Software license generation method and system based on certificate chain verification and storage medium

Abstract

The invention discloses a software license generation method and system based on certificate chain verification and a storage medium. The method comprises the steps that a certificate authorization center creates a certificate chain of a software product and issues a root CA certificate, a secondary CA certificate and a terminal signature certificate; a software developer signs to form a software license; the software developer puts the root CA certificate and the second-level CA certificate in a software product and installs the root CA certificate and the second-level CA certificate in executable hardware of a user side together with a software license; authorization verification is carried out when the software product is started, the software product is normally used if the authorization verification is passed, or the software product automatically ends running; and when the software license is about to expire or has a demand, requesting a software developer to re-issue the software license. The method has the advantages that offline software license inspection is supported, and when the signature private key of the software license is changed, a software product does not need to be changed.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer technology and PKI, and specifically relates to a method, system and storage medium for generating a software license based on certificate chain verification. Background Art

[0002] A software license is a contract between an entity that creates and provides an application, underlying source code, or related product and its end user, designed to protect the intellectual property of software developers and limit any claims that may be made for the use of the license. With the rapid development of information technology, a variety of software has emerged in an endless stream, and software licenses have become increasingly important as an important means of protecting the interests of software companies themselves.

[0003] At present, there are two main implementation schemes for software license verification: online verification and offline verification. Online verification methods can usually be divided into real-time verification and dynamic update; among them, real-time verification sends a request to the authorization server when the software is started, submits the license key and information, and the server returns the result after verification; dynamic verification is that the software communicates with the server regularly to obtain the latest license status and version information to ensure that the user is using the legal and latest version. The offline verification method verifies the validity of the license through a static license file. This method uses encryption technology to protect the license information, and the software verifies the validity of the license through the public key.

[0004] However, some software is deployed in an internal LAN and cannot be connected to the Internet, so there is a need to use the software offline. In addition, the encryption technology used for offline verification of software licenses requires the use of public keys to verify the validity of the license. It is difficult to update the public key because the public key is usually built into the software. Once the public key is released, if it needs to be changed or revoked, there must be an effective mechanism to notify all users to upgrade the software. Otherwise, the public key built into the existing software will not match the public key of the new key, and the public key verification of the license validity will fail.

[0005] In order to alleviate the difficulty of software distribution after the offline license key is updated, the present application proposes a software license generation method based on certificate chain verification, so that after the offline license key is updated, the existing version of the software can still use the license issued by the new key. Summary of the invention

[0006] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a method, system and storage medium for generating a software license based on certificate chain verification, which has the advantage that when the private key for signing the software license is changed, the software product does not need to be modified.

[0007] In order to achieve the above-mentioned object, the present invention adopts a method for generating a software license based on certificate chain verification, which includes the following steps: a certificate authority creates a certificate chain for a software product, and issues a root CA certificate in advance as the starting point of the certificate chain; at the same time, the root CA certificate is used to issue a secondary CA certificate and write it into the certificate chain; The software developer submits a certificate request for the software product to the certificate authority; The certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; The certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer; The software developer fills in the license file information and signs it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; The software developer combines and encodes the license file information and its signature value to form a software license; The software developer embeds the root CA certificate and the secondary CA certificate into the software product and installs them together with the software license in the user-side executable hardware; When the executable hardware starts the software product, the software product reads the software license and performs authorization verification in combination with the root CA certificate and secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends its operation; When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0008] As a preferred technical solution, the process of the certificate authority issuing the root CA certificate and the secondary CA certificate is as follows: Generate a root CA key pair, and use the root CA key pair to generate a root CA certificate request; The root CA certificate request is signed using the private key of the root CA key pair to obtain a root CA certificate as the starting point of the certificate chain; the root CA certificate contains the identification information and public key of the root CA; The certificate authority generates a secondary CA key pair; Use the secondary CA key pair to generate a certificate request containing the secondary CA identification information and public key, and use the private key of the root CA certificate to sign it, generate a secondary CA certificate and write it into the certificate chain.

[0009] As a preferred technical solution, the process of issuing the terminal signature certificate is: The certificate authority verifies the certificate request for the software product submitted by the software developer. If the verification fails, the certificate request will be rejected. If the verification is successful, the certificate authority uses the private key of the secondary CA certificate to sign the certificate request and generate a terminal signature certificate.

[0010] As a preferred technical solution, the signature value of the license file information is obtained in the following manner: Use the private key of the terminal signature certificate and PKCS#7 to sign the license file information to obtain the signature value without the original text and with the terminal signature certificate.

[0011] As a preferred technical solution, the license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 encoding to form a software license.

[0012] As a preferred technical solution, the authorization verification process is: When the user-side executable hardware starts the software product, the software product reads the software license installed in the executable hardware. If the software license is not read, the software product automatically ends its operation; If read, the software license is decoded to obtain the license file information and its signature value; Using the license file information as the original text, verify the validity of the signature value of the license file information; if the signature value of the license file information is invalid, the software product automatically terminates operation; If the signature value of the license file information is valid, the terminal signature certificate is obtained from the signature value of the license file information to verify the validity period of the terminal signature certificate; if the validity period of the terminal signature certificate expires, the software product automatically ends operation; If the terminal signature certificate is within the validity period, the certificate chain is verified. If the verification passes, the software product runs normally, otherwise the software product automatically ends its operation.

[0013] As a preferred technical solution, the license file information is used as the original text to verify the validity of the signature value of the license file information, specifically: Decode the software license to obtain the license file information and its signature value; The field data in the license file information is spliced ​​according to the specified splicing rules to generate the signature original text; Obtain the terminal signature certificate from the signature value of the license file information, and use the public key of the terminal signature certificate to verify the signature original and the signature value of the license file information.

[0014] As a preferred technical solution, the verification certificate chain is specifically: Obtain the terminal signature certificate from the signature value of the license file information, obtain the root CA certificate and secondary CA certificate from the software product, and the three certificates form a certificate set to be verified; Read the issuer of the terminal signature certificate and verify whether it is the issuing certificate of the terminal signature certificate in the certificate chain; if it is, proceed to the next step, otherwise stop verification and the software product automatically ends running; Read the issuer of the secondary CA certificate and verify whether it is the issuing certificate of the secondary CA certificate in the certificate chain. If it is, proceed to the next step. Otherwise, stop verification and the software product automatically ends running. Check in sequence whether the terminal signature certificate, secondary CA certificate and root CA certificate are valid; if yes, proceed to the next step; otherwise, stop checking and the software product automatically ends running; Use the public key of the issuing certificate of the terminal signing certificate to verify the signature of the terminal signing certificate. If the verification passes, use the public key of the issuing certificate of the secondary CA certificate in the certificate chain to verify the signature of the secondary CA certificate. If the verification passes, use the public key of the root CA certificate in the certificate chain to verify the signature of the root CA certificate. If the verification passes, the software product runs normally; if any signature verification fails, the verification is stopped and the software product automatically ends.

[0015] On the other hand, the present invention provides a software license generation system based on certificate chain verification, including a certificate issuance module, a license formation module, a certificate installation module, a certificate verification module and a certificate re-issuance module; The certificate issuance module is used by the certificate authority to create a certificate chain for software products, and issue a root CA certificate in advance as the starting point of the certificate chain; at the same time, the root CA certificate is used to issue a secondary CA certificate and write it into the certificate chain; the software developer submits a certificate request for the software product to the certificate authority; the certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; the certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer together; The license formation module is used by software developers to fill in the license file information and sign it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; the software developer combines and encodes the license file information and its signature value to form a software license; The certificate installation module is used by software developers to embed the root CA certificate and the secondary CA certificate into the software product, and install them together with the software license in the user-side executable hardware; The certificate verification module is used for when the executable hardware starts the software product, the software product reads the software license, and performs authorization verification in combination with the root CA certificate and the secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends operation; The certificate re-issuing module is used to request the software developer to re-issue the software license when the software product detects that the software license is about to expire, or to request the software developer to re-issue the software license according to the needs of the software product.

[0016] Another aspect of the present invention provides a computer-readable storage medium storing a program, which implements the above-mentioned method for generating a software license when the program is executed by a processor.

[0017] Compared with the prior art, the present invention has the following advantages and beneficial effects: 1. This method supports the verification of software license files in an offline state and does not rely on network connection. Users can still verify and use software products in an environment without Internet.

[0018] 2. In this method, when the signature private key of the software license changes, the software product can be used without making any related changes. When the private key of the terminal signature certificate is replaced, the public key of the terminal signature certificate included in the software license will also change accordingly; if the traditional software product has built-in terminal signature certificate public key data (requiring the signature public key of the license file to be consistent with it), then the license file issued by the terminal signature certificate after the private key is replaced cannot be applied to the old version of the client, and the client can only be upgraded together. In this method, the software product has built-in certificate chain data such as the root CA certificate and the secondary CA certificate. As long as the terminal signature certificate is issued by the secondary CA built into the software product, the software license issued by the terminal signature certificate after the private key is replaced can also be applied to the old version of the client, and the software product can be compatible with the new software license without making any related changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 The figure is an overall flow chart of a method for generating a software license based on certificate chain verification in an embodiment of the present invention.

[0021] Figure 2 The figure is a flowchart of authorization verification in an embodiment of the present invention.

[0022] Figure 3 It is an overall block diagram of a software license generation system based on certificate chain verification in an embodiment of the present invention.

[0023] Figure 4 Schematic diagram of the structure of a computer-readable storage medium in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0025] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0026] like Figure 1 As shown, this embodiment provides a method for generating a software license based on certificate chain verification, comprising the following steps: Step 1: Issue certificate: The certificate authority creates a certificate chain for the software product and issues a root CA certificate in advance as the starting point of the certificate chain; at the same time, the root CA certificate is used to issue a secondary CA certificate and write it into the certificate chain.

[0027] The software developer submits a certificate request for the software product to the certificate authority.

[0028] The certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer.

[0029] The certificate authority will issue the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer.

[0030] Furthermore, the process of the certificate authority issuing the root CA certificate and the secondary CA certificate is as follows: Generate a root CA key pair, and use the root CA key pair to generate a root CA certificate request; The root CA certificate request is signed using the private key of the root CA key pair to obtain the root CA certificate as the starting point of the certificate chain; the root CA certificate contains the identification information and public key of the root CA.

[0031] The certificate authority generates a secondary CA key pair; Use the secondary CA key pair to generate a certificate request containing the secondary CA identification information and public key, and use the private key of the root CA certificate to sign it, generate a secondary CA certificate, and write it into the certificate chain.

[0032] Furthermore, the process of issuing the terminal signature certificate is as follows: The certificate authority verifies the certificate request for the software product submitted by the software developer. If the verification fails, the certificate request will be rejected. If the verification is successful, the certificate authority uses the private key of the secondary CA certificate to sign the certificate request and generate a terminal signature certificate.

[0033] Therefore, the root CA certificate in step one serves as the certificate chain trust anchor point in the license validity verification step. In the certificate chain verification step of the authorization validity verification, it is required to successfully construct the certificate chain through this trust anchor point before the certificate chain verification can be considered passed.

[0034] Step 2: Form a license: The software developer fills in the license file information and signs it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product usage expiration date, software product operating environment information (such as MAC address, etc.), software product version and software product authorized use functions, etc.

[0035] The software developer combines and encodes the license file information and its signature value to form a software license.

[0036] Furthermore, when the license file information is signed, the private key of the terminal signature certificate and PKCS#7 are used to sign the license file information to obtain a signature value without the original text but with the terminal signature certificate.

[0037] Furthermore, the license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 encoding to form a software license.

[0038] Step 3: Install the certificate: Software developers embed the root CA certificate and secondary CA certificate into the software product and install them together with the software license on the user-side executable hardware.

[0039] Step 4: Authorization verification: When the executable hardware starts the software product, the software product reads the software license and performs authorization verification in combination with the root CA certificate and secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends its operation.

[0040] Further, such as Figure 2 As shown, the authorization verification process is: 1. When the user-side executable hardware starts the software product, the software product reads the software license installed in the user-side executable hardware. If the software license is not read, the software product automatically ends its operation; 2. If read, decode the software license to obtain the license file information and its signature value; 3. Use the license file information as the original text to verify the validity of the signature value of the license file information; if the signature value of the license file information is invalid, the software product automatically terminates its operation.

[0041] Specifically, the validity verification process of the signature value of the license file information is as follows: 3.1. Decode the software license to obtain the license file information and its signature value; In this embodiment, the software license is decoded by Base64 to obtain the JSON string content, and then the license file information and its signature value are obtained from the JSON string content.

[0042] 3.2. Splice the field data in the license file information according to the specified splicing rules to generate the signature original text; 3.3. Obtain the terminal signature certificate from the signature value of the license file information, and use the public key of the terminal signature certificate to verify the signature original and the signature value of the license file information.

[0043] 4. If the signature value of the license file information is valid, the terminal signature certificate is obtained from the signature value of the license file information to verify the validity period of the terminal signature certificate; if the validity period of the terminal signature certificate expires, the software product automatically ends operation; 5. If the terminal signature certificate is within the validity period, the certificate chain is verified. If the verification passes, the software product runs normally, otherwise the software product automatically ends its operation.

[0044] Specifically, the verification process of the certificate chain is: 5.1. Obtain the terminal signature certificate from the signature value of the license file information, obtain the root CA certificate and secondary CA certificate from the software product, and the three certificates form the certificate set to be verified; 5.2. Read the issuer of the terminal signature certificate and verify whether it is the issuing certificate of the terminal signature certificate in the certificate chain (i.e., the secondary CA certificate); if it is, proceed to the next step 5.3; otherwise, stop verification and the software product automatically ends operation; 5.3. Read the issuer of the secondary CA certificate and verify whether it is the issuing certificate of the secondary CA certificate in the certificate chain (i.e. the root CA certificate). If yes, proceed to the next step 5.4. Otherwise, stop verification and the software product automatically ends operation. 5.4. Check in sequence whether the terminal signature certificate, secondary CA certificate and root CA certificate are valid; if yes, proceed to the next step 5.5; otherwise, stop checking and the software product automatically ends operation; 5.5. Use the public key of the issuing certificate of the terminal signing certificate in the certificate chain (i.e. the public key of the secondary CA certificate) to verify the signature of the terminal signing certificate. If the verification is successful, use the public key of the issuing certificate of the secondary CA certificate in the certificate chain (i.e. the public key of the root CA certificate) to verify the signature of the secondary CA certificate. If the verification is successful, use the public key of the root CA certificate in the certificate chain (because the root CA certificate is self-signed) to verify the signature of the root CA certificate. If the verification is successful, the software product will run normally. If any signature verification fails, the verification will be stopped and the software product will automatically end its operation.

[0045] Step 5: Re-issue the certificate: When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0046] Specifically, if the terminal signing certificate is about to expire, the software product will make a request to the certificate authority. The certificate authority needs to first issue the terminal signing certificate and update the certificate chain, and then use the newly issued terminal signing certificate private key to generate a signature value for the license file information. Then, a new software license is formed by combining the license file information and its signature value to ensure that the terminal signing certificate within the signature value can verify the signature value.

[0047] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0048] Based on the same idea as the software license generation method based on certificate chain verification in the above-mentioned embodiment, the present invention also provides a software license generation method system based on certificate chain verification, which can be used to execute the above-mentioned software license generation method based on certificate chain verification. For ease of explanation, the structural diagram of the embodiment of the software license generation method system based on certificate chain verification only shows the parts related to the embodiment of the present invention. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0049] like Figure 3As shown, another embodiment of the present invention provides a method system for generating a software license based on certificate chain verification, including a certificate issuance module, a license formation module, a certificate installation module, a certificate verification module and a certificate re-issuance module; Among them, the certificate issuance module is used by the certificate authority to create a certificate chain for software products. The root CA certificate is issued in advance as the starting point of the certificate chain; the root CA certificate is used to issue a secondary CA certificate and write it into the certificate chain; the software developer submits a certificate request for the software product to the certificate authority; the certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; the certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer together; The license formation module is used by software developers to fill in the license file information and sign it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; the software developer combines and encodes the license file information and its signature value to form a software license; The certificate installation module is used by software developers to embed the root CA certificate and secondary CA certificate into the software product and install them together with the software license in the user-side executable hardware; The certificate verification module is used when the executable hardware starts the software product. The software product reads the software license and performs authorization verification in combination with the root CA certificate and the secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends its operation. The certificate re-issuance module is used to request the software developer to re-issue the software license when the software product detects that the software license is about to expire, or to request the software developer to re-issue the software license according to the needs of the software product.

[0050] It should be noted that the software license generation system based on certificate chain verification of the present invention corresponds one-to-one to the software license generation method based on certificate chain verification of the present invention. The technical features and beneficial effects described in the embodiment of the software license generation method based on certificate chain verification are applicable to the embodiment of the software license generation system based on certificate chain verification. For specific contents, please refer to the description in the embodiment of the method of the present invention. It will not be repeated here. This is hereby declared.

[0051] In addition, in the implementation of the software license generation system based on certificate chain verification in the above-mentioned embodiment, the logical division of each program module is only an example. In actual application, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the software license generation system based on certificate chain verification is divided into different program modules to complete all or part of the functions described above.

[0052] like Figure 4 As shown, in one embodiment, a computer-readable storage medium is provided, which stores a program in a memory. When the program is executed by a processor, a method for generating a software license based on certificate chain verification is implemented, specifically: The certificate authority creates a certificate chain for the software product and issues a root CA certificate in advance as the starting point of the certificate chain. At the same time, the root CA certificate is used to issue a secondary CA certificate and written into the certificate chain. The software developer submits a certificate request for the software product to the certificate authority; The certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; The certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer; The software developer fills in the license file information and signs it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; The software developer combines and encodes the license file information and its signature value to form a software license; The software developer embeds the root CA certificate and the secondary CA certificate into the software product and installs them together with the software license in the user-side executable hardware; When the executable hardware starts the software product, the software product reads the software license and performs authorization verification in combination with the root CA certificate and secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends its operation; When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0053] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0054] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0055] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A method for generating a software license based on certificate chain verification, characterized in that: The steps include: The certificate authority creates a certificate chain for the software product and issues a root CA certificate in advance as the starting point of the certificate chain. At the same time, the root CA certificate is used to issue a secondary CA certificate and written into the certificate chain. The software developer submits a certificate request for the software product to the certificate authority; The certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; The certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer; The software developer fills in the license file information and signs it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; The software developer combines and encodes the license file information and its signature value to form a software license; The software developer embeds the root CA certificate and the secondary CA certificate into the software product and installs them together with the software license in the user-side executable hardware; When the executable hardware starts the software product, the software product reads the software license and performs authorization verification in combination with the root CA certificate and secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends its operation; When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

2. The method for generating a software license according to claim 1, characterized in that: The process of issuing the root CA certificate and the secondary CA certificate by the certificate authority is as follows: Generate a root CA key pair, and use the root CA key pair to generate a root CA certificate request; Use the private key of the root CA key pair to sign the root CA certificate request to obtain the root CA certificate as the starting point of the certificate chain; The root CA certificate contains the identification information and public key of the root CA; The certificate authority generates a secondary CA key pair; Use the secondary CA key pair to generate a certificate request containing the secondary CA identification information and public key, and use the private key of the root CA certificate to sign it, generate a secondary CA certificate and write it into the certificate chain.

3. The method for generating a software license according to claim 1, wherein: The process of issuing the terminal signature certificate is as follows: The certificate authority verifies the certificate request for the software product submitted by the software developer. If the verification fails, the certificate request will be rejected. If the verification is successful, the certificate authority uses the private key of the secondary CA certificate to sign the certificate request and generate a terminal signature certificate.

4. The method for generating a software license according to claim 1, wherein: The signature value of the license file information is obtained in the following way: Use the private key of the terminal signature certificate and PKCS#7 to sign the license file information to obtain the signature value without the original text and with the terminal signature certificate.

5. The method for generating a software license according to claim 1, wherein: The license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 encoding to form a software license.

6. The method for generating a software license according to claim 1, wherein: The authorization verification process is as follows: When the user-side executable hardware starts the software product, the software product reads the software license installed in the executable hardware. If the software license is not read, the software product automatically ends its operation; If read, the software license is decoded to obtain the license file information and its signature value; Using the license file information as the original text, verify the validity of the signature value of the license file information; If the signature value of the license file information is invalid, the software product automatically ends operation; If the signature value of the license file information is valid, the terminal signature certificate is obtained from the signature value of the license file information, and the validity period of the terminal signature certificate is verified; If the validity period of the terminal signature certificate expires, the software product will automatically stop running; If the terminal signature certificate is within the validity period, the certificate chain is verified. If the verification passes, the software product runs normally, otherwise the software product automatically ends its operation.

7. The method for generating a software license according to claim 6, wherein: The license file information is used as the original text to verify the validity of the signature value of the license file information, specifically: Decode the software license to obtain the license file information and its signature value; The field data in the license file information is spliced ​​according to the specified splicing rules to generate the signature original text; Obtain the terminal signature certificate from the signature value of the license file information, and use the public key of the terminal signature certificate to verify the signature original and the signature value of the license file information.

8. The method for generating a software license according to claim 6, wherein: The verification certificate chain is specifically: Obtain the terminal signature certificate from the signature value of the license file information, obtain the root CA certificate and secondary CA certificate from the software product, and the three certificates form a certificate set to be verified; Read the issuer of the terminal signature certificate and verify whether it is the issuing certificate of the terminal signature certificate in the certificate chain; If yes, go to the next step, otherwise stop the verification and the software product automatically ends running; Read the issuer of the secondary CA certificate and verify whether it is the issuing certificate of the secondary CA certificate in the certificate chain. If it is, proceed to the next step. Otherwise, stop verification and the software product automatically ends running. Check in sequence whether the terminal signature certificate, secondary CA certificate and root CA certificate are valid; if yes, proceed to the next step; otherwise, stop checking and the software product automatically ends running; Use the public key of the issuing certificate of the terminal signing certificate to verify the signature of the terminal signing certificate. If the verification passes, use the public key of the issuing certificate of the secondary CA certificate in the certificate chain to verify the signature of the secondary CA certificate. If the verification passes, use the public key of the root CA certificate in the certificate chain to verify the signature of the root CA certificate. If the verification passes, the software product runs normally; if any signature verification fails, the verification is stopped and the software product automatically ends.

9. A software license generation system based on certificate chain verification, characterized in that: It includes a certificate issuance module, a license formation module, a certificate installation module, a certificate verification module and a certificate re-issuance module; The certificate issuing module is used by the certificate authority to create a certificate chain for the software product, and to issue a root CA certificate in advance as the starting point of the certificate chain; At the same time, use the root CA certificate to issue the secondary CA certificate and write it into the certificate chain; The software developer submits a certificate request for the software product to the certificate authority; The certificate authority uses the secondary CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer; The certificate authority issues the root CA certificate, secondary CA certificate, and terminal signature certificate to the software developer; The license formation module is used by software developers to fill in the license file information and sign it with the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use deadline, software product operating environment information, software product version and software product authorized use function; the software developer combines and encodes the license file information and its signature value to form a software license; The certificate installation module is used by software developers to embed the root CA certificate and the secondary CA certificate into the software product, and install them together with the software license in the user-side executable hardware; The certificate verification module is used for when the executable hardware starts the software product, the software product reads the software license, and performs authorization verification in combination with the root CA certificate and the secondary CA certificate built into the software product. If the authorization verification passes, the software product can be used normally, otherwise the software product automatically ends operation; The certificate re-issuing module is used to request the software developer to re-issue the software license when the software product detects that the software license is about to expire, or to request the software developer to re-issue the software license according to the needs of the software product.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the software license generation method according to any one of claims 1 to 8 is implemented.

Images