Certificate chain-based software license generation method, system and storage medium

Abstract

The application discloses a software license generation method and system based on certificate chain verification and a storage medium, and the method is as follows: a certificate authority center creates a certificate chain of a software product, issues a root CA certificate, a secondary CA certificate and a terminal signature certificate; a software developer forms a software license by signing; the software developer embeds the root CA certificate and the secondary CA certificate in the software product and installs the software license in user-side executable hardware; when the software product is started, authorization verification is performed, if the authorization verification is passed, the software product is normally used, otherwise, the software product automatically ends running; when the software license is about to expire or has a demand, the software developer is requested to reissue the software license. The application supports offline software license inspection and has the advantage that the software product does not need to be changed when a software license signing private key is changed.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computer technology and PKI, and particularly relates to a software license generation method and system based on certificate chain verification and a storage medium. BACKGROUND

[0002] The software license is a contract between the entity creating and providing the application program, underlying source code or related product and its end user, aiming to protect the intellectual property rights of the software developer and limit any claims that may be raised due to the use of the license. With the rapid development of information technology, various software emerges in an endless stream, and the software license, as an important means to protect the interests of software companies, is becoming increasingly important.

[0003] At present, the software license verification implementation scheme mainly includes two kinds: online verification and offline verification. The online verification mode can be divided into real-time verification and dynamic updating; among them, the real-time verification sends a request to the authorization server when the software starts, submits the license key and information, and the server returns the result after verification; the dynamic verification is that the software communicates with the server regularly to obtain the latest license status and version information, ensuring that the user uses the legal and latest version. The offline verification mode verifies the license validity through a static license file, and this mode uses encryption technology to protect the license information, and the software verifies the validity of the license through the public key.

[0004] However, part of the software is deployed in the internal local area network for use, cannot connect to the Internet, and there is a demand for offline use of the software; and the encryption technology scheme used in the offline verification software license mode needs to verify the validity of the license through the public key, and the public key update is difficult because the public key is usually built-in in the software. Once the public key is published, if it needs to be changed or revoked, an effective mechanism must be used to notify all users to upgrade the software, otherwise the public key built-in in the existing software does not match the public key of the new key, and the public key verification of the license validity will not pass.

[0005] In order to alleviate the difficulty of software distribution after the offline license key is updated, the application provides a software license generation method based on certificate chain verification, so that the existing version of software can still use the license signed by the new key after the offline license key is updated. SUMMARY

[0006] The main purpose of the application is to overcome the shortcomings and deficiencies of the prior art, and provide a software license generation method and system based on certificate chain verification and a storage medium, which has the advantage that the software product does not need to be changed when the software license signing private key is changed.

[0007] In order to achieve the above object, the application adopts a software license generation method based on certificate chain verification, comprising the following steps: a certificate authority center creates a certificate chain of a software product, and issues a root CA certificate as the starting point of the certificate chain in advance; a second CA certificate is issued using the root CA certificate and written into the certificate chain;

[0008] A software developer submits a certificate request of the software product to the certificate authority center;

[0009] The certificate authority center issues a terminal signature certificate based on the certificate request submitted by the software developer using the second CA certificate;

[0010] The certificate authority center issues the root CA certificate, the second CA certificate and the terminal signature certificate to the software developer;

[0011] The software developer fills in the license file information and signs using the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use expiration time, the software product running environment information, the software product version and the software product authorized use function;

[0012] The software developer combines and encodes the license file information and its signature value to form a software license;

[0013] The software developer embeds the root CA certificate and the second CA certificate in the software product, and installs them in the user's executable hardware together with the software license;

[0014] When the executable hardware starts the software product, the software product reads the software license, and combines the root CA certificate and the second CA certificate embedded in the software product for authorization verification; if the authorization verification is passed, the software product is normally used, otherwise the software product automatically ends running;

[0015] When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0016] As a preferred technical solution, the process of the certificate authority center issuing the root CA certificate and the second CA certificate is as follows:

[0017] A root CA key pair is generated, and a root CA certificate request is generated using the root CA key pair;

[0018] The private key of the root CA key pair is used to sign the root CA certificate request to obtain the root CA certificate as the starting point of the certificate chain; the root CA certificate contains the identification information and public key of the root CA;

[0019] The certificate authority center generates a second CA key pair;

[0020] The second CA key is used to generate a certificate request containing second CA identification information and a public key, and the private key of the root CA certificate is used for signature, a second CA certificate is generated and written into the certificate chain.

[0021] As a preferred technical solution, the process of the issuing terminal signing the certificate is:

[0022] The certificate authority verifies the certificate request of the software product submitted by the software developer, and if the verification fails, the certificate request of the software developer is rejected;

[0023] If the verification is passed, the certificate authority uses the private key of the second CA certificate to sign based on the certificate request, and generates a terminal signature certificate.

[0024] As a preferred technical solution, the signature value of the license file information is obtained in the following way:

[0025] The private key of the terminal signature certificate and the PKCS#7 are used to sign the license file information, and the signature value without the original text and with the terminal signature certificate is obtained.

[0026] As a preferred technical solution, the license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 to form a software license.

[0027] As a preferred technical solution, the authorization verification process is:

[0028] When the user terminal executable hardware starts the software product, the software product reads the software license installed in the executable hardware, and if it is not read, the software product automatically ends running;

[0029] If it is read, the software license is decoded to obtain the license file information and its signature value;

[0030] The license file information is used as the original text, and the validity of the signature value of the license file information is verified; if the signature value of the license file information is invalid, the software product automatically ends running;

[0031] If the signature value of the license file information is valid, the terminal signature certificate is obtained from the signature value of the license file information, and the validity period of the terminal signature certificate is verified; if the validity period of the terminal signature certificate is invalid, the software product automatically ends running;

[0032] If the terminal signature certificate is within the validity period, the certificate chain is verified, and if the verification is passed, the software product runs normally, otherwise the software product automatically ends running.

[0033] As a preferred technical solution, the license file information is used as the original text, and the validity of the signature value of the license file information is verified, specifically:

[0034] Decode the software license to obtain license file information and its signature value;

[0035] Splice the field data in the license file information according to a specified splicing rule to generate a signature original text;

[0036] Obtain a terminal signature certificate from the signature value of the license file information, and use the public key of the terminal signature certificate to verify the signature original text and the signature value of the license file information.

[0037] As a preferred technical solution, the verification certificate chain is specifically:

[0038] Obtain a terminal signature certificate from the signature value of the license file information, obtain a root CA certificate and a secondary CA certificate from the software product, and form a to-be-verified certificate set with the three certificates;

[0039] Read the issuer of the terminal signature certificate, and verify whether it is the issuing certificate of the terminal signature certificate in the certificate chain; if yes, proceed to the next step, otherwise stop verification, and the software product automatically ends running;

[0040] Read the issuer of the secondary CA certificate, and verify whether it is the issuing certificate of the secondary CA certificate in the certificate chain; if yes, proceed to the next step, otherwise stop verification, and the software product automatically ends running;

[0041] Check whether the terminal signature certificate, the secondary CA certificate and the root CA certificate are within the valid period in sequence; if yes, proceed to the next step, otherwise stop checking, and the software product automatically ends running;

[0042] Use the public key of the issuing certificate of the terminal signature certificate to perform signature verification on the terminal signature certificate, and if the verification is passed, use the public key of the issuing certificate of the secondary CA certificate in the certificate chain to perform signature verification on the secondary CA certificate, and if the verification is passed, use the public key of the root CA certificate in the certificate chain to perform signature verification on the root CA certificate, and if the verification is passed, the software product normally runs; if any signature verification is not passed, stop verification, and the software product automatically ends running.

[0043] On the other hand, the application provides a software license generation system based on certificate chain verification, comprising a certificate issuing module, a license forming module, a certificate installation module, a certificate verification module and a certificate re-issuing module.

[0044] The certificate issuing module is used for a certificate authority center to create a certificate chain of a software product, previously issues a root CA certificate as a starting point of the certificate chain, simultaneously issues a second-level CA certificate using the root CA certificate and writes the second-level CA certificate into the certificate chain, a software developer submits a certificate request of the software product to the certificate authority center, the certificate authority center issues a terminal signature certificate based on the certificate request submitted by the software developer using the second-level CA certificate, and the certificate authority center issues the root CA certificate, the second-level CA certificate and the terminal signature certificate to the software developer together.

[0045] The license forming module is used for the software developer to fill in license file information and sign the license file information using the terminal signature certificate to obtain a signature value of the license file information, the license file information includes a software product use deadline, software product running environment information, a software product version and software product authorized use functions, and the software developer combines and encodes the license file information and the signature value to form a software license.

[0046] The certificate installing module is used for the software developer to embed the root CA certificate and the second-level CA certificate in the software product and install the software license and the software product in a user-side executable hardware together.

[0047] The certificate verifying module is used for the software product to read the software license when the executable hardware starts the software product, and the software product combines the root CA certificate and the second-level CA certificate embedded in the software product to perform authorization verification, if the authorization verification is passed, the software product is normally used, otherwise, the software product automatically ends running.

[0048] The certificate reissuing module is used for the software product to request the software developer to reissue the software license when the software product detects that the software license is about to expire, or request the software developer to reissue the software license according to a need of the software product.

[0049] The application also provides a computer readable storage medium storing a program, the program is executed by a processor to realize the software license generation method.

[0050] Compared with the prior art, the application has the following advantages and beneficial effects:

[0051] 1. The method supports software license file verification in an offline state, does not depend on network connection, and users can still verify and use the software product in an environment without Internet.

[0052] 2、In the method, when the signature private key of the software license is changed, the software product does not need to be changed and can be used. When the terminal signature certificate private key is replaced, the terminal signature certificate public key attached in the software license will also change; if the traditional software product is built-in terminal signature certificate public key data (the signature public key of the license file is required to be consistent), then the license file signed by the terminal signature certificate after the private key is replaced cannot be applied to the old version of the client, and only the client can be upgraded. In the method, the software product is built-in certificate chain data such as root CA certificate and secondary CA certificate. As long as the terminal signature certificate is signed by the secondary CA built-in in the software product, the software license signed by the terminal signature certificate after the private key is replaced can be applied to the old version of the client, and the software product does not need to be changed to be compatible with the new software license. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0054] Figure 1 The overall flowchart of the software license generation method based on certificate chain verification in the embodiments of the present application.

[0055] Figure 2 The flowchart of the authorization verification in the embodiments of the present application.

[0056] Figure 3 The overall block diagram of the software license generation system based on certificate chain verification in the embodiments of the present application.

[0057] Figure 4 The structure diagram of the computer readable storage medium in the embodiments of the present application. DETAILED DESCRIPTION

[0058] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0059] Reference to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all referring to a common set of embodiments. It is expressly understood that the described embodiments are merely examples from a

[0060] As shown in Figure 1 the embodiment of the present application, the software license generation method based on certificate chain verification comprises the following steps:

[0061] Step one, issuing a certificate:

[0062] The certificate authority center creates a certificate chain of the software product, and issues a root CA certificate as the starting point of the certificate chain in advance; meanwhile, a second-level CA certificate is issued using the root CA certificate and written into the certificate chain.

[0063] The software developer submits a certificate request of the software product to the certificate authority center.

[0064] The certificate authority center issues a terminal signature certificate based on the certificate request submitted by the software developer using the second-level CA certificate.

[0065] The certificate authority center issues the root CA certificate, the second-level CA certificate, and the terminal signature certificate to the software developer.

[0066] Further, the process of issuing the root CA certificate and the second-level CA certificate by the certificate authority center is as follows:

[0067] A root CA key pair is generated, and a root CA certificate request is generated using the root CA key pair;

[0068] The root CA certificate request is signed using the private key of the root CA key pair to obtain the root CA certificate as the starting point of the certificate chain; the root CA certificate contains the identification information and the public key of the root CA.

[0069] The certificate authority center generates a second-level CA key pair;

[0070] A certificate request containing the identification information and the public key of the second-level CA is generated using the second-level CA key pair, and the private key of the root CA certificate is used for signing to generate the second-level CA certificate and write it into the certificate chain.

[0071] Further, the process of issuing the terminal signature certificate is as follows:

[0072] The certificate authority center verifies the certificate request of the software product submitted by the software developer, and if the verification fails, the certificate request of the software developer is rejected;

[0073] If the verification is passed, the certificate authority center signs the terminal signature certificate based on the certificate request using the private key of the secondary CA certificate.

[0074] Thus, the root CA certificate in step one is used as the certificate chain trust anchor of the license validity verification step. In the authorized validity verification certificate chain verification step, the certificate chain is considered to be verified if it can be successfully constructed through the trust anchor.

[0075] Step two, forming a license:

[0076] The software developer fills in the license file information and signs it using the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use expiration time, software product running environment information (such as MAC address, etc.), software product version, and software product authorized use function, etc.

[0077] The software developer fills in the license file information and signs it using the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use expiration time, software product running environment information (such as MAC address, etc.), software product version, and software product authorized use function, etc.

[0078] Further, when signing the license file information, the private key of the terminal signature certificate and PKCS#7 are used to sign the license file information to obtain a signature value without the original text and with the terminal signature certificate.

[0079] Further, the license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 to form a software license.

[0080] Step three, installing the certificate:

[0081] The software developer embeds the root CA certificate and the secondary CA certificate in the software product, and installs them together with the software license in the user-side executable hardware.

[0082] Step four, authorization verification:

[0083] When the executable hardware starts the software product, the software product reads the software license and combines the root CA certificate and the secondary CA certificate embedded in the software product for authorization verification. If the authorization verification is passed, the software product is used normally, otherwise the software product automatically ends running.

[0084] Further, as shown in Figure 2 , the authorization verification process is:

[0085] 1. When the user-side executable hardware starts the software product, the software product reads the software license installed in the user-side executable hardware. If it is not read, the software product automatically ends running.

[0086] 2. If read, the software license is decoded to obtain the license file information and its signature value;

[0087] 3. The license file information is used as the original text to verify the validity of the signature value of the license file information. If the signature value of the license file information is invalid, the software product automatically ends running.

[0088] Specifically, the signature value validity verification process of the license file information is as follows:

[0089] 3.1. The software license is decoded to obtain the license file information and its signature value. In this embodiment, the software license is Base64 decoded to obtain the JSON string content, and then the license file information and its signature value are obtained from the JSON string content.

[0090] 3.2. The field data in the license file information is spliced according to the specified splicing rule to generate the signature original text.

[0091] 3.3. The terminal signature certificate is obtained from the signature value of the license file information, and the public key of the terminal signature certificate is used to verify the signature original text and the signature value of the license file information.

[0092] 4. If the signature value of the license file information is valid, the terminal signature certificate is obtained from the signature value of the license file information, and the validity period of the terminal signature certificate is verified. If the validity period of the terminal signature certificate is invalid, the software product automatically ends running.

[0093] 5. If the terminal signature certificate is within the validity period, the certificate chain is verified. If the verification is passed, the software product normally runs, otherwise the software product automatically ends running.

[0094] Specifically, the verification process of the certificate chain is as follows:

[0095] 5.1. The terminal signature certificate is obtained from the signature value of the license file information, the root CA certificate and the secondary CA certificate are obtained from the software product, and the three certificates form a set of certificates to be verified.

[0096] 5.2. The issuer of the terminal signature certificate is read, and it is verified whether it is the issuing certificate (i.e. the secondary CA certificate) of the terminal signature certificate in the certificate chain. If yes, go to the next step 5.3, otherwise stop verification and the software product automatically ends running.

[0097] 5.3. The issuer of the secondary CA certificate is read, and it is verified whether it is the issuing certificate (i.e. the root CA certificate) of the secondary CA certificate in the certificate chain. If yes, go to the next step 5.4, otherwise stop verification and the software product automatically ends running.

[0098] 5.4, check whether the terminal signature certificate, the secondary CA certificate and the root CA certificate are in the valid period in turn; if yes, go to next step 5.5, otherwise stop checking, and the software product automatically ends running;

[0099] 5.5, use the issuing certificate public key of the terminal signature certificate (i.e. the public key of the secondary CA certificate) to verify the signature of the terminal signature certificate, if the verification is passed, use the issuing certificate public key of the secondary CA certificate (i.e. the public key of the root CA certificate) to verify the signature of the secondary CA certificate, if the verification is passed, use the public key of the root CA certificate to verify the signature of the root CA certificate (as the root CA certificate is self-signed), if the verification is passed, the software product runs normally; if any of the signature verifications is not passed, stop the verification, and the software product automatically ends running.

[0100] Step five, certificate reissuing:

[0101] When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0102] Specifically, if the terminal signature certificate is about to expire, the software product will request the certificate authority center, the certificate authority center needs to first issue the terminal signature certificate and update the certificate chain, then use the newly issued terminal signature certificate private key to generate a signature value for the license file information, and then combine the license file information and the signature value to form a new software license, so as to ensure that the terminal signature certificate in the signature value can pass the signature verification.

[0103] It should be noted that, for the foregoing method embodiments, in order to facilitate the description, they are all described as a combination of a series of actions, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously.

[0104] Based on the same idea as the software license generation method based on certificate chain verification in the above embodiment, the present application also provides a software license generation method system based on certificate chain verification, which can be used to execute the software license generation method based on certificate chain verification. In order to facilitate the description, in the structural diagram of the embodiment of the software license generation method system based on certificate chain verification, only the parts related to the embodiment of the present application are shown, and those skilled in the art can understand that the diagrammed structure does not constitute a limitation on the device, and can include more or fewer components than the diagram, or combine certain components, or different component arrangements.

[0105] As Figure 3As shown, another embodiment of the present application provides a software license generation method based on certificate chain verification, including a certificate issuing module, a license forming module, a certificate installation module, a certificate verification module and a certificate re-issuing module.

[0106] The certificate issuing module is configured to create a certificate chain of the software product by a certificate authority, and pre-issue a root CA certificate as a starting point of the certificate chain; meanwhile, issue a secondary CA certificate using the root CA certificate and write it into the certificate chain; the software developer submits a certificate request of the software product to the certificate authority; the certificate authority issues a terminal signature certificate based on the certificate request submitted by the software developer using the secondary CA certificate; and the certificate authority issues the root CA certificate, the secondary CA certificate and the terminal signature certificate to the software developer.

[0107] The license forming module is configured to fill in license file information by the software developer and sign the license file information using the terminal signature certificate to obtain a signature value of the license file information; the license file information includes a software product use deadline, software product running environment information, a software product version and a software product authorized use function; and the software developer combines and encodes the license file information and the signature value to form a software license.

[0108] The certificate installation module is configured to embed the root CA certificate and the secondary CA certificate in the software product by the software developer, and install the software license and the software product in the user-side executable hardware.

[0109] The certificate verification module is configured to read the software license by the software product when the executable hardware starts the software product, and perform authorization verification by combining the root CA certificate and the secondary CA certificate embedded in the software product; if the authorization verification is passed, the software product is normally used, otherwise the software product automatically ends running.

[0110] The certificate re-issuing module is configured to request the software developer to re-issue the software license when the software product detects that the software license is about to expire, or request the software developer to re-issue the software license according to the needs of the software product.

[0111] It should be noted that the software license generation system based on certificate chain verification of the present application corresponds to the software license generation method based on certificate chain verification of the present application, and the technical features and advantages described in the embodiment of the software license generation method based on certificate chain verification are applicable to the embodiment of the software license generation system based on certificate chain verification, and the specific content can be referred to the description in the method embodiment of the present application, which will not be described here again, and hereby declared.

[0112] Further, in the implementation of the software license generation system based on certificate chain verification of the above-mentioned embodiments, the logical division of each program module is only illustrative, and in actual applications, the above-mentioned functions can be completed by different program modules according to needs, for example, for the configuration requirements of corresponding hardware or the convenience of software implementation, that is, the internal structure of the software license generation system based on certificate chain verification is divided into different program modules to complete all or part of the functions described above.

[0113] As shown in Figure 4 In one embodiment, a computer readable storage medium is provided, which stores a program in the memory, and when the program is executed by a processor, a software license generation method based on certificate chain verification is implemented, specifically:

[0114] The certificate authority center creates a certificate chain of the software product, and issues a root CA certificate as the starting point of the certificate chain in advance; and uses the root CA certificate to issue a second-level CA certificate and write it into the certificate chain;

[0115] The software developer submits a certificate request of the software product to the certificate authority center;

[0116] The certificate authority center uses the second-level CA certificate to issue a terminal signature certificate based on the certificate request submitted by the software developer;

[0117] The certificate authority center issues the root CA certificate, the second-level CA certificate, and the terminal signature certificate to the software developer;

[0118] The software developer fills in the license file information and signs it using the terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product use expiration time, software product running environment information, software product version, and software product authorized use function;

[0119] The software developer combines and encodes the license file information and its signature value to form a software license;

[0120] The software developer embeds the root CA certificate and the second-level CA certificate in the software product, and installs them together with the software license in the user-side executable hardware;

[0121] When the executable hardware starts the software product, the software product reads the software license and combines the root CA certificate and the second-level CA certificate embedded in the software product for authorization verification, and if the authorization verification is passed, the software product is used normally, otherwise the software product automatically ends running;

[0122] When the software product detects that the software license is about to expire, it requests the software developer to reissue the software license, or requests the software developer to reissue the software license according to the needs of the software product.

[0123] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0124] The technical features of the above embodiments can be combined in any way. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0125] The above embodiments are the preferred embodiments of the present application, but the embodiments of the present application are not limited to the above embodiments, and any changes, modifications, substitutions, combinations and simplifications of the embodiments of the present application without departing from the spirit and principles of the present application shall be equivalent replacement methods and shall be included in the protection scope of the present application.

Claims

1. A method for generating software licenses based on certificate chain verification, characterized in that, Includes the following steps: The Certificate Authority (CA) creates a certificate chain for the software product, first issuing a root CA certificate as the starting point of the certificate chain; at the same time, it uses the root CA certificate to issue secondary CA certificates and writes them into the certificate chain. Software developers submit certificate requests for their software products to certificate authorities. Certificate Authorization Centers use Level 2 CA certificates to issue terminal signature certificates based on certificate requests submitted by software vendors; The Certificate Authority will issue the root CA certificate, secondary CA certificate, and terminal signature certificate together to the software developer; The software developer fills in the license document information and signs it using a terminal signing certificate to obtain the signature value of the license document information; the license document information includes the software product's expiration date, the software product's operating environment information, the software product version, and the authorized functions of the software product. Software developers combine and encode license file information and its signature value to form a software license; Software developers embed the root CA certificate and secondary CA certificate into their software products and install them along with the software license on the user's executable hardware. When the executable hardware starts the software product, the software product reads the software license and performs authorization verification by combining the root CA certificate and secondary CA certificate built into the software product. If the authorization verification is successful, the software product can be used normally; otherwise, the software product will automatically terminate its operation. When a software product detects that its software license is about to expire, it requests a new software license from the software developer, or requests a new software license from the software developer as needed for the software product.

2. The software license generation method according to claim 1, characterized in that, The process by which the Certificate Authority issues root CA certificates and secondary CA certificates is as follows: Generate a root CA key pair, and use the root CA key pair to generate a root CA certificate request; The root CA certificate is obtained by signing the root CA certificate request with the private key of the root CA key pair, which serves as the starting point of the certificate chain. The root CA certificate contains the root CA's identification information and public key; Certificate Authority generates secondary CA key pairs; The secondary CA key pair is used to generate a certificate request containing the secondary CA identification information and public key, and then the private key of the root CA certificate is used to sign it, generating the secondary CA certificate and writing it into the certificate chain.

3. The software license generation method according to claim 1, characterized in that, The process of issuing the terminal signature certificate is as follows: The certificate authority verifies the certificate requests submitted by software developers for their software products. If the verification fails, the certificate request is rejected. If the verification is successful, the Certificate Authority will use the private key of the secondary CA certificate to sign the certificate request and generate a terminal signature certificate.

4. The software license generation method according to claim 1, characterized in that, The signature value of the license document information is obtained in the following way: The license file information is signed using the private key of the terminal signing certificate and PKCS#7, resulting in a signature value without the original text but with the terminal signing certificate.

5. The software license generation method according to claim 1, characterized in that, The license file information and its signature value are combined to generate a JSON string, and the JSON string is encoded using Base64 to form a software license.

6. The software license generation method according to claim 1, characterized in that, The authorization verification process is as follows: When the user-side executable hardware starts the software product, the software product reads the software license installed in the executable hardware. If it is not read, the software product will automatically terminate its operation. If read, the software license is decoded to obtain the license file information and its signature value; Using the license document information as the original text, verify the validity of the signature value of the license document information; If the signature value of the license file information is invalid, the software product will automatically terminate. If the signature value of the license document information is valid, the terminal signature certificate is obtained from the signature value of the license document information, and the validity period of the terminal signature certificate is verified. If the terminal signature certificate expires, the software product will automatically stop running. If the terminal signature certificate is valid, the certificate chain is verified. If the verification is successful, the software product runs normally; otherwise, the software product automatically terminates.

7. The software license generation method according to claim 6, characterized in that, The process of verifying the validity of the signature value of the license document information using the license document information as the original text specifically involves: Decode the software license to obtain the license file information and its signature value; The fields in the license file information are concatenated according to the specified concatenation rules to generate the original signature text; Obtain the terminal signature certificate from the signature value of the license document information, and use the public key of the terminal signature certificate to verify the original signature and the signature value of the license document information.

8. The software license generation method according to claim 6, characterized in that, The verification certificate chain is specifically as follows: Obtain the terminal signature certificate from the signature value of the license document information, and obtain the root CA certificate and secondary CA certificate from the software product. The three certificates form a certificate set to be verified. Read the issuer of the terminal signature certificate and verify whether it is the issuing certificate of the terminal signature certificate in the certificate chain; If yes, proceed to the next step; otherwise, stop verification and the software product will automatically terminate. Read the issuer of the secondary CA certificate and verify whether it is the issuing certificate of the secondary CA certificate in the certificate chain. If it is, proceed to the next step; otherwise, stop the verification and the software product will automatically end its operation. The terminal signature certificate, secondary CA certificate, and root CA certificate are checked sequentially to see if they are valid; if yes, proceed to the next step; otherwise, stop the check and the software product will automatically terminate. The terminal signing certificate is verified using the public key of the issuing certificate of the terminal signing certificate. If the verification is successful, the secondary CA certificate in the certificate chain is verified using the public key of the issuing certificate of the secondary CA certificate. If the verification is successful, the root CA certificate in the certificate chain is verified using the public key of the root CA certificate. If the verification is successful, the software product runs normally. If any signature verification fails, the verification stops and the software product automatically terminates.

9. A software license generation system based on certificate chain verification, characterized in that, It includes a certificate issuance module, a license generation module, a certificate installation module, a certificate verification module, and a certificate re-issuance module; The certificate issuance module is used by the certificate authority to create a certificate chain for the software product, and pre-issues a root CA certificate as the starting point of the certificate chain; At the same time, the root CA certificate is used to issue secondary CA certificates and write them into the certificate chain; Software developers submit certificate requests for their software products to certificate authorities. Certificate Authorization Centers use Level 2 CA certificates to issue terminal signature certificates based on certificate requests submitted by software vendors; The Certificate Authority will issue the root CA certificate, secondary CA certificate, and terminal signature certificate together to the software developer; The license generation module is used by software developers to fill in license file information and sign it using a terminal signature certificate to obtain the signature value of the license file information; the license file information includes the software product's expiration date, software product's operating environment information, software product version, and authorized functions of the software product; the software developer combines and encodes the license file information and its signature value to form a software license; The certificate installation module is used by software developers to embed the root CA certificate and secondary CA certificate into the software product and install them together with the software license in the user's executable hardware. The certificate verification module is used when the executable hardware starts the software product. The software product reads the software license and performs authorization verification by combining the root CA certificate and the secondary CA certificate built into the software product. If the authorization verification is successful, the software product can be used normally; otherwise, the software product will automatically terminate its operation. The certificate reissue module is used to request the software developer to reissue the software license when the software product detects that the software license is about to expire, or to request the software developer to reissue the software license as needed by the software product.

10. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the software license generation method according to any one of claims 1-8.

Images