in the user certificate; If the SP successfully identifies the user's device identity, the user is allowed to use the software.

2. The software protection method according to claim 1, wherein: The method further comprises: Send a certificate request containing the CPU chip identifier of the user device to the certificate management server; Receive the user certificate and signature certificate issued by the certificate management server according to the certificate request and store them; The user certificate includes a public key derived from a CPU chip identity key corresponding to the CPU chip identifier, and is signed by a private key corresponding to the public key in the signature certificate.

3. The software protection method according to claim 1, wherein: Instructing the security processor SP to perform identity recognition of the user device also includes: instructing the SP to verify whether the user certificate is within the validity period.

4. The software protection method according to claim 1, wherein: After allowing the user to use the software, the method further includes: When the user is using the software, the SP is instructed to use the public key in the user certificate to encrypt and protect the software's key codes and data; When the need to use the setting key code and data is detected, the SP is instructed to use the private key derived from the CPU chip identity key to decrypt the setting key code and data of the software.

5. A software protection method, characterized in that: A security processor SP applied to a central processing unit (CPU) chip of a user device, the method comprising: Receiving a user device identity identification instruction sent by the computing core in the CPU chip; Identify the user device, where the identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key; The identity recognition result is sent to the computing core in the CPU chip so that the computing core in the CPU chip can determine whether the user is allowed to use the software.

6. The software protection method according to claim 5, characterized in that: Before identifying the user equipment, the method further includes: Receive the user certificate and signature certificate imported by the computing core in the CPU chip.

7. The software protection method according to claim 5, characterized in that: Identifying the user's device identity also includes: verifying whether the user's certificate is valid.

8. The software protection method according to claim 5, characterized in that: The method further comprises: Receive the encryption protection instruction sent by the computing core in the CPU chip; use the public key in the user certificate to encrypt and protect the software's key code and data; Receive the decryption instruction sent by the computing core in the CPU chip; use the private key derived from the CPU chip identity key to decrypt the software's set key code and data.

9. The software protection method according to claim 8, characterized in that: Encrypt and protect the software's key codes and data, including: Get the public key in the user certificate from the secure non-volatile memory FLASH; The public key in the user certificate is sent to the cryptographic coprocessor so that the cryptographic coprocessor performs the following operations: reading the software's set key code and data from the system memory; encrypting the reading result using the public key in the user certificate, and storing the encrypted protection result in the system memory.

10. The software protection method according to claim 8, wherein: Decrypt the software's key codes and data, including: A private key derived from the CPU chip identity key is obtained from the secure non-volatile memory FLASH; the private key derived from the CPU chip identity key is sent to the cryptographic coprocessor, so that the cryptographic coprocessor performs the following operations: reading the setting key code and data of the encrypted software from the system memory; decrypting the reading result using the private key derived from the CPU chip identity key, and storing the decrypted result in the system memory.

11. A software protection method, characterized in that: Applied to a certificate management server, the method includes: Receive a certificate request sent by a user device that includes a CPU chip identifier of the user device; Obtain the CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and construct a user certificate based on the public key derived from the CPU chip identity key; Sign the user certificate using the private key corresponding to the public key in the signing certificate; The signature certificate and the signed user certificate are sent to the user device so that the user device can perform identity recognition and determine whether to allow the user to use the software.

12. The software protection method according to claim 11, wherein: Obtain the CPU chip identity key corresponding to the CPU chip identifier in the certificate request, including: The mapping relationship between the pre-created multiple CPU chip identifiers and the multiple CPU chip identity keys is searched, and the CPU chip identity key corresponding to the CPU chip identifier in the certificate request is obtained.

13. The software protection method according to claim 11, wherein: Before signing the user certificate using the private key corresponding to the public key in the signature certificate, the method further includes: Use its own CPU chip key to derive a pair of asymmetric keys: public key and private key; constructing a signing certificate based on the public key in the asymmetric key pair; Stores the private key from the asymmetric key pair.

14. The software protection method according to claim 11, wherein: The certificate request also includes certificate validity period and / or user customized information; Build a user certificate based on the public key derived from the CPU chip identity key, including: A user certificate is constructed based on the public key derived from the CPU chip identity key, as well as the certificate validity period and / or user customized information.

15. A software protection device, characterized in that: The device is applied to the computing core of the central processing unit (CPU) chip of the user equipment, and includes: An identity identification indication unit, configured to instruct the security processor SP to perform identity identification of the user device upon detecting a triggering operation on the use of the software by the user, wherein the identity identification includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key; The software use permission judgment unit is used to judge whether the user is allowed to use the software after the security processor successfully recognizes the user device identity.

16. A software protection device, characterized in that: A security processor SP applied to a central processing unit (CPU) chip of a user device, the device comprising: an indication receiving unit, configured to receive a user equipment identity identification indication sent by a computing core in the CPU chip; An identity recognition unit, configured to identify the user device, wherein the identity recognition includes: verifying the signature of the user certificate using the public key in the signature certificate, and verifying the public key in the user certificate using the private key derived from the CPU chip identity key; The identification result sending unit is used to send the identity identification result to the computing core in the CPU chip, so that the computing core in the CPU chip can determine whether the user is allowed to use the software.

17. A software protection device, characterized in that: Applied to a certificate management server, the device includes: a certificate request receiving unit, configured to receive a certificate request including a CPU chip identifier of the user equipment, sent by the user equipment; A user certificate construction unit is used to obtain a CPU chip identity key corresponding to the CPU chip identifier in the certificate request, and to construct a user certificate based on a public key derived from the CPU chip identity key; A user certificate signing unit, configured to sign the user certificate using a private key corresponding to the public key in the signature certificate; The certificate issuing unit is used to issue the signature certificate and the signed user certificate to the user device so that the user device can perform identity recognition and determine whether the user is allowed to use the software.

18. A central processing unit (CPU) chip, characterized in that: Applied to user equipment, the CPU chip includes: a computing core and a security processor SP; wherein: The computing core includes the software protection device according to claim 15; The security processor SP comprises the software protection device according to claim 16 above.

19. A software protection system, characterized in that: The system includes a user device and a certificate management server; wherein: The user equipment comprises a central processing unit (CPU) chip as claimed in claim 18; The certificate management server includes the software protection device according to claim 17.

20. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method described in any one of claims 1 to 4, or the method described in any one of claims 5 to 10, or the method described in any one of claims 11 to 14.

Images