A method and system for issuing authorization for a cryptographic device software module

Abstract

A method and system for issuing authorization for a software module of a cryptographic device, writing the issuing software body and issuing control software into the storage component of the issuing device; obtaining the issuing basic information of the issuing party, and recording the issuing basic information in a pre-authorization file; and using a preset algorithm to perform summary calculations on the files stored in the issuing software body and the issuing control software, respectively, generating the issuing software body and the issuing control software hash value tags, respectively, and recording them in the pre-authorization file; sending the hash value tag of the pre-authorization file to the issuing device by calling a hardware cryptographic component; the issuing device uses an internal issuing private key to perform a signature operation on the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding a SignValue tag, generating a final issuing authorization file and writing it into the storage component of the issuing device. The present invention solves the problem of low authorization efficiency and poor security in traditional technologies due to the fact that the software itself is easy to be copied and illegally used.

Description

Technical Field

[0001] The present invention belongs to the technical field of software module issuance authorization, and in particular relates to a method and system for issuing authorization of a cryptographic device software module. Background Art

[0002] At present, the development of a complete product software is not entirely completed by one manufacturer, and usually involves the participation of many manufacturers from upstream to downstream. Therefore, the cooperation between upstream and downstream becomes particularly important. However, especially after the development of each software is completed and the equipment enters the mass production stage, since the software itself is easy to be copied and illegally used, how manufacturers can realize the authorized distribution of their own software modules is a problem that needs to be solved.

[0003] In the existing technology, the mainstream practice in the software industry is to first install the software on the customer's new target hardware, generate an authorization request file by the software, and then send it to the authorization server online or offline. The authorization server generates a formal authorization file based on the request file and returns it to the customer's target system. The software reads the formal authorization file for verification and can be used normally after passing. This issuance process has relatively many steps, is time-consuming, and does not support batch and automation. Summary of the invention

[0004] To this end, the present invention provides a method and system for issuing authorization for a cryptographic device software module, which solves the problem of low authorization efficiency and poor security in traditional technologies due to the software itself being easily copied and illegally used.

[0005] In order to achieve the above object, the present invention provides the following technical solution: a method for issuing authorization for a cryptographic device software module, comprising:

[0006] Initialize the issuing device, clear the original data and key of the issuing device; call the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the public-private key pair including the issuing private key and the issuing public key; apply the issuing private key of the public-private key to the internal calculation process of the hardware cryptographic component; rewrite the issuing public key of the public-private key pair into the storage component of the issuing device;

[0007] Writing the issuing software body and the issuing control software into the storage component of the issuing device; obtaining the issuing basic information of the issuing party, and recording the issuing basic information in the pre-authorization file; and using a preset algorithm to perform summary calculations on the files stored in the issuing software body and the issuing control software, respectively, to generate hash value tags for the issuing software body and the issuing control software, respectively; and recording the generated hash value tags for the issuing software body and the issuing control software in the pre-authorization file;

[0008] A preset algorithm is used to perform a digest calculation on the pre-authorization file to generate a hash value tag of the pre-authorization file, and the hash value tag of the pre-authorization file is sent to the issuing device by calling the hardware cryptographic component; the issuing device uses an internal issuing private key to perform a signature operation on the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding a SignValue tag, generating a final issuance authorization file and writing it into the storage component of the issuing device.

[0009] As a preferred solution of the authorization method for issuing a software module of a cryptographic device, in the process of calling the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the SM2 key generation API interface inside the hardware cryptographic component is used to generate the currently issued public-private key pair;

[0010] The basic information of the issuance includes the authorization unit, the authorized quantity, the authorized software name, the installation path, the installation version and the installation date;

[0011] The SM3 algorithm is used to perform digest calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate preset byte hash value tags for the distribution software body and the distribution control software, respectively.

[0012] As a preferred scheme for the authorization method for issuing software modules of cryptographic devices, the SM3 algorithm is used to perform summary calculation on the pre-authorization file to generate a preset byte hash value tag of the pre-authorization file; the hash value tag of the pre-authorization file is sent to the issuing device by calling the SM2 cryptographic algorithm signature API interface of the hardware cryptographic component.

[0013] As a preferred solution of the issuance authorization method of the cryptographic device software module, a preset byte random number is generated by the issuance control software, the SM2 algorithm signature API interface in the issuance device is called, the preset byte random number is sent to the issuance device, and the preset byte random number is signed by the issuance private key inside the issuance device, and the signature value is returned;

[0014] The SM2 algorithm signature verification API interface in the issuing device is called, and the issuing public key and signature value are sent to the issuing device for signature verification; if the returned verification is correct, it is determined that the issuing public key and the issuing private key are legally paired public and private keys.

[0015] As a preferred solution of the issuance authorization method of the cryptographic device software module, after determining that the issuance public key and the issuance private key are legally paired public and private keys, the issuance authorization file is read by the issuance control software to extract the signature value at the SignValue tag in the issuance authorization file;

[0016] The SM3 algorithm is used to perform summary calculation on the portion of the issuance authorization file except the SignValue tag to generate a preset byte hash value; the SM2 cryptographic algorithm signature API interface of the issuance device is called to perform signature verification and integrity verification to determine whether the issuance authorization file has been illegally tampered with.

[0017] As a preferred solution of the method for issuing authorization for a cryptographic device software module, if the issuing authorization file has not been illegally tampered with, continue to determine whether the authorized quantity of the issuing authorization file is 0. If the authorized quantity of the issuing authorization file is 0, it indicates that the authorized installation quantity has been used up.

[0018] If the authorized installation quantity of the issuance authorization file is used up, the issuance control software reads the memory serial number, network MAC, and hardware information of the cryptographic component serial number of the cryptographic device, adds the issuance public key data and date, and uses the SM3 algorithm to perform hash operation to generate a unique authorization serial number, which is recorded in the pre-authorization file to generate a device pre-authorization file;

[0019] The device pre-authorization file, the issuing public key and the issuing software body are installed to the predetermined device storage path; the authorization quantity in the issuing authorization file is reduced by 1, the SM2 cryptographic algorithm and the issuing private key are called to re-sign, and the updated data is stored in the storage component of the issuing device.

[0020] As a preferred solution of the method for issuing authorization for a cryptographic device software module, when the issuing software body is running, the issuing software body confirms that the public and private keys of the device authorization signature are legally paired public and private keys; performs secondary signature verification and integrity verification on the issuing authorization file signature to determine whether the issuing authorization file has been illegally tampered with;

[0021] If the issuance authorization file has not been illegally tampered with, the issuance software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the issuance authorization file. If they are inconsistent, the operation of the issuance software body is terminated.

[0022] The present invention also provides a cryptographic device software module issuance authorization system, comprising:

[0023] The public-private key pair generation unit is used to initialize the issuing device, clear the original data and key of the issuing device; call the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the public-private key pair including an issuing private key and an issuing public key; apply the issuing private key of the public-private key pair to the internal calculation process of the hardware cryptographic component; rewrite the issuing public key of the public-private key pair into the storage component of the issuing device;

[0024] A pre-authorization file generation unit is used to write the distribution software body and the distribution control software into the storage component of the distribution device; obtain the distribution basic information of the issuer, and record the distribution basic information in the pre-authorization file; and use a preset algorithm to perform summary calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate hash value tags for the distribution software body and the distribution control software, respectively; and record the generated hash value tags for the distribution software body and the distribution control software in the pre-authorization file;

[0025] The issuing authorization file generating unit is used to perform summary calculation on the pre-authorization file by using a preset algorithm to generate a hash value tag of the pre-authorization file, and send the hash value tag of the pre-authorization file to the issuing device by calling the hardware cryptographic component; the issuing device uses an internal issuing private key to perform a signature operation on the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding a SignValue tag, thereby generating a final issuing authorization file and writing it into the storage component of the issuing device.

[0026] As a preferred solution of the cryptographic device software module issuance authorization system, the public-private key pair generation unit uses the SM2 key generation API interface inside the hardware cryptographic component to generate the currently issued public-private key pair;

[0027] In the pre-authorization file generating unit, the basic information of issuance includes the authorization unit, the authorization quantity, the name of the authorized software, the installation path, the installation version and the installation date;

[0028] In the pre-authorization file generation unit, the SM3 algorithm is used to perform digest calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate preset byte hash value tags for the distribution software body and the distribution control software;

[0029] In the issuance authorization file generation unit, the SM3 algorithm is used to perform summary calculation on the pre-authorization file to generate a preset byte hash value tag of the pre-authorization file; the hash value tag of the pre-authorization file is sent to the issuance device by calling the SM2 cryptographic algorithm signature API interface of the hardware cryptographic component.

[0030] As a preferred solution for the cryptographic device software module issuance authorization system, it also includes:

[0031] A random number generation processing unit, used to generate a preset byte random number through the issuance control software, call the SM2 algorithm signature API interface in the issuance device, send the preset byte random number to the issuance device, sign the preset byte random number using the issuance private key inside the issuance device, and return the signature value;

[0032] The public and private key legitimacy analysis unit is used to call the SM2 algorithm signature verification API interface in the issuing device, send the issuing public key and the signature value to the issuing device for signature verification; if the returned verification is correct, it is determined that the issuing public key and the issuing private key are legally paired public and private keys;

[0033] The signature extraction unit is used to read the issuance authorization file through the issuance control software and extract the signature value at the SignValue tag in the issuance authorization file after determining that the issuance public key and the issuance private key are legally paired public and private keys;

[0034] The first authorization file tampering analysis unit is used to perform summary calculation on the part of the issuance authorization file except the SignValue tag using the SM3 algorithm to generate a preset byte hash value; call the SM2 cryptographic algorithm signature API interface of the issuance device to verify the signature and integrity, and determine whether the issuance authorization file has been illegally tampered with; if the issuance authorization file has not been illegally tampered with, continue to determine whether the authorized quantity of the issuance authorization file is 0, if the authorized quantity of the issuance authorization file is 0, it means that the authorized installation quantity has been used up;

[0035] A device pre-authorization file generating unit is used to read the memory serial number, network MAC, and hardware information of the cryptographic device through the issuance control software, add the issuance public key data and date, perform hash operation using the SM3 algorithm to generate a unique authorization serial number, record it in the pre-authorization file, and generate a device pre-authorization file if the authorized installation quantity of the issuance authorization file is used up;

[0036] The device pre-authorization file, the issuing public key and the issuing software body are installed to the predetermined device storage path; the authorization quantity in the issuing authorization file is reduced by 1, the SM2 cryptographic algorithm and the issuing private key are called to re-sign, and the updated data is stored in the storage component of the issuing device.

[0037] As a preferred solution of the cryptographic device software module issuance authorization system, it also includes: a second authorization file tampering analysis unit, which is used for, when the issuance software body is running, the issuance software body confirms that the device authorization signature public and private keys are legally paired public and private keys; performs secondary signature verification and integrity verification on the issuance authorization file signature to determine whether the issuance authorization file has been illegally tampered with;

[0038] If the issuance authorization file has not been illegally tampered with, the issuance software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the issuance authorization file. If they are inconsistent, the operation of the issuance software body is terminated.

[0039] The beneficial effects of the present invention are as follows: the embedded software distribution process is simplified, the process of back-and-forth interaction in the authorization process is reduced, and the customer operation procedures are convenient; batch embedded software distribution authorization and automatic installation are supported, and the distribution efficiency is improved; the publisher does not need to set up a special server to accept online or offline distribution requests, which saves distribution costs; and a double digital signature and verification method is used to ensure the integrity and legality of the authorization file. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the drawings required for the implementation methods or the prior art descriptions are briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0041] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0042] Figure 1 A diagram of the issuing device architecture in the method for issuing authorization for a cryptographic device software module provided in an embodiment of the present invention;

[0043] Figure 2 A flowchart of a method for issuing authorization for a cryptographic device software module provided by an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of the architecture of a cryptographic device software module issuance authorization system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Example 1

[0047] See also Figure 1 The issuing device architecture involved in the embodiment of the present invention is as follows:

[0048] USB interface (A101): a universal communication interface used to connect devices to transfer files and data and call password service functions when making distribution devices or distributing and installing software.

[0049] Hardware cryptographic component (A102): used to implement SM2 cryptographic operations and save SM2 private keys. Private keys can only be used for internal computing applications and cannot be read by external programs. External devices can control cryptographic operations and key management through the USB interface.

[0050] Storage component (A103): used to store issuance-related documents, programs, records, key data, etc.

[0051] See also Figure 2 Based on the above-mentioned issuing device, Embodiment 1 of the present invention provides a method for issuing authorization for a cryptographic device software module, comprising the following steps:

[0052] S101, initialize the issuing device, clear the original data and key of the issuing device; call the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the public-private key pair including the issuing private key and the issuing public key; apply the issuing private key of the public-private key to the internal calculation process of the hardware cryptographic component; rewrite the issuing public key of the public-private key pair into the storage component of the issuing device;

[0053] S102, write the distribution software body and the distribution control software into the storage component of the distribution device; obtain the distribution basic information of the issuer, and record the distribution basic information in the pre-authorization file; and use a preset algorithm to perform summary calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate hash value tags for the distribution software body and the distribution control software, respectively; record the generated hash value tags for the distribution software body and the distribution control software in the pre-authorization file;

[0054] S103, using a preset algorithm to perform a digest calculation on the pre-authorization file, generating a hash value tag for the pre-authorization file, and sending the hash value tag of the pre-authorization file to the issuing device by calling the hardware cryptographic component; the issuing device uses an internal issuing private key to perform a signature operation on the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding a SignValue tag, generating a final issuance authorization file and writing it into the storage component of the issuing device.

[0055] In this embodiment, the issuing process of the issuing device is as follows:

[0056] S201: insert the USB interface (A101) of the issuing device into a USB interface of a computer, run the issuing management software, input the user and password, and enter the function menu;

[0057] S202: Operate the issuance management software to initialize the issuance device, clear the original data and key, call the SM2 key generation API interface inside the hardware cryptographic component (A102), A102 generates a public-private key pair (issuance public key D104, issuance private key D105) for this issuance protection, the issuance private key (D105) is directly stored in the hardware cryptographic component A102 and is not returned, the issuance public key (D104) is returned to the issuance management software, the issuance management software rewrites the issuance public key (D104) into the storage component (A103) of the device, the issuance private key (D105) can only be calculated and applied inside the hardware cryptographic component (A102) and cannot be read by external programs;

[0058] S203: Writing the distribution software body (D103) and the distribution control software (D101) into the storage component (A103) of the device;

[0059] S204: Input the basic information of issuance, such as the authorization unit, the number of authorizations, the name of the authorized software, the installation path, the version and the date. The basic information of issuance is described in XML language and recorded in the pre-authorization file (PLicenses.xml) using the tags such as CustomerName, AuthPLicenses, ProductName, ProductInsPath, ProductVersion and LicenseDate respectively; perform digest calculations on the files of the issuance software body (D103) and the issuance control software (D101) stored in the storage component A103 using the SM3 algorithm, generate 32-byte hash values ​​for each, add tags such as ProductSum and InstallCtrlSum to the PLICENSE.xml file to record them respectively, and generate the pre-authorization file (PLicenses.xml);

[0060] S205: Use the SM3 algorithm to perform digest calculation on the pre-authorization file (PLicenses.xml) to generate a 32-byte hash value, and send the returned hash value to the issuing device by calling the SM2 cryptographic algorithm signature API interface of the issuing device. The issuing device uses the internal issuing private key (D105) to perform a signature operation on the hash value, and appends the returned signature value to the authorization file PLICENSE.xml by adding a SignValue tag, generating the final issuing authorization file PLICENSE.xml (D102) and writing it into the storage component (A103) of the issuing device;

[0061] S206: Pull out the issuing device and end the production.

[0062] In this embodiment, the authorization installation process of the issuing device is as follows:

[0063] S301: insert the issuing device into the USB interface of the embedded device and automatically run the issuing control software (D101);

[0064] S302: Run the issuance control software (D101) to generate a 32-byte random number. First, call the SM2 algorithm signature API interface in the issuance device, send the aforementioned 32-byte random number to the issuance device, use the internal issuance private key (D105) to sign the random number, and return the signature value; then call the SM2 algorithm signature verification API interface in the issuance device, send the issuance public key (D104) and the signature value to the issuance device for signature verification; if the returned verification is correct and confirms that the issuance public key D104 and the issuance private key D105 are legally paired public and private keys, enter S303, otherwise end and exit the program;

[0065] S303: The issuance control software (D101) automatically reads the issuance authorization file (D102) PLICENSE.xml, extracts the signature value at the SignValue tag in PLICENSE.xml, performs summary calculation on the other parts of the issuance authorization file using the SM3 algorithm, and generates a 32-byte hash value; calls the SM2 cryptographic algorithm signature API interface of the issuance device to verify the hash value, the issuance public key (D104), the signature value, etc., and performs signature verification and integrity verification to determine whether the issuance authorization file D102 has been illegally tampered with. If the return is correct, continue to S304; if the verification fails, end and exit the program;

[0066] S304: Continue to determine whether the value of the authorization quantity AuthPLicenses tag in the issuance authorization file (D102) PLICENSE.xml is 0. The value 0 indicates that it has been used up. If it has been used up, exit the program. If the authorized installation quantity has not been used up, continue to S305;

[0067] S305: Run the issuance control software (D101) to read the hardware information of the cryptographic device, such as the memory serial number, network MAC, and cryptographic component serial number, and add the issuance public key (D104) data and date, and use the SM3 algorithm to perform a hash operation on the aforementioned data to generate a unique authorization serial number, which is described in XML language and recorded in the pre-authorization file (License.xml) using tags such as StrSNR, MAC-SNR, CypherID, PubpKey, LicDate, and LicSNR, to generate a device pre-authorization file (License.xml);

[0068] S306: The issuance control software (D101) calls the SM2 key generation API interface of the authorized cryptographic device to generate a public-private key pair (public key dPubKey, private key dPriKey) for the device authorization signature. The device authorization signature private key (dPriKey) is also stored in the cryptographic device hardware and can only be used for internal calculations and cannot be read by external programs. The public key dPubKey is returned to the issuance control software (D101); the SM3 algorithm is first used to perform a digest calculation on the pre-authorization file (Licenses.xml) to generate a 32-byte hash value, and the returned hash value is sent to the issuance device by calling the SM2 cryptographic algorithm signature API interface of the issuance device. The issuance device uses the internal issuance private key (D105) to sign the hash value. Calculate, append the returned signature value to the authorization file Licenses.xml by adding the pSignValue tag; then use the SM3 algorithm to perform digest calculation on the pre-authorization file (Licenses.xml) to generate a 32-byte hash value, and send the returned hash value to the authorized password device by calling the SM2 password algorithm signature API interface of the authorized password device. The authorized password device uses the internal device authorization signature private key (dPriKey) to sign the hash value, and append the signature value returned by the secondary signature to the authorization file Licenses.xml by adding the dSignValue tag. After appending the signature value, the authorization file (License.xml) of this password device is generated;

[0069] S307: Install the device authorization file (License.xml), the device authorization signature verification public key (dPubKey), the issuance public key (D104) and the issuance software body (D103) to the predetermined storage path of the cryptographic device;

[0070] S308: Reduce the value of the authorization quantity AuthPLicenses tag in the PLICENSE.xml file of the issuance authorization file (D102) by 1, and then call the SM2 cryptographic algorithm to re-digitally sign D102 (same as the above S205 step), and continue to S309;

[0071] S309: Unplug the issuing device and end the authorization installation.

[0072] In this embodiment, the operation process of the distribution software is as follows:

[0073] S401: The cryptographic device is turned on and automatically runs the issuing software body (D103);

[0074] S402: The issuing software body (D103) generates a 32-byte random number. First, the SM2 algorithm signature API interface of the cryptographic device itself is called to send the aforementioned 32-byte random number to the issuing device, and the random number is signed using the device authorization signature private key (dPriKey) stored inside, and the signature value is returned; then the SM2 algorithm signature verification API interface is called to send the device authorization signature verification public key (dPubKey) and the signature value to the cryptographic device for signature verification; if the returned verification is correct, and the device authorization signature private key (dPriKey) and the device authorization signature verification public key (dPubKey) are confirmed to be legally paired public and private keys, then enter S403, otherwise end and exit the program;

[0075] S403: The issuing software body (D103) reads the authorization file (License.xml) in the device to determine whether the authorization file has been illegally tampered with; first remove the dSignValue tag field in Licenses.xml, and use the SM3 algorithm to perform summary calculation on the rest of the file to generate a 32-byte hash value; call the SM2 cryptographic algorithm signature verification API interface of the cryptographic device to enter this hash value, the device authorization signature verification public key (dPubKey), the signature value, etc. for signature verification and integrity verification; then remove the pSignValue tag field and the dSignValue tag field in Licenses.xml, and use the SM3 algorithm to perform summary calculation on the rest of the file to generate a 32-byte hash value; call the SM2 cryptographic algorithm signature API interface of the cryptographic device to enter this hash value, the issuing public key (D104), the signature value, etc. for signature verification and integrity verification; only if the secondary signature verification and integrity verification are passed, continue to S404, and if any verification fails, the program ends and exits;

[0076] S404: The issuing software body (D103) reads the hardware information of the embedded device, such as the memory serial number, network MAC, and cryptographic component serial number, and adds the issuing public key (D104) data and date, and performs a hash operation on the aforementioned data using the SM3 algorithm to generate the current authorization serial number; then the aforementioned information is compared one by one with the serial numbers recorded in the StrSNR, MAC-SNR, CypherID, and LicSNR tags in the authorization file (License.xml). If the comparison is inconsistent, the program ends and exits. If the comparison results are consistent, it enters S405;

[0077] S405: The issuing software body (D103) enters the normal operation state.

[0078] In summary, the present invention initializes the issuing device, clears the original data and key of the issuing device; calls the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the public-private key pair including the issuing private key and the issuing public key; applies the issuing private key of the public-private key to the internal calculation process of the hardware cryptographic component; rewrites the issuing public key of the public-private key pair into the storage component of the issuing device; writes the issuing software body and the issuing control software into the storage component of the issuing device; obtains the issuing basic information of the issuer, records the issuing basic information in the pre-authorization file; and uses a preset algorithm to perform Perform summary calculation to generate the release software body and the release control software hash value tag respectively; record the generated release software body and release control software hash value tag in the pre-authorization file; use the preset algorithm to perform summary calculation on the pre-authorization file to generate the hash value tag of the pre-authorization file, and send the hash value tag of the pre-authorization file to the release device by calling the hardware password component; the release device uses the internal release private key to sign the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding the SignValue tag, generates the final release authorization file and writes it into the storage component of the release device. Generate a preset byte random number through the release control software, call the SM2 algorithm signature API interface in the release device, send the preset byte random number to the release device, use the release private key inside the release device to sign the preset byte random number, and return the signature value; call the SM2 algorithm signature verification API interface in the release device, send the release public key and signature value to the release device together for signature verification; if the returned verification is correct, determine that the release public key and the release private key are legally paired public and private keys. After determining that the issuance public key and the issuance private key are legally paired public and private keys, the issuance authorization file is read through the issuance control software, and the signature value at the SignValue tag in the issuance authorization file is extracted; the SM3 algorithm is used to perform summary calculation on the part of the issuance authorization file except the SignValue tag to generate a preset byte hash value; the SM2 cryptographic algorithm signature API interface of the issuance device is called to perform signature verification and integrity verification to determine whether the issuance authorization file has been illegally tampered with.If the issuance authorization file has not been illegally tampered with, continue to determine whether the authorized number of the issuance authorization file is 0. If the authorized number of the issuance authorization file is 0, it means that the authorized installation number has been used up; if the authorized installation number of the issuance authorization file has been used up, read the memory serial number, network MAC, and cryptographic component serial number hardware information of the cryptographic device through the issuance control software, add the issuance public key data and date, and use the SM3 algorithm to perform hash operation to generate a unique authorization serial number recorded in the pre-authorization file to generate a device pre-authorization file; install the device pre-authorization file, the issuance public key, and the issuance software body to the predetermined device storage path; and reduce the authorized number in the issuance authorization file by 1, call the SM2 cryptographic algorithm and the issuance private key to re-sign, and store it in the storage component of the issuance device after updating. When the release software body is running, the release software body confirms that the public and private keys of the device authorization signature are legally paired public and private keys; the release authorization file signature is double-checked and integrity verified to determine whether the release authorization file has been illegally tampered with; if the release authorization file has not been illegally tampered with, the release software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the release authorization file. If they are inconsistent, the operation of the release software body is terminated. The present invention simplifies the embedded software release process, reduces the process of back-and-forth interaction in the authorization process, and facilitates customer operation procedures; supports batch embedded software release authorization and automated installation, and improves release efficiency; the issuer does not need to set up a special server to accept online or offline release requests, saving release costs; a double digital signature and verification method is used to ensure the integrity and legality of the authorization file.

[0079] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0080] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0081] Example 2

[0082] See also Figure 3 Embodiment 2 of the present invention provides a cryptographic device software module issuance authorization system, including:

[0083] The public-private key pair generation unit 001 is used to initialize the issuing device, clear the original data and key of the issuing device; call the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the public-private key pair including the issuing private key and the issuing public key; apply the issuing private key of the public-private key to the internal calculation process of the hardware cryptographic component; rewrite the issuing public key of the public-private key pair into the storage component of the issuing device;

[0084] The pre-authorization file generation unit 002 is used to write the issuing software body and the issuing control software into the storage component of the issuing device; obtain the issuing basic information of the issuing party, and record the issuing basic information in the pre-authorization file; and use a preset algorithm to perform summary calculations on the files stored in the issuing software body and the issuing control software, respectively, to generate hash value tags of the issuing software body and the issuing control software, respectively; and record the generated hash value tags of the issuing software body and the issuing control software in the pre-authorization file;

[0085] The issuing authorization file generation unit 003 is used to perform summary calculation on the pre-authorization file using a preset algorithm to generate a hash value tag of the pre-authorization file, and send the hash value tag of the pre-authorization file to the issuing device by calling the hardware cryptographic component; the issuing device uses an internal issuing private key to perform a signature operation on the hash value tag of the pre-authorization file, and appends the returned signature value to the pre-authorization file by adding a SignValue tag, thereby generating a final issuing authorization file and writing it into the storage component of the issuing device.

[0086] In this embodiment, the public-private key pair generation unit 001 uses the SM2 key generation API interface inside the hardware cryptographic component to generate the currently issued public-private key pair;

[0087] In the pre-authorization file generation unit 002, the basic information of issuance includes the authorization unit, the authorization quantity, the name of the authorized software, the installation path, the installation version and the installation date;

[0088] In the pre-authorization file generation unit 002, the SM3 algorithm is used to perform digest calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate preset byte hash value tags for the distribution software body and the distribution control software;

[0089] In the issuance authorization file generation unit 003, the SM3 algorithm is used to perform a digest calculation on the pre-authorization file to generate a preset byte hash value tag of the pre-authorization file; the hash value tag of the pre-authorization file is sent to the issuance device by calling the SM2 cryptographic algorithm signature API interface of the hardware cryptographic component.

[0090] In this embodiment, it also includes:

[0091] The random number generation processing unit 004 is used to generate a preset byte random number through the issuance control software, call the SM2 algorithm signature API interface in the issuance device, send the preset byte random number to the issuance device, sign the preset byte random number using the issuance private key inside the issuance device, and return the signature value;

[0092] The public and private key legitimacy analysis unit 005 is used to call the SM2 algorithm signature verification API interface in the issuing device, send the issuing public key and the signature value to the issuing device for signature verification; if the returned verification is correct, it is determined that the issuing public key and the issuing private key are legally paired public and private keys;

[0093] The signature extraction unit 006 is used to read the issuance authorization file through the issuance control software and extract the signature value at the SignValue tag in the issuance authorization file after determining that the issuance public key and the issuance private key are legally paired public and private keys;

[0094] The first authorization file tampering analysis unit 007 is used to perform summary calculation on the part of the issuance authorization file except the SignValue tag using the SM3 algorithm to generate a preset byte hash value; call the SM2 cryptographic algorithm signature API interface of the issuance device to verify the signature and integrity, and determine whether the issuance authorization file has been illegally tampered with; if the issuance authorization file has not been illegally tampered with, continue to determine whether the authorized quantity of the issuance authorization file is 0, if the authorized quantity of the issuance authorization file is 0, it means that the authorized installation quantity has been used up;

[0095] The device pre-authorization file generating unit 008 is used to read the memory serial number, network MAC, and hardware information of the cryptographic device through the issuance control software, add the issuance public key data and date, perform hash operation using the SM3 algorithm to generate a unique authorization serial number, record it in the pre-authorization file, and generate a device pre-authorization file if the authorized installation quantity of the issuance authorization file is used up;

[0096] The device pre-authorization file, the issuing public key and the issuing software body are installed to the predetermined device storage path; the authorization quantity in the issuing authorization file is reduced by 1, the SM2 cryptographic algorithm and the issuing private key are called to re-sign, and the updated data is stored in the storage component of the issuing device.

[0097] In this embodiment, it also includes: a second authorization file tampering analysis unit 009, which is used to confirm that the public and private keys of the device authorization signature are legally paired public and private keys when the distribution software body is running; perform secondary signature verification and integrity verification on the distribution authorization file signature to determine whether the distribution authorization file has been illegally tampered with;

[0098] If the issuance authorization file has not been illegally tampered with, the issuance software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the issuance authorization file. If they are inconsistent, the operation of the issuance software body is terminated.

[0099] It should be noted that the information interaction, execution process and other contents between the various units of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0100] Example 3

[0101] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code of a cryptographic device software module issuing authorization method is stored, and the program code includes instructions for executing the cryptographic device software module issuing authorization method of embodiment 1 or any possible implementation thereof.

[0102] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0103] Example 4

[0104] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0105] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the cryptographic device software module issuance authorization method of embodiment 1 or any possible implementation thereof.

[0106] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0107] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital consumer customer line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0108] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0109] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A method for issuing authorization for a cryptographic device software module, characterized in that: include: Initializing the issuing device and clearing the original data and key of the issuing device; Calling the hardware cryptographic component of the issuing device to generate a currently issued public-private key pair, the public-private key pair including an issuing private key and an issuing public key; applying the issuing private key of the public-private key pair to the internal calculation process of the hardware cryptographic component; rewriting the issuing public key of the public-private key pair into the storage component of the issuing device; Writing the issuing software body and the issuing control software into the storage component of the issuing device; obtaining the issuing basic information of the issuing party, and recording the issuing basic information in the pre-authorization file; and using a preset algorithm to perform summary calculations on the files stored in the issuing software body and the issuing control software, respectively, to generate hash value tags for the issuing software body and the issuing control software, respectively; and recording the generated hash value tags for the issuing software body and the issuing control software in the pre-authorization file; Performing digest calculation on the pre-authorization file using a preset algorithm to generate a hash value tag of the pre-authorization file, and sending the hash value tag of the pre-authorization file to the issuing device by calling the hardware password component; The issuing device uses an internal issuing private key to sign the hash value tag of the pre-authorization file, appends the returned signature value to the pre-authorization file by adding a SignValue tag, generates a final issuing authorization file and writes it into the storage component of the issuing device.

2. A method for issuing authorization for a cryptographic device software module according to claim 1, characterized in that: In the process of calling the hardware cryptographic component of the issuing device to generate the currently issued public-private key pair, the currently issued public-private key pair is generated using the SM2 key generation API interface inside the hardware cryptographic component; The basic information of the issuance includes the authorization unit, the authorized quantity, the authorized software name, the installation path, the installation version and the installation date; The SM3 algorithm is used to perform digest calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate preset byte hash value tags for the distribution software body and the distribution control software, respectively.

3. A method for issuing authorization for a cryptographic device software module according to claim 2, characterized in that: The pre-authorization file is digested and calculated using the SM3 algorithm to generate a preset byte hash value tag of the pre-authorization file; the hash value tag of the pre-authorization file is sent to the issuing device by calling the SM2 cryptographic algorithm signature API interface of the hardware cryptographic component.

4. A method for issuing and authorizing a cryptographic device software module according to claim 3, characterized in that: Generate a preset byte random number through the issuance control software, call the SM2 algorithm signature API interface in the issuance device, send the preset byte random number to the issuance device, use the issuance private key inside the issuance device to sign the preset byte random number, and return the signature value; The SM2 algorithm signature verification API interface in the issuing device is called, and the issuing public key and signature value are sent to the issuing device for signature verification; if the returned verification is correct, it is determined that the issuing public key and the issuing private key are legally paired public and private keys.

5. A method for issuing and authorizing a cryptographic device software module according to claim 4, characterized in that: When it is determined that the issuing public key and the issuing private key are legally paired public and private keys, the issuing authorization file is read through the issuing control software, and the signature value at the SignValue tag in the issuing authorization file is extracted; Performing digest calculation on the portion of the issuance authorization file except the SignValue tag using the SM3 algorithm to generate a preset byte hash value; The SM2 cryptographic algorithm signature API interface of the issuing device is called to perform signature verification and integrity verification to determine whether the issuing authorization document has been illegally tampered with.

6. A method for issuing and authorizing a cryptographic device software module according to claim 5, characterized in that: If the issuance authorization file has not been illegally tampered with, continue to determine whether the authorization quantity of the issuance authorization file is 0. If the authorization quantity of the issuance authorization file is 0, it indicates that the authorized installation quantity has been used up; If the authorized installation quantity of the issuance authorization file is used up, the issuance control software reads the memory serial number, network MAC, and hardware information of the cryptographic component serial number of the cryptographic device, adds the issuance public key data and date, and uses the SM3 algorithm to perform hash operation to generate a unique authorization serial number, which is recorded in the pre-authorization file to generate a device pre-authorization file; The device pre-authorization file, the issuing public key and the issuing software body are installed to the predetermined device storage path; the authorization quantity in the issuing authorization file is reduced by 1, the SM2 cryptographic algorithm and the issuing private key are called to re-sign, and the updated data is stored in the storage component of the issuing device.

7. A method for issuing and authorizing a cryptographic device software module according to claim 6, characterized in that: When the issuing software is running, the issuing software confirms that the public and private keys of the device authorization signature are legally paired public and private keys; performs secondary signature verification and integrity verification on the issuing authorization file signature to determine whether the issuing authorization file has been illegally tampered with; If the issuance authorization file has not been illegally tampered with, the issuance software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the issuance authorization file. If they are inconsistent, the operation of the issuance software body is terminated.

8. A cryptographic device software module issuance authorization system, characterized in that: include: A public-private key pair generating unit, used to initialize the issuing device and clear the original data and key of the issuing device; Calling the hardware cryptographic component of the issuing device to generate a currently issued public-private key pair, the public-private key pair including an issuing private key and an issuing public key; applying the issuing private key of the public-private key pair to the internal calculation process of the hardware cryptographic component; rewriting the issuing public key of the public-private key pair into the storage component of the issuing device; A pre-authorization file generation unit is used to write the distribution software body and the distribution control software into the storage component of the distribution device; obtain the distribution basic information of the issuer, and record the distribution basic information in the pre-authorization file; and use a preset algorithm to perform summary calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate hash value tags for the distribution software body and the distribution control software, respectively; and record the generated hash value tags for the distribution software body and the distribution control software in the pre-authorization file; An issuing authorization file generating unit is used to perform a digest calculation on the pre-authorization file using a preset algorithm to generate a hash value tag of the pre-authorization file, and send the hash value tag of the pre-authorization file to the issuing device by calling the hardware password component; The issuing device uses an internal issuing private key to sign the hash value tag of the pre-authorization file, appends the returned signature value to the pre-authorization file by adding a SignValue tag, generates a final issuing authorization file and writes it into the storage component of the issuing device.

9. A cryptographic device software module issuance authorization system according to claim 8, characterized in that: In the public-private key pair generation unit, the currently issued public-private key pair is generated using the SM2 key generation API interface inside the hardware cryptographic component; In the pre-authorization file generating unit, the basic information of issuance includes the authorization unit, the authorization quantity, the name of the authorized software, the installation path, the installation version and the installation date; In the pre-authorization file generation unit, the SM3 algorithm is used to perform digest calculations on the files stored in the distribution software body and the distribution control software, respectively, to generate preset byte hash value tags for the distribution software body and the distribution control software; In the issuance authorization file generation unit, the SM3 algorithm is used to perform summary calculation on the pre-authorization file to generate a preset byte hash value tag of the pre-authorization file; the hash value tag of the pre-authorization file is sent to the issuance device by calling the SM2 cryptographic algorithm signature API interface of the hardware cryptographic component.

10. A cryptographic device software module issuance authorization system according to claim 9, characterized in that: Also includes: A random number generation processing unit, used to generate a preset byte random number through the issuance control software, call the SM2 algorithm signature API interface in the issuance device, send the preset byte random number to the issuance device, sign the preset byte random number using the issuance private key inside the issuance device, and return the signature value; The public and private key legitimacy analysis unit is used to call the SM2 algorithm signature verification API interface in the issuing device, send the issuing public key and the signature value to the issuing device for signature verification; if the returned verification is correct, it is determined that the issuing public key and the issuing private key are legally paired public and private keys; The signature extraction unit is used to read the issuance authorization file through the issuance control software and extract the signature value at the SignValue tag in the issuance authorization file after determining that the issuance public key and the issuance private key are legally paired public and private keys; A first authorization file tampering analysis unit, configured to perform a digest calculation on the portion of the issuance authorization file except the SignValue tag using an SM3 algorithm to generate a preset byte hash value; Call the SM2 cryptographic algorithm signature API interface of the issuing device to perform signature verification and integrity verification to determine whether the issuing authorization file has been illegally tampered with; if the issuing authorization file has not been illegally tampered with, continue to determine whether the authorized quantity of the issuing authorization file is 0. If the authorized quantity of the issuing authorization file is 0, it indicates that the authorized installation quantity has been used up; A device pre-authorization file generating unit is used to read the memory serial number, network MAC, and hardware information of the cryptographic device through the issuance control software, add the issuance public key data and date, perform hash operation using the SM3 algorithm to generate a unique authorization serial number, record it in the pre-authorization file, and generate a device pre-authorization file if the authorized installation quantity of the issuance authorization file is used up; Install the device pre-authorization file, the issuing public key and the issuing software body to the predetermined device storage path; reduce the number of authorizations in the issuing authorization file by 1, call the SM2 cryptographic algorithm and the issuing private key to re-sign, and store the updated files in the storage component of the issuing device; A second authorization file tampering analysis unit is used for confirming that the device authorization signature public and private keys are legally paired public and private keys when the distribution software body is running; Perform secondary signature verification and integrity verification on the issuance authorization document signature to determine whether the issuance authorization document has been illegally tampered with; If the issuance authorization file has not been illegally tampered with, the issuance software body reads the hardware information of the cryptographic device, generates a serial number, and compares it with the serial number in the issuance authorization file. If they are inconsistent, the operation of the issuance software body is terminated.

Images